Finland: Implemented Amendments to the Data Protection Act and the Criminal Data Protection Act

On 1 January 2024, the amendments to the Data Protection Act and the Criminal Data Protection Act came into force. The amendments align with the EU data protection legislation, requiring the Data Protection Ombudsman's office to resolve complaints or provide an estimated resolution timeline within three months of case initiation. Individuals can appeal to the administrative court if this is not observed. The amendments also introduce a provision for the Data Protection Ombudsman to delegate decision-making authority to officials acting as rapporteurs, and they clarify regulations concerning the processing of personal identification numbers. Furthermore, the Personal Identification Number is no longer sufficient for identification, even in combination with an individual's name.