Tietosuojalaki Section 24 - Sanctions Collegium (Seuraamuskollegio). The Seuraamuskollegio is a 3-MEMBER COLLEGIAL DECISION-MAKING BODY within the Tietosuojavaltuutettu Office, composed of the Tietosuojavaltuutettu + 2 Deputy Ombudsmen; the Collegium decides on administrative fines under GDPR Articles 83-84 + the Tietosuojalaki. ADMINISTRATIVE FINE TIERS: up to EUR 10 MILLION or 2% of global annual turnover (lower tier - GDPR Article 83(4)); up to EUR 20 MILLION or 4% of global annual turnover (higher tier - GDPR Article 83(5)+(6)); the Sanctions Collegium considers the GDPR Article 83(2) criteria + Finnish administrative-law proportionality principles. PUBLIC AUTHORITY EXEMPTION (Section 24(4)): Finland uses the GDPR Article 83(7) Member State derogation + EXEMPTS public authorities + bodies from administrative fines; public authorities are instead subject to other enforcement measures + parliamentary oversight + the Chancellor of Justice + the Parliamentary Ombudsman. APPEALS: to the Administrative Court (Hallinto-oikeus) within 30 days under the Administrative Court Procedure Act + then to the Supreme Administrative Court (Korkein hallinto-oikeus). 2024-2025 enforcement priorities: AI-related processing + dark-pattern consent + Henkilotunnus minimisation + cross-border one-stop-shop coordination.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.