Answers to questions about biometric data regulation

Biometric data means personal data that result from technical processing, such as facial images and fingerprints, and allow the unique identification of a person. 

Biometric data held in the passport and identity card register could be used more extensively than at present. The police would not be given a right to collect new data. Instead, the proposal would change the purpose for which the police could use the data they already have.

According to the proposal, biometric data could be used to prevent a significant danger to someone's life, health or liberty. In certain cases, biometric data could be used to establish a person's identity, if using other data could not ensure reliable identification. If the conditions specified in the legislation were met, biometric data could also be used as reference material for preventing and investigating certain serious offences, such as homicides and serious violent and sexual offences. Finally, the Finnish Security and Intelligence Service and the Defence Forces could obtain biometric data to protect national security against activities that pose a serious threat.

Fingerprint data and automated facial recognition are more reliable ways of identifying a person than other methods. Biometric data is particularly useful in preventing, detecting and investigating the most serious crimes. 

The police already use the suspects' facial images and fingerprint data in crime prevention. The use of facial images held in passport and identity card registers would bring significant additional benefits, as digitalisation has increased the importance of images and video in crime prevention and investigation. In practice, fingerprint comparisons would be used less often than image data.

Biometric data held in the passport and identity card register or gathered under the Aliens Act could be used to prevent, detect and investigate certain types of serious offences. 

According to the proposal, these would include serious treason and espionage offences, terrorist offences, endangerment, certain offences typically linked to organised crime, and all offences for which the most severe punishment is at least six years of imprisonment. For example, those investigating homicides and serious violent and sexual offences could use biometric data as reference data.

Fingerprints and other biometric data are sensitive personal data. There would be specific and detailed provisions on the purposes, conditions and procedures of processing such data. 

For example, the use of biometric data would be limited in crime prevention to combating certain serious crimes. Data could only be used at the request of a public official with the power of arrest or of a commanding police officer of the Finnish Security and Intelligence Service. Only the National Bureau of Investigation would be allowed to compare data after verifying that the request is legal and complies with the conditions for using biometric data. In addition, before using biometric data, the police should always make sure that the person cannot be identified using any other information held by the police.

The proposal complies with the requirements of EU data protection legislation

Some EU countries store the biometric data of passports and identity cards in a register and use it for crime prevention. For example, Estonia can use fingerprints and facial images taken for passports and identity cards to investigate crimes when certain conditions are met. Norway also uses facial images taken for passports and identity cards in crime prevention, and Sweden is considering the use of passport photos. 

It is an official duty of the police and other authorities to process personal data in compliance with the law. Data protection legislation lays down detailed rules on information security and on how the processing of personal data is supervised. 

Under the data protection regulations, the Finnish Data Protection Ombudsman must monitor the processing of personal data by the police. The National Police Board and police units also regularly monitor the use of data systems as part of their internal oversight of legality. Finally, the Parliamentary Ombudsman, the Office of the Chancellor of Justice, and the Ministry of the Interior assess the lawfulness of the activities and the processing of personal data by the police. The police administration develops data processing together with the data protection authorities and the authorities overseeing legality.

EU data protection legislation lays down provisions on the data subject's legal remedies and on the data controller's responsibilities. Finland's national Data Protection Act and the Criminal Matters Personal Data Act lay down provisions on the protection of data subjects under the law and the sanctions for unlawful data processing. For example, the data subject has the right to refer a matter to the Data Protection Ombudsman for consideration. Data subjects also have the right to receive compensation if they are harmed by unlawful processing of personal data.