The case was originally initiated in 2018 when a former employee and customer of OP requested information, essentially log data, indicating the specific OP employees who had accessed that individual’s customer data, including the dates and purposes of such access. The bank refused the request and the Finnish Data Protection Authority, subsequently investigating the matter, sided with the bank. The individual appealed to the Administrative Court of Eastern Finland, which referred the matter to the Court of Justice of the European Union (case C‑579/21). In its ruling on 22 June 2023, the Court of Justice concluded that the individual did have a right under the GDPR to receive information regarding the dates and purposes of access to his customer data. However, this right did not automatically extend to the identity of the bank employees who had accessed the data. Following the Court of Justice’s ruling, the Administrative Court of Eastern Finland, after organising oral hearings in autumn 2023, gave its own decision, which controversially concluded that the individual should essentially be provided with exact times of the customer data access (i.e., the same level of detail as in the bank’s log files), instead of indicating the timing on a date level.

However, following OP’s appeal, the Supreme Administrative Court of Finland ruled in its decision on 12 June 2025 (KHO:2025:51) that the bank was not required to provide exact times of the access. Instead, date-level information was deemed sufficient in light of the individual’s rights under the GDPR.

This case has a substantial impact on the application of the GDPR in the context of log files, both in the financial sector and more generally. While the case creates a broader right to log data compared to previous established regulatory guidance and market practice, it is crucially important that the individual was not considered to have a right to information on the identity of bank employees or exact times in relation to customer data access. As OP successfully argued, a contrary finding would have jeopardised the security, confidentiality and feasibility of the bank’s internal processes and would have posed privacy risks for the relevant bank employees.

The Supreme Administrative Court’s decision concludes a significant process spanning many years and court phases, both in Finland and in Luxembourg. We would like to express our sincere gratitude to OP Financial Group for their continued trust in the Dittmar & Indrenius team along the way.

Members of the Dittmar & Indrenius team: Jukka Lång, Toni Kalliokoski, Eva-Lotta Hokkonen, Julia Sikow, Oskari Paasikivi