Due to a human error, personal and earnings payment data were transferred to one of Incomes Register's guidelines


On 5 December 2019, the Incomes Register detected that one of the technical guidelines on the incomesregister.fi website contained an error. An example written in code, containing actual personal and earnings payment data instead of artificial data, had ended up in the guidelines document. The data concerned a single wage payment transaction of 384 employees of a single employer.

The document containing personal data was deleted from the website immediately upon discovering the error. Technical examples are meant for application developers of payroll administration and normally the examples utilise artificial personal identity codes and income data. In this situation, the example accidentally contained actual personal data.

The mistake was caused by a human error. The document had been downloaded from 53 addresses before it was deleted. The document had been on the website for about five months.

– The publication process of the Incomes Register's guidelines on the website has now been reviewed and made even stricter. The error occurred in the making of one of the xml-format guidelines. Therefore, the error has nothing to do with reporting or the Incomes Register system itself, says Terhi Holmström, Director of Incomes Register Unit.

The Incomes Register will contact the persons concerned

Information in the Incomes Register system is highly secured. In this case, the record containing personal data was undergoing manual troubleshooting when its details accidentally ended up in the guidelines example. The Incomes Register will contact by letter each individual whose information was included in the example. The employer in question has also contacted the persons concerned.

­– We take this situation extremely seriously and sincerely apologise for it. We take full responsibility for the situation. We will conduct a thorough investigation to find out how the error occurred and will make sure that such a mistake will never happen again. We have notified the Data Protection Ombudsman, Terhi Holmström says.

The Incomes Register asks everyone who downloaded the document to delete it immediately

  • The document containing the error was titled Tekninen rajapinta – ZIP – Sovelluskehittäjälle 2020 (zip), 27.6.2019, versio 1.0 / (Technical interface – ZIP file for application developers 2020 (zip), 27 June 2019, version 1.0)