Personal records surface as data protection cases expire after two years

Yle reports that documents containing personal data have been found at a school being demolished in Lahti and at other locations, while the right to prosecute data protection offences expires after just two years.

The Office of the Data Protection Ombudsman has received an unusually high number of reports this year about personal records left in the wrong places, Assistant Data Protection Ombudsman Annina Hautala said. Yle found nearly a sackful of documents at Kanerva School, which Lahti is demolishing. At least some of the papers contained personal data.

Records relating to school pupils or patients have also been found this year at an old bar in Ruovesi, outdoors in Lappeenranta and at a flea market in Kanta-Häme. The documents in these cases came from municipalities or wellbeing services counties.

Lahti is reviewing the documents found at the school and will notify people whose information appears in them. Hautala said organisations responsible for personal data, such as municipalities, must work to reduce the risks from a data leak. People who are informed can assess whether they need to take steps to protect their safety and privacy.

Older discoveries do not always lead to prosecution. An investigation into a USB drive found at a flea market earlier this year was closed because the right to prosecute had expired. The drive contained information about nearly 200 patients of the Pirkanmaa Wellbeing Services County from 2020 and 2021.

The right to prosecute a data protection offence expires after two years, even though personal identity codes do not change. The maximum penalty for the offence is one year in prison, a fine or a fixed-penalty fine. In some cases, breach of official duty may also be considered; the right to prosecute that offence expires after five years.

The Data Protection Ombudsman’s Office oversees whether organisations comply with data protection law and can impose administrative sanctions. Hautala said personal data in the wrong hands can enable identity theft and fraud, and damage a person’s reputation. Even when no concrete harm follows, people may suffer distress over the exposure of their information.

Hautala said data security breaches often result from human error. She also stressed the importance of properly managing the full lifecycle of documents containing personal data.