Translation from Finnish Legally binding only in Finnish and Swedish Ministry of the Interior, Finland

Transcription

1 Translation from Finnish Legally binding only in Finnish and Swedish Ministry of the Interior, Finland Act on the Processing of Personal Data by the Border Guard (579/2005; amendments up to 1072/2015 included) Chapter 1 General provisions Section 1 Scope of application (479/2010) When processing personal data at the Border Guard, provisions of the Personal Data Act (523/1999) or any other act shall be observed unless otherwise provided in this Act. Provisions on the military service register are laid down in the Conscription Act (1438/2007), those on the maritime search and rescue register in the Maritime Search and Rescue Act (1145/2001), those on the register of aliens in the Act on the Register of Aliens (1270/1997) and those on police information systems in the Act on the Processing of Personal Data by the Police (761/2003), hereinafter the Police Personal Data Act. Provisions on access to documents, restrictions of access to information and the non-disclosure obligation are laid down in the Act on the Openness of Government Activities (621/1999) and in the Act on the Administration of the Border Guard (577/2005). Provisions on the processing of personal data on employees are laid down in the Act on the Protection of Privacy in Working Life (759/2004). Provisions on border control and border checks are laid down in Regulation (EC) No 562/2006 of the European Parliament and of the Council establishing a Community Code on the rules governing the movement of persons across borders, hereinafter the Schengen Borders Code. Section 2 Definitions (479/2010) For the purposes of this Act: 1) Data System for Administrative Matters means the administrative data system referred to in section 3 of the Police Personal Data Act; 2) administrative unit means a unit of the Border Guard laid down in section 3(1) of the Act on the Administration of the Border Guard; 3) Data System for Police Matters means the police matters data system referred to in section 2 of the Police Personal Data Act; 4) police information system means a police data system referred to in Chapter 2 of the Police Personal Data Act; 5) border management means measures taken in Finland and abroad to prevent breaches of provisions on crossing the national or external border and threats to public order and security posed by cross-border passenger traffic, to combat cross-border crime and to ensure the safety of border crossings.

2 Section 3 Operational data system of the Border Guard The operational data system of the Border Guard is a permanent personal data file intended for nationwide use of the Border Guard which is maintained by means of automatic data processing and which includes the following components meant for nationwide use: 1) the Investigation and Executive Assistance Register; 2) the Licensing Register; 3) the Data Monitoring Register; 4) the Criminal Suspect Register of the Border Guard; 5) the Security Data Register; 6) the Register for Administration of Justice under Military Law; 7) the Register for Disciplinary Decisions. (751/2014) Section 4 Other personal data files of the Border Guard In addition to the personal data files specified in section 3, a personal data file may be established at the Border Guard which is necessary for: 1) the nationwide use of the Border Guard; 2) the use of an administrative unit or units; 3) the use of a working group set up at the Border Guard. Section 5 Establishment of a personal data file, controller, and supervision of personal data processing The establishment of a personal data file is decided on by the Border Guard Headquarters if the data file is intended for nationwide use of the Border Guard. The establishment of other personal data files is decided on by an administrative unit unless otherwise provided or ordered. The administrative unit that has established the personal data file is the controller. (1230/2013) Decisions to establish a personal data file are made in writing and they include the description of the file referred to in section 10 of the Personal Data Act as well as a plan on the archiving and destruction of data. Decisions to terminate the use of a personal data file are also made in writing and they include a plan on measures for the archiving of data remaining in the data file and for the destruction of data to be destroyed. Besides other legal provisions, the Border Guard Headquarters and the administrative unit acting as the controller supervise compliance with the provisions on the processing of personal data at

3 the Border Guard. The Data Protection Ombudsman shall be notified of the establishment of and any significant changes to a nationwide personal data file no later than one month before the establishment or change. Section 6 Data necessary for the planning and implementation of duties laid down for the Border Guard The Border Guard receives and communicates notifications, instructions and orders to safeguard and protect people, property and the environment. In order to plan, carry out and supervise these duties, the following necessary information may be recorded in a nationwide personal data file of the Border Guard: 1) the persons on standby and the persons participating and having participated in the duty; 2) information related to units carrying out rescue, police, customs as well as social and healthcare duties, such as information on preparedness, communication systems, chain of command, gear, the area of the duty, size and composition of the unit as well as other similar information; 3) the time and manner of issuing the notification, order or instructions and their content together with telephone identification information and address information as well as a tape or a similar technical recording; 4) of the information on the person receiving and recording the notification, order, instructions or duty: the name and the receiving unit with dates and times; 5) of the information on the identity of persons connected with the notification, order, instructions, duty or action: the name, personal identity code or the date of birth, sex, mother tongue, citizenship or lack thereof, nationality, country of birth, home country, statelessness, place of residence, address and telephone number or other similar information, their connection with the matter as well as the identification information on the target; 6) information on the duty or action, such as an account of the incident or action, its time and place, urgency and danger of the duty as well as other necessary information related to an individual task; 7) information necessary for the safety or occupational safety of the person targeted by or performing the action, such as information on the danger posed by the target or person or on their unpredictability. Section 7 Investigation and Executive Assistance Register The Investigation and Executive Assistance Register may contain data the processing of which is necessary to perform the duties referred to in Chapter 1, section 1(1) of the Police Act (876/2011) and laid down for the Border Guard in the Border Guard Act (578/2005) or elsewhere in the law. (876/2011) Of the information on the identity of persons suspected of an offence investigated by the Border Guard; or of persons subject to a criminal investigation carried out by the Border Guard or to another investigation, another procedure or a coercive measure under section 27 of the Border Guard Act; or of persons reporting an offence, witnesses, injured parties or persons otherwise connected with the matter, the following data necessary for the purpose of the data system may

4 be recorded in the Register: names, date of birth, personal identity code, sex, mother tongue, citizenship or lack thereof, nationality, home country, marital status, country of birth, municipality of birth, municipality of residence, profession, address and telephone number or other contact information, information on the death or declaration of death of the person, customer number issued by the authorities, names and address of parents of a foreign national, the travel document data of the person, his or her picture, other necessary information related to entry and border crossing, as well as information necessary to identify a legal person. (1182/2013) Other necessary information obtained for the performance of the duties referred to in Chapter 1, section 1(1) of the Police Act and laid down for the Border Guard in the Border Guard Act or elsewhere in the law may also be recorded in the Register as follows: 1) information obtained in a criminal investigation referred to in the Criminal Investigation Act (805/2011), or another investigation under section 27 of the Border Guard Act, in connection with actions of the Border Guard or during an executive assistance duty, or in connection with the application of the Coercive Measures Act (806/2011), to perform and record investigation and executive assistance duties and to search information relevant to these duties (investigation and executive assistance data) as follows: a) the report number for the offence or incident, time and place of the incident, reporting time, name of the offence or incident, period of limitation for prosecuting the most serious offence, investigating unit, investigators, status of the investigation, decisions made by the Border Guard to conclude the matter, identification information on the decision by a prosecutor or court and information on whether the person has been convicted, the charges or the punishment waived, the charges rejected or dismissed, as well as information on whether the decision is final; b) information on coercive measures, actions taken by the Border Guard and the stages of the criminal investigation and other investigations; c) information on other necessary descriptions, circumstances and details related to the Border Guard duty, action and incident; d) to classify and analyse the criminal modi operandi, information describing the offender, incident or act, and information needed for case linkage and forensic investigation; 2) to target surveillance by the authorities carrying out investigation and border control, information that needs to be communicated particularly because of the urgency of the matter, danger of the situation, crime prevention, border management, or reasons related to the investigation (communication data); 3) observations made by border guards or information reported to the Border Guard concerning incidents or persons who, on the basis of the circumstances or threats made by the person, or the person s behaviour otherwise, may reasonably be believed to be involved in criminal activity (observation data). (1182/2013) Section 8 Licensing Register (1230/2013)

5 The Licensing Register may contain data the processing of which is necessary to perform the duties referred to in Chapter 1, section 1(2) of the Police Act and laid down for the Border Guard in the Border Guard Act or elsewhere in the law. Of the information on identity, the following data necessary for the purpose of the data system may be recorded in the Register: names, date of birth, personal identity code, sex, mother tongue, citizenship or lack thereof, nationality, home country, marital status, country of birth, municipality of birth, municipality of residence, profession, address and telephone number or other contact information, information on the death or declaration of death of the person, customer number issued by the authorities, names and address of parents of a foreign national, the travel document data of the person, his or her picture, other necessary information on entry and border crossing, as well as information necessary to identify a legal person. Other necessary information obtained for the performance of the duties referred to in Chapter 1, section 1(2) of the Police Act and laid down for the Border Guard in the Border Guard Act or elsewhere in the law may also be recorded in the Register as follows: 1) information on an application, permit, statement, notification and decision related to a border zone permit, border crossing permit and other permit to be issued by the Border Guard as referred to in the Border Guard Act (Border Guard permit data); 2) information on border zone notifications and other notifications referred to in the Border Guard Act to be made to the Border Guard (Border Guard notification data); The information stored in the Register may be used to carry out border control laid down in the Schengen Borders Code. Section 9 Data Monitoring Register (1230/2013) The Data Monitoring Register may contain data the processing of which is necessary to perform the duties referred to in Chapter 1, section 1(1) of the Police Act and laid down for the Border Guard in the Border Guard Act or elsewhere in the law. (1230/2013) Of the information on the identity of persons, the following data necessary for the purpose of the data system may be recorded in the Register: names, date of birth, personal identity code, sex, mother tongue, citizenship or lack thereof, nationality, home country, marital status, country of birth, municipality of birth, municipality of residence, profession, address and telephone number or other contact information, information on the death or declaration of death of the person, customer number issued by the authorities, names and address of parents of a foreign national, the travel document data of the person, his or her picture, other necessary information on entry and border crossing, as well as information necessary to identify a legal person. (1182/2013) Other necessary information obtained for the performance of the duties referred to in Chapter 1, section 1(1) of the Police Act and laid down for the Border Guard in the Border Guard Act or elsewhere in the law may also be recorded in the Register as follows: (1230/2013) Paragraph 1 has been repealed by Act 1230/ ) for the performance of identification laid down in section 31 of the Border Guard Act, necessary image data on persons who are to be apprehended in order to prevent, investigate or forward to

6 prosecution an offence punishable by imprisonment, or to enforce a sentence of imprisonment (data on persons to be automatically identified); (751/2014) 3) information on maritime traffic and the location of vessels necessary for the performance of the duty of surveillance at sea laid down for the Border Guard; and information on the decisions, notifications and orders referred to in the Act on the Exclusive Economic Zone of Finland (1058/2004) necessary for the performance of the surveillance duties laid down for the Border Guard in that Act (surveillance data on maritime traffic and the exclusive economic zone); 4) information on the movements and location of persons and vehicles in the vicinity of the border necessary for the performance of the surveillance duty at the borders laid down for the Border Guard (surveillance data on the land and sea border); 5) to control entry into and departure from the country and to impose a financial penalty, necessary information on passengers and crew in cross-border passenger traffic, withholding of the information and imposition of the financial penalty (border traffic personal data); 6) to monitor and supervise periods of deprivation of liberty, to ensure safety of custody and to supervise compliance with the provisions on taking aliens into custody, necessary information on taking aliens into custody under the Aliens Act (301/2004) (data on aliens taken into custody); (479/2010) 7) information on the conduct of border checks necessary for the performance of border check duties and their recording (border check data); (479/2010) 8) information to be registered at border crossing points as referred to in Annex II of the Schengen Borders Code (data specified in Annex II of the Schengen Borders Code), unless the same is entered in another register. (479/2010) Section 10 Use of police personal data files in Border Guard duties (1230/2013) Provisions on the right of the Border Guard to record in police personal data files any necessary information gathered for the performance of the duties laid down for the Border Guard in the Border Guard Act or elsewhere in the law are laid down in section 14(1)(4) of the Police Personal Data Act. The Border Guard is responsible for accuracy of the information recorded in police personal data files and for legality of the recording and use of the information in its own activities. Section 11 Criminal Suspect Register of the Border Guard The Criminal Suspect Register of the Border Guard may contain criminal intelligence, surveillance and observation data concerning persons gathered for the performance of the duties referred to in Chapter 1, section 1(1) of the Police Act and laid down for the Border Guard in the Border Guard Act or elsewhere in the law when there is reason to suspect that these persons will commit or have committed an offence being investigated by the Border Guard which may be punishable by imprisonment, or will contribute or have contributed to an offence being investigated by the Border Guard which may be punishable by imprisonment for more than six months, or to unlawful use of narcotics. (876/2011)

7 Of the information on the identity of persons, the following data necessary for the purpose of the data system may be recorded in the Register: names, date of birth, personal identity code, sex, mother tongue, citizenship or lack thereof, nationality, home country, marital status, country of birth, municipality of birth, municipality of residence, profession, address and telephone number or other contact information, audio and visual recordings concerning the person as well as identification information based on the physical characteristics of the person, information on the death or declaration of death of the person, customer number issued by the authorities, names and address of parents of a foreign national, the travel document data of the person, his or her picture, other necessary information on entry and border crossing, as well as information necessary to identify a legal person. (1182/2013) The Criminal Suspect Register may be used only by border guards who are assigned to criminal intelligence, crime analysis and surveillance duties. The Border Guard Headquarters may also give access to the Criminal Suspect Register of the Border Guard to public officials employed by the Police, Customs or the Defence Forces who are assigned to criminal intelligence, crime analysis and surveillance duties. (1230/2013) Section 12 Security Data Register The Security Data Register may contain data the processing of which is necessary to perform the duties referred to in Chapter 1, section 1(1) of the Police Act and laid down for the Border Guard in the Border Guard Act or in the Act on Security Measures on certain Ships and in Ports serving them and on monitoring the Security Measures (485/2004), hereinafter the Maritime Security Act. (876/2011) Of the information on the identity of persons, the following data necessary for the purpose of the data system may be recorded in the Register: names, date of birth, personal identity code, sex, mother tongue, citizenship or lack thereof, nationality, home country, marital status, country of birth, municipality of birth, municipality of residence, profession, address and telephone number or other contact information, information on the death or declaration of death of the person, customer number issued by the authorities, names and address of parents of a foreign national, the travel document data of the person, his or her picture, as well as information necessary to identify a legal person. (1182/2013) Information other than the necessary information specified in subsection 2 obtained for the performance of the duties laid down for the Border Guard and referred to in subsection 1 may also be recorded in the Register as follows: 1) information necessary for the performance of the duties laid down for the Border Guard in the Maritime Security Act concerning notifications of security threats to ships and port facilities, security alerts, security incidents, control measures and coercive measures referred to in section 5 of that Act, and concerning technical monitoring under section 17 as well as other data necessary to arrange a contact point under section 5 (maritime security data); 2) information necessary for the performance of the duties laid down for the Border Guard in section 22 of the Border Guard Act concerning actions related to counter-terrorism and special situations and information concerning preparedness (data on counter-terrorism); 3) information necessary for border management from messages sent to the Border Guard by the authorities of the Baltic Sea littoral states operating in the field of the Border Guard (border control data of the Baltic Sea region);

8 4) information necessary for border management and international cooperation concerning the operation and composition of the authorities operating in the field of the Border Guard in other states, as well as contact information (contact information of border authorities); Paragraph 5 has been repealed by Act 1230/ ) information on the border situation in Finland and in the European Union (border situation data). Section 13 Right of use of the Security Data Register The Security Data Register may be used by border guards who are assigned to criminal intelligence, crime analysis and surveillance duties, as well as by border guards performing situation awareness and risk analysis duties. (479/2010) The controller may also give access to the Security Data Register to public officials employed by the Police, Customs or the Defence Forces who are assigned to criminal intelligence, crime analysis and surveillance duties as well as to public officials of the Finnish Transport Safety Agency assigned to tasks under the Maritime Security Act to the extent that these authorities have the right to receive information from the Border Guard. (1182/2013) Section 13a Register for Administration of Justice under Military Law (751/2014) The Register for Administration of Justice under Military Law is a permanent personal data file intended for nationwide use of the Border Guard. The Register may contain data the processing of which is necessary to investigate offences referred to in section 27 of the Act on Military Discipline and Combating Crime in the Defence Forces (255/2014). Of the information on the identity of persons suspected of an offence investigated by the Border Guard; or of persons subject to a criminal investigation carried out by the Border Guard or to a coercive measure; or of persons reporting an offence, witnesses, injured parties or persons otherwise connected with the matter, the following data necessary for the purpose of the data system may be recorded in the Register: names, date of birth, personal identity code, sex, mother tongue, citizenship or lack thereof, nationality, home country, marital status, country of birth, municipality of birth, municipality of residence, profession, military rank, place of service, employment and service history, address and telephone number or other contact information, information on the death or declaration of death of the person, as well as information necessary to identify a legal person. Other necessary information that is obtained in connection with applying the Act on Military Discipline and Combating Crime in the Defence Forces and needed to perform the investigation duties referred to in section 27 of the Act and to record and search information on them at the Border Guard may also be recorded in the Register as follows: 1) the number of the report of an offence or incident, time and place of the incident, reporting time, name of the offence or incident, period of limitation for prosecuting the most serious offence, investigating administrative unit, investigators, status of the investigation, lead investigator, disciplinary superior, decisions made to conclude the matter, as well as information on the outcome of the matter;

9 2) information on coercive measures and stages of the criminal investigation; 3) information on property that has been lost through an offence or that has been taken into possession to recover the property and return it to its owner or holder; 4) information on a person affecting his or her safety or the occupational safety of an official of the Border Guard; 5) information on other necessary descriptions, circumstances and details related to the Border Guard s criminal investigation duties, actions and incidents. The Register shall show the person who recorded the information. Section 13b Register for Disciplinary Decisions (751/2014) The Register for Disciplinary Decisions is a nationwide permanent personal data file of the Border Guard. The Register for Disciplinary Decisions is kept for recording and monitoring decisions in disciplinary matters resolved through the military discipline procedure, for reviewing earlier disciplinary decisions and for maintaining statistics on offences and punishments, as well as for recording decisions on matters tried as military court cases, including disciplinary punishments. Necessary information may be transferred from the Register for Disciplinary Decisions into the register of persons liable for military service as provided in the Conscription Act. Information to be recorded in the Register for Disciplinary Decisions includes information on decisions made in the disciplinary procedure, and, of the matters prosecuted and tried as military court cases, information on decisions made by the prosecutor and decisions made in the disciplinary procedure. Information to be recorded on decisions includes the name of the authority that handled the case, identification information on the case and the decision, the decision or information on the outcome in the matter, as well as information on whether the decision is final. In addition to the information referred to in subsection 2, information to be recorded in the Register on decisions made in the disciplinary procedure includes the information referred to in section 53 of the Act on Military Discipline and Combating Crime in the Defence Forces, as well as the following: 1) the time when the party concerned was notified of the decision; 2) information on appeals and relevant decisions; 3) inspection notes and measures necessitated by oversight of the disciplinary procedure; 4) information on the enforcement of the punishment. All persons under section 1 of the Act on Military Discipline and Combating Crime in the Defence Forces who have been suspects in the military discipline procedure are recorded in the Register. Of the information related to the identity of the data subject, the Register may include the following information: name, personal identity code, sex, mother tongue, citizenship, municipality of residence, and address. Chapter 2

10 Special provisions on processing personal data and the right to obtain information Section 14 Processing sensitive data The data specified in section 11, paragraph 3 of the Personal Data Act on a criminal act, punishment or other criminal sanction may be collected and recorded in the Border Guard personal data file when the processing of the data is necessary for the purpose of the data file. The data referred to in section 11, paragraphs 1 2 and 4 6 of the Personal Data Act on a person s race or ethnic origin, social, political or religious affiliation, trade-union membership, state of health, illness, disability or treatment, sexual behaviour or orientation, or need for social welfare, social welfare services, assistance or other social welfare benefits may be collected and recorded in a personal data file used by the Border Guard only when the processing of the data is necessary to perform an individual task of the Border Guard. The data referred to in section 11, paragraph 4 of the Personal Data Act on a person s state of health, illness, disability or treatment or other similar measures directed at him or her may be collected and recorded in the Border Guard personal data file when the processing of the data is necessary to ensure the safety of the data subject or the occupational safety at the Border Guard. Provisions on restrictions concerning the recording of DNA profiles are laid down in Chapter 9, section 4 of the Coercive Measures Act. (1230/2013) Section 14a Processing surplus information obtained through secret intelligence gathering methods (1230/2013) Provisions on the use of surplus information obtained through secret intelligence gathering methods referred to in Chapter 5 of the Police Act are laid down in Chapter 5, section 54 of the Police Act, and provisions on surplus information obtained by the covert coercive measures referred to in Chapter 10 of the Coercive Measures Act are laid down in Chapter 10, section 56 of the Coercive Measures Act. The surplus information referred to in subsection 1 may be recorded in the personal data files referred to in sections 7 and 11. Section 15 Processing information not related to an individual task Personal data obtained in performing an individual task of the Border Guard which are not related to that task but which are needed in another task which is likely to arise in future may be collected and recorded at the Border Guard only in the Investigation and Executive Assistance Register as observation data referred to in section 7(3)(3), in the Border Guard Criminal Suspect Register, in the Security Data Register, and in a temporary personal data file established for that purpose for the use of an administrative unit or working group. (1182/2013) When recording information, an assessment of the reliability of the source of the information and the accuracy of the information shall be attached to it, where possible. Section 16 An electronic identifier based on the physical characteristics of a person and its data security

11 To identify a person and verify the authenticity of a document, the Border Guard has the right, unless otherwise provided, to accept an electronic identifier which is based on the physical characteristics of a person and which is attached to a travel document. The Border Guard has the right to compare the identifier in the document with the person. When processing electronic identification information based on the physical characteristics of a person, special attention shall be paid to data security. An electronic identifier may not be recorded in a personal data file of the Border Guard unless otherwise provided. Section 17 Obtaining information from public authorities Notwithstanding the obligation of secrecy, the Border Guard has the right to obtain free of charge from a public authority, and a body or a person assigned to perform a public function any information and documents necessary to carry out an official duty unless disclosing such information or documents to the Border Guard or using such information as evidence is prohibited or restricted by law. The decision to obtain secret information is made by an official with the power of arrest. Section 18 Obtaining information from a private organisation or person At the request of a border guard with the power of arrest, the Border Guard has the right to obtain any information necessary to prevent or investigate an offence to be investigated by the Border Guard, notwithstanding business, banking or insurance secrecy binding on members, auditors, managing directors, board members and employees of an organisation. The Border Guard has the same right to obtain information needed in an investigation referred to in section 27 of the Border Guard Act if an important public or private interest so requires. In individual cases, the Border Guard has the right to obtain from a telecommunications operator and a corporate or association subscriber on request contact information on a network address that is not listed in a public directory or data identifying a network address or terminal end device if the information is needed to carry out Border Guard duties. Similarly, the Border Guard has the right to obtain postal address information from organisations engaged in postal services. (876/2011) For licence administration purposes, the Border Guard has the right to obtain information from private organisations and persons as provided in section 17. Section 19 Information on persons in a vehicle crossing the border (689/2009) Notwithstanding the provisions on secrecy of information, the Border Guard has the right to obtain from organisations and corporations information contained in registers concerning passengers and crew members of vehicles that is necessary to prevent and investigate offences to be investigated by the Border Guard and to submit cases to prosecutors for consideration of charges, and to ensure border management. This information may also be obtained with the aid of a technical interface as agreed with the controller. The driver of a vehicle entering or leaving the country and crossing the external border shall submit to the border control authorities of the point of entry or exit information on the persons in

12 the vehicle. The captain of a ship or an aircraft, and the owner or holder of a train or another means of transport, or their representative shall submit to the border control authorities of the point of entry or exit the passenger and crew list, or in some other manner information on the employees, passengers and other persons in the means of transport (passenger and crew list), unless the information has already been submitted under section 20 or 20a. This information may be disclosed with the aid of a technical interface. (751/2014) The passenger and crew list shall state the last and first name of each person entered in the list, their date of birth, sex and nationality as well as the nationality and registration information of the means of transport and the place of arrival and departure. Section 20 Obligation of a carrier to submit information on air passengers Besides the provisions in section 19, a natural person or a legal person whose profession it is to provide passenger transport by air (air carrier) shall submit to border control authorities, on their request, information specified in this section on passengers who they will carry to an authorised border crossing point through which these persons will enter or leave the territory of the Member States of the European Union (air passenger data). The air passenger data shall include the number and type of the travel document used, citizenship or lack thereof, full name, date of birth, the border crossing point of entry into or exit from the territory of the Member States, code of transport, departure and arrival time of the transport, total number of passengers carried on that transport and the initial point of embarkation. The data shall be submitted electronically or, if this is not possible, by any other appropriate means. The border control authorities may process the data referred to in this section and in section 19 to facilitate border checks, to combat illegal entry and illegal immigration and to attend to other duties laid down for them. The data shall be submitted immediately after the end of check-in. The border control authorities shall destroy the data within 24 hours from their submission after the arrival of the passengers or their departure from the country unless the data are needed for other statutory duties of the border control authorities. Unless otherwise provided, those who have submitted the data shall destroy the personal data they have obtained and submitted to the border authorities within 24 hours from the arrival at the destination of the means of transport. Section 20a Obligation of a carrier to submit information on passengers and crew in vessel traffic and rail transport (751/2014) A natural person or a legal person whose profession it is to provide passenger or goods transport by ship or by rail shall submit to border control authorities the data on passengers and crew referred to in section 19(2 3) prior to arrival to border checks. In rail transport, the data shall be submitted no later than when the train has departed the last station at which it has taken on passengers. The provisions of the Schengen Borders Code and other statutes apply to the obligation to submit information on vessel traffic in advance. Section 20a, which was added by Act 751/2014, comes into force on 1 January However, it will be applied as of 1 July 2015.

13 Section 21 Sanctions to be imposed on carriers (751/2014) Provisions on the financial penalty to be imposed on carriers who violate the obligation under sections 20 and 20a are laid down in section 179 of the Aliens Act. Section 22 Right of the Border Guard to obtain information from certain registers and information systems Besides the provisions in the Border Guard Act or in any other act, the Border Guard has the right, notwithstanding secrecy provisions, to obtain information from registers necessary to perform its duties and to maintain its personal data files as follows: 1) from the Vehicular and Driver Data Register referred to in the Vehicular and Driver Data Register Act (541/2003), information in accordance with sections of the Act; (1182/2013) 2) from the Charger Register referred to in section 3 of the Charger Act (219/2000), information for the purpose of surveillance and emergency duties and to prevent, investigate and detect crime; (1182/2013) Paragraph 3 has been repealed by Act 1182/ ) from territorial surveillance authorities, information from maritime information systems concerning the location of vessels necessary for the performance of the surveillance duty at sea laid down for the Border Guard; 5) from the Register of Ships, Register of Ships under Construction and Continuous Synopsis Record referred to in the Registers of Ships Act (512/1993), information on vessels and their owners and holders necessary for the surveillance of waterborne traffic, border management, criminal and other investigation, rescue duties, tasks referred to in the Maritime Security Act and for the imposition of a financial penalty on a carrier; 6) from the Register of Fishing Vessels referred to in the Act on Implementing the Common Fisheries Policy of the European Community (1139/1994) and the Register on Professional Fishers, Catch Register and Fish Trade Register which are connected to the Register of Fishing Vessels, information necessary for the surveillance of fishing and waterborne traffic, border management, criminal and other investigation, rescue duties, tasks referred to in the Maritime Security Act and for the imposition of a financial penalty on a carrier; 7) from the data system of the Criminal Sanctions Agency as laid down in the Act on the Processing of Personal Data by the Criminal Sanctions Agency (1069/2015), information on persons who are serving or who have served a sentence of imprisonment that is necessary to reach these persons; (1072/2015) 8) from aviation, fishing, maritime and rescue authorities and from the Police, Defence Forces, Customs and environmental authorities, information on vehicles, traffic, operational readiness of the authorities and their alerting necessary for border management, criminal and other investigation, rescue duties, and for the performance of the surveillance duty at sea or on the land border laid down for the Border Guard; 9) from the operating licence data systems of the Centres for Economic Development, Transport and the Environment and the Ministry of Transport and Communications, information necessary for

14 traffic surveillance, border management, criminal and other investigation as well as for the imposition of a financial penalty on a carrier; (1427/2009) 10) information on passengers referred to in section 6(1) of the Act on Accommodation and Catering Operations (308/2006) necessary to carry out border control, border checks and other duties laid down for the Border Guard by law; (1182/2013) 11) from maritime authorities, information on maritime traffic, its surveillance and the location of vessels from the ship reporting system, information systems of the guidance and information service of maritime traffic, information systems of the guidance and support service of ships, information systems of port traffic and other information systems of vessel traffic services necessary for the performance of the surveillance duty at sea laid down for the Border Guard; 12) for border management, criminal and other investigation, rescue duties, tasks referred to in the Maritime Security Act as well as for the imposition of a financial penalty on a carrier or an oil discharge fee, information on fines and their enforcement from the register of fines; information on criminal cases which are pending or have been pending before prosecuting authorities or a court from the national document and case management data processing system of the judicial administration's national information system, and information on judgments given in criminal cases and whether they are final, where available, from the judgment and decision notification system; (405/2010) 13) from the Trade Register maintained by the Finnish Patent and Registration Office, information on notifications and notices on entrepreneurs necessary for border management, criminal and other investigation and for the imposition of a financial penalty on a carrier; 14) from the personal data files of the Police and Customs, information for border management, prevention and detection of crime, criminal and other investigation, other Border Guard duties that correspond to the duties for the purpose of which the information was collected and recorded, and for other purposes in cases under section 25(1); (1182/2013) Paragraph 15 has been repealed by Act 1182/2013. Paragraph 16 has been repealed by Act 1182/ ) from the information systems of the Ministry for Foreign Affairs, information on members of the staff of diplomatic and consular missions representing their sending state in Finland, bodies of international organisations in Finland and international bodies in similar positions as well as members of their families and persons privately employed by these persons for effective border management, criminal and other investigation and for the performance of duties laid down for the Border Guard in the Aliens Act; (1182/2013) 18) from the information systems of the Finnish Immigration Service, information on matters concerning travel documents, visas, residence, international protection, removal from the country, prohibition of entry and citizenship for border management, criminal and other investigation as well as for the performance of duties laid down for the Border Guard in the Aliens Act; (1182/2013) 19) from the Vessel Register referred to in the Vessel Register Act (424/2014) and the Leisure Boat Register of the Åland Islands, information on boats and their owners and holders necessary for the surveillance of waterborne traffic, border management, criminal and other investigation,

15 rescue duties, tasks referred to in Maritime Security Act and the imposition of a financial penalty on a carrier; (425/2014) 20) from an authority requesting executive assistance, information necessary to provide the executive assistance; 21) from the population information system, information laid down in sections of the Act on the Population Information System and the Certificate Services of the Population Register Centre (661/2009); (1230/2013) 22) from the emergency response centre data system, information necessary for the safety of a person or the occupational safety of an official of the Border Guard to carry out a statutory duty of the Border Guard; such information may be disclosed with the aid of a technical interface. (1230/2013) The Border Guard shall, upon request, submit information on the processing of data obtained under subsection 1 to the relevant controllers. If personal data have been disclosed without a request, the Border Guard shall immediately verify whether the data are needed for the purpose for which they were disclosed. (1182/2013) Section 23 Disclosure of data to the Border Guard by means of direct-use recording (1182/2013) The Border Guard may grant the right to record data to be disclosed to it in direct-use in the personal data file maintained by the Border Guard to: (1182/2013) 1) judicial administration, Criminal Sanctions Agency and Prison Service authorities and to the Legal Register Centre; 2) police, customs and military authorities; 3) foreign affairs administration authorities; (479/2010) 4) the Ministry of Employment and the Economy. (479/2010) The Border Guard shall, upon request, submit information about the processing of data obtained under subsection 1 to the relevant controllers. If personal data have been disclosed without a request, the Border Guard shall immediately verify whether the data are needed for the purpose for which they were disclosed. (1182/2013) Chapter 3 Use and disclosure of data Section 24 Use of data for purposes for which they have been collected and recorded (1182/2013) Nationwide personal data files of the Border Guard may be used by the administrative units of the Border Guard unless otherwise provided. A personal data file of the Border Guard other than the nationwide personal data file may be used only by the administrative units or working groups for which the data file has been established unless otherwise provided.

16 Unless otherwise provided, data in a personal data file established for the performance of the duties of the Border Guard referred to in Chapter 1, section 1(1) of the Police Act or data in a police data file assigned to be used directly by the Border Guard may be used at the Border Guard if the data are necessary for the performance of Border Guard duties referred to in Chapter 1, section 1(1) of the Police Act. Unless otherwise provided, data in a personal data file established for the performance of Border Guard duties referred to in Chapter 1, section 1(2) of the Police Act or data in a police data file assigned to be used directly by the Border Guard may be used at the Border Guard if the data are necessary to perform the duty for which the data have been collected and recorded. (876/2011) Section 25 Use of data for purposes other than for which they have been collected and recorded (1182/2013) Data in a personal data file of the Border Guard may be used for other purposes than for which they have been collected and recorded if this is necessary to: 1) ensure State security; 2) avert an immediate and serious danger to public safety and security; 3) prevent or investigate an offence which may be punishable by imprisonment; 4) establish identity when performing an individual task of the Border Guard which absolutely requires the establishment of identity; 5) decide on or submit a statement on the granting or validity of a permit if the granting of the permit or its validity is subject to the reliability, suitability or other such characteristic of the permit applicant or holder the assessment of which requires information on the state of health, use of intoxicants, criminal act or violent behaviour of the permit applicant or holder. Data in a personal data file of the Border Guard may be used in control of legality, research, planning and development activities. Such data may also be used in training activities if the data are essential for carrying out the training. The observation data referred to in section 7(3)(3) and the data in the personal data file referred to in section 11 may not be used for the performance of the duties referred to in subsection 1, paragraph 5 above. Section 26 Disclosure of data to another administrative unit of the Border Guard for purposes for which they have been collected and recorded (1182/2013) Notwithstanding secrecy provisions, an administrative unit may disclose to another administrative unit data in a personal data file established for a more limited use than nationwide use of the Border Guard to perform the duties referred to in Chapter 1, section 1(1) of the Police Act and laid down for the Border Guard if the data are necessary to perform the Border Guard duties in question. Data referred to in section 15 may, however, only be disclosed if the data are necessary to: 1) ensure State security;

17 2) avert an immediate and serious danger to public safety and security; 3) prevent or investigate an offence which may be punishable by imprisonment; 4) prevent and investigate crime falling within the competence of the European Police Office, or some other serious crime. Notwithstanding secrecy provisions, an administrative unit may disclose to another administrative unit data in a personal data file established for a more limited use than nationwide use of the Border Guard to perform the duties referred to in Chapter 1, section 1(3) of the Police Act and laid down for the Border Guard if the data are necessary to perform the duty for which they have been collected and recorded. Data may also be disclosed with the aid of a technical interface or as a set of data. Section 27 Disclosure of data to another administrative unit for purposes other than for which they have been collected and recorded (1182/2013) Notwithstanding secrecy provisions, an administrative unit may disclose to another administrative unit data in a personal data file of the Border Guard established for a more limited use than nationwide use for similar purposes other than for which the data have been collected and recorded if the data are necessary to: 1) ensure State security; 2) avert an immediate and serious danger to public safety and security; 3) prevent or investigate an offence which may be punishable by imprisonment; 4) establish identity when performing an individual task of the Border Guard which absolutely requires the establishment of identity; 5) decide on or submit a statement on the granting or validity of a permit if the granting of the permit or its validity is subject to the reliability, suitability or other such characteristic of the permit applicant or holder the assessment of which requires information on the state of health, use of intoxicants, criminal act or violent behaviour of the permit applicant or holder. Data referred to in section 15 in a temporary personal data file established for a more limited use than nationwide use may not, however, be disclosed to perform the duties referred to in subsection 1, paragraph 5 above. Data in a personal data file of the Border Guard may, notwithstanding secrecy provisions, also be disclosed for use in control of legality, research, planning and development activities. Such data may also be disclosed for use in training activities if the data are essential for carrying out the training. Data may also be disclosed with the aid of a technical interface or as a set of data. Section 28 Disclosure of data to other authorities (1182/2013)