Deputy Data Protection Ombudsman reprimands Finnkino and orders the company to change its personal data processing practices

The Deputy Data Protection Ombudsman has ordered Finnkino Oy to change its data protection practices, including neglect of customers’ data protection rights and dubious direct-marketing practices. A total of 40 matters involving Finnkino were processed and resolved by the Office of the Data Protection Ombudsman.

The Deputy Data Protection Ombudsman reprimanded Finnkino for forcing customers to give their consent to direct marketing. Customers who have wanted to purchase Finnkino’s digital serial tickets or book tickets online have had to join the Finnkino Lab scheme and give their consent to direct marketing. It has not been possible to join the customer loyalty scheme without ticking the box indicating consent to direct marketing. This practice is not in compliance with the General Data Protection Regulation’s requirements regarding voluntary consent as the basis for processing personal data. 

In her decision, the Deputy Data Protection Ombudsman also pointed out that Finnkino has not implemented the right of data subjects to object to the processing of their personal data. Data protection legislation affords data subjects the right to object to the processing of their personal data for purposes of direct marketing at any time. The Deputy Data Protection Ombudsman notes that data subjects must have the opportunity to object to the processing of their personal data at the time it is collected; it is not sufficient to give customers the opportunity to ask the company to stop sending electronic advertising later.

The Deputy Data Protection Ombudsman also reprimanded Finnkino for its authentication practices, which have caused unreasonable inconvenience to customers. Finnkino has demanded its customers to send a photograph of their passport or both sides of their identity card, along with a photograph of the person’s face next to the identity card. These practices have required the data subjects to provide more data than Finnkino originally had on them.

Finnkino was also reprimanded for not having told its customers that their telephone calls were being recorded. This practice had already been changed before the Deputy Data Protection Ombudsman’s reprimand, however.

As the state of the legislation has been unclear since the implementation of the General Data Protection Regulation, the Deputy Data Protection Ombudsman considered a reprimand to be a sufficient sanction for Finnkino’s infractions. The fact that Finnkino has taken independent action to bring its practices into compliance with the GDPR on the basis of feedback also influenced the decision.

Six of the resolved matters involved practices related to the authentication of data subjects, while 34 concerned forced consent to digital direct marketing. One matter involved a complaint about Finnkino neglecting to tell a customer that their telephone calls were being recorded.

The decisions can be appealed in the administrative courts.

Deputy Data Protection Ombudsman’s decision on obtaining consent for direct marketing and implementing the right to object (in Finnish)
Deputy Data Protection Ombudsman’s decision on the authentication of data subjects and the recording of telephone calls (in Finnish)

Additional information:
Deputy Data Protection Ombudsman Anu Talus, tel. +358 29 566 6766, anu.talus(at)om.fi