Compliance Radar

Who was sanctioned, and for what?

Fines, court rulings and incidents from Europe and North America: 718 cases from 32 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.

EU Financial services and insurance Aktia Pankki Oyj Clear all filters

1case from 1 jurisdiction

€865,000Total of monetary amounts

€865,000Largest single case: Aktia Pankki Oyj

€865,000Median per case with an amount

Click a bar to drill down one level.

by amount by number of cases

Where?

by country

Finland €865,000 100 % · 1 case

What for?

by area of law

All areas of law

Data protection €865,000 100 % · 1 case

Who?

by company

When?

per quarter, by date of decision

Trend
Period	Cases	Total
Q3 2023	0	—
Q4 2023	0	—
Q1 2024	0	—
Q2 2024	0	—
Q3 2024	0	—
Q4 2024	0	—
Q1 2025	0	—
Q2 2025	0	—
Q3 2025	0	—
Q4 2025	1	€865,000
Q1 2026	0	—
Q2 2026	0	—
Q3 2026	0	—

1 case

Newest first Highest amounts

23 Oct 2025 Aktia Pankki OyjAktia: 865,000 EUR – other people’s data visible in OmaKanta and OmaKela via bank login FinlandData breaches and data security €865,000

Following a technical change to the bank’s strong electronic identification service, a disruption lasting around one hour occurred in January 2023 during which customers logging in with Aktia credentials to services such as OmaKanta, OmaKela, unemployment funds, insurers and healthcare providers saw data of other persons; around 350 people were affected. The sanctions board of the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) criticised the deficient planning, implementation and testing of the change and imposed 865,000 EUR in addition to a reprimand.

What organisations can take from it

Changes to identification services have effects far beyond one’s own organisation – testing and release processes must reflect this.

Authority / court: Tietosuojavaltuutetun toimisto – seuraamuskollegio (Datenschutzbeauftragter, Sanktionsgremium)
Area of law: Data protection · Data breaches and data security
Legal basis: DSGVO Art. 5 Abs. 1 lit. f, Art. 25, Art. 32
Action: Fine
Status of proceedings: unknown
Sector: Financial services and insurance
Published: 28 Oct 2025

Sources

Finlex – Tietosuojavaltuutettu 23.10.2025 (pankin tunnistamispalvelun muutosprosessi) Decision of an authority
Tietosuojavaltuutettu – Aktialle seuraamusmaksu tietoturvapuutteista vahvan sähköisen tunnistamisen palvelussa (28.10.2025) Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

How the radar is compiled

Official sources only

Every case is based on a decision, press release or database of an authority or a court. Press and law-firm reports count at most as additional references.

Four-eyes check

Whoever enters a case may not approve it. A second, independent check compares company, date, amount and area of law with the source. Only then is the case published.

Comparable amounts

Amounts are converted at the ECB reference rate on the day of the decision. Each case also shows the original amount.

Corrections on record

A correction is a new version that is checked again. Every change is logged. You can report errors directly on each case.

Case texts are translated from the German original. Where a translation is not yet available, the German text is shown and marked “(German original)”. Names of authorities, laws and companies are given as in the source.

The radar reports on published decisions and is not legal advice. Decisions that are not yet final are marked as such where the status is known.

Embed the radar on your website

Who was sanctioned, and for what?

Ready for training that sticks?