joao-silas-74207-unsplash

GDPR Compliance Investigation in Finland and Sweden

After GDPR regulation coming into force on the 25th of May, the Finnish Data Protection Authority’s office was flooded with complaints about possible infringements.

This may result in sanctions worth millions in euros (read more about the fines for not complying with GDPR). Therefore, the Finnish Data Protection Authority starts a GDPR Compliance investigation of every notification received about possible infringement.

According to the public data, there are already 1300 data protection, 300 cross-border as well as 300 national infringement related complaints. Therefore, the Finish Data Protection Authority will visit hot-spots of infringements, where the search will be conducted in 1-2 days each.

Sanctions That Worth Millions – only one of the options

After the Finnish National Law regarding personal data protection coming into force, the supervisory power of the data protection authority enhances significantly. Therefore, GDPR infringement can lead to sanctions of up to 10 million euros or alternatively up to 2% of the worldwide revenue. However, it is possible that the sanction is merely a warning, or no consequences will follow.

According to the Finnish Data Protection Authority, every alleged infringement will be evaluated individually. Though, the sanction is only one of the options.  For instance, companies might face restrictions or changes to make within the company. Therefore, the use of monetary sanctions will happen in accordance with European practice.

Sweden Started Investigation Already in June

The National Law regarding data protection is already in force in Sweden. As a result, it allowed starting an investigation on how companies comply with the new GDPR already back in June. An investigation report. is available and probable sanctions will be ready by the end of 2018.

A list of 66 companies under investigation was previously released by the Swedish Data Protection Authority to the Di Digital magazine. The list contains:

  • 13 trade unions;
  • 5 telecommunication service providers;
  • 5 insurance companies;
  • 3 public transport service providers;
  • 3 banks;
  • 2 health service providers; and
  • 35 different public authorities.

In total, 362 objects from both the public and private sectors were investigated. On the 31st of October, the Swedish Data Protection Authority published an overview of the complete investigation.  It revealed that approximately 16 % of the investigated companies lack GDPR compliance. As a result, out of 66 listed cases, 57 reprimands and 2 injunctions were given. The rest (7 companies) didn’t face any consequences.

Investigated companies include operators Tele2 and Telia, money exchange service Forex Bank and Resurs Bank and others. 

Read more on this topicGDPR Compliance Checklist for 2019

Share on facebook
Share on linkedin
Share on twitter
Share on pinterest
Share on email

Get your compliance organized with proper GDPR tools.
Contact us for a demo and get access to 14-day trial.

Save time and be confident

Latest Posts
The EU-U.S. Data Privacy Framework: A Transatlantic honeymoon for data flows, but for how long?

The EU-U.S. Data Privacy Framework: A Transatlantic honeymoon for data flows, but for how long?

The European Commission concluded that the United States ensures adequate protection for personal data transferred from the EU to U.S....
A Comprehensive Guide to Personal Data Mapping

A Comprehensive Guide to Personal Data Mapping

Introduction Data privacy and security are of utmost concern in the digital era of today, especially when it comes to...
Data Processing Agreement (DPA)

Data Processing Agreement (DPA)

What is a Data Processing Agreement (DPA)? A Data Processing Agreement (DPA) is a legally binding document to be entered...
Direct marketing rules and exceptions under the GDPR

Direct marketing rules and exceptions under the GDPR

Direct marketing includes text messages (SMS) and emails that a customer receives from a product or service provider. But activities...
Transmitting personal data to third countries

Transmitting personal data to third countries

The GDPR has put strict rules in place, when it comes to data transfer to third countries or international organizations. Which...
Records of processing activities in GDPR Article 30

Records of processing activities in GDPR Article 30

What are the records of processing activities (ROPA)? Article 30 of the EU General Data Protection Regulation (GDPR) requires organisations...
10 Great GDPR Software Tools for Compliance in 2023 (Review + Pricing)

10 Great GDPR Software Tools for Compliance in 2023 (Review + Pricing)

In this article, we will introduce you to some useful GDPR software tools which may help you reach GDPR compliance...
Personal Data Breach Reporting Requirements Under the GDPR

Personal Data Breach Reporting Requirements Under the GDPR

What is Data Breach? According to General Data Protection Regulation (GDPR), a personal data breach is a security incident that...
Data Protection Authorities (DPA)

Data Protection Authorities (DPA)

Data Protection Authorities (DPA) Data Protection Authorities (DPA) are independent public authorities that supervise, through investigative and corrective powers, the...
GDPR compliance checklist for controllers

GDPR compliance checklist for controllers

This is a simple GDPR compliance checklist for data controllers that you can use to ensure you have considered most important...