New law on personal data processing on cards

The government has drafted a new law enabling the police to process personal data of the citizens, said the interior ministry in a press release.

The ministry has already sent out the draft law for comments. The new personal data act would replace the existing provisions for the police to process people’s personal data. The new act must fulfil the requirements of the EU’s updated data protection legislation, taking into account the needs of crime prevention and the requirements of basic and human rights.

The government aims to table the proposed bill to parliament so that it could be processed at the same time with the government proposals concerning the implementation of the EU’s data protection legislation. The EU’s data protection legislation was approved on 27 April 2016. The project for introducing the new act will also implement the Directive of the European Parliament and of the Council on the use of passenger name record (PNR) data for crime prevention, which was approved simultaneously with the data protection legislation.

The section concerning a suspect data system will be replaced by a provision concerning the processing of personal data for the purposes of criminal intelligence. The new regulations would improve the opportunities of the police to prevent and investigate crime through efficient criminal intelligence. Through criminal intelligence, data important for crime prevention are acquired and analysed and reports prepared about crime, criminals, criminality and its consequences, and the phenomena that put society in danger.

New powers will not be proposed for the police for data acquisition. Instead, the opportunities of the police to process the personal data acquired using their existing powers will be secured. In future, personal data could be processed more efficiently in order to analyse organised crime or criminal groups and with regards to broader entities, for instance.

At the same time, the provision would provide the police with better opportunities to process the data of different groups of persons. Data on persons connected with crime or criminal action in one way or another and those under police surveillance would be recorded in the system. In addition, data on persons repeatedly contacting or meeting persons connected with crime or criminal action could be processed for the purposes of criminal intelligence.

The police could also process the personal data of witnesses, victims, persons reporting crime and complainants for criminal intelligence. However, if the question is not of persons suspected of actual criminal action, the threshold for processing personal data would be higher so as to guarantee data protection and legal protection. The police could only process the personal data of such persons for criminal intelligence purposes if necessary.

The EU’s passenger name record directive obliges air carriers to transfer specific passenger data to Passenger Information Units established or appointed by the EU member states for preventing terrorism and serious criminality. Passenger name record data refers to a register containing the details of each passenger and the booking data submitted by the passenger. In Finland, the Passenger Information Unit would be established by the police, Customs and the Finnish Border Guard.

The Passenger Information Units analyse the data based on specific criteria and compare the data with national and international databases of relevance to preventing terrorist crime and serious criminality. The draft law also proposes the establishment of a new personal data file by the police for this purpose. Passenger information should be kept in the Passenger Information Units for five years.