Finland: Web service to request verifying of secret registry data

EDRi-member Effi ry has launched a web service for citizens to request the data protection authorities to verify that any records in various law enforcement and secret services registries are filed according to the relevant regulations. Previously, this kind of request required detailed knowledge of relevant registers, leaving the process practically unavailable for the majority of citizens. The service created by Effi ry provides citizens with an immediate and easy-to-use tool to submit their request to check the legality of any records connected to them in these databases that are otherwise inaccessible.

After the announcement of launching the service, over 3 000 requests were made. The launch raised immediately significant media attention, and provoked a reaction from the relevant authority, the National Police Board, that claimed that some of the requests would not be processed. According to them, all requests have to be submitted in person, by the person whose data is being requested, to a local police station, from where they are handed over to the verification authority, the Data Protection Ombudsman (DPO). Effi ry responded, insisting that according to the law, based on 45§ of the law on processing of personal data by the police, the request for such verification can be submitted directly to the DPO.

“The fact that the verification request is processed by the same institution that maintains the dataset in question is highly problematic,” said Tapani Tarvainen, Vice President of Effi ry. “If the request is submitted to the police, it permits the requested data to be hidden or destroyed before the Data Protection Ombudsman gets the opportunity to access and verify them,” he continued.

Two opposite views on how to interpret the law remain. While both the National Police Board and the DPO’s office consider that handling of the requests online is impossible, Effi ry sticks to the point of view that citizens, being the data subjects, should be allowed to have an accessible way to initiate a reliable check of any records connected to them that the registries may contain. This is essential, taking into consideration the fact that these records might significantly influence a person’s life, as the data is routinely used to classify and evaluate individuals for example in security clearance processes. Furthermore it has been reported in public that it is likely that many of the records are created without reasonable grounds or are completely erroneous. For example, it was reported that the registry included a record of the Russian President Vladimir Putin, for which Finnish government later apologised.

Effi ry stresses that DPO should respond to the requests, and promptly and thoroughly investigate the legality as well as the proportionality of any such database records, and that initiating the process of verifying their records should be made as easy and reliable as possible for citizens.

“One may also wonder why a similar service hasn’t already been created by the authorities. This kind of crucial issues should not be left to the responsibility of NGOs alone,” said Ville Oksanen from Effi ry.

Some of the members of the Board of Effi ry have submitted their requests, in order to follow up the process, and to make it more likely that the case could not be swept under the carpet and silently closed.

Data Protection Ombudsman’s office: Request to verify the data in the police registries has to be presented in person at a police station (only in Finnish, 30.10.2014)
http://www.tietosuoja.fi/fi/index/ajankohtaista/tiedotteet/2014/10/tarkastusoikeuspyyntopoliisinhenkilorekistereihinesitettavahenkilokohtaisestipoliisintoimipaikassa.html

Effi: Data Protection Ombudsman is wrong, the verification request can be submitted without visiting the local police (only in Finnish, 29.10.2014)
https://effi.org/uutiset/141029-tsv-vaarassa-tarkistuspyynno.html

Law on the processing of personal data by the police 45 § (only in Finnish)
http://www.finlex.fi/fi/laki/ajantasa/2003/20030761#L7P45

Data verification request web service (only in Finnish)
https://tarkastuspyyntogeneraattori.effi.fi/

(Contribution by EDRi-member Effi ry, Finland)