New act on migration authorities’ processing of personal data to bring clarity and underline legal protection

The various provisions on the processing of personal data by authorities dealing with migration matters will be brought together in a new act. The Government submitted the bill for approval on Thursday 20 August. The President of the Republic is to approve the bill on Friday. The act will then enter into force on 1 September.

The new act will replace the old Act on the Register of Aliens, which is more than 20 years old, and will complement the provisions of the EU Data Protection Regulation, the Finnish Data Protection Act, the Act on the Processing of Personal Data in Criminal Matters and in Connection with Maintaining National Security, and the Act on Information Management in Public Administration. The new act will also incorporate other provisions concerning the processing of personal data laid down in other acts that apply to the migration authorities. In this way, the provisions concerning the processing of personal data will be clarified both from the perspective of the party applying the law and the rights of the data subject.

The purpose of the reform is to ensure that the constitutional requirement to regulate the protection of personal data by law is met in an appropriate manner by the migration authorities. The Act on the Register of Aliens, adopted in 1998, does not currently meet the requirements for digitalisation, for example. This complex issue has been resolved in a way that takes into account the views of the Constitutional Law Committee, the requirements of EU data protection legislation and the operating environment of the migration authorities.

There are a number of authorities that deal with migration matters. The new act on migration authorities’ processing of personal data will apply to the processing of personal data in the activities of, for example, the Finnish Immigration Service, reception centres and detention units, as well as the police, the Finnish Security and Intelligence Service, the Border Guard, Customs, the Foreign Service, Employment and Economic Development Offices (TE Offices) and the Centres for Economic Development, Transport and the Environment (ELY Centres). These authorities act as data controllers responsible for the data.

General legislation needed for automated decision-making

During parliamentary consideration, the proposal for automated individual decisions was removed from the bill. The Ministry of the Interior also considered that provisions could not, in the end, be given on the automated procedure in this context. 

The aim of the proposal had been to allocate the limited resources of the Finnish Immigration Service in such a way that simpler matters could be resolved as efficiently as possible. However, this would involve difficult legal issues that should be resolved through general legislation. The Ministry of Justice has begun preparations for the drafting of general legislation.

Secrecy provisions brought together in the Act on the Openness of Government Activities 

With the new act, provisions on secrecy that apply to the migration authorities will be only those that are laid down in the Act on the Openness of Government Activities. Until now, the Act on the Register of Aliens, which is to be repealed by the new act, has also included secrecy provisions. 

In future, the possibility of harm or inconvenience caused by the publication of a document will no longer serve as grounds for the secrecy of the document. Under the current Act on the Openness of Government Activities, there will be grounds for secrecy if the safety of the person concerned or of his or her friends or family is at risk. The migration authorities will also continue to apply certain other grounds for secrecy laid down in the Act on the Openness of Government Activities. For example, personal health data are always confidential.

When the reform was being prepared, the aim was to keep the secrecy provisions that apply to the migration authorities unchanged as far as possible. However, the Constitutional Law Committee stated that secrecy at the former level was incompatible with the principle of public access to official documents, as there are information needs involved that are justified in terms of this principle. These relate, among other things, to opportunities for public debate and exchange of views, assessment of the implementation of good governance and legal protection, and monitoring of the use of public funds. 

Inquiries:

Tuuli Tuunanen, Senior Specialist, tel. +358 295 488 658, [email protected]