Processing of personal data in the Authorisation Service

Purpose of processing personal data

The Customs Authorisation Service grants authorisations upon application to companies and private individuals. The authorisations include authorisations for simplified customs procedures, authorisations for transferring payments of taxes or customs duties or authorisations granting exemption from customs duties for goods. Personal data are processed when processing applications as well as when granting and managing authorisations.

The Authorisation Service processes applications for registering to become a customer, for registering as a message declarant as well as registering for EORI and REX. It manages guarantees provided as collateral by businesses to Customs, maintains Customs’ customer register by recording data of Customs’ customers with authorisations, and of message exchange customers. The service also provides information to Customs’ authorisation customers during the authorisation process.

The Authorisation Service processes and replies to customer feedback and feedback on accessibility concerning the authorisation services. The Authorisation Service processes the replies in customer surveys related to the authorisation services. The Authorisation Service also processes control reports of personal data collected from the Customer Register and the Authorisation Register as well as compiled lists of email addresses of customers in the Customer Register and Authorisation Register, for the purpose of customer surveys. 

In the Authorisation Service, personal data are also processed for the maintenance of customer relations, in the follow-up of the quality of the authorisation service and correctness of customs activity, in the planning of authorisation services, in the development of the service function as well as service channels and transaction channels. 

The processing of personal data is based on legislation. Personal data for the performance of Customs’ statutory tasks are processed in accordance with the Customs Act (304/2016) and the Union Customs Code (EU 952/2013). Appendix A of the Commission Delegated Regulation (EU) 2015/2446 and Appendix A of the Commission Implementing Regulation (2015/2447), define the data requirements for applications and decisions submitted to the authorisation services. The basis for the legal processing of personal data in accordance with the Data Protection Regulation is compliance with the controller’s statutory obligation.

Categories of personal data

The following personal data of private customers are collected: 

  • first and last names, personal identity codes, email addresses and phone numbers (mobile phones)
  • date of birth, passport number, other than mobile telephone numbers, home address or other address 
  • position, occupation, education, country of residence, native language, communication language, bank account number, status of representation and mandate
  • identification numbers for customs transactions
  • details of transactions and customer transactions

The following data are collected of responsible persons and contact persons at businesses:

  • first and last names, personal identity codes, email addresses and phone numbers (mobile phones)
  • position, occupation, education, country of residence, native language, communication language, bank account number, status of representation and mandate
  • identification numbers for customs transactions
  • details of transactions and customer transactions 

Personal data belonging to special categories (previously called sensitive personal data) may be included in the customers’ applications or attached documents.

Sources of personal data

Customer details are accumulated to Customs Authorisation Service from authorised transactions and message exchange transactions as well as from customs clearance, the corporate audit and customer services. Data are also obtained from customs clearances at Customs offices and Customs Enforcement as well as from other functions at Customs reported with the form ‘Observation report relating to Customs procedures.’ Personal data are also transferred to the Authorisation Service with the amendment request forms in the My Details service as well as from replies in customer surveys. 

Regular disclosures of personal data

The data of the Authorisation Service are disclosed to parties concerned. 

Data from the Authorisation Service can be transferred on reasonable grounds to other functions within Customs, for the performance of Customs’ official tasks.

Furthermore, data may be disclosed to other authorities for the performance of official tasks according to the Act on the Openness of Government Activities of Finland (21.5.1999/621) and according to the Act on the Processing of Personal Data by Finnish Customs (639/2015). Data are disclosed when the right to information has been prescribed by special provisions in legislation. Most commonly, data are transferred upon request to the following authorities based on the legal right to information:

  • The Tax Administration for carrying out taxation and for tax control 
  • To the Police, for the investigation and uncovering of offences, for safeguarding justice and social peace as well as for duties related to maintaining public order and security. 

Data are processed by Customs’ personnel who process matters related to Customs’ authorisations and by other personnel who need the data in their duties.

Personal data retention and disposal times

Materials and supporting information, which are part of the assessment when granting an authorisation (data from the Authorisation Management System), must be retained for at least 3 years after the end date of the authorisation’s validity. Authorisations are valid from six months and upward until further notice. The required minimum storage time is based on Article 13 of the Commission’s Implementing Regulation (2015/2447).

Authorisation decisions (data in the Authorisation Register) are stored indefinitely in electronic format from 2016. The storage time is based on a decision by the National Archives of Finland as of 15 March 2018, KA/10021/07.01.01.03.02/2017.

Authorisation applications are retained for six years following the year of the authorisation decision.

Data of EORI and REX registrations are deleted from the systems 10 years from the date of registration. The storage time is based on Annex 12-01 of the Commission’s Delegated Regulation.

Detailed storage times of documents for the authorisation procedures are entered in Customs’ data management plan. The storage times are 3-10 years depending on the document type (documents for import, transit, warehousing, special procedures, and authorisations for simplifications and authorisation procedures for taxation). 

Other data of the Authorisation Service are stored as follows: 

  • Data of customer registrations are stored for as long as the registration is valid and the following 6 years. 
  • Changes to customs office details arriving via the My Details service, are retained for as long as the authorisation/registration is valid and the following 6 years. 
  • Responses provided in customer surveys are retained for as long as the authorisation/registration is valid and the following 6 years. 
  • Data of control reports related to personal data are stored indefinitely. 
  • Lists containing customer email addresses are stored for as long as the authorisation/registration is valid. 
  • Customer feedback and responses are stored for a maximum of two years.
  • Feedback on accessibility and responses are saved indefinitely. 

When the time for retaining personal data has ended, the data are deleted in accordance with Customs’ normal practice based on an annual review. 

Contact person of the data controller and additional information

Sari Bjong
sari.bjong(at)tulli.fi

Points to consider

Read more

Any questions?

Contact Customs Information Mon–Fri 8 am–4.15 pm

Please have a look at the frequently asked questions.

If you have a question about the arrival of parcels, its contents or the handling fee, please contact Posti.

Customs Information Service