On December 27, 2023, the Office of the Data Protection Ombudsman (the Ombudsman) announced that Parliament has approved amendments to the Data Protection Act and the Data Protection Act in Criminal Matters. The Ombudsman further stated that Parliament aims to bring the laws into line with EU data protection legislation.

What are the changes? 

Starting in 2024, the authorized data protection office will have to decide on a person's complaint or inform the person of the estimated date of the decision within three months of a case being initiated. If no decision or estimate is provided within three months, a person may appeal to an administrative court. This amendment will not apply retroactively to cases initiated before 2024. 

Also, to speed up the processing time of cases, the Ombudsman's office will have the power to delegate decision-making powers to officials acting as representatives. These representatives will be able to rule on cases where the law being applied is well established. 

Lastly, clarifications have been made regarding the rules for the processing of personal identification numbers. The personal identification number or a combination of the number and name of a data subject may not be used exclusively to identify a person. 

What are the next steps?

The amendments will enter into force on January 1, 2024. 

You can read the press release, only available in Finnish, here.