Privacy statement for the Population Information System 

Population Information System

Digital and Population Data Services Agency and State Department of Åland

Lintulahdenkuja 2, 00530 Helsinki 

PL 123, 00531 Helsinki

Telephone (switchboard) 02 9553 6000, email kirjaamo(a)dvv.fi

Contact person in register-related matters:

Development Manager Anu Aakula
Lintulahdenkuja 2, 00530 Helsinki
PL 123, 00531 Helsinki

Telephone (switchboard) 02 9553 6000, email kirjaamo(a)dvv.fi

Telephone (switchboard) 02 9553 6000, [email protected]

The Population Information System is maintained to facilitate, implement and ensure society’s functions and information services as well as the rights and obligations held by members of society. 

Personal data entered into the Population Information System is retained in accordance with the Act on the Population Information System and on the Certificate Services of the Digital and Population Data Services Agency 661/2009. Hereinafter the act will be referred to as the Population Information System Act.

Personal data in the Population Information System is retained permanently with the exception of information on cases where social services have taken a child into care, which is deleted when the child is returned to his or her parent or when the child turns 18, and information on a foreign citizen’s residence permit, which is deleted when the person receives Finnish citizenship. The retention periods of paper documents are stated in the filing plan of the organisation.

Information on an individual that will be stored in the Population Information System:

The following information on the data subject will be stored in the Population Information System: 

1. full name;
2. personal identity code;
3. municipality of residence and place of residence there, as well as data on real estate, building or residence, which identify the individual’s municipality of residence and their place of residence there.
4. full names of parents and their personal identity codes;
5. marital status as well as information on getting married or dissolving a marriage or on the registration of a partnership, the termination of a registered partnership and the conversion of a registered partnership into a marriage; 
6. full name and personal identity code of the individual’s husband/wife or registered partner;
7. full names of children and their personal identity codes;
8. legal status of a child and parent under family law;
9. information concerning a child’s guardianship;
10. information on a confirmed adoption; 
11. information related to the restriction of competency, guardianship and authorisation of guardianship, as well as personal information on the guardian or assignee;
12. information on a child being taken into care;
13. municipality of birth or place and country of birth;
14. citizenship;
15. details on the recognition of the gender of a person who has undergone gender reassignment;
16. time of death or time at which a person has been declared dead;
17. information on the register authority;
18. data on the right to vote necessary for carrying out elections and referendums;
19. membership of a religious community as referred to in the Freedom of Religion Act (453/2003);
20. the mother tongue and communication language that the individual has submitted;
21. non-disclosure of data contained in the Population Information System given under the EU’s General Data Protection Regulation and the Population Information System Act: non-disclosure order, non-disclosure for customer register update, non-disclosure for contact information, non-disclosure for direct marketing, non-disclosure for genealogical research and non-disclosure for public registers; 
22. postal address given by the individual and other contact information as well as profession; 
23. an order to prevent change of address at the express request of the individual; 
24. data related to real estate and parts of real estate owned by the individual: the identifier code for the real estate, name and address of the real estate unit as well as information related to the buildings that the individual owns: permanent building code, building code and address: 
25. the individual’s possible foreign personal identity code; 
26. a notification to a Finnish citizen permanently living abroad on their population registration municipality as referred to in the Act on the Municipality of Residence;
27. the full name, date of birth, gender, marital status, citizenship, address and time of death for a person’s spouse, child or parent, who lives in a country other than Finland and has not been issued a personal identity code; 
28. type and duration of a residence permit granted to foreign citizen and other similar information.

Data is collected from private citizens (e.g. Notification of move) and various authorities on the basis of the duty to notify stipulated in the Act or Regulation.

These authorities include:

• parishes
• the Finnish Immigration Service
• Finnish missions in other countries
• courts
• the Finnish Tax Administration
• social service authorities
• the Criminal Sanctions Agency
• hospitals
• other health care service points and professionals
• marriage officiants
• the National Land Survey of Finland and building control authorities

• Nordic and Estonian Population Register Authorities

• Provincial governments in Sweden

The police and telecommunications operators can activate electronic client identifier.

Under the Population Information System Act, information listed in the act or regulation will be disclosed to state and municipal authorities as will information necessary for the performance of their statutory or required duties. Individuals or communities are given access to data from the Population Information System when they need this information to implement their rights and obligations. The disclosed data must be essential for the performance of the purpose for which it is disclosed. Data cannot be disclosed, if there is a justified reason to believe that the disclosure of data will violate the individual’s right to protection of privacy and personal data, the person's interests or rights and/or will compromise national security.

Data can also be disclosed for direct marketing, opinion and market surveys, address services, the update of customer registers, historical or scientific studies and/or for other comparable reasons, if the prerequisites for the disclosure of data listed in the Population Information System Act exist and if the individual’s right to prohibit the disclosure of their data does not prevent this. However, a non-disclosure for direct marketing is register-specific, meaning that the non-disclosure is not transferred to the non-disclosure subject’s register when data is transferred there, and the party can later use the information for direct marketing.

Valtori as the IT infrastructure service provider (processor) is responsible for the maintenance of the Population Information System in accordance with an agreement entered into with Digital and Population Data Services Agency. The IT infrastructure service provider has entered in an agreement with TietoEVRY Corporation on the procurement of services related to maintenance.

Private sector mass information service contractors (processors) are Posti Distribution Ltd and Dun & Bradstreet Marketing Ltd.

Public sector information service contractors (processors) are CGI and TietoEVRY Corporation.

As a rule, data may not be transferred to areas outside the EU or EEA. The possible transfer of information to areas outside the EU or EEA will be carried out in accordance with the relevant legislation, paying special attention to the general level of data protection in the country in question.

We process personal data in a manner that is safe and fulfils the statutory requirements. We have assessed the potential risks in our data processing activities and taken appropriate measures to control these risks.

The controller has protected the data by appropriate technical and organisational means. Some of the means used to protect the register include:

• protection of hardware and files
• access control
• user identification
• access privileges
• registration of access events
• guidance and monitoring of the processing.

Material on paper is located in locked facilities protected by access control. The retention, archiving and destruction of data are based on legislation and organisation-specific guidelines derived from the legislation. Personal data stored in the Population Information System are classified as confidential information by law.

The controller requires that also their personnel who process personal data protect the personal data appropriately.

No automatic decision-making is performed on the basis of data from the personal data file.

Right of inspection

The data subject has the right to inspect their own data in the Population Information System.

The data subject can inspect information that applies to them at Suomi.fi.

Information that can be viewed in the service include

• personal data and real estate ownership
• additional information on maintenance
• a person’s population registration municipality
• information on their residence permit
• verification of gender
• former marriages
• registered partnerships
• religious community
• as well as the number of people living at a person’s permanent residence. 

The data subject can also submit the following information via the service:

• mother tongue and communication language (when one’s mother tongue is a language other than Finnish or Swedish)
• profession
• preferred given name
• e-mail address
• restrictions on the disclosure of data (with the exception of a non-disclosure order) as well as resignation from a religious community.

The data subject may also inspect their own data by visiting the Digital and Population Data Services Agency or by requesting an inspection by filling in the local register office’s form (only in finnish and swedish).

Right to demand data correction

The Digital and Population Data Services Agency is responsible for guaranteeing that the data subject’s right to have the data listed on them in the Population Information System corrected is implemented.

If you observe an error in your personal data, contact the Digital and Population Data Services Agency,where the error can be corrected. You, as a data subject, can make corrections to the following data by signing into your data:

• mother tongue and communication language (when one’s mother tongue is a language other than Finnish or Swedish)
• profession
• preferred given name
• e-mail address
• restrictions on the disclosure of data (with the exception of a non-disclosure order)
• as well as resignation from a religious community. 

If you observe an error in data concerning the ownership of a building, please contact the municipality and ask that the information be corrected. If you observe an error in data concerning the ownership of real estate, please contact the Digital and Population Data Services Agency and ask that the information be corrected.

Limitations to the rights of the data subject with regard to the processing of personal data

As a rule, the data entered into the Population Information System is retained permanently. The Act on Population Information provides on situations in which legislation requires that information be deleted from the Population Information System (see section 5). Thus, the data subject does not have the right to ask for their data to be deleted from the Population Information System. For the same reason, the data subject does not have the right to object to the processing of their personal data or the right to have their data transferred to another system. It is not possible to request a restriction on the processing of personal data in the Population Information System for purposes prescribed by law.

However, the data subject always has the right to prohibit the processing of their personal data for direct marketing purposes. The non-disclosure for direct marketing can be submitted to the Population Information System via the online service (only in finnish and swedish) or by notifying it by phone or in writing to the Digital and Population Data Services Agency.

The data subject has the right to lodge a complaint to the supervisory authority on the processing of their personal data. 

Additional information by the Office of the Data Protection Ombudsman.