Description of the processing of personal data in the AI-assisted voicebot of the Tax Administration's service numbers for individual taxation
Description of data processing in accordance with Articles 13–14 of the EU General Data Protection Regulation (2016/679)
This description depicts how the Tax Administration processes personal data in the AI-assisted voicebot that is used in the telephone service for individual taxation. The voicebot is used in certain service numbers. A taxpayer who calls such a number can choose if they want to communicate with a voicebot in certain situations or if they would rather communicate with a taxpayer advisor. So far, the voicebot is used in the following cases:
Voicebot for tax cards: The voicebot helps customers with simple and limited matters regarding tax cards. A taxpayer who calls the tax card service number can choose whether they want to talk to a voicebot. If they choose this option, the call will be transferred to a voicebot to which this despcription of data processing applies. The taxpayer can return to the phone service queue at any time.
Voicebot for general advice concering tax credit for household expenses: The voicebot provides general advice on the topic of tax credit for household expenses. When a taxpayer calls the service number for individual income taxation and their question concerns a tax credit for household expenses, they can choose whether they want to talk to a voicebot. If they choose this option, the call will be transferred to a voicebot to which this despcription of data processing applies. The taxpayer can return to the phone service queue at any time.
| 1. Controller |
The Finnish Tax Administration |
|---|---|
| 2. The contact information of the Data Protection Officer at the Tax Administration |
The Finnish Tax Administration |
| 3. Name of the description of data processing | Description of the processing of personal data in the AI-assisted voicebot of the Tax Administration's service numbers for individual taxation |
| 4. Purposes of the processing of personal data |
Voicebot for tax cards: The tax card bot helps the taxpayer to make certain changes to their tax card. First, the voicebot identifies the taxpayer, and then it guides the conversation and collects the information needed for the tax card from the taxpayer. The voicebot operates on rule-based logic. The bot converts the taxpayer’s speech into text, processes the text based on predefined criteria, and generates text-based questions and answers that it then converts into speech to present to the taxpayer. Personal data is processed in order to identify an individual taxpayer (data subject) and to issue a tax card. Personal data is also processed for the purposes of developing the service, quality assurance and investigating error situations. Voicebot for tax credit for household expenses: The voicebot for general guidance on individual taxation gives advice on matters related to the tax credit for household expenses. The voicebot receives the taxpayer’s question in the form of speech, converts it into text, searches for the answer in the official material of the Tax Administration and converts the answer into speech, which it then presents to the taxpayer. The voicebot does not record actual speech and cannot identify an individual person. The voicebot does not make interpretations, so in unclear or otherwise difficult cases it will direct the taxpayer to a taxpayer advisor. In addition, personal data is processed for the purposes of developing the service, quality assurance and investigating error situations. |
| 5. Legal grounds for the processing |
The legal basis for the processing of personal data is primarily the fulfilment of the controller’s legal obligation and the exercise of public authority. These are based in particular on the following provisions:
|
| 6. Categories of personal data |
The tax card voicebot processes the following categories of personal data:
The voicebot for the tax credit for household expenses processes the following categories of personal data:
|
| 7. Regular sources of data |
The data is obtained from the data subject. In the case of the tax card bot, the data is also collected in connection with the preparation of the tax card. |
| 8. Regular disclosure and transfer of data, and the processors of data |
The system suppliers, service providers and contracting partners used by the Tax Administration act as processors of personal data. |
| 9. Regular disclosure and transfer of data outside the EU or the European Economic Area | No data is disclosed outside the EU or the European Economic Area. |
| 10. Information storage periods |
The voicebot software keeps processed data in storage for a 30-day period. After that, an automatic process will delete the data. Regarding information directly related to taxes, the period of storage of personal data falls under the rules that govern the time limits set for the assessment process, tax control, appeal periods, appeal process, and the collection of unpaid taxes. In general, the length of the storage period is 12 years, counting from the end date of the tax year or the reportable tax period that the information concerns (for example information concerning a tax return or a tax decision). However, the storage periods depend on the tax type and on the matters that are processed. It is therefore possible that the information is stored for longer than 12 years. In addition, exceptions to the lengths of information storage periods may occur in connection with the lodging of appeals, collection of unpaid taxes, and the investigation of tax crimes. Storage of information is also carried out for archiving purposes in the public interest. This type of storage is subject to the official decisions on screening issued by the National Archives. Call data is retained for a maximum of one hour and then deleted or anonymised. |
| 11. Data protection principles |
The data is stored in electronic format in a system that requires access rights. Only the employees assigned to the task have access to the data. They are required to enter in their user ID and password. The data is only processed by people whose work entails data processing. All employees who process data have a security clearance (in reference to the Security Clearance Act (726/2014)). |
| 12. Automated decision-making, including profiling |
The voicebot does not perform appraisals, profiling or awarding of points with regard to individuals. The software does not contain any automatic processes that would analyse or categorise its users. Personal data is not used to create user profiles. No automatic decision-making – which would have legal impact or other significance from the individual’s perspective – is associated with the functionalities of the voicebot. The voicebot’s purpose is to give guidance and issue tax cards based on the information provided by the data subject. The voicebot does not make automated decisions concerning users without human participation, including checks and verifications conducted afterwards. The decision-making is always based on the data provided by the data subject and on the public authority’s evaluations. The personal data provided is not used for automated decision-making. |
| 13. Your rights |
(1) Right of access by the data subject (Article 15) You have the right to obtain confirmation from the controller as to whether or not your personal data is being processed. If your personal data is processed, you can ask for copies of your information. As for the systems you do not have access to, you can request to inspect the data here. Exception: Under Section 31, Subsections 2 and 3 of the Whistleblower Act (Laki Euroopan unionin ja kansallisen oikeuden rikkomisesta ilmoittavien henkilöiden suojelusta (1171/2022)), a data subject’s access rights to data that are normally safeguarded by Article 15 of the GDPR are subject to restrictions when the Whistleblower Act is invoked. These restrictions can be imposed if they are deemed necessary and appropriate for the purpose of clearing up the facts included in a whistleblowing report that contains personal data, or for the purpose of protecting the identity of the whistleblower. You will be given the reasons for the restriction, and you are entitled, as referred to in Section 34, Subsections 3 and 4 of the Data Protection Act, to ask for delivery of the related data to the Data Protection Ombudsman. (2) Right to rectification (Article 16) You have the right to ask the controller to rectify, without undue delay, any incorrect or inaccurate personal data that concerns you. You have the right to have incomplete personal data completed by means of providing a supplementary statement. The public authority will take into account the purposes of data processing when making its decision regarding the incompleteness of the data and the related needs for supplementing it. (3) Right to restriction of processing (Article 18) In certain situations, you have the right to request that the controller restrict the processing of your data. To invoke this right would become relevant in a situation where an individual, whose personal data is processed by the employees of the Tax Administration, is in disagreement with the accuracy of the saved data. To invoke this right is possible only for the length of time that it takes the public authority to rectify the data. Exception: Under Section 31, Subsection 1 of the Whistleblower Act, a data subject’s right to restriction of processing, normally safeguarded by Article 18 of the GDPR, is not applicable to personal data within the meaning of the Whistleblower Act. |