Processing of personal data for the purpose of preventing or uncovering criminal offences

Purpose of processing personal data

The purpose of the processing is laid down in section 9 of the Act on the Processing of Personal Data by Finnish Customs (650/2019). The content of the personal data to be processed in these tasks is laid down in section 8 of the Act.

According to section 9(1), Customs is permitted to process personal data in order to prevent and uncover customs offences.

In addition, according to section 9(5), Customs may process information on observations made by customs officers and information reported to Customs regarding incidents or persons who, based on the circumstances or on the behaviour of the person, can reasonably be assessed as being connected to a customs offence (observations).

Finnish Customs has the right to process personal data obtained through technical surveillance including biometric data, in order to monitor compliance with customs legislation and other legislation under Customs supervisory competence as well as to establish a person’s identity according to section 28 of the Customs Act. 

In the context of automated facial recognition, authorities also have the right to process personal data obtained through technical surveillance by comparing it with personal data stored based on sections 8 and 10 for conducting a measure aimed at preventing, investigating or uncovering a criminal offence, or for implementing a procedure involving the use of a coercive measure.

In order to process personal data in crime prevention and detection duties, they must concern persons, who are

  1. suspected of an offence or complicity in an offence, for which the most severe punishment provided by law is imprisonment;
  2. in contact with a person referred to in paragraph 1 or seen with such a person and the contacts or meetings can be assumed to have a link with the offence due to their regularity or the circumstances or behaviour of the person;
  3. subjects of surveillance, customs supervision or crime prevention measures referred to in chapter 3, section 9 of the Act on Crime Prevention by Finnish Customs (623/2015) 

Finnish Customs may also process data on the following persons, if this is essential for the prevention or uncovering of a customs offence:

  1. witnesses to an offence;
  2. victims of an offence;
  3. persons reporting an offence or injured parties

Categories of personal data

Basic details collected regarding the persons are names, date and place of birth, personal identity code, gender, native language, communication language, civil status, citizenship or lack of citizenship and nationality, domicile and place of residence, occupation and education, contact information, information in the documentation necessary to establish identity, in the case of a foreign national the parents' names, travel document information and other information concerning border-crossing, registration number of vehicle, customer number issued by the authority, information on the person’s death or declaration of death and information on guardianship, declaration of bankruptcy or imposition of a business prohibition.

In addition to the basic details on the previously mentioned individuals, Customs may process the following personal data:

  1. specifications, descriptions and classifications connected to Customs’ task, actions and operations; 
  2. details concerning the person’s connections, lifestyle, financial situation, hobbies, and other interests;
  3. personal identifying characteristics to establish identity, including voice samples, facial images and other biometric data;
  4. details for the purpose of safeguarding the safety of a person who is the subject of an action or the occupational safety of an official, concerning the person’s health and its monitoring or the treatment of his or her condition and concerning the danger presented by or unpredictability of the subject or the person; and details that describe or are intended to describe a criminal act, punishment or other consequence of an offence

Where possible, an assessment of the reliability of the data provider or data source and the accuracy of the data shall be appended to the personal data obtained.

Regular disclosures of personal data

According to sections 20 and 21 of the Act on the Processing of Personal Data by Finnish Customs, personal data can be disclosed to other authorities as well as abroad according to sections 23 to 25. Data can be disclosed through a technical interface or as a set of data. 

Customs may also disclose data via a public information network and for the purpose of informing the general public and receiving leads from the public, where this is necessary for the purpose of crime prevention, returning property to its owner or for investigative reasons.

Personal data retention and disposal times

The data are deleted in accordance with section 29 of the Act on Processing Personal Data by Finnish Customs. Personal data are deleted no later than ten years after the last entry concerning an offence, criminal activity or action. However, the data are deleted no later than six months after making the entry, and the data referred to in paragraph 4 are deleted no later than one year after the death of the data subject.

Personal data may, however, be retained if this is necessary for investigative reasons, surveillance reasons or other justified reasons or to ensure the rights of the data subject or other parties or employees of Finnish Customs. The necessity of retaining personal data shall be reviewed at least every five years.

Contact person of the data controller and additional information

Pirkko Alamäki-Karkiainen 
pirkko.alamäki-karkiainen(at)tulli.fi