The Deputy Data Protection Ombudsman in Finland has ordered the entity responsible for social and health services in the Kymenlaakso region (Kymsote) to stop criminal background checks for people who want to become foster parents. The Deputy Data Protection Ombudsman saw a violation of Article 6(1) and Article 10 of the GDPR.
Kymsote required foster parent applicants to obtain information from the police about their own criminal history and make it available to the authority. The Deputy Data Protection Ombudsman, on his own initiative, investigated and reviewed the procedure regarding background checks for candidates. According to the information received from the police, extracts from the criminal record were provided by exercising the right of access under Article 15 of the GDPR.
The Deputy Data Protection Ombudsman indicated that Kymsote had no legal basis for processing the data obtained under the right of access. The purpose of this right is to enable the data subject to obtain information on the lawfulness of the processing of his data. No authority may require the data subject to provide it with information obtained on the basis of the right of access, and therefore may not use the data subject’s right of access as a means to obtain information. The data controller may not adopt additional procedures to obtain data beyond the means provided by law.
The Deputy Data Protection Ombudsman warned Kymsote and ordered it to correct its procedure regarding criminal background checks to ensure compliance with the GDPR.