Incomes Register FAQs for data users

Data permission

Identification for the e-service

The data user’s authorisations

Using data

Access logs

Changes in data users’ services

Certificate

What is an Incomes Register data user?

A data user is either an organisation or authority which, by law, has the right to obtain data from the Incomes Register.

What are the Incomes Register’s service channels?

The e-service is a service used with a browser. You can sign in to the e-service at incomesregister.fi. The service requires identification with online banking codes, a mobile certificate or a certificate card. In the e-service you can, for example, search for data.

The e-service also features an upload service which is a unidirectional service. In addition to sending files that contain reports, you can make record subscriptions in the upload service, while the subscribed records or reports are not delivered there. Records subscribed to are delivered to the data user via an interface, while reports subscribed to are delivered in PDF format to the e-service.

The technical interface is an electronic connection between two systems. Via the interface, you can, for example, retrieve data from the Incomes Register directly to your customer payment system. Building the interface requires a technical implementation. For information about how to build the interface, contact your organisation’s system supplier. Using the technical interface requires a certificate.

Read more: Use the Incomes Register electronically

Data permission

What is a data permission?                

A data permission is a decision issued by the Incomes Register Unit on the forwarding and disclosure of data to a certain data user. The data permission consists of an administrative decision and attachments to the decision, defining data access profiles, data user roles and services.

What is a data access profile?           

A data access profile is a description of what individual data can be disclosed to a data user and for what purposes. The right to access data is based on law. The data access profile and its content are defined in the data permission.

Do I also need to apply for a data permission for the interface, although the deployment time of the interface is not yet known?

If a data user has already submitted a data user’s report for data permission purposes (form 6200) via secure email and selected an interface that will be deployed at a later date (but during 2021) as the channel on the report, the data user must contact the Incomes Register Unit for postponing the certificate request to a later date.

If a data user has not yet submitted a report for a data permission (form 6200), the postponement of the certificate request can be requested at the same time when the data user sends the report for a data permission via secure email.

Does the data permission need to be in effect before testing?

Testing does not require a production data permission; instead, testing can be started after sending the testing start notification (form 6115). You can request a testing start notification from YHT_Tulorekisteri_testaus@vero.fi.

How are data access rights and access rights defined? How are they restricted and monitored?

Data is only disclosed on the basis of valid data access rights based on law and only to parties defined in the act on the incomes information system (laki tulotietojärjestelmästä 53/2018). Data access profiles form disclosed data into groups based on different purposes of use and situations. Only data that is necessary by law in the case being settled or the task being carried out can be disclosed at each time.

The e-service interface can be used to connect profiles to roles, with each profile giving access to different data. A role means data attached to a user, on the basis of which the user has the right to use specific functions in the Incomes Register. A user may have several different roles.

Search terms and processing rules are tied to each data user’s data access rights. Access log data is produced for monitoring the use of the service. For example, an access log is produced for each login and each login attempt to the Incomes Register and for each action carried out in the e-service.

Identification for the e-service

My company does not allow me to use my personal online banking codes for work-related matters. How can we use the Incomes Register?

In addition to using your online banking codes, you can use a mobile certificate or certificate card for identification in the e-service.

Certificate cards include an electronic identity card granted by the Police of Finland, and an organisation card and a social welfare and healthcare professional’s ID card granted by the Digital and Population Data Services Agency.

A data user can retrieve data from the Incomes Register directly to their own system through the technical interface, in which case no personal identification is needed. The technical interface requires system development. For more information, contact your system supplier.

The data user’s authorisations

Can the data user’s authorisations be granted for a fixed period?

Yes, the data user’s authorisations are granted for a fixed period. By default, an authorisation will remain valid for 25 years. The data user’s master user can maintain and remove authorisations in the Incomes Register’s e-service.

Can a single person have the role of a master user as well as another data user role?

Yes. The data-using organisation names its master users. A master user can also have a data user role required for data retrieval.

Using data

Can a municipality use the Incomes Register’s data to define client fees for early childhood education?

Yes, the Incomes Register’s data can be used to define client fees for early childhood education. Data can be retrieved using data access profiles intended for defining client fees for early childhood education.

Can a municipality or joint municipal authority use the Incomes Register’s data to make decisions on discretionary (supplementary/preventive) social assistance?

Yes. Data can be retrieved using a data access profile defined for this purpose.

Can the Incomes Register’s data be used to define the value of a service voucher granted by a municipality?

At present, the Incomes Register’s data cannot be used to define the value of an income-based service voucher or the amount of its deductible, because the definition of the value of a service voucher or the amount of deductible is not indicated as a purpose of use for data in section 13, subsection 1, paragraph 18 or 19 of the act on the incomes information system.

Why am I not shown the same data when I search for data per earnings period and per payment date?

The earnings period comprises voluntary data on the earnings payment report, and not all payers have provided this data. This is why the earnings period should not be used as the only search term when searching for data.

Instead, the payment date is mandatory, and search results are exhaustive when it is used as a search term.

Does the use of the Incomes Register’s data carry a fee?        

The use of the Incomes Register is free of charge.

Where can I find the Finnish Tax Administration’s account and reference number?

The Finnish Tax Administration’s payment details are indicated in your company’s MyTax service.

Access logs

For how long will the Incomes Register’s access log data be retained. From how far back can access log events be retrieved for an access log report (702)?

Access log data is retained for 10 years from the beginning of the year following the year in which the data was registered.

Changes in data users’ services

Will the Incomes Register replace Kela’s benefit data system Kelmu?

The Incomes Register will not replace the Kelmu service, as data users cannot obtain data about decisions or solutions concerning benefits and pensions from the Incomes Register. Furthermore, data about the payment of basic social assistance is not reported to the Incomes Register.

Certificate

Can a single data user’s certificate be used to search for wages and benefits?

Yes, if the same technical interface channels are used.

If a record subscription has been placed using certificate A, but the certificate needs to be closed for reasons of information security, can the record subscription be retrieved using new certificate B?

Yes. The validity of a certificate is always verified when it is used, not afterwards. If certificate B is valid when it is used at the time of retrieval, the record subscription can be retrieved.

If a record subscription has been placed using certificate A which is about to expire and is renewed in the certificate renewal service before it expires, can the record be retrieved using the renewed certificate?

Yes, the record can be retrieved using the renewed certificate.

The renewed certificate is connected to a new key, making it a different certificate.

If a record subscription has been placed using certificate A which is about to expire and is renewed by retrieving new certificate B, can the record be retrieved using certificate B?

Yes.

If a record subscription has been placed using certificate A, which expires, and new certificate B is retrieved after certificate A expired, can the record be retrieved using certificate B?

Yes.

A data user uses the WS interface for retrieving earnings and benefits payment data. Does the data user need to retrieve a new certificate for benefits?

No. Data users can use a single certificate to retrieve both earnings and benefits payment data, provided that they have the right to access this data.

A data user uses the WS interface to retrieve earnings payment data and the SFTP interface to retrieve benefits payment data. Does the data user need to retrieve a new certificate for benefits?

Yes. The WS certificate and SFTP certificate are different certificates.