EU warns Finland on personal tax data

The European Commission today warned Finland that its data protection law may be breaking EU rules. Finnish taxpayers’ personal data is available to the public and is being collected by businesses for sale as special publications, CDs and text messages.

Finnish data protection rules do not cover personal data that has been made public in the media. Under EU rules, personal data may only be collected for legitimate purposes, and may only be further processed for the specific purposes for which it is was collected. In a letter of formal notice – the first stage in the infringement process – sent today, the Commission asked Finland for more information on how it will ensure that personal tax data is protected, as required by EU rules.

"Personal data collected by public authorities should not be collected selectively and sold by private companies for personal gain," said Vice-President Viviane Reding, Commissioner for Justice, Fundamental Rights and Citizenship. "Transparency is very important, but it can be counter-productive if it is abused and undermines our right to privacy. I hope that Finland will fix its rules so that taxpayers’ personal data is protected."

The Commission today warned Finland that the Finnish legislation on personal data does not fulfil the requirements of EU law – the 1995 Data Protection Directive (Directive 95/46/EC) – because it does not protect personal tax data published in the media.

In Finland, personal tax data published in the media is not protected by data protection rules. This is because the Finnish law implementing EU data protection rules – does not apply to personal data published by the media in its entirety and without changes. In Finland, personal tax data is public information, making it easier to use for commercial purposes.

The EU Data Protection Directive allows national laws to have some exemptions, such as for security reasons (Article 13 of the Directive) or for journalistic purposes (Article 9).

The European Court of Justice (ECJ) and Finnish Supreme Administrative Court have already confirmed that the exemption allowed by the Finnish Personal Data Act does not conform with the exemptions allowed under EU rules.

On 16 December 2008, the ECJ, responding to a request from the Finnish court, ruled that the collection and sale of personal tax data did not constitute a journalistic purpose and was therefore not covered by the derogation in Article 9 of the EU Data Protection Directive.

Although on 23 September 2009 the Finnish Supreme Administrative Court confirmed the ECJ’s decision, Finland has not yet notified the Commission about how it plans to amend its legislation to comply with the EU Data Protection Directive.

Background

EU data protection rules (Directive 95/46/EC) set out general principles on peoples’ privacy rights when their data is processed. The rules state that people must be informed about data collection and processing and they must give specific consent for their data to be used.

The rules governing infringement procedures are set out in under Article 258 of the Treaty on the Functioning of the European Union.