Processing of personal data for customs supervision and tax control

Purpose of processing personal data

The purpose of the processing is laid down in section 12 of the Act on the Processing of Personal Data by Finnish Customs (650/2019). In order to carry out customs supervision and tax control, Customs can process personal data concerning declarations and other information provided to Customs based on legislation as well as data concerning customs supervision and tax control measures already carried out, and follow-up measures proposed based on these controls. Furthermore, personal data may be processed based on a request for investigation, based on a criminal offence report or based on a reason and solution referred to in the Act on imposition of a fine and summary penal fee (754/2010). Data can also be processed for targeting customs supervision and tax controls. Details related to goods import can be processed as well as details of the number of border crossings and their dates. The processing may be tasks based on legislation and agreements between different ministries, agencies, EU bodies and international organisations. 

Finnish Customs has the right to process personal data obtained through technical surveillance including biometric data, in order to monitor compliance with customs legislation and other legislation under Customs’ supervisory competence as well as to establish a person’s identity according to section 28 of the Customs Act. 

Personal data related to the person, their vehicle, some other transport unit, goods, documents and postal parcels are processed. The data can concern internal and external EU trade as well as commercial and private traffic.

Categories of personal data

The following data of private customers are collected:

  • names, date and place of birth, personal identity code, gender, native language, communication language, civil status 
  • citizenship or lack of citizenship and nationality, domicile and place of residence, occupation and education, contact information
  • information in the documentation necessary to establish identity, in the case of a foreign national the parents' names, citizenship and nationality 
  • travel document information and other information concerning border-crossing, registration number of vehicle, customer number issued by the authority, information on the person’s death or declaration of death and information on guardianship, declaration of bankruptcy or imposition of a business prohibition.

The following data of businesses are collected:

  • name, personal identity code, travel document information, email address and telephone number (mobile phone)
  • data of birth, other telephone numbers and other contact information
  • nationality data

Sources of personal data

Some of the data are obtained from the persons themselves and some are obtained based on section 16 of the Act on Processing Personal Data by Finnish Customs. Data are also obtained from the Digital and Population Data Services Agency, Customs’ declaration service, the Police, the Border Guard as well as the Immigration Service.

Regular disclosures of personal data

According to sections 21 of the Act on the Processing of Personal Data by Finnish Customs, personal data can be disclosed to other authorities. Data can be disclosed based on EU agreements or bilateral or multilateral international agreements. The disclosure of data can also be based on specific national legislation. Data can be disclosed through a technical interface or as a set of data. Personal data can further be transferred to other functions within Customs for the performance of official tasks. 

Personal data retention and disposal times

In accordance with legislation, data are deleted no later than at the end of the sixth calendar year following the year of storage.

Contact person of the data controller and additional information

Pirkko Alamäki-Karkiainen 
pirkko.alamäki-karkiainen(at)tulli.fi