Record of personal data processing in the Tax Administration Incomes Register Unit

Regulation of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (EU) 2016/679, Articles 13 and 14.

The Finnish Tax Administration Incomes Register Unit (Incomes Register Unit) acts as the controller for the Incomes Register.

Provisions on the Incomes Information System are given in the Act on the Incomes Information System (53/2018).

The Incomes Information System comprise of the Incomes Register, which contains information submitted to meet the statutory reporting and disclosure obligation and information disclosed in compliance with the data access right, as well as a register containing identifying and contact information used for data verification and validation purposes.

The Incomes Information System is used to receive and store data reported by employers and other parties referred to in the Act and forward the data to authorities and other parties entitled to such data in order to fulfil the payers’ statutory reporting and disclosure obligation as well as to implement data access rights.

The Tax Administration Incomes Register Unit processes personal data only in the performance of its statutory duties.

As controller, the Incomes Register Unit is obliged to comply with the obligations concerning the security of personal data under the General Data Protection Regulation and, as a government authority, good data processing practices and an increased level of information security as provided in the Government Decree on information security in central government.

 

Controller

Finnish Tax Administration Incomes Register Unit
Postal address: PO Box 5, 00055 TULOREKISTERI
Visiting address: Lintulahdenkuja 10, Helsinki, Finland

Data Protection Officer at the Finnish Tax Administration

Helena Hynynen

Taito von Konow

P.O. Box 325, FI-00052 VERO
tel. +358 29 512 000 (exchange)

Personal data processor

The Incomes Register Unit processes personal data by itself.

The server hosting service provider is Tieto Oyj and the application provider is Digia Oyj.

 

Purpose of the processing of personal data

 1) Data reported by payers

 

The Incomes Information System is used to receive and store income data reported by payers and forward the income data to authorities and other parties entitled to such data in order to fulfil the payers’ statutory reporting and disclosure obligation, as well as to implement data access rights. The Incomes Register may only contain income data that is forwarded and disclosed to data users specified in legislation for statutory purposes within their data access rights. The Incomes Register Unit forwards and discloses the data as it was saved in the Incomes Register. It does not modify or combine the data. The Incomes Register Unit does not make decisions on the basis of the data.

 

Payers are responsible for the accuracy of the data they have reported to the Incomes Register, and for correcting any errors in the data without undue delay.

 

2) Data obtained from the Population Information System

 

The purpose of processing personal data obtained from the Population Information System is to ensure the accuracy of data in the Incomes Register, as well as to perform other duties laid down in law for the Incomes Register Unit.

 

Personal data is also used for communication targeted at the person in question as well as to infer the language used by the person in the e-service.

 

3) Data obtained from the Business Information System

 

The purpose of processing data obtained from the Business Information System is to ensure the accuracy of data in the Incomes Register, as well as to perform other duties laid down in law for the Incomes Register Unit.

 

4) Pension policy numbers

 

The purpose of processing data is to forward data from the Incomes Register to the pension provider in question.

Categories of data subjects

1) Data reported by payers

 

The categories of data subjects are the statutory payers and income earners.

 

2) Data obtained from the Population Information System

 

The categories of data subjects are Finnish citizens entered in the Population Information System and foreigners resident in Finland.

 

3) Data obtained from the Business Information System

 

The category of data subjects comprises the sole traders included in the Business Information System.

 

4) Pension policy numbers

 

The category of data subjects comprises wage payers who have taken out pension insurance.

Categories of personal data  

1) Data reported by payers

 

The categories of the payers’ personal data are the identifying and contact information that the payers are obliged to report to the data user under the relevant law. These include a Finnish personal identity code or business identity code.

 

The categories of income earners’ personal data are:

  1. identifying and contact information that the payers are obliged to report to the data user under the relevant law. These include a Finnish personal identity code or business identity code
  2. information on the payments made and non-monetary benefits provided by a wage payer
  3. information on payments made by a benefit payer 
  4. complementary data saved in the Incomes Register, such as absence data.

 

2) Data obtained from the Population Information System

 

The categories of personal data are:

  1. name
  2. identifying information, such as a personal identity code or foreign personal number
  3. addresses
  4. non-disclosure for personal safety reasons

 

3) Data obtained from the Business Information System

 

The categories of personal data are:

  1. identifying information (business ID and personal identity code)
  2. addresses.

 

4) Pension policy numbers

 

The categories of personal data are the policyholders’ company- and insurance-specific pension policy numbers maintained by the pension providers.

 

Specific categories of personal data/criminal convictions and offences

 

Are not processed

Categories of recipients of personal data

1) Data reported by payers

 

The data users to which data reported by payers is forwarded and disclosed are laid down in law. From 2019, the data users will be the Finnish Tax Administration, earnings-related pension providers, the Unemployment Insurance Fund and the Social Insurance Institution of Finland. From 2020, the data users will also include accident and occupational disease insurers, motor insurance companies, the Patient Insurance Centre, the Workers’ Compensation Centre, the State Treasury, municipalities, joint municipal authorities, unemployment funds, the Education Fund, occupational safety and health authorities, Statistics Finland, Employment and Economic Development Offices, Centres for Economic Development, Transport and the Environment, and the development and administration centres for the Centres for Economic Development, Transport and the Environment and Employment and Economic Development Offices. From 2021, the data users will also include the enforcement authorities.

 

 2) Data obtained from the Population Information System

 

The categories of recipients of personal data are:

  1. the data users laid down in law to which income data is forwarded and disclosed from the Incomes Register
  2. payers (information concerning the persons)
  3. income earners (information concerning the persons and information on the payer’s name).

Personal data that is subject to non-disclosure for personal safety reasons will not be disclosed from the Incomes Register. If the payer has reported the payment recipient’s address on the incomes payment report, the data user will be informed of the non-disclosure for personal safety reasons.

  

3) Data obtained from the Business Information System

 

The category of recipients of personal data is the data user laid down in law.

 

4) Pension policy numbers

 

The categories of data users are:

  1. the pension insurance company providing the pension insurance
  2. other data users laid down in law who have statutory data access rights.

Disclosure of data to third countries

Data will not be disclosed to third countries. 

Time limits for erasure of data categories 

Data saved in the Incomes Register will be deleted after ten years from the beginning of the year following the year the data was saved.

 

Data saved in the Incomes Information System’s register containing identifying and contact information that was obtained from the Population Information System will be deleted ten years from the end of the year during which a natural person has deceased or been declared deceased. However, the data will only be deleted ten years from the end of the year during which the last data concerning income received or paid by the deceased or the estate was saved in the Incomes Register.