Office of the Data Protection Ombudsman: Government cloud services must meet data protection requirements
The Office of the Data Protection Ombudsman has assessed the practices of the Government ICT Centre Valtori, the Digital and Population Data Services Agency and the Tax Administration in the use of cloud services in 2022. The assessment found that an adequate level of data protection had not been ensured for personal data transferred to the United States through the cloud service provided by Valtori. The EU and the United States did not have a data transfer arrangement in force at the time. The assessment was part of a more extensive report examining the use of cloud services by approximately 100 public-sector organisations in the EU.
The report covered the activities of the organisations in February and April 2022. During this period, the EU and the United States did not have a valid framework that would have allowed the secure transfer of data. For this reason, the organisations had an obligation to ensure, through various additional safeguards, that the required level of data protection was maintained when personal data was being transferred to the United States.
In July 2023, the European Commission adopted a decision on an adequate level of data protection in the United States. Currently, it allows the transfer of personal data to US companies that are committed to the safeguards agreed in the EU–US Data Privacy Framework.
Public sector actors must ensure an adequate level of data protection in the transfer of personal data
The Office of the Data Protection Ombudsman found that there had been shortcomings in how the organisations had ensured adequate data protection in the use of cloud services. The Data Protection Ombudsman notes that Valtori should have ensured the implementation of an adequate level of data protection in the cloud services it provided to the public administration. The Digital and Population Data Services Agency and the Tax Administration have a statutory obligation to use the services provided by Valtori.
“The reliability and legality of cloud services is especially important in central government, which processes significant amounts of Finnish personal data. Central government actors have little choice in the cloud services they use. That is why it is especially important that the service provider ensure their legality,” says Data Protection Ombudsman Anu Talus.
Valtori was cautioned about the shortcomings in data protection. The Digital and Population Data Services Agency was also cautioned as it had failed to fulfil its obligation to ensure an adequate level of protection for data transfers. No caution was issued to the Tax Administration, as the assessment showed that it had attempted to take data protection requirements into account by introducing various additional safeguards. They had not fully addressed the shortcomings, however.
The decisions are part of the European data protection authorities’ joint study assessing the use of cloud services in sectors such as health, finance, taxation, education and IT. Valtori, the Digital and Population Data Services Agency and the Tax Administration were selected for the study in Finland, as they process significant amounts of citizens’ personal data.
In its decision T-553/23 of September 2025, the General Court of the European Union stated that the current EU–US Data Privacy Framework remains appropriate.
The decisions of the Office of the Data Protection Ombudsman are not yet final and can be appealed in the Administrative Court.
- Data Protection Ombudsman's decision TSV/7/2022 concerning Valtori in Finlex in Finnish
- Deputy Data Protection Ombudsman's decision TSV/164/2022 concerning the Digital and Population Data Services Agency in Finlex in Finnish
- Deputy Data Protection Ombudsman's decision TSV/24/2022 concerning the Tax Administration in Finlex in Finnish
Further information:
Data Protection Ombudsman Anu Talus, anu.talus(at)om.fi, tel +358 29 566 6776
Press release 15 February 2022: The Office of the Data Protection Ombudsman launches an investigation into the use of cloud-based services in the public sector as a part of a coordinated action of European supervisory authorities
Press release 19 January 2023: European Data Protection Board published recommendations on the use of public-sector cloud services (in Finnish)
More information on international data transfers based on an adequacy decision on our website
Judgment of the General Court of the European Union in matter T-553/23 (curia.europa.eu)