Office of the Data Protection Ombudsman (Finland) — Taksi Helsinki Oy

Decided by

Office of the Data Protection Ombudsman’s sanctions board

Parties

Office of the Data Protection Ombudsman v. Taksi Helsinki Oy

Decision date

May 26, 2020

Remedy

Taksi Helsinki Oy was fined EUR 72,000 and ordered to perform required impact assessments and balance tests, immediately halt audio data processing lacking appropriate grounds, and fix its customer disclosures and documentation procedures.

Amount

€72,000

Appeal

Appeal pending

Key holdings

1. Taksi Helsinki failed to perform required data protection impact assessments prior to processing data via security cameras, location tracking, and automated decision-making.

   “Taksi Helsinki also failed to conduct the impact assessments required by the GDPR before the start of processing.” — The impact of the processing had not been assessed in accordance with data protection legislation

2. The processing of audio data in taxis violated the data minimisation principle and was ordered to be stopped immediately.

   “She ordered Taksi Helsinki to ensure that the processing of audio data without appropriate grounds is stopped immediately.” — No basis given for processing audio data

3. The sanctions board imposed a EUR 72,000 administrative fine due to severe deficiencies in risk identification, compliance, and data subject rights.

   “The Office of the Data Protection Ombudsman’s sanctions board imposed an administrative fine of EUR 72,000 on Taksi Helsinki.” — Administrative fine imposed

In plain English

In November 2019, the Office of the Data Protection Ombudsman in Finland launched an investigation into the personal data processing practices of Taksi Helsinki Oy. In the summer of 2019, the taxi company had introduced a camera surveillance system recording both video and audio in its vehicles. The investigation uncovered several serious violations of the General Data Protection Regulation. Specifically, Taksi Helsinki failed to assess the risks and lawfulness of its processing operations before deploying the system. The company did not conduct required data protection impact assessments for its security camera surveillance, location data processing, or the automated decision-making and profiling associated with its loyalty scheme. Furthermore, the authority found no valid legal basis for recording audio data, determining that audio recording violated the principle of data minimisation. Taksi Helsinki also failed to adequately inform passengers about audio recording and omitted information about automated decision-making from its privacy statement. Consequently, the Deputy Data Protection Ombudsman ordered Taksi Helsinki to conduct balance tests, perform impact assessments, rectify customer disclosures and documentation, and immediately halt audio data processing without appropriate grounds. Additionally, the sanctions board of the Office of the Data Protection Ombudsman imposed an administrative fine of EUR 72,000 on Taksi Helsinki, deeming the amount proportionate, effective, and cautionary. The decisions remain open to appeal in the administrative court.