The Supreme Administrative Court maintained the decision of the Administrative Court repealing the administrative fine imposed on the Finnish Motor Insurers’ Centre

The Supreme Administrative Court has issued its decision on the decision of the Sanctions Board of the Office of the Data Protection Ombudsman, in which an administrative fine was imposed on the Finnish Motor Insurers’ Centre in December 2021. The decision was previously overturned by the Helsinki Administrative Court. The Supreme Administrative Court did not see any grounds for changing the decision of the Administrative Court.

In 2021, the Office of the Data Protection Ombudsman examined the Finnish Motor Insurers’ Centre’s practices in requesting patient records from health care providers for claims handling purposes. The Data Protection Ombudsman considered that the extensive collection of patient record entries cannot be justified, for example, by the data being used to check whether they contain information that may be relevant to the traffic accident. The Finnish Motor Insurers’ Centre also justified the collection of patient records by verifying the correctness of invoicing. The Data Protection Ombudsman considered the practice to be regular and considered that it had violated the GDPR.

In October 2023, the Administrative Court overturned the decisions of the Data Protection Ombudsman and the Sanctions Board and removed the administrative fine imposed on the Finnish Motor Insurers’ Centre.

The Supreme Administrative Court issued its precedent on the matter on 26 March. According to the precedent, a clarification had not found that the Finnish Motor Insurers’ Centre would have regularly acted in violation of data protection provisions when it has obtained patient data for the settlement of claims. The decision of the Administrative Court thus remained valid. 

The Supreme Administrative Court emphasises that the request and disclosure of patient data must comply with the principles of the GDPR, such as fairness of processing, data minimisation and data protection by design and by default. Similarly, the Traffic Insurance Act also contains provisions stating that the information requested must be necessary. According to the Supreme Administrative Court, the request for information must be justified and it must be as specific and clear as possible so that the party disclosing the information can also assess whether the conditions laid down in the law for disclosing the information are met.

The Supreme Administrative Court did not request a preliminary ruling from the Court of Justice of the European Union.

Further information:

​​​​​​​Precedent of the Supreme Administrative Court (in Finnish)

Press release 27 January 2022: Administrative fine imposed on the Finnish Motor Insurers’ Centre for the collection of unnecessary patient information