Loan information
Where does the data come from?
On what basis do we process data?
Your data protection rights regarding the processing of personal data
Purpose of processing data
The Positive credit register is a national register containing information about loans. The register’s aim is to prevent over-indebtedness by ensuring that reliable loan data is available to lenders especially for purposes of assessing the loan applicant’s creditworthiness during the lending process, and by improving natural persons’ ability to control their own finances. In addition, some authorities use the register’s data to supervise and monitor the stability of the financial markets and the credit markets, support decision-making and compile statistics.
Whose data do we process?
The Positive credit register contains data on natural persons who have a Finnish personal identity code and a place of residence in Finland. Businesses with the reporting obligation can also report loan data on natural persons who do not have a place of residence in Finland, provided that the person has a Finnish personal identity code and, in addition, receives income from Finland or has another special bond to Finland when the loan is granted.
Where does the data come from?
We receive loan data from lenders and other businesses that are obliged to submit reports to the Positive credit register. Loan data can be reported to and stored in the register as of 1 February 2024.
Businesses with the reporting obligation are defined in the Act on the Positive Credit Register (739/2022). They include:
- entities supervised by the Financial Supervisory Authority under the Act on the Financial Supervisory Authority (878/2008), Finnish branches of foreign EEA supervised entities, and foreign supervised entities that provide services in Finland but do not have a Finnish branch
- lenders and loan brokers entered into the Financial Supervisory Authority’s register in accordance with the Act on the Registration of Certain Credit Providers and Credit Intermediaries (186/2023)
- other businesses to which the lender’s rights arising from a loan contract reported to the register are transferred (reassignees).
Kela is required to submit reports on guarantee receivables referred to in section 38 of the act on financial aid for students (Opintotukilaina 65/1994).
The names and Business IDs or foreign business IDs of operators that report loan data to the register can be found at Data notifiers on the Positive credit register's website.
The data in the Positive credit register is not real-time data. According to the Act on the Positive Credit Register, data on a new loan contract must be reported to the register no later than on the day following the day when the loan contract was concluded. When the contract has been concluded, any loan transactions (payment transactions, delayed amounts, acceleration of the loan, end and transfer of the loan) and changes to the loan contract data must be reported within two business days.
What data do we process?
The data processed in the Positive credit register is laid down in the Act on the Positive Credit Register. The register contains data on consumer credits and loans comparable to consumer credits. This means that the register does not contain data on all invoices and credits.
A consumer credit means credit which, by agreement, is granted or promised to the consumer by a business in the form of a loan, deferred payment or another corresponding financial arrangement and on which interest or other charges are collected. An extension for payment granted in commodity trading is not a consumer credit, so data on such agreements is not found in the register. Further, the Positive credit register does not contain data on promised loans, interest-free and expense-free loans, credits granted by pawnbrokers, or social loans.
Loans comparable to consumer credits refer to leases or other such contracts by which goods are transferred to the consumer’s control and according to the terms and conditions of which the cash price and loan expenses will be paid during the lease period or the consumer can otherwise become the owner of the goods at the end of the contract. The Positive credit register calls such contracts leasing contracts.
A credit which a party other than a lender grants or promises to grant to the consumer as a loan, deferred payment or another corresponding financial arrangement is also regarded as comparable to a consumer credit if the business operator brokers the credit to the consumer. In those cases, the lender acts as a peer-to-peer loan broker.
The register also contains data that Kela has reported on guarantee receivables for student loans. Guarantee receivables for a student loan refer to a debt that Kela pays to the lender based on a government guarantee. If the borrower does not pay a government-guaranteed student loan or its interest on time, Kela will pay the student loan to the lender. After than, Kela will collect the amount it paid from the borrower.
According to law, lenders are obliged to report loan data to the register only if it is reasonably available. Because of this, some individual data may not be found in the register.
Basic information
Lump-sum loan information
Lump-sum loans include other than running-account loans, such as a home loan or a student loan.
Running-account loan information
A running-account loan is a consumer credit continuously available to the borrower up to a pre-defined credit limit. Running-account loans include credit cards, deferred debit cards and different accounts with credit facilities, for example.
Leasing information
Leasing includes lease contracts or other contracts under which goods are transferred to the consumer’s control and according to the terms and conditions of which the cash price of the goods and the loan expenses will be paid during the lease period or the consumer can otherwise become the owner of the goods at the end of the contract.
Interest information
Lenders report the following interest information on running-account loans and on lump-sum loans other than guarantee receivables for student loans:
Lenders report only expenses that are taken into account in the calculation of the effective interest rate. Expenses resulting from breaches of contract, such as late-payment interest, are not reportable expenses.
Information on collateral
Lenders report the following information on collateral for loans other than leasing contracts:
Amortization information and deferment periods
The register does not contain payment transactions related to leasing contracts.
In addition, lenders report the start and end dates for separately agreed deferment periods of lump-sum loans and running-account loans. If a deferment period is an integral part of the loan contract and requires no separate agreement and if it is under the borrower’s control, then the period is not reported to the register.
Information on delayed amounts, and loan acceleration
Information on instalments that are more than 60 days late from the original due date are reported to the Positive credit register as delayed amounts.
Information on a debt arrangement and business restructuring
With regard to all loans, the Positive credit register contains information whether the borrower is in a debt arrangement or business restructuring confirmed by a court of law and whether the loan is included in a debt arrangement payment plan or a business restructuring program.
If the debt arrangement or business restructuring program lapses, the lender will inform the register to that effect. In that case, the lender must update all loan data, if needed.
Income information
The Positive credit register stores income data that is necessary for the calculation of a natural person's gross and net income. The data is received from the Incomes Register.
Read more about the processing of income data received from the Incomes Register.
In addition to the income data received from the Incomes Register, the register contains income data that has been established for purposes of assessing the borrower’s creditworthiness. The lender has received the data by asking directly from the borrower or in some other way. The income is reported as monthly income and separated into gross income and net income.
Information on the end and transfer of a loan contract
Lenders report information on the end of a loan contract and on the transfer of a loan contract to another party with the reporting obligation.
On what basis do we process data?
Personal data is processed in order to comply with the statutory obligation set for the Incomes Register Unit (General Data Protection Regulation (EU 2016/679), Article 6(1)(c)). The processing is provided for in the Act on the Positive Credit Register (Act on the Positive Credit Register 739/2022).
Disclosure of data
According to the Act on the Positive Credit Register, the data stored in the register is confidential, with the exception of the name, Finnish Business ID or foreign business ID of the lender with the reporting obligation. We disclose data from the Positive credit register to lenders and authorities only for the purposes laid down in the Act on the Positive Credit Register.
Disclosing data to lenders
The Act on the Positive Credit Register provides for the disclosure of data to lenders and other businesses with the right of access to data. We disclose data only for the purposes laid down in the Act on the Positive Credit Register. We disclose data in the form of credit register extracts.
Businesses with the right of access to data
Businesses with the right of access to data include:
- businesses under the supervision of the Financial Supervisory Authority that have been entered into the register of lenders and loan brokers and have the duty to report loan data to the register (read more about these businesses)
- other lenders that have the obligation to test the consumer’s creditworthiness or check the accuracy of consumer-related data under the Consumer Protection Act.
To request a credit register extract, the business must have a data permission granted by the Incomes Register Unit
Credit register extract’s purposes of use
The Act on the Positive Credit Register provides exhaustively for the purposes of use for which data may be disclosed from the register.
A business operator must state the purposes of use of the credit register extract when submitting a request. The business operator is responsible for seeing that the confidential data received from the Positive credit register is processed in compliance with law. The credit register extract may be used only for the purpose for which it was disclosed from the register. Notwithstanding the above, however, data may also be used for the purposes below by virtue of the Act on the Positive Credit Register:
Content of the credit register extract
Credit register extracts are displayed in the e-service
You can view the credit register extracts requested about you in the Positive credit register’s e-service. You can also check the content of the credit register extract there, and see who has requested the register extract, when and for what purpose.
Disclosing data to authorities
We disclose loan data to the Bank of Finland, the Financial Supervisory Authority, the Finnish Competition and Consumer Authority, the Consumer Ombudsman and Statistics Finland.
We disclose data to the Bank of Finland, the Financial Supervisory Authority and the Finnish Competition and Consumer Authority in pseudonymised form. This means that the personal data cannot be linked to an individual without additional information. We disclose data to the Consumer Ombudsman both in pseudonymised form and as identifiable data. The data disclosed to Statistics Finland is not pseudonymised.
The disclosure of data is based on the Act on the Positive Credit Register, which explicitly lays down the tasks for which authorities can receive data from us. After the data has been disclosed, the authorities process the data in the capacity of controllers. Further information about the processing of personal data is available on the authorities' own websites.
By virtue of the Act on the Positive Credit Register, we can also disclose data to the Financial Supervisory Authority and the Regional State Administrative Agency of Southern Finland for the supervision of business operators’ obligation to sign up and submit reports.
Disclosure of data by virtue of the Act on Openness
According to the Act on the Positive Credit Register, we can also disclose data for the following purposes laid down in the Act on the Openness of Government Activities (621/1999, Act on Openness):
- right of access to data of the party concerned
- right of access to a document pertaining to the party concerned
- provision of executive assistance
- processing of advance information, a preliminary ruling or a complaint.
Processors
The Positive credit register has been implemented on the Microsoft Azure cloud service platform. We use the following service providers for application management services, such as troubleshooting: Innofactor Software Ltd, Gofore Plc, Gofore Verify Ltd, Fujitsu Finland Ltd, Advania Finland Ltd, Futurice Ltd and Siili Solutions Plc. When processing personal data, application management uses a service management system provided by ServiceNow.
Transfer of personal data to third countries
In principle, we do not disclose data to countries outside the EU/EEA. However, in exceptional individual cases, Microsoft may have access to personal data during support and maintenance activities. In data transfer, the transfer basis under the General Data Protection Regulation is the European Commission's decision on the adequacy of data protection under Article 45(1) (Adequacy decision for the EU-US Data Privacy Framework, C(2023) 4745 final) or, where necessary, standard contractual clauses published by the European Commission.
Retention of data
Data retention periods are defined in the Act on the Positive Credit Register. With regard to data retention, we comply with the Tax Administration's information management plan. After the end of the retention period, data is either destroyed or archived in accordance with the archives act (Arkistolaki 831/1994).
We will delete the loan data reported by lenders and other parties with the reporting obligation two years after the end or cancellation of the loan. Amortization data will be deleted two years after it is stored in the register. However, as regards the balance and deferment periods of lump-sum loans, the two-year retention period is calculated from the end of the loan.
We will delete the information about delayed amounts from the register 30 days after the lender has reported that the delayed amount has been paid or the loan has ended. When reporting a loan as accelerated, the lender must also remove any delayed amounts that have been reported to the register.
We will delete the information about acceleration 30 days after the lender has reported that the accelerated loan has been paid up in full or that the loan has otherwise ended. We will also delete the information about a debt arrangement or business restructuring 30 days after the lender has reported that the payment plan or restructuring program has ended or lapsed or the loan has ended.
After the lender has reported that the delayed amount has been removed or the accelerated loan has been paid up, that the debt arrangement payment plan or business restructuring program has ended or lapsed, or that the loan has ended, data relating to them will no longer be disclosed on credit register extracts.
We delete credit register extracts five years after sharing them with lenders.
Your data protection rights regarding the processing of personal data
As a controller, the Income Register Unit is responsible for enforcing your data protection rights based on the EU's General Data Protection Regulation. You can make a free-form written request regarding your data protection rights and send it to us to the address below:
POSITIVE CREDIT REGISTER
P.O. BOX 2
FI-00055 Incomes Register
You can find more information about your data protection rights on the website of the Office of the Data Protection Ombudsman.
If you need help in exercising your rights, you can contact our customer service.
Right to view personal data
You have the right to know if we are processing your personal data. You are also entitled to receive a copy of your personal data that we process.
You can submit us a request to view your personal data with the paperform or contact form below.
You can access the Positive credit register’s data through the e-service for private individuals. There you will see the latest loan data reported by lenders, and the credit register extracts requested about you. To use the e-service, you will need your online banking codes, a mobile certificate or a certificate card.
Right to rectify data
You have the right to request us to rectify your inaccurate or incorrect personal data without any undue delay.
The loan data in the Positive credit register is as reported by lenders. You can see the most recent data reported by a lender in the Positive credit register’s e-service. The credit register extract is always generated based on the most recent data.
If you detect an error in your loan data, it is important to correct it, because lenders use the register’s data when assessing your creditworthiness. To correct the error, you can contact the Incomes
Register Unit or the lender who submitted the erroneous data. Usually the quickest way to settle the matter is to contact the lender directly. When you contact us, we will investigate the matter with the lender and, in the first place, ask the lender to correct the error by reporting the correct data to the register.
Right to restriction of processing
If you think the data we are processing about you is incorrect, if the data is processed against the law or if you have opposed the processing of your data, you can request us to restrict the processing of your personal data.
The Act on the Positive Credit Register separately prescribes that we can disclose data to authorities, lenders and other parties having the right of access to data even in situations where the data subject has denied the accuracy of their data and required that the processing should be restricted. In such a case, the credit register extract delivered to the lender will show that you have requested the restriction of processing. This will be indicated on the credit register extract until the matter is settled. The lender or other party using the credit register extract can thus take into account that the accuracy of the data has been questioned.
Right to file a notification with the supervisory authority
You have the right to file a notification with the Data Protection Ombudsman regarding the processing of your personal data. Further information and instructions on how to file a notification are available on the website of the Office of the Data Protection Ombudsman.