A Finnish banker suspected that his personal financial information had been disclosed to his colleagues at the bank without his knowledge. The banker requested the Finnish Privacy Protection Authority to demand from the bank for the reasons why the financial information was disclosed, and the exact date of the disclosure.
The Court of Justice of the European Union held that the banker must be given the date on which the information was transferred as well as the reasons why the information was shared. Under the GDPR, in cases where there is a disclosure of information about a person, even as part of the disclosure of the information to law authorities, the person may receive the reasons for which the disclosure was made, although the right to provide the information is not absolute and depends on considerations of public policy. Here, under the circumstances, the banker's right to information prevailed over the bank's right to protect its employees, even in cases of violation, and it was held that the banker is entitled to receive the information he requested.