Finland

[FI] The Personal Data Act

IRIS 1999-6:1/19

Marina Österlund-Karinkanta

Finnish Broadcasting Company YLE, EU and Media Unit

On 22 April 1999, the Personal Data Act ( Henkilötietolaki ) was confirmed. It entered into force on 1 June 1999 and replaces the Personal Data Files Act ( Henkilörekisterilaki ), Act No. 471/1987.

The Personal Data Act implements the EU Directive on Data Protection (Directive 95/46/EC) into Finnish law. The Act expands the right of access to data for the data subjects. A new feature is that, besides private individuals, the definition of a data subject includes other legal persons, e.g., businesses. Finnish regulations concerning sensitive data now also cover trade union membership. This is a relatively new feature in the Nordic countries. It was introduced by provisions of the Swedish Personal Data Act of 1998 (Act 1998: 204). Nevertheless, trade unions are allowed to process union membership data. The right of access to public registers is defined in the legislation on the openness of Government activities. For purposes of direct marketing, opinion polls and market research, data can be given in accordance with specific rulings or if the data subject has not prohibited disclosure. The Data Protection Ombudsman's responsibilities are extended in the new Act and his decisions are binding on those concerned. Permissions for the processing of personal data is granted by the Data Protection Board.