A combined file and information system description and information document regarding the Data System for Administrative Matters

Transcription

1 Privacy statement ID (10) POL A combined file and information system description and information document regarding the Data System for Administrative Matters Personal Data Act (523/1999), Sections 10 and 24 Act on the Openness of Government Activities (621/1999), Section 18 Decree on the Openness of Government Activities (1030/1999), Section 8 1. Name of the information system Data System for Administrative Matters, which consists of the following data groups: 1. Firearm permit and licence data 2. Identity card and passport data 3. Image data 4. Passport fingerprint data 5. Security sector supervisory data 6. Identification data of aliens 7. Money collection supervisory data 8. Lottery licence data 9. Explosives precursor licence data 2. Controller National Police Board Mailing address: P.O. Box 22, Helsinki Street address: Asemapäällikönkatu 14 Helsinki Telephone: (exchange) kirjaamo.poliisihallitus@poliisi.fi 3. Contact person in matters concerning the register 4. Grounds for maintaining the information system 5. Purpose of use of the information system National Police Board, Police Information Services Centre Suvi Pato-Oja, Senior Adviser (Contact information: See section 2) Section 3 of the Act on the Processing of Personal Data by the Police (761/2003). Provisions on the data content and purpose of the Data System for Administrative Matters are also contained in the Police Act (872/2011), police decree (1080/2013), Personal Data Act (523/1999), Firearms Act (1/1998), Firing Range Act (763/2015), Identity Card Act (663/2016), Passport Act (671/2006), Private Security Services Act (1085/2015), Aliens Act (301/2004), Convention on the Abolition of Passport Controls at Intra- Nordic borders (SopS 10/1958), Money Collection Act (255/2006), Lotteries Act (1047/2001) and the Act on the Marketing and Use of Explosives Precursors (653/2014) with their later amendments. The Data System for Administrative Matters is a permanent, computerised personal data file intended for nationwide use by the police. The Data System for Administrative Matters may contain information on individuals that must be processed in order to perform the duties specified in Chapter 1, Section 1.2 of the Police Act. The purposes of the data groups in the Data System for Administrative Matters are as follows: NATIONAL POLICE BOARD Asemapäällikönkatu 14, PO BOX 22, HELSINKI kirjaamo.poliisihallitus@poliisi.fi Tel , Fax police.fi

2 Privacy statement ID (10) 1. firearms permit and licence data are processed to perform the duties of the police laid down in the Firearms Act; 2. identity card and passport data are processed to perform the duties of the police and Finnish missions laid down in the Identity Card Act, and duties of the police, the Ministry for Foreign Affairs and Finnish missions laid down in the Passport Act; 3. image data are processed to identify a person and to produce a document in proof of identity; by permission of the person in question, the image data can also be used to prepare other administrative permits or decisions he or she has applied for than the document for which the data was provided; 4. passport fingerprint data are used to perform the duties of the police, the Ministry for Foreign Affairs and Finnish missions as laid down in the Passport Act; fingerprints saved as part of fingerprint data may also be used, with the permission of the person in question, in the preparation of another document applied for later for proof of identity purposes; 5. security sector supervisory data are used to perform the duties of the police laid down in the Private Security Services Act; 6. identification data of aliens are used to perform the duties laid down in section 131 of the Aliens Act; 7. money collection supervisory data are used to perform the duties laid down in the Money Collection Act. 8. lottery licence data are used to perform the duties specified in the Lotteries Act; 9. explosives precursor licence data are used to perform the police duties laid down in the Act on the Marketing and Use of Explosives Precursors. The police have the right to utilize data in the Data System for Administrative Matters for a purpose other than one equivalent to data collection and recording, if the data is necessary: 1. for ensuring State security; 2. for preventing an imminent and serious threat to public security; 3. for preventing or investigating an offence subject to imprisonment; 4. for establishing a person s identity when undertaking an individual police duty that necessarily requires verification of identity; 5. when deciding or issuing an opinion on the granting or validity of an authorisation if it has been laid down that a requirement for the granting or validity of the authorisation is the applicant s or holder s reliability, suitability or other such attribute whose assessment requires information on the state of health, intoxicant use, criminal guilt or violent behaviour of the applicant or holder. Data from a police personal data file may also be used in legality control, research, planning and development work. In addition, the data may be used in training activities if the data is essential for carrying out the training. Passport fingerprint data and fingerprint data included in the identification data of foreigners may only be used for purposes other than those equivalent to the purpose of their collection and recording if this is necessary in order to identify a victim of a natural disaster, a major accident

3 Privacy statement ID (10) or other catastrophe or an offence, or to identify a victim who would otherwise remain unidentified. Data recorded on the data subject for the purpose of comparing them with passport fingerprint data may only be used for the duration of the comparison process, and they must be destroyed immediately thereafter. Information included in a firearms notification may only be used for processing a firearms permit. 6. Information system contents and data groups The data that may be recorded in the Data System for Administrative Matters on the identity of a person consist of the person s name, date of birth, personal identity code, gender, native language, citizenship, the lack of citizenship, nationality, home country, marital status, country of birth, municipality of birth, municipality of residence, profession, address and telephone number and other contact details, information on a person s death or declaration of death, and travel document information and other necessary information related to immigration and entry into Finland. In addition, other necessary data obtained for the performance of duties laid down in Chapter 1, Section 1.2 of the Police Act may be recorded in the Data System by data group as follows: 1. in firearms permit and licence data, information on an application, a licence or a permit, a police measure, a decision, an obstacle, a firearms notification, a warning, a notification, an inspection and the completion point of time of an aptitude test referred to in Chapter 114 of the Firearms Act; 2. in identity card and passport data, information on an application, a decision, a licence or a permit, a measure by the police and a Finnish mission abroad, an obstacle, a warning and a notification referred to in the identity card act, as well as information on a passport application and a decision issued in a passport-related matter, information on a passport or other travel document issued by Finnish authorities, information on a lost or a stolen passport and on taking possession of a passport, and information on obstacles to issuing a passport and a warning related to a passport matter; 3. in image data, a photograph and sample signature that the relevant person has provided for the police, the Ministry for Foreign Affairs or a foreign affairs administration authority when applying for a permit or a decision, where the person s photograph and sample signature are needed in order to prepare the permit or a decision; 4. in passport fingerprint data, fingerprints taken from the applicant when applying for a passport referred to in section 6 a of the passports act; 5. in security sector supervisory data, data on an application, a decision, a card, a police measure, an obstacle, a warning, a notification and an inspection referred to in the Private Security Services Act and the more detailed regulations issued pursuant to it; 6. in identification data of aliens, data on an alien referred to in section 131 of the Aliens Act comprising the personal description data and travel document data referred to in this section; 7. in money collection supervisory data, data on permit applications, permits, cancellations of permits, warnings and accounting practices

4 Privacy statement ID (10) as well as on parties having applied for and received a permit, parties carrying out a money collection in practice and persons responsible for the collection as well as auditing practices; 8. in lottery licence data, data on notifications, licence applications, licences, cancellations of licences, accounting practices as well as on parties having issued notifications and applied for and received a licence, parties carrying out lotteries in practice and persons responsible for such lotteries as well as auditing practices and measures related to prohibitions and the conditional imposition of a fine; 9. in explosives precursors licence data, data on a licence application, a licence, a police measure, a decision and an inspection laid down in the Act on the Marketing and Use of Explosives Precursors. 7. Regular information sources of the information system Personal data for the Data System for Administrative Matters are collected while performing duties laid down in Chapter 1, Section 1.2 of the Police Act. Other necessary data by data group are obtained as follows: 1. data on firearm permits and licences are collected in connection with licence administration, supervisory and auditing actions pertaining to firearms by the relevant authorities and personally provided by the applicant; 2. identity card and passport data are collected in connection with licence administration actions pertaining to identity cards and passports by the relevant authorities and personally provided by the applicant; 3. image data are obtained from photographs and sample signatures provided by the applicant to the police, the Ministry for Foreign Affairs or a foreign affairs administration authority in connection with a matter related to a licence or a permit, or a decision; 4. passport fingerprint data are collected from the applicant when applying for a passport by the relevant authorities; 5. security sector supervisory data are collected in connection with licence administration, supervisory and auditing actions pertaining to private security services and security stewards by the relevant authorities and personally provided by the applicant; 6. identification data of aliens are collected by the police and passport control authorities from data obtained in connection with official actions concerning aliens who have applied for asylum or a residence permit, or who are to be refused entry or removed from the country; 7. money collection supervisory data are collected in connection with licence administration and supervisory duties related to money collections by the relevant authorities and personally provided by the applicant. 8. data on lottery permits are collected in connection with licence administration and supervisory actions by relevant authorities and personally provided by the applicant; 9. explosives precursor permit data are collected in connection with licence administration and supervisory actions by relevant authorities and personally provided by the applicant.

5 Privacy statement ID (10) Provisions on the right of access of the police to data in certain registers are contained in section 13 of the Act on the Processing of Personal Data by the Police. Provisions on supplying information from other authorities to the police online or as a set of data for the purpose of recording are contained in section 14 of the Act on the Processing of Personal Data by the Police. With the aid of a technical user interface, the Population Register Centre gives the police access to population register data that are necessary in order for the police to fulfil their official duties or to maintain the national personal data registers of the police. Sections 29, 55 and 58 of the act on the population register system and certification services of the Population Register Centre (661/2009); Section 13.1 paragraph 13 of the Act on the Processing of Personal Data by the Police (761/2003). 8. Regular use and disclosure of data in the information system The police have the right to use the data in the Data System for Administrative Matters to perform duties laid down in Chapter 1, Section 1.2 of the Police Act, provided that the data is necessary in order to perform such duties. The right to use passport fingerprint data only applies to those who of necessity need to use this data in their work duties. Sections 2 and 3 in Chapter 15 of the Act on the Processing of Personal Data by the Police (761/2003). The police have the right to use the data in the Data System for Administrative Matters to perform duties other than data collection and recording as laid down in Chapter 16 and 16a the Act on the Processing of Personal Data by the Police. Data in the Data System for Administrative Matters are supplied with the aid of a technical user interface or as a set of data under section 19 of the Act on the Processing of Personal Data by the Police: 1. Necessary data in order to carry out duties specified in the Emergency Response Centres Act (692/2010), Chapter 4 or ensure initial measures or occupational safety or; 2. to the Border Guard, data for maintaining border security, preventing crime, crime exposure, pre-trial investigations and other investigations, other duties of the Border Guard that correspond to the duties for which the data has been collected and recorded and for other purposes in cases in accordance with Chapter 16, Section 1; 3. to the Defence Forces Defence Command for security and supervisory tasks and for criminal investigations referred to in the Act on Discipline and Combating Crime in the Defence Forces (255/2014) and for the performance of background checks referred to in the Act on Background Checks (726/2014); 4. to Customs for the supervision of customs, preventing, exposing and investigating customs offences and for other data collection and recording purposes in cases according to Chapter 16, Section 1, and for carrying out an on-the-spot summons and another notification; 5. to the Ministry for Foreign Affairs and a Finnish mission for

6 Privacy statement ID (10) processing a matter within their competence concerning a passport or other travel document, a visa, a residence permit for employed or self-employed persons, or another residence permit; 6. to the Finnish Immigration Service for processing and resolving such matters related to foreigners and Finnish citizenship as are mandated by law or decree as duties of the Finnish Immigration Service; 7. to civil servants for the purpose of performing duties laid down in Chapter 8 of the Police Act (493/1995), as enacted in Act 498/2009, with special police powers, or who operate abroad in the duties of a contact person of the police assigned by Finland; the provisions laid down in Section 17(1-3) and 18 (1-2) apply to the supplying of data; 8. to Metsähallitus game wardens within the scope of the game management activities within their competence; Passport fingerprint data are only disclosed to the Border Guard, the Customs, the Ministry for Foreign Affairs and Finnish missions as well as to the Finnish Immigration Service in order to establish the identity of a person and the authenticity of a document, whenever this is necessary for processing matters related to the entry into, residence in and departure from the country. The party to which the data is disclosed may only use the data recorded on the data subject for the purpose of comparing them with the fingerprint data for the duration of the comparison process, and the data must be destroyed immediately thereafter. Data are also supplied to other authorities, organisations and private parties following the provisions on right of access in the law. Provisions on processing personal data in connection with international police cooperation are contained in Chapter 6 of the Act on the Processing of Personal Data by the Police. 9. Data system quality and protection principles The Data System for Administrative Matters is a permanent, computerized personal data file intended for nationwide use by the police to which outsiders have no access. Users of information systems maintained by the police administration log into their workstations using a certificate related to the officeholder's e- service card. Users have personal technical user rights and passwords in their tasks that are issued following the controller's instructions. User rights are only granted to the extent that this is necessary in order to perform official duties and tasks. Use of the Data System for Administrative Matters is supervised following principles agreed upon in advance. Use of the system and the data it contains and user numbers are monitored, for example based on user logs, in order to supervise legality of use. The legality of use of the information systems is also controlled during inspections related to legality control of the police and other measures related to such legality control. The foundation of the technical, administrative and organisational information security of the police administration is the police data security

7 Privacy statement ID (10) policy (2020/2010/4157), which specifies objectives, responsibilities and methods of implementation within the police administration. The data security policy is specified in separate regulations and instructions. 10. Frequency of updating and storage period of information system data The data in the Data System for Administrative Matters is continuously supplemented while performing duties laid down in Chapter 1, Section 1.2 of the Police Act. Data is deleted by the data group as follows: 1. of data on firearm permits and licences, data on a decision are deleted twenty years after the making or expiry of a decision or the expiry of a period of validity cited in the decision, licence and permit data twenty years after the expiry of the licence or permit, data on obstacles or reprimands and other recorded data twenty years after the data was entered, and data on firearms twenty years after the firearm was permanently disabled, scrapped or removed from the country; 2. of identity card and passport data, passport fingerprint data, security sector supervisory data and money collection and lottery supervisory data, data on a decision are deleted ten years after the making or expiry of the decision or the expiry of a period of validity cited in the decision; data on obstacles, warnings, inspections and audits, and other recorded data ten years after the data was entered; 3. image data are deleted three years after the expiry of the licence or decision issued by the police, the Ministry for Foreign Affairs or a Finnish mission abroad for the preparing of which the person s photograph or sample signature were most recently used; however, if some prior licence or decision has a longer period of validity than the licence or decision that was prepared last, the data will be removed three years after the expiry of the licence or decision that was prepared earlier but is valid for a longer period; 4. identification data of an alien are deleted ten years after registration; however, if the data subject has received Finnish citizenship, the data will be deleted one year after the controller was informed of the person in question receiving citizenship. However, all data on a person will be removed from the information system at the latest one year after the death of the data subject, unless particular reasons exist for retaining the data. The need to retain the data is reviewed no later than five years after the previous occasion on which it was reviewed, and an entry is made accordingly. Data collected on the data subject for the purpose of comparison with passport fingerprint data and fingerprint data included in the identification data of foreigners in a situation referred to in Section 16 a subsection 1 of the Act on the Processing of Personal Data by the Police may only be used for the duration of the comparison process, and must be destroyed immediately thereafter. 11. Publicity of the data Legal basis: Section 24 of the Act on the Openness of Government Activities (621/1999)

8 Privacy statement ID (10) Section 113 of the Firearms Act (1/1998) Section 7 of the Personal Data Act (523/1999) Public, contains secret information. 12. Right of access Legal basis: Sections 26 and 27 of the Personal Data Act (523/1999) Sections 44 and 45 of the Act on the Processing of Personal Data by the Police (761/2003) Chapter 3 of the Act on the Openness of Government Activities (621/1999) Under section 26 of the Personal Data Act, regardless of the secrecy provisions, everyone shall have the right of access, after having supplied sufficient search criteria, to the data on him/her in a personal data file, or to a notice that the file contains no such data. Everyone shall also have the right of access to data on a child whose guardian he or she is in the file. A minor, or a child aged less than 18, also has an independent right of access. However, a child aged less than 15 shall only have the right of access in the event that he or she, in consideration of his/her age, level of development and the nature of the matter, understands the significance of the issue. Assessing the right to self-determination of a minor and fulfilment of the criteria cited above is primarily a matter of the controller s evaluation. The ultimate decision is made by a court of law. A guardian also has a right of access on behalf of his or her client in the event that using the right of access is included in the power of attorney given to the guardian (source: publication by the office of the Data Ombudsman Right of access to data in a personal data file, updated on 27 July 2010). Under section 27 of the Personal Data Act, however, there is no right of access: 1. if providing access to the data could compromise national security, defence or public order and security, or hinder the prevention or investigation of crime; 2. if providing access to the data would cause serious danger to the health or treatment of the data subject or to the rights of someone else; 3. if the data in the file are used solely for historical or scientific research or statistical purposes; or 4. if the personal data in the file are used in the carrying out or monitoring or inspection functions and not providing access to the information is indispensable in order to safeguard an important economic interest or financing position of Finland or the European Union. Under section 45.1 paragraph 5 of the Act on the Processing of Personal Data by the Police, the right of access does not apply in any way to: classification, surveillance, modus operandi or information source data concerning persons or acts included in other police personal data files

9 Privacy statement ID (10) On request by the data subject, the Data Ombudsman can check the legality of the data on the data subject. 13. Presentation and realisation of a request on right of access Legal basis: Sections 26 and 28 of the Personal Data Act (523/1999) Section 44 of the Act on the Processing of Personal Data by the Police (761/2003) In order to exercise his or her right of access, the data subject must make a request to this effect personally with the police and prove his or her identity. The data subject may bring an assistant with him/her. Specific forms have been designed to facilitate the implementation of the right of access. Using these forms is not an absolute requirement for implementing the right of access, and the request can also be made in some other document. Such a request document must always indicate, with sufficient accuracy, the police information system or another police data file to which the person wishes to exercise their right of access. The person receiving the form or other document at the police unit should ascertain the identity of the customer making the request and make an entry to that effect on the document. On request, the data will be provided in writing. If the controller declines the right of access, a written certificate of this is issued to the data subject. The certificate must state the reasons for which the right of access was declined. If the data subject has not, within three months of making the request, received a written reply, this will be considered tantamount to refusing the right of access. The data subject may then take the matter to the Data Ombudsman. According to section 26 of the Personal Data Act, the controller may charge a reasonable fee for the immediate costs of providing access to the data if less than one year has passed since the previous instance of providing the data subject with access to the file. According to the Ministry of the Interior's Decree on Police Service Charges 2016 (1484/2015), the amount of the fee is 62 euros. The police administration has issued guideline 2020/2012/66 on the implementation of a data subject's rights by the police. This guideline contains a detailed description of procedures related to right of access and other rights of data subjects. The guideline is available to everyone on the national police information network ( 14. Rectification of data and implementation of rectifications Legal basis: Sections 29 and 40 of the Personal Data Act (523/1999) Section 27 of the Act on the Processing of Personal Data by the Police (761/2003) The data subject has the right to demand that the controller rectify data in the file that is erroneous, unnecessary, incomplete or obsolete as regards the purpose of the processing. A detailed request to have the data rectified should be addressed to the controller (contact information: see section 2) or made personally with the

10 Privacy statement ID (10) controller. Requests to rectify data concerning the national personal data registers of the police will be received by all police units. If the controller refuses a demand, presented by a data subject, for the rectification of an error, the data subject shall be issued with a written statement to this effect. Such a statement must indicate why the demand was refused. After this, the data subject may refer the matter to the Data Protection Ombudsman. Data that have been found to be erroneous must be marked as such, while the data may be kept alongside corrected data if this is necessary in order to safeguard the rights of the data subject, another interested party or a member of police personnel. Such information may only be used for the stated purpose of safeguarding rights. Data found erroneous must be removed as soon as storing the data is no longer necessary for safeguarding rights, however no later than five years after the period laid down for the deletion of data has elapsed. 15. Providing access to the privacy statement The privacy statement on the Data System for Administrative Matters is kept available for everyone on the premises of the controller, at the customer service desks of police departments and, in electronic format, on the national police information network (