The Office of Data Protection Ombudsman (Ombudsman) published on March 18, 2024, it's ruling in which it imposed a fine of €856,000 to Verkkokauppa.com Oyj for violations of the General Data Protection Regulation (GDPR) following a complaint. 

Background to the decision 

The Ombudsman investigated a complaint received from a customer regarding the requirement by Verkkokauppa for a person to create a customer account before making purchases online. The Ombudsman stated that Verkkokauppa also stored customer account information for indefinite periods of time and based the retention period for data on the customer's request for personal data to be deleted.  

Findings of the Ombudsman 

The Ombudsman stated that Verkkokauppa violated the GDPR by requiring the customer to create an account before making purchases online because making an online purchase does not require storing personal data or creating a customer account. 

Regarding customer data retention, the Ombudsman stated that data retention cannot be justified by the ability of the customer to request the deletion of their data at a later date. The Ombudsman also highlighted that the investigation uncovered that a defined retention period for customer data did not exist. 

Outcomes  

The Ombudsman issued a fine of €856,000 based on Verkkokauppa's annual turnover. The Ombudsman also ordered Verkkokauppa to define an appropriate retention period for customer account data and correct its procedures requiring customers to make an account before making an online purchase. Verkkokauppa also received a notice for practices that violate data protection regulations. 

The Ombudsman mentioned that the decision is not yet legally binding and Verkkokauppa has stated it will appeal the decision to the Administrative Court.

You can read the announcement, only available in Finnish, here.