tietosuojalaista

Tietosuojalaista is the Finnish term for the country's privacy legislation, which regulates the protection of personal data and governs how personal information may be collected, processed, stored, and transferred. The law is grounded in the EU General Data Protection Regulation (GDPR) and has been implemented in Finland through the Act on the Protection of Personal Data (Tietosuojalaite) enacted in 1999 and subsequently amended in 2001, 2003, and 2006 to align with EU directives and later, the GDPR.

Key provisions of the law provide individuals with rights to access, rectify, erase, or restrict the processing of their personal data. Organisations must obtain lawful bases for processing, such as consent, contractual necessity, or legitimate interest, and must implement appropriate technical and organisational safeguards to protect data. The law also imposes obligations on data controllers and processors, including mandatory reporting of data breaches to the supervisory authority, the Finnish Data Protection Authority (Tietosuojavaltuutettu), within 72 hours of becoming aware of a breach.

The Act established the Finnish Data Protection Authority, an independent supervisory body responsible for monitoring compliance, handling complaints, granting approvals for certain data processing operations, and issuing fines. The authority can enforce the law by imposing penalties that may reach up to €20 million or 4 % of a company's global turnover, reflecting the EU-level sanctions under the GDPR.

Since the GDPR came into force, the Act has been regularly updated to reflect changes in technology and jurisprudence, ensuring that Finland remains compliant with EU standards while addressing national concerns about privacy, data security, and the balance between personal rights and public interests.