Data protection

According to section 7 of the Act on the Processing of Personal Data in the Immigration Administration, the Finnish Immigration Service processes

• personal data identifying the person, 
• family relationship information, 
• data on representatives, 
• information describing skills and 
• contact details, and 
• information on travel documents and the card for a pending application pursuant to section 96 of the Aliens Act (301/2004).

When justified for the purposes of the case, the Finnish Immigration Service will process:

1. information arising from an application, request, request or notification or from an enquiry or consultation made in pursuance thereof;
2. information on the proceedings, findings and decisions;
3. information concerning reception services and other reception activities, the identity and contact details of the representative, information concerning the appointment, removal and termination of the representative's mandate, and information necessary for the guidance, planning and supervision of the representative's activities;
4. information on when the foreign national has been placed in the detention facility and when he/she has left the facility, information to ensure the organisation, planning, implementation, monitoring and proper treatment of aliens in detention, as well as information on visitors to the detained alien and other persons visiting the detention facility and other information related to the visit or visit;
5. information on the municipality to which the person is allocated.

The Finnish Immigration Service may also process any observations that it has discovered or been informed of which, due to the circumstances or the person's behaviour, may reasonably be considered to relate to the competence of the Finnish Immigration Service to monitor the conditions of entry and residence of a person, to decide on the acquisition and loss of Finnish citizenship or to the obligation to ensure the safety of persons in its employment. The comments must be accompanied by information on the provider or source of the data and an assessment of the reliability and accuracy of the data. The Finnish Immigration Service does not use the information in the comments as a basis for its decisions.

The Finnish Immigration Service also processes personal data of the applicant's family members, persons living in the same household and recipients in Finland, as well as personal data of the person who employs the foreign worker.

The Finnish Immigration Service processes data belonging to special categories of personal data only if the processing is necessary for the purposes for which it is intended. Such data indicates person's racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or concerns a person's health, sexual orientation or behaviour, or is genetic and biometric data for the purpose of identifying a person.
The Finnish Immigration Service also processes applications for residence permits, residence cards and residence cards for family members of Union citizens, as well as fingerprints taken for alien passports and travel documents for refugees. 

The Finnish Immigration Service also processes the data stored in the case management system for immigration affairs for purposes other than the original purpose of processing, if the data are necessary for the performance of the statutory tasks of the Finnish Immigration Service, as separately provided by law.

Personal data will also be disclosed to other authorities for the performance of the authority's statutory task to the extent specified in the law, if the recipient has a statutory right to receive such data from the Finnish Immigration Service.

Personal data will be transferred to third countries or international organisations only to the extent permitted by law.

Subject to the provisions on confidentiality, the Finnish Immigration Service shall disclose personal data to the common information systems of the European Union established by the Regulations adopted pursuant to Chapter 2 of Title V of the Treaty on the Functioning of the European Union in accordance with the provisions of those Regulations.

Subject to an international obligation or the law, personal data processed on the basis of the Immigration Service Personal Data Act should be deleted as follows:

1. the customer number, name, date of birth, personal identity code, foreign identity number, any other code or number issued to identify a foreign person, nationality and the person’s family connections should be deleted from a person’s identification data ten years after they have died, or have acquired Finnish citizenship, or the details of matters relating to that person have been deleted;
2. personal data other than those referred to in paragraph 1 and data relating to personal matters shall be erased at the latest five years after the end of the right of residence or the last entry of data in the last pending case;
3. special categories of personal data are deleted as soon as they become unnecessary to keep;
4. remarks are deleted when six months have passed since they were recorded.

With regard to reception activities and assistance to victims of human trafficking, the Finnish Immigration Service and the reception centres and detention units under the authority of the Finnish Immigration Service act as controllers in the reception's patient register and payment card register in addition to the case management system for immigration affairs (later UMA). In addition to the above, the Finnish Immigration Service's reception centres and detention facilities have recording security cameras, a visitors' register and possibly other systems or registers where personal data are processed on the basis of the statutory tasks of the reception centre and detention facility.

In practice, the processing of personal data relates to the organisation, planning, implementation, monitoring and control of accommodation, reception and subsistence allowances, social and health services, work and study activities and other reception-related activities. The data may also be processed for the planning, organisation, implementation, statistics, monitoring and control of the reception of asylum seekers. Data can be processed both electronically and manually on paper.

All persons registered with the reception centre and detention unit and admitted to the assistance system for victims of trafficking in human beings who apply for and receive healthcare services are registered in the patient register. In the patient register, personal and patient data are processed in connection with initial health checks and other health-related healthcare interventions carried out by the reception centre/detention centre operator or by a healthcare service provider on its behalf (so-called "outsourcing"). The data may also be processed for the planning, organisation, implementation, statistics, monitoring and control of healthcare activities.

The patient records referred to in section 12 of the Act on the Status and Rights of Patients (785/1992) are stored in the patient register at the reception. The data to be stored in medical records and the periods for which they are to be kept are governed by the provisions of section 12 of the said Act and the provisions issued pursuant thereto.

In addition to the reception centres of the Finnish Immigration Service, other reception centres also operate within the reception function, each of which is responsible for keeping records of the data they store as a data controller. For information on the processing of personal data and data protection in these organisations, please contact each controller.

The reception centre will initially receive the personal data from the authority that received the asylum application. At the reception centre, personal data are processed in different information systems and are completed at different stages of the reception process. If a client moves from one reception centre to another, the new centre will receive the personal data from the previous centre and the processing of personal and patient data will continue at the new centre.

Privacy policy on the processing of personal data in reception activities (pdf)
Privacy policy on the processing of personal data by representatives (pdf)
Privacy policy on the payment card register (enfuce.com)
Processing of personal data in reception services information (pdf) (in Finnish)

Privacy policy on the processing of personal data in detention (pdf)
Privacy policy on the processing of personal data by representatives (pdf)
Privacy policy on the patient register (pdf)
Privacy policy on the payment card register (enfuce.com)

The purpose of the feedback form is to receive feedback, ideas and suggestions. The form tells customers that the feedback will not include any personal data about the person giving the feedback. Feedback can also be sent anonymously.

The Finnish Immigration Service processes personal data on the basis of Article 6(1)(a) of the GDPR. The data subject has given their consent to the processing of their personal data.

Feedback is stored in the Webropol application.

The data stored in the application includes:

• feedback from the customer,
• feedback entered into the system on behalf of the customer; and
• any personal data provided by the customer in their feedback (name, date of birth, personal identification number, e-mail address, telephone number, customer number)

Only the data that the user chooses to provide when giving feedback is stored in the system. If you wish, you can also provide feedback anonymously. In addition, feedback given over the phone or at the customer service desk can be entered into the system by the customer service agent on behalf of the customer.

Data retention period: The data are kept in the database of the information systems for the time necessary for operations and reporting. However, the personal data will be deleted at the latest one year after the date of storage. 

The Finnish Immigration Service processes personal data for the purpose of carrying out customer and stakeholder communications and surveys for the Finnish Immigration Service. 

We process personal data on the basis of Article 6(1)(a) of the GDPR. The processing of personal data are based on the customer's consent.

Saved data: All data to be stored is obtained from the data subject.

Disclosure of data: As a rule, no data are disclosed to entities outside the Finnish Immigration Service. In addition, the data will not be transferred outside the EU or EEA, nor to international organisations.

Data retention period: The data will be deleted from the register at the request of the person concerned or when there is no longer a legitimate reason to keep it. The content and timeliness of the register is checked at least every three years. 

Privacy policy for customer and stakeholder communications and surveys (pdf)

Purpose and legal basis of the processing of personal data

The purpose of the processing of personal data in this register is customer services and guidance. When a customer contacts the customer guidance services by phone, the customer is informed at the beginning of the phone call that the call will be recorded. You can also contact the helpdesk by e-mail.

The Finnish Immigration Service uses the data in the register for planning and developing its services and service channels, as well as for securing the quality and controlling the legality of guidance.
The management, persons responsible for reporting and system administrators have access to all personal data stored. Officials only have access to the recordings of the calls they have personally handled.

The processing of customer calls and the identification of callers in connection with disclosure of data are based on Article 6(1)(c) of the General Data Protection Regulation (EU 2016/679).

Categories of personal data

The data stored in the register constitutes personal and company data provided by the customer themselves and those created in connection of guidance provision.

For incoming and outgoing communications to the Finnish Immigration Service and for communications handled by the service, the following personal identification data are registered:

• The caller’s telephone number or e-mail address
• The name and telephone number of the official or service e-mail address

The calls are recorded automatically and in their entirety. The data content consists of information provided by the customer, and may include, for example,

• name,
• date of birth, 
• personal identity code,
• customer number or case number,
• citizenship,
• language of contact,
• address information, 
• telephone number, 
• e-mail address, 
• housing details, 
• family details,
• information about other service and customer transactions.

The data may include special categories of personal data, including the following personal data:

• data revealing racial or ethnic origin
• data on political opinions
• data concerning religious of philosophical beliefs
• data on trade union membership
• data concerning sex life or sexual orientation
• data concerning health
• genetic data
• biometric data.

The recording of a call begins when a Finnish Immigration Service officer answers the call or makes a phone call to a customer. The recording ends when the phone call ends.

Sources of data

The data is acquired from the caller or the customer over the phone.

Recipients of personal data

As a rule, no data is disclosed to entities outside the Finnish Immigration Service.

Transfer of personal data outside the EU/EEA

No data is transferred outside the EU or the EEA or to international organisations.

Retention period of personal data

The call recordings are stored for one (1) year from their recording. E-mails are stored for six months from receipt. The deleted information is erased using appropriate methods.

The purpose of the processing of personal data contained in this register is to enable making appointments at an Immigration Service Point, to make an appointment providing guidance and contacting the customer for appointments and planning and managing the scheduling and management of officers' appointments.

The Finnish Immigration Service uses the data in the register to serve customers and in the design and development of services and an access channel. In accordance with Article 6(1)(c) of the General Data Protection Regulation (EU 2016/679), the processing is based on the controller's legal obligations. The controller's legal obligation is based on the following regulations:

• Aliens Act (301/2004)
• Nationality Act (359/2003)
• Act on the Processing of Personal Data in the Immigration Administration (615/2020)

Categories of personal data

The following are registered in the Finnish Immigration Service's appointment system the identification of persons:

• Name
• Nationality
• Date of birth
• Gender
• Contact information (either phone number or email address)
• The branch the customer visited
• Type of appointment
• Name, office and email address of the officer

The data content also includes information provided by the time person making the appointment, which may include for example, the identification data of a person:

• Customer number
• Personal identification number
• Telephone number of the officer and the reason for the absence

The data may also include other information provided by the person on his or her own initiative personal data.

Sources of data

The data are obtained from the customer via the online service.

The data on the officer is obtained from persons in managerial positions within The Finnish Immigration Service.

Recipients of personal data

As a rule, no data is disclosed to entities outside the Finnish Immigration Service.

Transfer of personal data outside the EU/EEA

The Finnish Immigration Service does not transfer data from this register outside the EU/ETA.

Retention period of personal data

The personal data processed will be retained for one (1) year after their entry. Deleted data will be archived/destroyed with appropriate methods.

Every year, the Finnish Immigration Service requests the Digital and Population Data Services Agency to extract from the Population Information System data on persons registered as Finnish citizens aged 18 or over in the year in question for whom the Population Information System has an address where the person can be contacted. Persons who have had a municipality of residence in Finland for a total of at least seven years are not included in the sample. The person whose data has been obtained by this extraction will be instructed on how to proceed in order to retain Finnish citizenship when he or she reaches the age of 22. The instructions are issued in the year in which the person turns 18.

The Finnish Immigration Service processes personal data both for the purpose of informing about the retention of citizenship and for the purpose of informing about the circumstances under which a person loses Finnish citizenship directly by law on reaching the age of 22.

The processing is based on compliance with a legal obligation pursuant to Article 6(1)(c) of the GDPR. This task is laid down in section 37, subsection 2 of the Nationality Act, which obliges the controller to inform about the threat of losing Finnish citizenship and the possibility of retaining it. 

Data to be processed

For the purpose of informing persons, the Finnish Immigration Service processes the following personal data: 

• personal identity code, 
• name, 
• the code of the population register authority
• your address in Finland or abroad (permanent, temporary or postal address), 
• the latest migration dates,
• the possible start and end dates of the different addresses, and
• native language.

The Finnish Immigration Service processes separately the data of persons with and without an address data security ban.

Disclosure of data

The data will not be disclosed outside the Finnish Immigration Service. In addition, the data will not be transferred outside the EU or EEA, nor to international organisations.

Data retention period

Personal data will be properly destroyed after the sending of customer letters. 

The Finnish Immigration Service's newsletters may be subscribed to directly from the website to your e-mail. By subscribing to the newsletter, the customer gives permission to store his/her contact details for the purpose of sending the newsletter. The data are entered into the Finnish Immigration Service's information system or entered by the staff of the Finnish Immigration Service.

The purpose of the press release distribution list is to distribute press releases and event invitations from the Finnish Immigration Service by e-mail to the media and other persons who have subscribed to the press releases. The collected contact information can also be used for other communications from the Finnish Immigration Service. The communication is based on the consent of the individual.

We process personal data on the basis of Article 6(1)(a) of the GDPR. The processing of personal data are based on the customer's consent.

Saved data

The following customer data are stored in the distribution list for press releases:

• name of the subscriber 
• the organisation represented by the subscriber, if provided 
• subscriber's email address

Disclosure of data

The data will not be disclosed outside the Finnish Immigration Service. The data will not be transferred to a third country or international organisation.

Data retention period

The data will be deleted from the register at the request of the person concerned or when there is no longer a legitimate reason to keep it. The content and timeliness of the press release distribution list is also checked every three years.