Electronic services at the Office of the Data Protection Ombudsman

Instituting a case electronically

Our website features electronic forms for instituting matters falling under the competence of the data protection authority. Cases can also be instituted by delivering the materials by e-mail to the registry.

What do we use online forms for?

  • Receiving notifications concerning Data Protection Officers
  • Receiving notifications concerning personal data breaches
  • Receiving requests for prior consultation
  • Receiving requests concerning the exercise of the rights of data subjects
  • Receiving notifications concerning personal data processing violations

The data collected with the forms is not saved on our website, but is directed to the registry’s e-mail. The registry then enters the case in our case management system.

Visiting the website

Our website is open to the public and browsing it does not require registration. We collect data with cookies and the above-mentioned forms.

Social plugins

Our site includes a Twitter feed and buttons for sharing content in social media (Facebook, Twitter, LinkedIn, Google+). The site does not collect the users’ data with these social plugins. The functions opened by the share buttons are downloaded from the servers of the social media service in question.

Our processing is based on

We process personal data for the performance of a task carried out in the public interest and in the exercise of official authority vested in the Office of the Data Protection Ombudsman:

  • General Data Protection Regulation (EU 2016/679), Article 6(1), point e

We process special categories of personal data for reasons of public interest and by virtue of national legislation:

  • General Data Protection Regulation (EU 2016/679), Article 9(2), point g
  • Personal Data Act (523/1999) section 12, subsection 1, paragraph 5

The position, tasks and competence of the Office of the Data Protection Ombudsman are provided for in:

We additionally process personal data in connection with the use of electronic services in order to comply with the legislation generally applied to the activities of authorities:

  • Administrative Procedure Act (434/2003), section 8
  • Act on Electronic Services and Communication in the Public Sector (13/2003), sections 5–6

With regard to notifications concerning Data Protection Officers, we process personal data for compliance with a legal obligation to which the Data Protection Ombudsman is subject

  • General Data Protection Regulation (EU 2016/679), Article 6(1), point c
  • General Data Protection Regulation (EU 2016/679), Article 37(7)

Disclosure of data

There are no regular disclosures of data.

Data is disclosed in accordance with the Act on the Openness of Government Activities. The data and documents are public unless specifically decreed confidential by law.

Data may be disclosed also to other supervisory authorities in the EU or EEA in circumstances where we must handle complaints and investigations in cooperation with other supervisory authorities in the EU/EEA.

Your data-protection rights with regard to the processing of personal data

In this section, we describe your data-protection rights related to the use of electronic services with regard to personal data concerning others than Data Protection Officers. Information on the data protection rights related to the processing of the personal data of Data Protection Officers can be found in the section Processing of the personal data of Data Protection Officers.

Right to obtain information on the processing of personal data

  • You have the right to know for what purposes and by which methods we process your personal data.
  • The aim of this description of our data protection policies is to provide a comprehensive picture of the processing of personal data in our operations. If some aspect of our processing of personal data remains unclear, however, the description has failed in its purpose. If this is the case, you are welcome to send your questions to the Office of the Data Protection Ombudsman by e-mail (see contact details below).
  • Additional information on the right to be informed of the processing of personal data.

Right of access

Right to rectification

  • If the personal data we are processing is inaccurate, you can request us to rectify such data that concerns you.
  • If we rectify data on the basis of your request, we are obligated to notify all parties to whom we have previously disclosed your data of the rectification where viable.
  • Additional information on the right to rectification.

Right to restriction of processing

  • If you consider the data that we are processing to be inaccurate or the processing to be unlawful, or you have objected to the processing of your data, you can request us to restrict the processing of your data.
  • In such cases, we are only allowed to process your data
    • with your consent
    • if we need the data for the establishment, exercise or defence of legal claims
    • for the public interest or
    • in order to safeguard the rights of another person.
  • If we restrict the processing of data on the basis of your request, we are obligated to notify all parties to whom we have previously disclosed your data of the restriction where viable.
  • Additional information on the right to restriction of processing.

You have the right to object to the processing of your personal data by us. You can exercise this right at any time on grounds relating to your particular situation. After this, we may not continue processing your personal data except for compelling legitimate grounds which override your interests, rights and freedoms, or if the processing is necessary for the establishment, exercise or defence of legal claims. Additional information on the right to object.

The Office of the Data Protection Ombudsman does not make decisions based on automated processing. Neither does the Office create profiles on the basis of the personal data it processes.

You can send requests concerning your data-protection rights to the Office of the Data Protection Ombudsman by e-mail (tietosuoja@om.fi) or post (PL 800, 00521 HELSINKI).

The decisions of the Office of the Data Protection Ombudsman can be appealed in the competent Administrative Court according to the instructions for appeal provided by the Office of the Data Protection Ombudsman. The legality of the Office of the Data Protection Ombudsman's actions is supervised by the supreme guardians of the law, i.e. the Parliamentary Ombudsman and Chancellor of Justice.