Cookies used on the kela.fi website collected visitor data without consent

Certain cookies deployed on the kela.fi website collected visitor information also from visitors who did not give their consent. These cookies were removed on 19 April 2022. No third-party cookies have been used in the OmaKela e-service.

Between 28 March and 19 April 2022, certain cookies were used on the kela.fi website which collected users’ IP addresses despite their not having given consent to the use of cookies. There were a total of about 1.25 million visitors to kela.fi in this period.

Among other things, the cookies tracked users’ journeys on the website and collected data on the results of ads directing users to kela.fi, Some of the data collected may have been used to target online advertising, in which case they will have been made available to third parties. Similar cookies are widely used on many websites. The EU General Data Protection Regulation requires users to be asked for their consent to the use of such cookies.

The cookies were removed from kela.fi on 19 April 2022. No third-party cookies have been used in the OmaKela e-service.

A cookie banner is displayed on kela.fi allowing users to indicate their consent to the use of specific types of cookies. However, after an update to the application tracking visitor data, it began to collect data before users had a chance to give or withhold their consent to the use of cookies.

“We are very sorry. We will investigate the issue thoroughly and will be even more careful going forward about addressing potential security gaps in our use of cookies”, Kela’s communications manager Päivi Bergman says. 

Kela treats the issue as a data breach and has reported it to the Data Protection Ombudsman.

Videos in sign language collect visitor data without consent

The kela.fi website features embedded videos in sign language which are hosted on YouTube. Also these videos may have collected visitor data without consent.

”We discovered this challenge earlier and are now adopting a new video platform that provides better data protection for users,” Bergman says.

Sign-language videos cannot be removed from kela.fi right away, because Kela must continue to offer such content to persons using sign language in the interests of non-discrimination and accessibility.

Read more

The following links are to websites which are not maintained by Kela: