News and events

The new national Data Protection Act is in force


The national Data Protection Act which supplements and complements the General Data Protection Regulation (GDPR) has come into effect in the beginning of the new year. The GDPR left a margin of maneuver for the Member States on certain topics and the aim of the Data Protection Act is to further regulate some of these issues. The Data Protection Act replaces the former national Personal Data Act.

The Data Protection Act names the Data Protection Ombudsman as the Finnish supervisory authority to monitor the application of the GDPR. Moreover, the Data Protection Act regulates the new collegial body, led by the Data Protection Ombudsman. The collegial body imposes sanctions for non-compliance, including administrative fines. However, administrative fines cannot be imposed on public authorities and bodies.

The GDPR allows for Member States to adjust the default age of consent anywhere between 16 and 13 years in relation to information society services. The new Data Protection Act uses that freedom, setting the age to 13 and thus mirroring the position of Finland’s Nordic peers. The GDPR also allows for Member States to determine specific conditions for the processing of national identification numbers. The Data Protection Act limits processing of the Finnish personal identity code only to specific situations and subjects the processing to additional requirements. Further, to preserve the freedom of speech, the processing of personal data for journalistic, academic, artistic, or literary purposes are exempt from certain provisions in the GDPR, such as the legal bases of processing and the rights of data subjects.

For further information, please contact:
Anna Liinamaa

More news

Back to News and Events »