Law note · Finland
GDPR Article 22 and Data Protection Act Sections 33-34, Data Subject Rights in Finland
General Data Protection Regulation (GDPR) Articles 15 to 21 apply, including Article 22's qualified right against a decision based solely on automated processing with legal or similarly significant effect. Data Protection Act Section 33 restricts the Article 13/14 information duty, and Section 34 restricts the Article 15 access right, both on national security, defence, public order, offence prevention, or tax and public finance supervisory grounds, read directly from the Act.
Section 21 gives a right to refer a complaint to the Data Protection Ombudsman, with a three-month handling deadline and a right of appeal to an administrative court if that deadline is missed.
What it asks of an app
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Finland within one month of receipt, unless a Data Protection Act Section 33 or 34 national security, defence, public order, or tax supervisory ground applies.
- Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Finland, under General Data Protection Regulation (GDPR) Article 22.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, high_risk_decisions
Primary source: Ministry of Justice, Finland, official English translation, Data Protection Act Sections 21, 33, 34