Which municipal documents are public?

As a rule, all of them. Under the Act on the Openness of Government Activities, official documents are public unless otherwise provided by law, and secrecy always rests on a ground named in law, such as the protection of private life, health data, trade secrets or security. Emails, memos and messages are also official documents when they relate to the authority's task. What is secret is the information, not the document: the rest is disclosed.

What does the Information Management Act require of a municipal employee in practice?

That a document received or drawn up is registered in the case register without delay, that access rights match the task and that the use of information systems is logged. Section 25 of the Information Management Act requires registering documents in the case register, section 16 defining access rights according to tasks and keeping them up to date, and section 17 collecting log data on use and disclosures where the system requires logging in. The employee's share is to register the matter and use only the data the task requires.

May a meeting agenda with its attachments be published on the municipality's website?

Section 29 of the Local Government Act obliges the municipality to publish information on matters being prepared for its bodies online once the agenda is ready, but at the same time to ensure that secret information is not put online and that privacy in the processing of personal data is protected. An attachment containing an individual resident's data does not belong online even if the matter is public. This is a common municipal data breach, and it is made out of diligence, not carelessness.

Openness and information management law for municipal employees: what is public, what is secret and what is recorded

Q: How quickly must an information request be answered?

Under the Act on Openness, information on a public document is given as soon as possible and at the latest within two weeks of receiving the request. Where there are many documents or they contain secret parts whose separation requires more than the usual amount of work, the time limit is at most one month. A refusal is reasoned, and the requester is told that they may refer the matter to the authority for a decision and appeal against it.

A municipal employee's document is an official document. What the Act on Openness requires of requests, what the Information Management Act requires of registers, access and logs.

In brief

A municipal employee works between two laws that pull in different directions. The Act on the Openness of Government Activities says that official documents are public unless otherwise provided by law, and that information must be given quickly. The GDPR and the secrecy provisions say that information about private life, health and other sensitive matters is protected. The Information Management Act builds a procedure between the two: documents are registered, access rights are limited by task, use is logged, and systems are designed so that openness can be implemented without difficulty. For the employee the question is threefold: is this an official document, what in it is secret, and has it been registered.

Everything is public, except what the law makes secret

The starting point of the Act on Openness (621/1999) is the principle of openness: official documents are public unless otherwise specifically provided by law. An official document is a broad concept. It means not only decisions and minutes but also memos, emails and messages, when they relate to the authority's task and are in its possession. A municipal employee's work email is an official document to the extent it concerns the work. The limit is in section 5 of the act: an employee's own notes and drafts not yet released for the handling of a matter are not official documents.

Secrecy is the exception, and it always rests on a ground named in law. Section 24 of the Act on Openness lists the documents to be kept secret, and the list includes information on private life, state of health, social welfare clientship and financial position, as well as trade secrets and security arrangements. Two things follow. First, secrecy is not the employee's discretion; they must be able to point to the provision. Second, what is secret is the information, not the document. If a document contains a secret passage, the rest is disclosed and the passage is redacted.

The duty of secrecy follows the employee. Under section 23 of the Act on Openness, a person in the service of an authority may not disclose secret information or use it for their own or another's benefit, and the duty continues after the service relationship ends. The same applies to the elected officials referred to in section 69 of the Local Government Act, who under section 83 have the right to receive information they need in their office also from documents that are not yet public, unless the secrecy provisions provide otherwise.

An information request: two weeks, at most a month

Anyone may request information on a public document, the request need not be justified and the requester need not say who they are. Under section 14 of the Act on Openness, the information is given as soon as possible and at the latest within two weeks of receiving the request. Where there are many requested documents or they contain secret parts whose separation requires more than the usual amount of work, the information is given at the latest within one month.

If an employee refuses to give information, they must state the reason for the refusal, that the matter may be referred to the authority for a decision, and that the authority's decision may be appealed. Silence is not a refusal but a failure. This is level 2 competence in our skills catalogue: recognises an information request, knows the time limit and routes the request correctly instead of guessing.

An information request under the Act on Openness is a different right from the right of access under the GDPR. The former concerns official documents and belongs to everyone; the latter concerns a person's own personal data and belongs only to them. The same request can be both, and they are decided by different procedures and different time limits. The right of access is covered in Data subject rights.

The Information Management Act: register, rights, logs

The Information Management Act (906/2019) turns openness and data protection into a procedure. Its requirements bind the information management unit, that is the municipality, but they are met only if the employee does their part.

Section	Requirement	What it means for the employee
25	A document received or drawn up by the authority is registered in the case register without delay, including the time of receipt	An application that arrived by email is registered the same day; a matter is not handled "just by email"
26	A case identifier for each matter; for a received document the sender and manner of receipt, for a drawn-up document the author and time; the status of the matter and the measures taken	The document is found by its identifier, not by memory
16	Access rights are defined according to task-related needs and kept up to date	You look only at the data your task requires, even if you could reach more
17	Log data on use and disclosures is collected where use requires logging in	Every search is visible afterwards; none is made out of curiosity
13	Information systems are designed so that the openness of documents can be implemented without difficulty; security is sized to a risk assessment	Public and secret information is kept separable from the start
15	Integrity, authenticity, availability and archivability of data sets are ensured; availability is restricted only on a legal basis	The original is not edited; making something secret without a provision is itself a deviation
21	Retention periods are set by necessity, legal protection and limitation periods; afterwards the data is archived or securely destroyed	Personal copies are not kept in personal folders past the deadline

The logs deserve attention. Under section 17 the purpose of log data is to monitor the use and disclosure of information and to investigate technical faults. In practice it means the municipality can see afterwards who looked at whose data. An employee who looks up a neighbour's data out of curiosity commits a data protection breach that shows in the log, and having an access right is not a ground for using it. Access rights and logs are covered further in Access control, multi-factor authentication and encryption.

Material published online

Section 29 of the Local Government Act obliges the municipality to inform about its activities and to publish online information on the preparation of matters coming before its bodies once the agenda is ready. The same section requires ensuring that secret information is not put on the public network and that privacy in the processing of personal data is protected.

This is where openness and data protection collide most often in municipal daily life. A rectification claim attached to an agenda contains a resident's name and address; a land lease decision contains a personal identity code; a social welfare committee matter contains secret information. The matter being public does not make the personal data in the attachment publishable online. Publishing online is different from giving information on request: online, the information is available to everyone without limit, and taking personal data there therefore needs a ground of its own. The authority's own publication is also a common route to a personal data breach in a municipality; that is covered in Personal data breach.

What this requires of each role

Our skills catalogue describes public-sector information management and openness at four levels. Every municipal employee knows that a document they draw up is an official document, and recognises an information request. Whoever handles a matter registers the documents, separates what is secret and answers within the time limit. A supervisor is responsible for the unit's access rights and for what is published online. Whoever is responsible for information management defines the case register, retention periods and log monitoring.

Elected officials are a group of their own: they have the right of access under section 83 of the Local Government Act and the same duty of secrecy as office holders, but rarely the same training. Meeting material on a personal email account and a screenshot of an attachment in a group chat are common situations for which the library course Data protection for elected officials was written. The staff's data protection basics are covered in What data protection competence is required of every employee?.