Supreme Administrative Court upholds the administrative fine imposed on Verkkokauppa.com for data protection violations
The Supreme Administrative Court has enforced the decision of the Office of the Data Protection Ombudsman and the Sanctions Board of the Data Protection Ombudsman concerning the operations of Verkkokauppa.com Plc. The company violated data protection provisions by failing to specify the storage periods for customer account data.
In March 2024, the Sanctions Board of the Data Protection Ombudsman imposed an administrative fine of EUR 856,000.00 on Verkkokauppa.com, as the company had failed to specify the storage period for Verkkokauppa customer accounts. According to the company, the customer data was retained until the customer requested its erasure.
It was not possible to make online purchases without creating a customer account, which had also resulted in data on individual online purchases being retained longer than necessary.
The Administrative Court had previously reduced the amount of the administrative fine to EUR 792,639.00, which was set on the basis of the company’s most recent turnover. In other respects, the Administrative Court rejected the appeal lodged by Verkkokauppa.com. The Supreme Administrative Court upheld the decision of the Administrative Court.
Responsibility for the storage period and erasure of personal data cannot be left to the customer
The Supreme Administrative Court finds that the company had an obligation to specify the storage periods for the personal data it collects, and the storage period cannot be based solely on the person taking action themselves. In other words, the company was not within its rights to not specify the storage period for personal data on the basis that the customer could request erasure of the data or take measures to erase the data themselves.
According to the Supreme Administrative Court, this practice had resulted in the data being retained for a longer period than would have been required for its intended use.
The Supreme Administrative Court also states that the Data Protection Ombudsman issued a decision concerning violations of the storage of personal data, and the decision did not restrict the company’s ability to conduct business.
Additional information:
Supreme Administrative Court decision KHO 12.6.2026/1604 (in Finnish, kho.fi)
Press release 18 March 2024: Administrative fine imposed on Verkkokauppa.com for failing to define storage period of customer data – requiring customers to register was also illegal