What does Finland’s Data Protection Act add to the GDPR?

In brief

Finland’s Data Protection Act (tietosuojalaki) does not replace the General Data Protection Regulation (GDPR). It complements it where the General Data Protection Regulation allows national rules. For daily work, the most visible additions are the age of 13 for a child’s own consent in certain online services, national rules for processing in the public interest, and Finnish exceptions and safeguards for special categories of personal data. A personal identity code is also personal data under the General Data Protection Regulation, but it is not listed as a special category of personal data.

The Data Protection Act complements the Regulation, but does not replace it

The General Data Protection Regulation is the main rulebook. It defines personal data, sets the legal bases for processing, gives data subjects rights, and requires the controller to show that the rules are followed.

Finland’s Data Protection Act 1050/2018 adds national detail in selected areas. This is possible because the General Data Protection Regulation’s Article 6 allows Member States to keep or introduce more specific rules for processing based on a legal obligation, a task in the public interest, or the exercise of official authority.

This matters in a municipality, a wellbeing service provider, a school, an association or a company that handles data linked to Finnish public tasks. The question is not only “what does the General Data Protection Regulation say?” The second question is whether Finnish law gives more detail for the same processing.

The starting point still stays the same:

• The controller must identify a legal basis under the General Data Protection Regulation’s Article 6.
• The controller must follow the principles in the General Data Protection Regulation’s Article 5.
• The controller must tell the data subject the information required by Articles 13 and 14.
• The controller must be ready to handle rights under Articles 12 to 20.
• The controller must manage personal data breaches under Articles 33 and 34.

For the practical choice of legal basis, the topic continues in What legal basis permits processing personal data?.

A personal identity code identifies a person, so it is personal data

A personal identity code is an everyday example of a strong identifier. In a payroll file, a customer register or a student system, it points to a specific person. That makes it personal data.

The General Data Protection Regulation’s Article 4 defines personal data as information relating to an identified or identifiable natural person. The same definition gives examples of identifiers, including a name, a personal identity code, location data and online identifiers.

This means that a personal identity code needs the same basic checks as other personal data. The organisation needs a purpose, a legal basis, limited access, accuracy, retention control and security. These are not optional because the identifier is familiar in Finnish administration.

It is also important not to put the personal identity code in the wrong legal box. The special categories of personal data are listed in the General Data Protection Regulation’s Article 9. They include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for unique identification, health data, and data on sex life or sexual orientation. A personal identity code is not on that list.

That does not make it harmless. It can increase the risk if it is sent to the wrong recipient or used in a system where too many employees can see it. The point is that the stricter “special category” route is not triggered by the personal identity code alone.

The age of 13 applies to a child’s consent in a specific service

Finland’s Data Protection Act 1050/2018, section 5, sets the age threshold at 13. It applies when personal data is processed on the basis of consent under the General Data Protection Regulation’s Article 6 and the service is an information society service offered directly to a child.

In plain language, this is not a general rule for every situation involving a child. It concerns a specific combination: consent as the legal basis, and a certain kind of service offered directly to the child.

For example, if a service asks a child to create an account and relies on the child’s own consent for personal data processing, section 5 is relevant. If a municipality processes a pupil’s personal data because a legal task requires it, the issue is different. The legal basis is then not the child’s consent in the same way.

The General Data Protection Regulation’s Article 12 also matters in work with children. It requires information to be given in a clear and plain way, especially where information is addressed specifically to a child. This affects privacy notices, forms and service texts. A child-facing service cannot rely on wording that only a lawyer can understand.

The child consent topic continues in When is guardian consent needed for a child’s personal data in Finland?.

Public authority processing turns on public interest, task and proportionality

The General Data Protection Regulation’s Article 6 lists the legal bases. For public authorities, the key point is that the legitimate interests basis does not apply to processing carried out in the performance of their tasks. This removes a common private-sector route from authority work.

Finland’s Data Protection Act 1050/2018, section 4, adds national detail for processing under the General Data Protection Regulation’s Article 6(1)(e). That is the legal basis for a task carried out in the public interest or in the exercise of official authority.

Section 4 covers several situations. In daily work, three ideas stand out.

First, processing may concern information that describes a person’s position, duties and performance of those duties in a public body, business, association or similar activity, when the aim is in the public interest and the processing is proportionate. An everyday example is a public-facing role where a person’s work position is relevant to the public task.

Second, processing may be necessary and proportionate for an authority to perform a task in the public interest. This is the clearest public authority route. The authority must be able to connect the data use to the task and to the need for the data.

Third, section 4 also covers processing that is necessary for scientific or historical research or statistics, and certain archiving purposes, when the processing is proportionate to the public interest aim and to the rights of the data subject.

The word “proportionate” is practical. It asks whether the same task could be done with less data, fewer users, shorter retention or a narrower disclosure. In a case management system, for example, proportionality affects who can see a file and which fields are necessary.

Special categories need a basis and protective measures

Some personal data is more sensitive because misuse can harm a person in a serious way. Health data in an HR file is a simple example. Trade union membership in a payroll context is another.

The General Data Protection Regulation’s Article 9 starts from a prohibition on processing special categories of personal data. It then lists exceptions. Finland’s Data Protection Act 1050/2018, section 6, adds national situations where that prohibition does not apply.

The Finnish additions include, among others, processing by an insurance institution when necessary to determine liability, processing required by law or directly caused by a legal task of the controller, trade union membership data needed for labour law rights and obligations, health and social welfare service processing, certain anti-doping and parasport processing, research and statistics, and certain public-interest archiving.

Section 6 does not work as a free pass. When these situations apply, the controller and the processor must use appropriate and specific measures to protect the rights of the data subject.

Protective measure in section 6	What it means at work
Measures to verify afterwards who recorded, changed or transferred personal data	The system needs traceability, such as logs that show who did what.
Measures that improve the competence of staff processing personal data	Employees need training for the data they handle.
Appointment of a data protection officer (DPO)	A named role supports and monitors data protection work where required.
Internal measures to prevent access to personal data	Access is limited to people who need it for their work.
Pseudonymisation and encryption	Data is made harder to connect to a person or harder to read without permission.
Testing and evaluating security measures	Controls are checked, not just written in a policy.
A data protection impact assessment (DPIA) under the General Data Protection Regulation’s Article 35	Higher-risk processing is assessed before or as part of the processing decision.

These measures show why special category processing is not only a legal decision. It becomes an operational duty for HR, service units, information management and suppliers.

The limits are as important as the additions

The Finnish Act adds rules, but it does not remove the General Data Protection Regulation.

It does not create a general permission to collect more data. The General Data Protection Regulation’s Article 5 still requires data minimisation, purpose limitation, accuracy, storage limitation, integrity, confidentiality and accountability.

It does not turn every child-related service into a consent case. The age of 13 in section 5 applies only in the situation described there: consent and an information society service offered directly to a child.

It does not make the personal identity code a special category of personal data. It is personal data because it identifies a person. The special categories are the categories listed in the General Data Protection Regulation’s Article 9.

It does not let a public authority use legitimate interests for processing carried out in the performance of its tasks. The General Data Protection Regulation’s Article 6 excludes that basis in this context.

It also does not remove breach duties. Under the General Data Protection Regulation’s Article 33, the controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to create a risk to people’s rights and freedoms. Under Article 34, the controller must inform the data subject without undue delay when the breach is likely to create a high risk. The breach topic continues in Personal data breach: the 72 hours start when an employee notices.

What this means in a municipality or company day to day

The practical task is to join the European rule and the Finnish addition in the same workflow.

For a municipality, the first question is often the task. If an employee opens, records or discloses personal data, the organisation should be able to connect that action to a public task, public interest or official authority where that is the legal basis. Legitimate interests will not solve authority processing carried out in official tasks.

For a company, the Finnish additions matter when the work falls into one of the national situations. A company may handle information on a person’s position and duties in business life where the aim is in the public interest and the processing is proportionate. It may also handle special category data in a situation covered by section 6, but then the protective measures become central.

For both, the same staff-level risks repeat. An employee may not recognise that a personal identity code is personal data. A service team may ask for consent from a child in the wrong setting. A unit may process health data but forget access controls, logging or competence measures. A manager may assume that Finnish law replaces the General Data Protection Regulation, when it actually sits beside it.

Good daily practice therefore starts with a few checks:

• What personal data is being processed?
• Is any data a special category under the General Data Protection Regulation’s Article 9?
• What is the legal basis under Article 6?
• Does Finland’s Data Protection Act 1050/2018 add a more specific rule?
• Is the processing necessary and proportionate for the stated purpose?
• Have the data subject been given the information required by Articles 13 or 14?
• Can the organisation respond to rights under Articles 12 to 20?
• Would an employee recognise and report a personal data breach quickly enough for Article 33?

This is where legal compliance becomes work competence. The rules only work if the people who collect, view, correct, disclose and delete data can apply them in ordinary situations.