The case register of the Office of the Data Protection Ombudsman is a logical entity that contains information describing the handling of cases opened to the Office of the Data Protection Ombudsman in connection with carrying out the tasks assigned to the Office by the Data Protection Act (1050/2018). The case register also deals with matters and documents related to the support processes of the Office of the Data Protection Ombudsman.

The case register is a register of cases received or instituted, their processing stages, measures, and documents and other information related to the measures. Information in the case register are also included in the case management system of the Office of the Data Protection Ombudsman, data in paper format and the shared information systems of the central government.

The processing of personal data by the Office of the Data Protection Ombudsman is based on statutory duties, and personal data are collected and processed only to the extent necessary for the performance of the Agency’s duties. You can read more about the data protection practices of the Office of the Data Protection Ombudsman on the page Our data protection policy.

The case register of the Office of the Data Protection Ombudsman consists of five data repositories: the administrative data repository, the international operations data repository, the access management repository, the data repository for the supervision of data protection and the communications data repository.

The data repositories of the Office of the Data Protection Ombudsman are not available openly through a technical interface. An exception to this are the publications in the communications data repository that are available on the public website.

The data repositories are described in more detail in the following sections.

The administrative data repository is maintained for the purpose of registering administrative matters of the Office of the Data Protection Ombudsman. The data repository covers data related to the personnel, finances, data management and information service, among other things.

The administrative data repository contains data stored both permanently and for a fixed term. The data are mostly public. However, depending on the case, the material may be non-disclosable.

The administrative data repository includes the following categories of data:

• Personnel data
• Employment relationship data
• Financial information
• Invoicing and payment information
• Corporate and community information
• Records management information
• Information on decisions in administrative matters

Information systems: case management system, shared central government information systems (e.g. Kieku, Valtiolle.fi, Tahti and Handi services).

Search Factors: case ID, name of the case or document, type of document, initiator, name of the person, name of the company or community, or business ID.

The repository of international operations is maintained for the management of data arising from the activities of the Data Protection Ombudsman as Finland’s representative to the European Data Protection Board (EDPB) and other international cooperation.

The repository of international operations contains data that are stored both permanently and for a fixed term. The data are partly public. Public access to EDPB’s data is in line with the EDPB guidelines and the Regulation (EC) No 1049/2001 of the European Parliament and of the Council regarding public access to European Parliament, Council and Commission documents.

The repository of international operations includes the following categories of data:

• Meeting information
• Decision information
• Instructions and recommendations
• Reporting information

Information systems: case management system, Internal Market Information System (IMI), Confluence.

Search Factors: document number, document date, case ID, EU GDPR article number, name of the controller and processor, EDPB subgroup.

The access management data repository is maintained for the management of the access rights and log data of the organisational users at the Office of the Data Protection Ombudsman. The data repository includes data that are stored permanently and for a fixed term. The data are mostly non-disclosable.

The access management data repository includes the following categories of data:

• User information
• Access and access control data
• Access rights information
• Log data

Information systems: log management service, user directory (AD), IdM identity and access rights management service.

Search Factors: name of the user, date of the event (date, time), case that is or was being processed.

The data repository for the supervision of data protection legislation is maintained for the management of data arising from carrying out the duties specified for the Data Protection Ombudsman and the Office of the Data Protection Ombudsman in the Data Protection Act (1050/2018), the EU General Data Protection Regulation (EU 2016/679) and the Act on the Processing of Personal Data in Criminal Matters and in Connection with Maintaining National Security (1054/2018).

The data repository for the supervision of data protection legislation contains data that are stored for a fixed term. The data are mostly public. However, depending on the case, the data may be partially or completely non-disclosable.

The data repository for the supervision of data protection legislation includes the following categories of data:

• Customer information
• Corporate and community information
• Ex ante control data
• Ex post control data
• Information on influencing and general guidance

Information systems: case management system and separate register.

Search Factors: case ID, name of the case or document, document type, initiator, name of the person, name of the company or community, or business ID.

The communications data repository is maintained for the purpose of managing the data generated by the communications of the Office of the Data Protection Ombudsman. The data in the communications data repository may include newsletters from the Office of the Data Protection Ombudsman, electronic and printed publications, social media content and contact details of stakeholders, for example.

The communications data repository contains data stored both permanently and for a fixed term. The data are mostly public.

The communications data repository includes at least the following categories of data:

• Publication data
• Newsletters and bulletins
• Images and video
• Corporate and community information
• Social media updates

Information systems: case management system, Shared Publishing Platform YJA, social media channels used by the Office of the Data Protection Ombudsman (X, LinkedIn).

Search Factors: name or business ID of the company or community, name of the publication, language of the publication, format of the publication (electronic or printed), date of publication.

Some of the data in the communications data repository are available on the page Julkaisut (Publications, in Finnish) on the website of the Data Protection Ombudsman.

The principle of publicity and grounds for non-disclosure

According to the principle of openness (section 12, subsection 2 of the Constitution of Finland 731/1999) and section 1 of the Act on the Openness of Government Activities (621/1999), official documents are, in principle, public unless their publicity is specifically restricted by law. Everyone has the right of access to public documents. The main grounds for the non-disclosure of official documents are listed in section 24 of the Act on the Openness of Government Activities.

The Office of the Data Protection Ombudsman discloses information to those who request it in accordance with the Act on the Openness of Government Activities. As a rule, the data of the Office of the Data Protection Ombudsman are public. Depending on the case, they may nevertheless be non-disclosable. The decision on non-disclosure is made separately in each case.

Submitting a request for information

Requests for information addressed to the Office of the Data Protection Ombudsman are sent to the Registry, where they are registered for the purpose of monitoring the deadlines. The Registry sends the requests for information to the right party within the organisation for a response.

A request for information may be free-form, but the requested documents must be identified in the request as clearly as possible. The Office of the Data Protection Ombudsman can assist customers in identifying the document, if necessary.

Contact details of the Registry:

E-mail: [email protected]
Telephone: +358 (0)29 566 6700
Postal address:
Office of the Data Protection Ombudsman
P.O. Box 800
00531 Helsinki, Finland

If data are disclosed, it may be necessary to charge a fee in accordance with the Decree of the Ministry of Justice (646/2024) and the Decision OEV-HPY/88/2025 by the Agency for Special Authorities in Judicial Administration (in Finnish).