Data protection

The Supreme Administrative Court processes personal data in accordance with the requirements of the legislation in force. More detailed information on the processing of personal data and the rights of data subjects can be found in the following statements: the processing of personal data in judicial matters, the processing of personal data in non-judicial matters and the rights of the data subject.

Page content

Processing of personal data in judicial matters

1 General

This statement concerns the processing of judicial matters in the Supreme Administrative Court and the processing of data related to the administration of justice in the information systems and other data files of which the Supreme Administrative Court is the controller.

The purpose of the statement is to provide data subjects with information on the processing of data and other information required by current data protection legislation. The statement is available on the website and notice board of the Supreme Administrative Court (www.kho.fi).

2 Controller

Supreme Administrative Court
Postal address: PL 180, FI-00131 Helsinki, Finland
Street address: Fabianinkatu 15, FI-00130 Helsinki, Finland
Telephone: +358 29 56 40200
Email: korkein.hallinto-oikeus@oikeus.fi

3 Controller’s contact person

Jenny Rebold
Secretary General
Telephone: +358 29 56 40200 (switchboard)
Email: korkein.hallinto-oikeus@oikeus.fi

4 Data protection officer

Satu-Maarit Tarkkanen
Head of Information Services
Telephone: +358 29 56 40200 (switchboard)
Email: korkein.hallinto-oikeus@oikeus.fi

5 Purpose and legal basis of the processing of personal data

Personal data is processed to fulfil the statutory obligations of the Supreme Administrative Court.

Key legal basis for the processing of personal data:

Constitution of Finland, sections 3, 98 and 99
Courts Act, chapter 1, section 2
Act on the Supreme Administrative Court
Administrative Procedure Act
Act on the Openness of Government Activities, section 18
Decree on the Openness of Government Activities and on Good Practice in Information Management, sections 5 and 6
Rules of Procedure of the Supreme Administrative Court, section 29

Some of the data processed is secret. The secrecy is based on the following statutes, among others:

Act on the Openness of Government Activities
Act on the Publicity of Administrative Court Proceedings
Data Protection Act
Act on the Processing of Personal Data in Criminal Matters and in the Maintenance of National Security

Appeals to the Supreme Administrative Court, secrecy of data and the processing of special categories of personal data are additionally subject to a number of special statutes pertaining to a specific activity, procedure or branch of law.

6 Description of categories of data subjects and personal data being processed

The Supreme Administrative Court processes data on interested parties, legal counsel and attorneys as well as other parties to judicial matters. In addition, we process data concerning the Supreme Administrative Court personnel participating in the processing of the matter and the delivery of decisions. The personal data being processed are:

the person’s name
municipality of residence
contact details and service address (including the address, telephone number, email address and e-services consent)
language
non-disclosure for personal safety reasons
non-disclosure of contact information
date of birth / personal identity code / business ID
personal number (client number) related to the digital case management system for immigration matters (UMA)
e-invoicing details
legal aid information
attorney or counsel information
other information necessary for the processing of the matter (e.g. information on a person’s death, bankruptcy, prohibition of representation or restriction of legal capacity)

Trial documents or other data being processed may also contain other personal data, such as personal identity codes or information on the data subject’s family, work, hobbies, health, sexual orientation, criminality or ethnic origin, as well as information related to criminal convictions, violations or related precautionary measures. However, this data is not indexed in such a way that would enable, for example, all persons representing a particular ethnic origin to be retrieved from the information systems.

7 Regular sources of data

Data is primarily obtained from interested parties, the competent authorities or other parties to the matter. In addition, data may be obtained from:

other courts
the Legal Register Centre
the Digital and Population Data Services Agency
the Tax Administration
the Finnish Immigration Service
the Finnish Transport Safety Agency (Trafi)
National Land Survey of Finland
the Finnish Patent and Registration Office
the Finnish Institute for Health and Welfare
the Finnish Supervisory Agency
the Social Insurance Institution of Finland (Kela)
legal aid offices
the Board on Trial Counsel
State regional administrative authorities
municipalities
social welfare and health care units
other authorities or parties from whom information is needed to process the matter

8 Recipients or categories of recipients to whom personal data has been or will be disclosed

Data is disclosed, among other things, to the interested parties in trials, authorities and third parties (publicity). Data is disclosed on the grounds laid down in the Act on the Publicity of Administrative Court Proceedings, the Act on the Openness of Government Activities or other legislation applying to the disclosure of information.

Recipients of regular transfers or disclosures of personal data:

interested parties or other parties to a trial and their attorneys or counsel
the authority which issued the decision or other ruling being appealed
administrative courts
the Legal Register Centre
the Tax Administration
the Finnish Immigration Service
the police
the Government and ministries
the National Archives of Finland
the Parliamentary Ombudsman and Chancellor of Justice
other state and municipal authorities or units

Data may also be disclosed to the following recipients:

the Board on Trial Counsel
the Disciplinary Board of the Finnish Bar Association
the Official Journal of Finland
the Finlex databank and Edilex
Alma Media
the media
EU institutions
judicial authorities and courts of Member States
foreign authorities performing service
Fonecta Oy

Data can also be disclosed to the public by publishing the decision of the Supreme Administrative Court, press release or other similar information on the Supreme Administrative Court website or other publication platform. When disclosing data in this way or, for example, for publication in the Finlex databank, personal data is pseudonymised as specified in the Publication Policy approved by the Supreme Administrative Court.

Data may also be disclosed to other recipients to the extent required by publicity or the fulfilment of other statutory obligations to provide information. Due to the nature of the activity, not all potential recipients of data are known in advance and it is thus not possible to provide an exhaustive list of them.

9 Categories of personal data transfers to third countries or international organisations

Data is not disclosed or transferred outside the European Union or the European Economic Area, except in situations where the processing of the matter so requires (e.g. service to a country outside the EU/EEA).

10 Data storage periods

Data is stored in accordance with the Supreme Administrative Court’s archiving plan. The storage period of the data contained in the case management systems and the archive of permanently stored documents has not been limited.

The storage period of documents in the archiving plan is either 25 years or permanent. Documents stored for a fixed period may be destroyed after the expiration of the storage period.

As a rule, case law published in Finlex is stored permanently.

11 Rights of the data subject

The rights of data subjects are provided for in the EU General Data Protection Regulation or other applicable legislation on the protection of personal data (both hereinafter jointly referred to as ‘data protection legislation’). These rights include, among others:

the right of access
the right to rectification, supplementation or erasure
the right to restriction of processing
the right to object
the right to lodge a complaint with a supervisory authority

More detailed information on the rights of the data subject and on their content and exercise can be found in the statement on the rights of the data subject.

Processing of personal data in non-judicial matters

1 General information

This statement concerns the processing of personal data of persons not employed by the Supreme Administrative Court in non-judicial matters. The processing of the personal data of Supreme Administrative Court staff is subject to a separate statement.

The purpose of this statement is to provide data subjects with information on the processing of data and other information required by the data protection legislation in force. The statement is available on the website and notice board of the Supreme Administrative Court (www.kho.fi).

2 Controller

Supreme Administrative Court
Postal address: PL 180, FI-00131 Helsinki, Finland
Visiting address: Fabianinkatu 15, 00130 Helsinki
Telephone: +358 29 56 40200
Email: korkein.hallinto-oikeus@oikeus.fi

3 Controller’s contact person

Jenny Rebold
Secretary General
Telephone: +358 29 56 40200 (switchboard)
Email: korkein.hallinto-oikeus@oikeus.fi

4 Data protection officer

Satu-Maarit Tarkkanen
Head of Information Services
Telephone: +358 29 56 40200 (switchboard)
Email: korkein.hallinto-oikeus@oikeus.fi

5 Purpose and legal basis of the processing of personal data

The Supreme Administrative Court processes data under Article 6(1)(c) of the General Data Protection Regulation in order to comply with the controller’s legal obligations, and under paragraph 1, point (e) of the same Article for the performance of a task carried out in the public interest and in the exercise of official authority vested in the controller.

The data of persons applying for a post or public-service employment relationship in the Supreme Administrative Court may be processed on the bases laid down in the Courts Act, the legislation applying to the Supreme Administrative Court, the Security Clearance Act or the legislation on civil servants.

The Supreme Administrative Court may also process personal data disclosed voluntarily to the Supreme Administrative Court by persons who are not members of the Supreme Administrative Court’s staff or parties to judicial matters. For example, such data may have been provided in order to obtain information or documents concerning the activities of the Supreme Administrative Court, for visiting the Supreme Administrative Court or for other similar purposes.

6 Description of categories of data subjects and categories of personal data being processed

The categories of data subjects are:

jobseekers
payees
external passengers
visitors
lessors
those making requests for information
those making enquiries concerning the rights of the data subject
sales invoice customers
senders or beneficiaries of purchase invoices
third parties operating on court premises
third parties entered in user registers
persons for whom a decoration is being applied for; and
persons whose data have been stored for the distribution of press releases, reports or similar documents

The personal data collected can be divided into the following categories of personal data:

Identifying information:
The person’s name, title, date of birth, personal identity code, personal number, postal address, email address, telephone number, bank details, nationality, native language and gender.

Information on jobseekers:
For example, information on education and work experience, other information submitted by the applicant in support of their application, such as a person’s personal dossier / CV, school and study certificates, employment certificates, references, other necessary information related to the recruitment and terms of employment, and information on aptitude assessments.

Payment information:
Fees, travel expenses, sales and purchase invoice data, lessor data, refunds, tax information and enforcement information.

Other information:
System access rights, security clearance information, event participant information and travel information. Camera surveillance.

7 Regular sources of data

The personal data are mainly obtained from the data subjects themselves. Other regular sources of data include:

agreements (organisation’s contact persons)
the enforcement authority (enforcement information)
the Finnish Security and Intelligence Service (security clearance information)
camera surveillance and access control
the National Courts Administration
the Judicial Appointments Board and Judicial Training Board
other courts
educational institutions
employers of jobseekers
municipal employment services
insurance companies
Non-Military Service Centre
the Finnish Government Shared Services Centre for Finance and HR (Palkeet)
lessors

8 Recipients or categories of recipients to whom personal data have been or will be disclosed

Data are disclosed on the grounds laid down in the Act on the Openness of Government Activities or other legislation on the disclosure of information.

Recipients of regular transfers or disclosures of personal data:

in appointment matters – to other courts, the National Courts Administration, the Judicial Appointments Board and the Judicial Training Board
concerning trainees and similar persons – to educational institutions, municipal employment services and insurance companies, and to the Centre for Non-Military Service on non-military servicemen
service providers providing real estate or security services, security authorities, enforcement authorities, financial institutions in the form of fee and compensation information, Keva and the Tax Administration, as well as the Finnish Security and Intelligence Service and the bodies processing applications for decorations

Parties that regularly process data on behalf of the Supreme Administrative Court:

the Finnish Government Shared Services Centre for Finance and HR (Palkeet)
the Legal Register Centre
information system suppliers of key systems (e.g. CGI, Tieto and Visma)

In addition, data is stored in systems to which it is necessary to create user rights for third parties for the performance of agreed tasks.

Data can also be disclosed to other recipients to the extent required by publicity or other compliance with a statutory obligation to provide information. Due to the nature of the activity, not all potential recipients of data are known in advance and thus cannot be listed exhaustively.

9 Transfer of personal data to third countries

As a rule, data is not disclosed or transferred out of the European Union or the European Economic Area. If it is agreed that a supplier may transfer personal data out of the European Economic Area, the parties ensure that the transfer is carried out in accordance with the legislation applied in Finland.

10 Data storage periods

The storage periods of the personal data of persons not employed by the Supreme Administrative Court are based on the archiving plan. Documents stored for a fixed period may be destroyed after the expiration of the storage period.

11 Profiling

No profiling is used in the processing of personal data.

12 Rights of the data subject

The rights of the data subject are provided for in the EU General Data Protection Regulation or other applicable legislation on the protection of personal data (both hereinafter jointly referred to as ‘data protection legislation’). These rights include:

the right of access
the right to rectification, supplementation or erasure of data
the right to restriction of processing
the right to object
the right to lodge a complaint with a supervisory authority

More detailed information on the rights of the data subject and on the content and exercise of the rights can be found in the statement on the rights of data subjects.

Rights of the data subject

1 General information on the rights of the data subject

the right of access
the right to rectification, supplementation or erasure of data
the right to restriction of processing
the right to object
the right to lodge a complaint with a supervisory authority

This statement provides information on the content and exercise of the rights of the data subject with regard to the data processed by the Supreme Administrative Court.

2 Right of access

The data subject has the right to be informed of whether personal data concerning them are being processed. If data is being processed, the data subject has the right to receive the information referred to in data protection legislation from the controller.

In order to obtain information concerning oneself, a request must be made to the controller.

More detailed information on the exercise and content of the right of access:

Article 15 of the EU General Data Protection Regulation
section 23 of the Act on the Processing of Personal Data in Criminal Matters and in the Maintenance of National Security, in matters related to the scope of the Act

3 Rectification, erasure, completion or restriction of processing of data

Under the conditions laid down in data protection legislation, a data subject has the right to demand that the controller rectify without undue delay any inaccurate, incomplete and incorrect personal data concerning the data subject. In addition, the data subject has the right to have the data erased or its processing restricted under the conditions laid down in data protection legislation.

More detailed information on the exercise and content of the right to rectification, erasure or restriction of processing of data:

Articles 16–18 of the EU General Data Protection Regulation
section 25 of the Act on the Processing of Personal Data in Criminal Matters and in the Maintenance of National Security, in matters related to the scope of the Act

4 Other rights and additional information

A data subject has the right to object to the processing of personal data concerning them under the conditions laid down in data protection legislation. In addition, the legislation gives the data subject the right not to be subject to a decision based solely on automated processing.

The data subject has the right to receive notifications of personal data breaches from the controller under the conditions laid down in data protection legislation.

More detailed information on the exercise and content of the above-mentioned rights:

Articles 21–22 of the EU General Data Protection Regulation
chapters 4 and 5 of the Act on the Processing of Personal Data in Criminal Matters and in the Maintenance of National Security, in matters related to the scope of the Act

If necessary, the controller will provide additional information on the exercise and implementation of the rights of the data subject. General information on the rights of data subjects is also available in the material published by the Office of the Data Protection Ombudsman.

www.tietosuoja.fi/en

5 Right to lodge a complaint with a supervisory authority

A data subject has the right to lodge a complaint with the supervisory authority if the data subject considers that the processing of personal data concerning them violates data protection legislation.
According to Article 55(3) of the EU General Data Protection Regulation, the supervisory authorities referred to in the Regulation are not competent to supervise processing operations of courts acting in their judicial capacity. Correspondingly, under section 45 of the Act on the Processing of Personal Data in Criminal Matters and in the Maintenance of National Security, the enforcement provisions of the Act do not apply to courts.

You can complain to the Chancellor of Justice or the Parliamentary Ombudsman if you consider that an authority, public official or other party performing a public duty has acted incorrectly or neglected their obligations.

Contact information

Chancellor of Justice
Visiting address: Snellmaninkatu 1 A, Helsinki
Postal address: PL 20, FI-00023 VALTIONEUVOSTO, FINLAND
Telephone: +358 29 51 62902
Email: kirjaamo@okv.fi

Parliamentary Ombudsman
Visiting address: Arkadiankatu 3, 2nd floor, Helsinki
Postal address: Office of the Parliamentary Ombudsman, FI-00102 EDUSKUNTA, FINLAND Telephone: +358 9 4321
Email: oikeusasiamies@eduskunta.fi

Office of the Data Protection Ombudsman
Visiting address: Lintulahdenkuja 4, Helsinki
Postal address: PL 800, FI-00531 HELSINKI, FINLAND
Telephone: +358 29 56 66700
Email: tietosuoja@om.fi