Court rules on data protection breach involving Finnish diplomats and Israeli spyware

The Supreme Administrative Court of Finland has issued a precedent regarding obligations to report data protection breaches. The case relates to incidents where Finnish diplomats working abroad had their phones hacked and were subjected to online espionage using Israeli spyware.

According to the court’s ruling, the data controller, which is the Ministry of Foreign Affairs, reported the data security breach involving personal data due to online espionage to the Data Protection Ombudsman and to the diplomats without undue delay. Previously, the Deputy Data Protection Ombudsman had determined that the Ministry of Foreign Affairs failed to comply with the 72-hour deadline for reporting the incident.