Processing of personal data in cash flows (tax collection)

Purpose of processing personal data

Cash flows cover tax collection by Customs and related financial administration. This includes invoicing, payment monitoring, repayments, payment transactions, cash operations, collection measures as well as the management of guarantees and auxiliary accounts related to customs debts and liabilities, shipping dues as well as related public and commercial service charges.

Excluded from cash flows are, e.g. processes related to the management of Customs’ operational expenses, such as the processing of salaries, rents and invoices. These financial data are processed in the government’s joint administration system.

Personal data in the cash flows are processed in the following contexts:

Related to the cash flow (payments, payment transactions, monitoring of payments as well as managing guarantees) and to debt collection as well as supervision of tax recovery.
For the development of systems and applications related to the cash flow process.
For storage of personal data related to the cash flow process.
For the processing of customer feedback and feedback on accessibility, concerning the services related to the cash flow process, and responding to feedback.
For performing tasks related to Customs’ administrative tasks and to Customs’ orders and instructions.

The basis for the legal processing of personal data in accordance with the Data Protection Regulation is compliance with the controller’s statutory obligation.

Categories of personal data

Data collected from private persons are the name, date of birth, personal identification code, address and telephone number or other contact information, citizenship and for a foreign person also travel document information, citizenship as well as contact information such as email, telephone number, address and country of residence.

Data collected from contact persons of companies are the name, position in the company as well as email and telephone number.

Transaction and customer transaction details related to Customs’ cash flows (payments, payment transactions and the monitoring of payments as well as guarantee management) and debt collection as well as to the supervision of tax recovery are:

customs clearance decision number
position of an individual
status of representation
name of payee, who can be someone other than the debtor
name and bank account number of the recipient of the repayment
reference information related to sequestration cases or distraint settlements
data by which the customs decision can be connected to the identifier in the Commission’s notification system for reporting fraud and irregularities
personal data related to payment prohibition and accounting specification documents in distraint cases: name of individual, personal identity code, reference to legal procedure
personal data in documents related to depreciation from accounts: court judgements and decisions
customer and supplier details in the financial administration system as well as information on payments and penalty fees (data corresponding to customs clearance decisions) in the Kieku system
information on manual tax repayments as well as on invoicing and bookkeeping records (data on customs clearances and repayment decisions, bank account numbers and interface reports that contain the same information as the decisions on charges and their payments) in the Handi system
additional data related to the individual in the data systems’ description fields, which can contain references to a criminal procedure
personal data related to the management of guarantees: basic data of the person providing a guarantee such as first and last name, contact information such as address details, bank account number and BIC, number of customs clearance decision, transit reference (MRN) transit MRN, customs declaration MRN, reference number of guarantee (GRN), basic information on the company’s contact persons and contact information, identification code of foreign customer (country code and foreigner’s identity code transmitted from Suomi.fi’s authorisation service for foreign citizens (FinnAuth) and date of birth as well as identity code of domestic customer (country code and identity code)
personal data related to payment arrears of responsible persons of companies: name and position in the company
data for debt collection related to taxes and supervision
personal data in applications for payment deferment and in feedback on accessibility

Sources of personal data

Personal data are obtained from the persons themselves, from enforcement authorities, district courts, Suomen Asiakastieto OY as well as from customs clearance and taxation systems.

Regular disclosures of personal data

Data to be processed in cash flows are disclosed to enforcement authorities (domestic and foreign), the National Audit Office of Finland (NAOF), the European Commission, authorities on whose behalf Customs collects or has collected taxes or charges (Traficom, Finnish Motor Insurers’ Centre, Tax Administration), National Bureau of Investigation (reports of money laundering), the postal service (payment reminders) and to district courts as well as to other authorities who conduct insolvency proceedings.

Personal data can be transferred to other functions or parties within Customs for the performance of official tasks. Furthermore, data can be transferred to the National Archives of Finland if they are to be stored indefinitely.

The personal data of cash flows are processed by Customs’ personnel according to their user rights, the Tax Administration’s personnel according to their roles (content of personal data registers in joint use) as well as by the administrators of the Finnish Government Shared Services Centre for Finance and HR. Personal data of cash flows are also processed by consultants employed by Customs, when they develop applications and systems.

Personal data retention and disposal times

Personal data gathered through the cash flow process are stored for a period in accordance with statutory obligations. The regulations of the State Budget Decree (423/1988) and the Accounting Act of Finland are applied in verifications, bookkeeping records and other accounting materials. If the statutory basis for storing personal data has ended, the data are deleted in accordance with Customs’ normal practice based on an annual review.

Contact person of the data controller and additional information

Pekka Pylkkänen
pekka.pylkkanen(at)tulli.fi