Law note · Finland
Data Protection Act (Tietosuojalaki)
The Data Protection Act specifies and supplements the General Data Protection Regulation (GDPR) within the GDPR's own scope of application. Read directly from the Ministry of Justice's official English translation: Section 5 sets the digital age of consent for information society services at 13, the lower bound GDPR Article 8 permits.
Section 24 assigns GDPR Article 83 administrative fines to a collegial Sanctions Board made up of the Data Protection Ombudsman and at least two Deputy Ombudsmen, with a three-member quorum, rather than to a single official, and bars a fine against central government and several other public bodies.
Section 27 disapplies specified GDPR articles for processing performed solely for journalistic, academic, artistic or literary purposes, including Chapter V transfer rules where applying them would infringe freedom of expression.
What it asks of an app
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Finland, including data collected by crawling.
- Treat consent given by a child of at least 13 years as valid for an information society service offered directly to that child, under Data Protection Act Section 5.
- Expect a Sanctions Board of the Data Protection Ombudsman and at least two Deputy Ombudsmen, not a single official, to decide any GDPR Article 83 administrative fine against you.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot
Primary source: Ministry of Justice, Finland, official English translation, current to amendments through Act 29/2024