The Data Protection Board is an independent authority affiliated to the Ministry of Justice. It is appointed by the Council of State for three years at a time. The Data Protection Board is the most important decision-making agency in personal data matters.  

The Finnish Data Protection Board

Finland has two data protection authorities; the Data Protection Ombudsman and the Data Protection Board.

The Data Protection Ombudsman provides direction and guidance on the processing of personal data, supervises the processing in order to achieve the objectives of the Personal Data Act (523/1999), as well as makes decisions concerning right of access and rectification.

The Data Protection Board deals with questions of principle relating to the processing of personal data, where these are significant to the application of the Personal Data Act. The Board has also the power to grant permissions and issue orders.

Power of the Data Protection Board to grant permissions

The Data Protection Board may grant a permission for the processing of personal data, if the processing is necessary, otherwise than in an individual case, in order to protect the vital interests of the data subject, or to use the public authority of the controller or a third person to whom the data is to be disclosed. The permission may be granted also in order to realise a legitimate interest of the controller or the recipient of the data, provided that such processing does not compromise the protection of the privacy of the individual or his/her rights.

The Board may grant a permission for the processing of sensitive data, for reason pertaining to an important public interest.

The permission, that may be granted for a fixed period or for the time being, shall contain the rules necessary for the protection of the privacy of the data subject. The rules may be amended or supplemented at the request of the Data Protection Ombudsman or the data subject, if this is necessary owing to a change in circumstances.

Orders of the Data Protection Board

At the request of the Data Protection Ombudsman, The Data Protection Board may:

• prohibit processing of personal data which is contrary to the provisions of the Personal Data Act or the rules and regulations issued on the basis of the Act;
• in matters other than those concerning right of access or rectification, compel the person concerned to remedy an instance of unlawful conduct or neglect;
• order that the operations pertaining to the file be ceased, if the unlawful conduct or neglect seriously compromise the protection of the privacy of the data subject or his/her interest or rights, provided that the file is not set up under a statutory scheme; and
• revoke a permission granted by the Board, where the prerequisites for the same are not longer fulfilled or the controller acts against the permission or the rules attached to it.

Contact information

Data Protection Board/Ministry of Justice
PO BOX 25, FI-00023 Government

Secretary of Data Protection Board, Master of Laws Anu Talus
Telephone: +358 9 160 67636
+358 9 160 03 (telephone exchange)
telefax: +358 9 160 67770
email: tietosuojaltk.om(at)om.fi

Updated 27.5.2009