Frequently asked questions about personal identity code

Yes. According to the Decree on Accommodation and Restaurant Services (727/1991), a traveller card must be completed for travellers checking into their accommodation, and the traveller is required to sign the card. One of the details required on the traveller card is the traveller's personal identity code.

If the price of the room is paid when checking out, the hotel's right to collect the personal identity code can also be based on the credit relationship between the hotel and customer.

Yes. One of the instances in which the processing of personal identity codes is permitted is when the unambiguous identification of the individual is important for the fulfilment of the data subject’s or controller’s rights and obligations. The processing of personal identity codes is also permitted in connection with granting credit or collecting receivables.

The insurance company asks for the personal identity code in order to determine the credit information of the insurance applicant. Insurance companies have the right to check credit information when evaluating the granting of a policy, and the credit reference agency has the right to disclose such information to the insurance company.

The processing of personal identity codes is permitted, for example, in connection with granting credit or collecting receivables. If the use of a commercial service is invoiced in arrears, the company has the right to process the customer’s personal identity code for collecting the receivable. The situation is comparable to purchasing on credit. If the service is invoiced in arrears, the company therefore has the right to ask for the personal identity code of a customer who is, e.g. opening an internet or mobile subscription or ordering a removal service.

An optician is a health care professional with an obligation to draw up patient records and store them in the manner provided for in the law. The personal identity code is entered in the records to identify the patient.

When retrieving a mail parcel or other delivery, the person retrieving the delivery will be asked to provide proof of identity. A valid identity document is required in order to ensure that the delivery is handed over to the correct recipient. The recipient will not be asked for their personal identity code as such. The final characters of the personal identity code indicated in the identity document presented by the person retrieving the delivery may be written down to show that identity has been verified upon handing over the delivery.

The post frequently has responsibility for quite valuable deliveries, and its liability for damages mostly ends when the shipment has been handed over to the correct recipient. The postal service company's right to ask for the personal identity code and record it is based on the Postal Act (415/2011).

Postal service companies maintain address files used to manage postal services and deliver shipments to the correct addresses and recipients. In addition to the recipient's name and address, the personal identity code and other information necessary for the successful delivery of shipments and safeguarding the rights of the recipients.

A customer paying by debit card can be required to prove his or her identity. The practice ensures the legal protection of both the customer and recipient of the payment.

Asking for a personal identity code is not a reliable method for identifying customers using services over the telephone or internet. The personal identity code can be known to others besides the person to whom it belongs. The personal identity code is not intended for determining identity, only for distinguishing between individuals.

Controllers may not base their identification procedures solely on asking for the personal identity code and name of individuals. It is permitted to ask for the personal identity code as one item of information among many, however, when someone calls a company’s customer service, a health care unit or an authority.

The Data Protection Ombudsman does not recommend using personal identity codes or parts thereof in invoice reference numbers. Invoices can be differentiated with other identifiers, a separate customer number or a code. It is a common principle of good data processing practice not to risk the privacy of anyone needlessly.

You should never use your personal identity code as a password for electronic services. Your password should be something only you know, but your personal identity code may be known to others. Also, it should be possible to change your password, when necessary.