We represented the City of Espoo and achieved a landmark victory over the Finnish Data Protection Authority, the Data Protection Ombudsman, in a precedent-setting data protection case concerning the education sector and interpretation of the GDPR. In its decision published today, the Supreme Administrative Court ruled on the applicable legal basis of processing personal data in the context of digital learning platforms in basic education.
The Supreme Administrative Court sided with the City of Espoo and found, contrary to the Data Protection Ombudsman and the Administrative Court, that basic education legislation could constitute a sufficient legal basis for such processing. This case has a significant impact on the application of data protection law across the education sector in Finland as well as throughout the EU, while clarifying related interpretations in the public sector more generally.
The case also apparently marks the first time that the Supreme Administrative Court ordered the Data Protection Ombudsman to compensate part of the appellant’s legal costs.