Processing of personal data in investigative tasks

Purpose of processing personal data

The purpose of the processing is laid down in section 7 of the Act on the Processing of Personal Data by Finnish Customs (650/2019). The content of the personal data to be processed in these tasks, i.e. investigations, is laid down in section 8 of the Act.

According to section 7, the customs authority is permitted to process personal data in order to investigate customs offences and to forward the cases for consideration of charges.

Finnish Customs has the right to process personal data obtained through technical surveillance including biometric data, in order to monitor compliance with customs legislation and other legislation under Customs’ supervisory competence as well as in order to establish a person’s identity according to section 28 of the Customs Act. 

In the context of automated facial recognition, authorities also have the right to process personal data obtained through technical surveillance by comparing it with personal data stored based on sections 8 and 10 for conducting a measure aimed at preventing, investigating or uncovering a criminal offence, or for implementing a procedure involving the use of a coercive measure.

In order to process personal data in investigative tasks, the data must concern a person, who is

  • suspected of an offence or complicity in an offence;
  • younger than 15 years of age and suspected of a criminal act;
  • a subject of a criminal investigation;
  • reporting an offence or is an injured party;
  • a witness;
  • a victim;
  • a provider of additional information related to the investigation

Categories of personal data

Basic details collected regarding the persons are names, date and place of birth, personal identity code, gender, native language, communication language, civil status, citizenship or lack of citizenship and nationality, domicile and place of residence, occupation and education, contact information, information in the documentation necessary to establish identity, in the case of a foreign national the parents' names, travel document information and other information concerning border-crossing, registration number of vehicle, customer number issued by the authority, information on the person’s death or declaration of death and information on guardianship, declaration of bankruptcy or imposition of a business prohibition.

In addition to the basic details of the previously mentioned person, Customs may process the person’s following personal data:

  1. specifications, descriptions and classifications connected to a customs task, action and transaction; 
  2. personal identifying characteristics to establish identity, including fingerprints, handprints and footprints, handwriting, voice and odour samples, DNA profiles, facial images and other biometric data;
  3. information for the purpose of safeguarding the safety of a person who is the subject of an action or the occupational safety of an official, concerning the person’s health and its monitoring or the treatment of his or her condition and concerning the danger presented by or unpredictability of the subject or the person; and information that describes or is intended to describe a criminal act, punishment or other consequence of an offence;
  4. identification information on a decision by the prosecutor or court; information on whether the person was convicted, his or her charges or punishment waived, or his or her charges dismissed, ruled inadmissible or dropped; and information on whether the decision is final.

Regular disclosure of personal data

According to sections 20 and 21 of the Act on the Processing of Personal Data by Finnish Customs, personal data can be disclosed to other authorities as well as abroad according to sections 23 to 25. Data can be disclosed through a technical interface or as a set of data. 

Customs may also disclose data via a public information network and for the purpose of informing the general public and receiving leads from the public, where this is necessary for the purpose of crime prevention, returning property to its owner or for investigative reasons.

Personal data retention and disposal times

The data are deleted in accordance with sections 27 and 28 of the Act on Processing Personal Data by Finnish Customs. The disposal of data depends firstly on whether the personal data relate to a criminal case or if the personal data are processed for some other investigative reason. If the data relates to a criminal matter, the provisions for disposal vary according to whether the matter was transferred to the prosecutor or if it is some other criminal matter. 

Contact person of the data controller and additional information

Pirkko Alamäki-Karkiainen 
pirkko.alamäki-karkiainen(at)tulli.fi