Record of personal data processing in the Tax Administration Incomes Register Unit

Regulation of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (EU) 2016/679, Articles 13 and 14.

The Finnish Tax Administration Incomes Register Unit (Incomes Register Unit) acts as the controller for the Incomes Register.

Provisions on the Incomes Information System are given in the Act on the Incomes Information System (53/2018).

The Incomes Information System comprise of the Incomes Register, which contains information submitted to meet the statutory reporting and disclosure obligation and information disclosed in compliance with the data access right, as well as a register containing identifying and contact information used for data verification and validation purposes.

The Incomes Information System is used to receive and store data reported by employers and other parties referred to in the Act and forward the data to authorities and other parties entitled to such data in order to fulfil the payers’ statutory reporting and disclosure obligation as well as to implement data access rights.

In addition to the personal data stored in the Incomes Register, the Incomes Register Unit processes personal data reported by payers, data users and other stakeholders and needed for the maintenance, troubleshooting and user guidance of the Incomes Information System.

The Tax Administration Incomes Register Unit processes personal data only in the performance of its statutory duties.

As controller, the Incomes Register Unit is obliged to comply with the obligations concerning the security of personal data under the General Data Protection Regulation and, as a government authority, good data processing practices and an increased level of information security as provided in the Government Decree on information security in central government.

Information on the controller and the personal data that is processed.
Controller	Finnish Tax Administration Incomes Register Unit Postal address: PO Box 5, 00055 TULOREKISTERI Visiting address: Vääksyntie 4, Helsinki, Finland
Data Protection Officer at the Finnish Tax Administration	Noora Kontro Taito von Konow P.O. Box 325, FI-00052 VERO National telephone number +358 29 512 000 (exchange)
Personal data processor	The Incomes Register Unit processes personal data by itself. The server hosting service provider is Tieto Oyj and the application management services are provided by Digia Oyj.
Purpose of the processing of personal data	1) Data reported by payers The Incomes Information System is used to receive and store income data reported by payers and forward the income data to authorities and other parties entitled to such data in order to fulfil the payers’ statutory reporting and disclosure obligation, as well as to implement data access rights. The Incomes Register may only contain income data that is forwarded and disclosed to data users specified in legislation for statutory purposes within their data access rights. The Incomes Register Unit forwards and discloses the data as it was saved in the Incomes Register. It does not modify or combine the data. The Incomes Register Unit does not make decisions on the basis of the data. Payers are responsible for the accuracy of the data they have reported to the Incomes Register, and for correcting any errors in the data without undue delay. 2) Data obtained from the Population Information System The purpose of processing personal data obtained from the Population Information System is to ensure the accuracy of data in the Incomes Register, as well as to perform other duties laid down in law for the Incomes Register Unit. Personal data is also used for communication targeted at the person in question as well as to infer the language used by the person in the e-service. 3) Data obtained from the Business Information System The purpose of processing data obtained from the Business Information System is to ensure the accuracy of data in the Incomes Register, as well as to perform other duties laid down in law for the Incomes Register Unit. 4) Pension policy numbers The purpose of processing data is to forward data from the Incomes Register to the pension provider in question. 5) Personal data not contained in the Incomes Register The purpose of processing data is maintenance, troubleshooting and user guidance relating to the Incomes Information System.
Categories of data subjects	1) Data reported by payers The categories of data subjects are the statutory payers and income earners. 2) Data obtained from the Population Information System The categories of data subjects are Finnish citizens entered in the Population Information System and foreigners resident in Finland. 3) Data obtained from the Business Information System The category of data subjects comprises the sole traders included in the Business Information System. 4) Pension policy numbers The category of data subjects comprises wage payers who have taken out pension insurance. 5) Personal data not contained in the Incomes Register The category of data subjects is the persons who have given the Incomes Register their name and contact information in connection with maintenance, troubleshooting and user guidance relating to the Incomes Information System.
Categories of personal data	1) Data reported by payers The categories of the payers’ personal data are the identifying and contact information that the payers are obliged to report to the data user under the relevant law. These include a Finnish personal identity code or business identity code. The categories of income earners’ personal data are: identifying and contact information that the payers are obliged to report to the data user under the relevant law. These include a Finnish personal identity code or business identity code information on the payments made and non-monetary benefits provided by a wage payer information on payments made by a benefit payer complementary data saved in the Incomes Register, such as absence data. 2) Data obtained from the Population Information System The categories of personal data are: name identifying information, such as a personal identity code or foreign personal number addresses non-disclosure for personal safety reasons 3) Data obtained from the Business Information System The categories of personal data are: identifying information (business ID and personal identity code) addresses. 4) Pension policy numbers The categories of personal data are the policyholders’ company- and insurance-specific pension policy numbers maintained by the pension providers. 5) Personal data not contained in the Incomes Register Persons’ names and contact information.
Specific categories of personal data/criminal convictions and offences	Are not processed
Categories of recipients of personal data	1) Data reported by payers The data users to which data reported by payers is forwarded and disclosed are laid down in law. From 2019, the data users will be the Finnish Tax Administration, earnings-related pension providers, the Employment Fund and the Social Insurance Institution of Finland. From 2020, the data users will also include accident and occupational disease insurers, motor insurance companies, the Patient Insurance Centre, the Workers’ Compensation Centre, the State Treasury, municipalities, joint municipal authorities, unemployment funds, the Employment Fund (adult education benefits) , occupational safety and health authorities, Statistics Finland, Employment and Economic Development Offices, Centres for Economic Development, Transport and the Environment, and the development and administration centres for the Centres for Economic Development, Transport and the Environment and Employment and Economic Development Offices. From 2021, the data users will also include the enforcement authorities. 2) Data obtained from the Population Information System The categories of recipients of personal data are: the data users laid down in law to which income data is forwarded and disclosed from the Incomes Register payers (information concerning the persons) income earners (information concerning the persons and information on the payer’s name). Personal data that is subject to non-disclosure for personal safety reasons will not be disclosed from the Incomes Register. If the payer has reported the payment recipient’s address on the incomes payment report, the data user will be informed of the non-disclosure for personal safety reasons. 3) Data obtained from the Business Information System The category of recipients of personal data is the data user laid down in law. 4) Pension policy numbers The categories of data users are: the pension insurance company providing the pension insurance other data users laid down in law who have statutory data access rights. 5) Personal data not contained in the Incomes Register The data are only for the use of the Incomes Register Unit; they are not disclosed to third parties.
Disclosure of data to third countries	Data will not be disclosed to third countries.
Time limits for erasure of data categories	Data saved in the Incomes Register will be deleted after ten years from the beginning of the year following the year the data was saved. Data saved in the Incomes Information System’s register containing identifying and contact information that was obtained from the Population Information System will be deleted ten years from the end of the year during which a natural person has deceased or been declared deceased. However, the data will only be deleted ten years from the end of the year during which the last data concerning income received or paid by the deceased or the estate was saved in the Incomes Register. Personal data not saved in the Incomes Register are stored until the contact person changes or the data are no longer needed.

Page last updated 5/2/2022