On October 2, 2024, the Office of Data Protection Ombudsman (Ombudsman) published its ruling in case no. TSV/12/2019, as issued on September 17, 2024, where it ordered a mobile phone operator to provide mobile phone subscription data to comply with the General Data Protection Regulation (GDPR), following a complaint.

Background to the decision

The Ombudsman investigated a complaint received on December 23, 2019, from an individual after a request to a mobile phone operator for all information generated by the individual's mobile phone connection. The Ombudsman stated that a request was made to receive the information in a machine-readable format. In response to the request, the mobile phone operator provided call breakdown and location and base station information in paper form to the individual by post. The Ombudsman also stated that the mobile phone operator partially refused to provide proxy information.

The Ombudsman mentioned that the mobile phone operator justified its actions to provide the information by post because it could not verify if the email address belonged to the individual who made the request.

Findings of the Ombudsman

The Ombudsman stated that the mobile phone operator acted in violation of Article 15(3) of the GDPR as it did not submit the information in a machine-readable format as requested. The Ombudsman stated that information could have been sent by post with a memory stick, for example, instead of paper printouts. A notice was issued to the mobile phone operator by the Ombudsman.

The Ombudsman also highlighted that proxy data requires a separate assessment for each piece of relayed data to determine if personal data is involved. The Ombudsman further stated that not all proxy data is personal data and that data protection regulations will only apply to proxy data that is personal data. This particular issue was outside the scope of the Ombudsman's determination because the complainant did not state which individual proxy data was wanted.

Outcomes

The Ombudsman ordered the mobile phone operator to comply with Article 15(3) of the GDPR and deliver the previously provided personal information in a commonly used electronic format as required.

You can read the press release here and the decision here, both only available in Finnish.