Finnish legal services agency reprimanded for mishandling employee credit data

The Finnish Data Protection Ombudsman has issued a reprimand to the Legal Services Agency after it processed the credit records of dozens, later hundreds, of its employees without a lawful basis between 2024 and 2025.

The agency itself detected the breach during internal auditing and reported it to the ombudsman in November 2025, according to a statement from the Data Protection Ombudsman’s office. The decision is not yet legally binding.

The ombudsman noted that the severity of the case is mitigated by the fact that no external parties accessed the data.