Published 

21.11.2024

Parliamentary Ombudsman Petri Jääskeläinen has issued a decision on a complaint criticising the prosecutor for not having considered the persons registered in the patient database of Vastaamo to be injured parties in the suspected data protection offence related to the operation of Vastaamo.

The Ombudsman is of the view that the injured party status in the data protection offence referred to in the charges has been open to interpretation, and it is possible to present legal grounds to support the views of both the prosecutor and the complainant. Taking into account the matter as a whole, the Ombudsman considers that it was within the limits of the prosecutor’s discretion to decide, based on the interpretation adopted by them, that it was not justified to start hearing potential injured parties in the investigation of the matter in question. In addition, the Ombudsman states that the injured parties had later been heard in another matter that dealt with the dissemination of the patient information of the persons recorded in the patient database and the cases of blackmail and attempted blackmail targeted at them.

The rights of injured parties should be secured in situations open to interpretation

Like the Parliamentary Ombudsman, the pre-trial investigation authority or the prosecutor also cannot make a legally binding decision on who are to be considered injured parties in a specific suspected crime. The decision is ultimately made by the court.

According to the Ombudsman, it would therefore be justified that, when the status of injured parties is unclear or open to interpretation, an opportunity would be given to potential injured parties to be heard in the pre-trial investigation and, when the matter progresses, to participate in the court proceedings.

If the number of potential injured parties had been small, hearing them could have been implemented with a fast timetable. However, as there have been more than 33,000 potential injured parties in this case, the choice of the operating method has played a very important role from the point of view of procedural economy and the period of limitation of the right to bring charges. The most severe punishment for a data protection offence is imprisonment for one year, which means that the period of limitation for the right to bring charges is two years. The prosecutor’s application for summons had been dated only one month before the end of the limitation period.

The Ombudsman considers it unsatisfactory if the injured parties’ rights in the criminal proceedings cannot be implemented for such reasons. On the other hand, the current legislation on criminal proceedings does not provide for criminal cases such as this, in which the number of injured parties may be huge.

The need to develop the law has been identified

The working group set up by the Ministry of Justice to develop the judicial system has identified the needs related to this, however. The Ombudsman refers to one of the working group’s preliminary proposals for measures for situations in which a very large number of injured parties have been target of a suspected crime. In it, the working group proposes an investigation of the possibility to ensure the legal protection of injured parties with the help of an advocate general system and to replace the notices sent to the injured parties with public announcements. The working group's term of office ends on 31 December 2027.

Referring to the proposal, the Ombudsman proposes that the Ministry of Justice consider whether a separate and more urgent investigation and preparations of the proposal could be initiated. The Ombudsman considers it obvious that there will be a rapid increase in the number of offences such as information network and cyber crimes and that they will cause difficult problems from the point of view of both the legal protection of the injured parties and the workload of the authorities involved in the criminal procedure.

The Ombudsman requests the Ministry of Justice to report any action it will take by 28 February 2025.

Decision EOAK/2261/2023 has been published (in Finnish) on the Parliamentary Ombudsman's website at www.oikeusasiamies.fi

Further information is available from Principal Legal Adviser Mikko Eteläpää, tel. +358 9 432 3359.