On 3 June 2010, the European Commission warned Finland that the Finnish Data Protection Law may infringe the Data Protection Directive (Directive 95/46/EC) because it does not protect personal tax information published in the media. This will lead to an amendment of the Finnish Personal Data Act in the near future.
The Commission referred to the case considered by the European Court of Justice (ECJ) and the Supreme Administrative Court of Finland, where a company had annually published the tax data of 1.2 million persons in a local newspaper and transferred such data to another company on a CD to be processed in connection with a chargeable SMS service.
Section 2.4 of the Finnish Personal Data Act states that the Act does not apply to personal data files containing, solely and in unaltered form, data that has been published by the media. Additionally, according to Section 2.5 of the Personal Data Act, personal data may be processed for purposes of journalism and artistic or literary expression, provided that it complies with certain provisions of the Act.
Pursuant to Article 9 of the Data Protection Directive, Member States shall provide for exemptions or derogations from certain provisions of the Directive for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression, only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression. Additionally, under the Directive, personal data may only be collected for legitimate purposes and may only be further processed for the specific purposes for which it is was collected.
The ECJ and the Finnish Supreme Administrative Court confirmed that the exemption under Section 2.4 allowed by the Finnish Personal Data Act does not conform with the exemptions allowed under the Data Protection Directive. On 16 December 2008, the ECJ ruled that the collection and sale of personal tax data did not constitute a journalistic purpose and was therefore not covered by the derogation in Article 9 of the Data Protection Directive. The Supreme Administrative Court confirmed this decision on 23 September 2009 and further ruled that Section 2.4 of the Personal Data Act could not be interpreted that the personal data, once disclosed by the media, could then be processed for any purposes and by any party without the requirement to comply with the Personal Data Act.
Although the Finnish Supreme Administrative Court confirmed ECJ’s decision, Finland did not take action to amend its legislation to comply with the Data Protection Directive. For this reason, the Commission warned Finland on 3 June 2010.
The Ministry of Justice of Finland gave its response to the Commission in August 2010. According to a representative of the Ministry of Justice, Finland responded to the Commission that Finland will amend the Personal Data Act by removing Section 2.4 of the Act. The Government Bill regarding the matter was given to the Parliament on 22 October 2010. Pursuant to the Government Bill, Section 2.4 has been proposed to be removed from the Personal Data Act. The detailed schedule for the amendment cannot be given yet, but due to the technical nature of the amendment and ECJ’s decision, it is probable that the processing of the amendment will not take very long. Processing of this issue has been concluded on 16 November 2011 but the amendment is not published yet. The amendment, although not major in nature, is very important as a clarification and will strengthen the protection of privacy of the persons whose personal data has been disclosed by the media.