Information on the Incomes Register information system
The purpose of the processing of personal data
The Incomes Register, which will be introduced in 2019, is a national electronic database. It contains comprehensive wage, pension and benefit data at individual level. The purpose of the Incomes Register is to receive and store income and other, related data reported by the payers and to pass such data onto data users for the purposes referred to in section 13 of the Act on the Incomes Information System. The Incomes Register will be introduced in stages on 1 January 2019 and 1 January 2020.
Stakeholder testing of the incomes information system will begin on 1 March 2018. Genuine personal data will not be used in stakeholder testing. The Incomes Register Project will generate fictitious customer data for use by stakeholders during testing. In addition to the data generated by the Incomes Register Project, for test purposes stakeholders may use their own test customers, rendered anonymous in accordance with Appendix 7 of the stakeholder testing plan. Because this is the testing environment of a system under development, test records used for testing may not contain production data. (The EU's General Data Protection Regulation, Articles 25 and 32).
During the Incomes Register Project, contact information will be collected and stored by the project for the purposes of various advisory and communications tasks. These include the following:
- Stakeholder testing of the Incomes Register requires a testing agreement and acceptance of the terms and conditions for using the testing environment. In the testing agreement, the testing party will indicate the contact person for testing and the technical contact person within the organisation he/she represents.
- Newsletters and project bulletins providing guidance and advice for customers. Due to the authorities' obligation to provide guidance and advice, the Incomes Register Project only collects the address data of individuals who have subscribed for the newsletter. The newsletter subscription may be cancelled at any time. This address data will not be used for any other purposes.
The controller of the personal data file maintained for the purposes of the incomes information system will be the Finnish Tax Administration’s Incomes Register Unit.
The Finnish Tax Administration is the controller of the personal data file maintained for activities related to the Incomes Register Project.
Incomes Register information system
The Finnish Tax Administration's Incomes Register Unit will maintain the incomes information system, to be deployed on 1 January 2019. Together with the Finnish Tax Administration, the unit will be responsible for the performance and information security of the Incomes Register forming part of the system.
The Finnish Tax Administration's Incomes Register Project collects, records and processes personal data at the implementation stage of the incomes information system. Personal data provided for these purposes is recorded in the incomes information system. The incomes information system is divided into sub-registers.
Regular sources of data
During the system's implementation phase, the Incomes Register Project receives personal data for the implementation of the incomes information system from testing agreements, the various newsletter subscription forms of the Incomes Register, contact requests and other cooperation with stakeholders.
Confidentiality and public disclosure of data
Personal data related to testing agreements and newsletter subscribers, recorded in the incomes information system during the Incomes Register Project, is intended for the sole use of the Incomes Register Project and will not be disclosed to third parties.
Regular disclosure of data
Personal data collected in the Incomes Register Project will not be disclosed to parties outside the project.
Use of customer information
The customer database of the Incomes Register Project includes the basic information – such as the name, email address and telephone number – of stakeholder representatives, representatives of Incomes Register testing organisations, and subscribers of the Incomes Register newsletters. Customer information will only be used for the purpose for which it was provided. For instance, subscribers to a data providers’ project bulletin will only receive the bulletin. Customer information will not be used for any other purposes.
Data security principles
The data collected by the Incomes Register Project is protected against unauthorised viewing, modification and destruction. Such protection is based on access control, personal user identifiers and restriction of user rights.
Authorisations for the viewing and modification of contact information collected by the Incomes Register Project are restricted in accordance with staff duties.
Backup copying and physical security procedures ensure the conservation of data. Data on paper, related to the register, is protected through access control and locked archives.