A fine was imposed for non-compliance with an injunction from the authority, following a failure to respond to a data subject access request.

Facts and context

The Finnish Data Protection Authority (Tietosuojavaltuutetun toimisto) issued a sanction decision against the Helsinki Aesthetic Surgery Center, including the imposition of a €12,000 fine, for breaches related to non-compliance with an injunction and the data subjects' right of access.

The case originated from a complaint by a data subject who did not receive a response to their request for access to their personal data.

Grounds for the decision

• Obligation to guarantee the right of access (Article 15 of the GDPR): The controller did not respond to a data subject's request to access their data. The authority recalled that failure to respond within the prescribed time limits constitutes a direct violation of the rights granted to data subjects.
• Obligation to comply with injunctions from the supervisory authority (Article 58(2) of the GDPR): Following the complaint, the authority ordered the center to provide the requested information to the data subject. The finding of non-compliance with this binding corrective measure constituted a separate breach, sanctioned under Article 83(6) of the GDPR.

Decision of the authority

Consequently, the authority imposed a €12,000 fine on the Helsinki Aesthetic Surgery Center.

Furthermore, the authority ordered the controller to provide the data subject with a copy of their personal data within one month.

Lessons learned

This decision reminds that:

• Failure to comply with a binding corrective measure, such as an injunction issued by a supervisory authority, constitutes an independent and serious breach, liable to result in an administrative pecuniary sanction.
• Failure to respond to a request to exercise rights is not only a violation of the data subject's rights but may also lead to escalation of corrective measures and sanctions.
• Controllers must implement effective internal procedures to handle not only data subjects' requests but also communications and formal orders from data protection authorities.