SAC confirms €100,000 fine to Posti for data protection violation

The Supreme Administrative Court (SAC) has confirmed the €100,000 penalty issued to national postal and logistic services operator Posti by the data protection authority on May 18, 2020 on charge of violating data protections rules.

The SAC annulled the decision given by the administrative court on November 11, 2021 and upheld the original decision of the data protection authority, said Posti in a press release on Tuesday.

Number of individuals filed a complaint with the Data Protection Ombudsman as they had received communications and direct marketing from various companies after making change-of-address notifications to Posti Oy.

The investigation carried out by the Office of the Data Protection Ombudsman revealed that Posti had not informed the data subjects of their rights, including the right to object the disclosure of data, in connection with making change-of-address notifications.

The Supreme Administrative Court stated that based on the data protection regulation, Posti had not practiced enough transparency and activity in informing users of the address notification service about disclosing of their personal data to third parties, or about the possibility to prohibit the disclosure.

Posti considered the data protection authority’s decision regarding a penalty was excessive and appealed against the decision.

But the SAC conformed that decision given by the data protection authority in this regard.