You are hired to support the Finnish Data Protection authority: Eu Data Protection Law, Case Study, Ireland

You are hired to support the Finnish Data Protection authority.

In your first week, they ask you to investigate the following three situations and write a short legal report for each of them The Finnish company Vesi manages more than forty public sauna facilities in Southern Finland.

The company asks its clients to complete a survey after using their services. The survey is anonymous; it only requires an email address and asks for a series of general questions about the quality of the sauna experience. Last week Vesi was attacked by a series of Russian hackers who accessed the survey data. Vesi did not report this incident to the authority neither informed its clients as the survey was anonymous.

When questioned by the Finnish authority during the preliminary phase of the investigation, Vesi revealed that they delete all survey data regularly, every five years, together with all the other personal information they collect at the time of purchase of entrance tickets.

Vesi facilities’ users, when purchasing their entrance, are asked to provide an ID card and reveal any critical health conditions. Vesi workers are instructed to annotate these conditions in the Vesi platforms and check their compatibility with the sauna experience offered. Vesi has recently started a new business, creating a sister company, Tammi Insurance. Tammi has decided to target healthy individuals with its products, based on the information received by Vesi.