1
NB: Unofficial translation
Personal Data Act
(523/1999)
Chapter 1 — General provisions
Section 1 — Objectives
The objectives of this Act are to implement, in the processing of personal data, the
protection of private life and the other basic rights which safeguard the right to privacy, as well as to
promote the development of and compliance with good processing practice.
Section 2 — Scope of application
(1)
The provisions of this Act apply to the processing of personal data, unless otherwise
provided elsewhere in the law.
(2)
This Act applies to the automatic processing of personal data. It applies also to other
processing of personal data where the data constitute or are intended to constitute a personal data file
or a part thereof.
(3)
This Act does not apply to the processing of personal data by a private individual for
purely personal purposes or for comparable ordinary and private purposes.
(4)
This Act does not apply to personal data files containing, solely and in unaltered form,
data that have been published by the media.
(5)
Unless otherwise provided in section 17, only sections 1—4, 32, 39(3), 40(1) and (3), 42,
44(2), 45—47, 48(2), 50, and 51 of this Act apply, where appropriate, to the processing of personal
data for purposes of journalism or artistic or literary expression.
Section 3 — Definitions
In this Act,
(1) personal data means any information on a private individual and any information
on his/her personal characteristics or personal circumstances, where these are identifiable as
concerning him/her or the members of his/her family or household;
(2) processing of personal data means the collection, recording, organisation, use,
transfer, disclosure, storage, manipulation, combination, protection, deletion and erasure of
personal data, as well as other measures directed at personal data;
(3) personal data file means a set of personal data, connected by a common use and
processed fully or partially automatically or sorted into a card index, directory or other manually
accessible form so that the data pertaining to a given person can be retrieved easily and at
reasonable cost;
(4) controller means a person, corporation, institution or foundation, or a number of
them, for the use of whom a personal data file is set up and who is entitled to determine the
use of the file, or who has been designated as a controller by an Act;
(5) data subject means the person to whom the personal data pertains;
(6) third party means a person, corporation, institution or foundation other than the
data subject, the controller, the processor of personal data or someone processing personal
data on the behalf of the controller or the processor;
(7) consent means any voluntary, detailed and conscious expression of will, whereby
the data subject approves the processing of his/her personal data;
(8) personal credit data means the personal data intended for the assessment of the
financial situation, ability to keep a commitment or credibility of a private individual; and
(9) credit data file means a file containing personal credit data.
Section 4 — Application of Finnish law
(1)
This Act applies to processing of personal data where the controller is established in the
territory of Finland or otherwise subject to Finnish law.
(2)
This Act applies also if the controller is not established in the territory of a Member