Information on voluntary ban on credits
You can set a voluntary ban on credits in the Positive credit register's e-service. The ban is not subject to a charge. Information on the ban will be disclosed to lenders on the credit register extract. If you give you consent in the e-service, we will also disclose information on the credit ban to credit reference agencies, and they can store the information in their own registers and disclose it further for purposes laid down in section 19 of the act on credit information (Luottotietolaki 527/2007).
The voluntary ban on credits is in force indefinitely or for a fixed term, depending on your choice. The reasons you can select when setting the ban are Risk of identity theft, Control of personal finances and Other reason.
You can edit the ban on credits and remove it at any time.
If you have granted another person a Suomi.fi authorisation for the use of the Positive credit register's e-service, the authorisation holder can make, edit or remove the ban on credits and grant or cancel your consent to the disclosure of data to credit reference agencies in the e-service.
If you cannot use the e-service, you can set a voluntary ban on credits by filling in a paper form. If you want to set a voluntary ban on credits on behalf of a minor, you must always fill in a paper form.
Purpose of processing data
The purpose of processing data is to store a voluntary ban on credits in the Positive credit register and to disclose information about it to lenders on the credit register extract. With your consent, information on the voluntary ban on credits can be disclosed to credit reference agencies, and they can store the information in their own registers and disclose it further for purposes laid down in section 19 of the act on credit information (Luottotietolaki 527/2007).
- granting of a loan, supervision of a loan, and automated lending
- planning of debt recovery
- accepting or providing a guarantee or third-party security
- concluding a rental agreement on an apartment
- defining the terms and conditions when the contract concluded is such that it cannot be legally refused
- assessing a job applicant or an employee as provided by law
- assessing a company's or its responsible person's ability to meet their contractual obligations, and selecting a person as the company's responsible person
- a situation where a person requests a credit or insurance institution to draw up a certificate or recommendation regarding the person's ability to fulfil their obligations
- a situation where information is disclosed to certain operators with the reporting obligation so that they can take customer due diligence measures (Act on Preventing Money Laundering and Terrorist Financing 444/2017)
- scientific research, statistics or a public authority's planning and reporting duties
- an authority's statutory right of access to data
- a situation where the person is a responsible person in a company for whose operations authorities grant support
- other purpose of use separately prescribed by law.
What personal data do we process?
If you have set a voluntary ban on credits, we will process the following information regarding the ban:
- name of person using the e-service
- name of natural person or authorisation holder
- period of credit ban
- reason for credit ban
- consent that information on the credit ban can be disclosed to credit reference agencies for purposes prescribed in section 19 of the act on credit information.
On what basis do we process data?
We process personal data to comply with the Incomes Register Unit’s statutory obligation (General Data Protection Regulation (EU 2016/679), Article 6(1)(c)). The processing is provided for in the Act on the Positive Credit Register (739/2022).
Disclosure of data
According to the Act on the Positive Credit Register, the data stored in the register is confidential. We disclose data from the Positive credit register to lenders and authorities only for the purposes laid down in the Act on the Positive Credit Register.
Disclosing data to lenders
We disclose information on voluntary bans on credits on the credit register extract.
Under the Act on the Positive Credit Register, lenders and other businesses with the right of access to data can request credit register extracts for the purposes laid down in the act. To request a credit register extract, the business must have a data permission granted by the Incomes Register Unit.
You can view the credit register extracts requested about you in the Positive credit register’s e-service. You can also check the content of the credit register extract there, and see who has requested the register extract, when and for what purpose.
Read more about disclosing data to lenders.
Disclosing data to authorities
We disclose information about the credit ban to the Consumer Ombudsman on the credit register extract when they have the right of access to the information to perform their supervisory duties laid down in law.
Disclosure of data to credit reference agencies
We disclose information on the voluntary ban on credits to credit reference agencies if you have given your consent to the disclosure. Currently there are two credit reference agencies: Suomen Asiakastieto Oy and Dun & Bradstreet Finland Oy. For the time being, Suomen Asiakastieto Oy does not accept information.
Credit reference agencies can store the information in their own registers and disclose it further for purposes laid down in section 19 of the act on credit information. You can cancel the consent you have given at any time, after which information on the voluntary ban on credits will no longer be disclosed except on the credit register extract.
Processors
The Positive credit register has been implemented on the Microsoft Azure cloud service platform. We use the following service providers for application management services, such as troubleshooting: Innofactor Software Ltd, Gofore Plc, Gofore Verify Oy and Advania Finland Oy. When processing personal data, application management uses a service management system provided by ServiceNow. Digia Plc handles the on-call service regarding disruptions in the Positive credit register.
Transfer of personal data to third countries
In principle, we do not disclose data to countries outside the EU/EEA. However, in exceptional individual cases, Microsoft may have access to personal data during support and maintenance activities. In data transfer, the transfer basis under the General Data Protection Regulation is the European Commission's decision on the adequacy of data protection under Article 45(1) (Adequacy decision for the EU-US Data Privacy Framework, C(2023) 4745 final) or, where necessary, standard contractual clauses published by the European Commission.
Retention of data
Data retention periods are defined in the Act on the Positive Credit Register. With regard to data retention, we comply with the Tax Administration's information management plan. After the end of the retention period, data will be destroyed.
You can request the removal of a voluntary ban on credits at any time. When we have received your request, we will remove the voluntary ban on credits from the Positive credit register and no longer disclose information about it to lenders on the credit register extract, nor to credit reference agencies. You can also cancel your consent to the disclosure of data to credit reference agencies at any time. When you have cancelled your consent, we will no longer disclose information about the ban on credits to credit reference agencies, and they can no longer disclose the information further for purposes laid down in section 19 of the act on credit information.
We delete credit register extracts and information on credit bans disclosed to credit reference agencies based on consent five years after they were shared.
Your data protection rights regarding the processing of personal data
As a controller, the Income Register Unit is responsible for enforcing your data protection rights based on the EU's General Data Protection Regulation. You can make a free-form written request regarding your data protection rights and send it to us to the address below:
POSITIVE CREDIT REGISTER
P.O. BOX 2
FI-00055 Incomes Register
You can find more information about your data protection rights on the website of the Office of the Data Protection Ombudsman.
If you need help in exercising your rights, you can contact our customer service.
Right to view personal data
You have the right to know if we are processing your personal data. You are also entitled to receive a copy of your personal data that we process.
You can submit us a request to view your personal data with the paperform or contact form below.
You can access the Positive credit register’s data through the e-service for private individuals. There you will see the latest loan data reported by lenders, and the credit register extracts that have been requested about you and contain information about your voluntary ban on credits. To use the e-service, you will need your online banking codes, a mobile certificate or a certificate card.
Right to rectify data
You have the right to request us to rectify your inaccurate or incorrect personal data without any undue delay.
Right to restriction of processing
If you think the data we are processing about you is incorrect, if the data is processed against the law or if you have opposed the processing of your data, you can request us to restrict the processing of your personal data.
Right to file a notification with the supervisory authority
You have the right to file a notification with the Data Protection Ombudsman regarding the processing of your personal data. Further information and instructions on how to file a notification are available on the website of the Office of the Data Protection Ombudsman.