Personal identity codes not to be used on invoices

The Data Protection Ombudsman has ordered an organisation to change its practice of using personal identity codes to identify customers on invoices. The company printed the personal identity codes of customers on its invoices in addition to the name of the customer. Customers can be identified with various customer or reference numbers instead of their personal identity codes.

The Office of the Data Protection Ombudsman has received a complaint about an organisation’s practice of adding the personal identity codes of the recipients to invoices for its health care services. According to the organisation, the personal identity codes were printed on the invoices to identify the customers.

In the opinion of the Data Protection Ombudsman, printing personal identity codes on invoices for the purpose of identifying the customers is not in compliance with data protection legislation, and there is no justified need for using personal identity codes in this connection.

The State Treasury has issued an order prohibiting the use of personal identity codes on sales invoices. Furthermore, the Data Protection Act prohibits the unnecessary use of personal identity codes on documents printed or drawn up on the basis of a personal data file.

The customer’s personal identity code is not required on printed invoices for debt collection, enforcement or insurance claims, for example. Neither is the personal identity code included in the information printed on administrative decisions.

Data Protection Ombudsman’s decision on printing personal identity codes on invoices in Finlex