Questions and answers for victims of identity theft or data leak

Updated on June 22nd 2021, first published on October 25th 2020

The Digital and Population Data Services Agency has compiled questions and answers on issues related to the agency's area of responsibility which may be useful to the victims of the data leak.

A comprehensive information package for victims of identity theft or data leak can be found on  Suomi.fi web service: "What shoud I do? My personal data has been stolen or leaked".

What can happen if your personal identity code ends up in the wrong hands?

The personal identity code is intended as a unique identifier for private individuals. A unique identifier means that two citizens cannot have the same personal identity code. This is important to ensure that two persons with the same name cannot, for example, be mixed with each other in authority or bank services, or that the right to vote cannot be used more than once.

In different e-services, the personal identity code should only be used to individualise customers. The personal identity code should not be used to identify the customer. When using services in person, the customer should always be identified by a personal identity card or passport issued by the police and in electronic services by strong electronic identification means, such as online banking codes, a mobile certificate or a citizen certificate for an ID card.

Unfortunately, some service providers make it possible to use services solely on the basis of the personal information that the customer has given which enables the use of false personal data. Typical false personal data scams include taking different small credit loans with false personal data and reporting false address changes to direct online shopping purchases to the wrong address. The personal identity code can also be misused for bullying and harassment purposes.

What can a victim of identity theft do?

In all cases, it is always a good idea to report an offence and follow the police's instructions. You can prevent the possible misuse of your personal data by criminals by adding non-disclosures on your data for the purposes you wish and by setting orders to prevent change of address. In serious criminal cases involving a threat of physical violence, you can consider an order of non-disclosure for personal security reasons. It is also possible - although very rare - to change the personal identity code.

Can a citizen decide for what purposes and to whom their data may be disclosed from the Population Information System?

Criminals can be prevented from misusing your personal data in the Population Register by setting data disclosure bans for the uses you wish at Omien tietojen tarkastus -service (in Finnish and Swedish).

You can prohibit the disclosure of personal data for customer register updates, the disclosure of contact information, direct marketing, the compilation of public registers and genealogical research. In this case, the Digital and Population Data Services Agency will not disclose personal data for these purposes. Several authorities have a statutory right to obtain data from the population register and the disclosure of data cannot be prohibited from authorities.

What does the block on a change of address mean and how can it be done?

You can prevent false address change scams by setting a form block and by activating a block on a change of address.

When a block on a change of address has been entered, you may only make a notification of move by personally visiting an office of the Digital and Population Data Services Agency. You must prove your identity in connection with the visit. If you wish to make a change of address electronically or on paper, you must first cancel the block that you applied for.

Please note that a block on a notification of a change of address has to be made to both the Digital and Population Data Services Agency and to Posti. The Digital and Population Data Services Agency enters the block into the population data system.

Read more about blocking a notification of move

Check the instructions for filing a block with Posti.

When should I apply for an order of non-disclosure for personal safety reasons and what does it mean?

If you are under a threat of serious physical violence, you can protect yourself and your family by applying for an order of non-disclosure for personal safety reasons. A non-disclosure for personal safety is a robust protection measure that restricts the disclosure of personal data such as your address and place and municipality of residence from the Population Information System. Only the authorities that have the right to process data subject to a non-disclosure will be able to access it. When considering applying for the order of non-disclosure for personal safety reasons, you should also remember that it can make everyday life more difficult so you should thoroughly consider the benefits and disadvantages of the non-disclosure order.

More information about non-disclosure for personal safety reasons

Can a victim of identity theft apply to change their personal identity code?

According to legislation, a personal identity code is meant to be a permanent and life-long identity code, and changing it is very rare. You can apply for a change of personal identity code if someone has repeatedly misused your original identity code and this has resulted in significant economic or other hardship to you, and if a change of personal identity code could prevent continued misuse. Under the law, changing a personal identity code must be strictly necessary to protect a person in situations where their health or safety is subject to an obvious and permanent threat. Witness protection is an example of such a situation.

A personal identity code may also be changed if changing the personal identity code can prevent the continuation of the harmful consequences of abuse and all of the following conditions are met:

• the misuses are continued
• the misuses have caused significant economic or other disadvantage or hardship
• the misuse will be prevented with a change of personal identity code.

More information on changing your personal identity code