In connection with Suomi.fi e-Authorizations, the Digital and Population Data Services Agency maintains a mandate register. The data in the register is used in Suomi.fi e-Authorizations to verify the right to act on behalf of a person, company or organisation. The information in the mandate register is also used for end user advice and to investigate problems related to the registration and use of mandates.
Mandate register of Suomi.fi e-Authorizations and the event log file of the mandate register
Digital and Population Data Services Agency
Lintulahdenkuja 2, 00530 Helsinki
PL 123, 00531 Helsinki
Telephone (switchboard) 02 9553 6000, email: kirjaamo(a)dvv.fi
Tuuli Krekelä, Chief Specialist, Business Owner (Suomi.fi e-Authorizations)
Lintulahdenkuja 2, 00530 Helsinki
Telephone (switchboard): 02 9553 6000
email: kirjaamo(a)dvv.fi
Telephone (switchboard) 02 9553 6000, tietosuoja@dvv.fi
The register functions as the mandate register of the Suomi.fi e-Authorizations and as the event log file of the register. The Digital and Population Data Services Agency produces Suomi.fi e-Authorizations in accordance with sections 3 and 4 of the Act on Common Administrative E-Service Support Services (Support Services Act, 571/2016). The register contains data on the mandates and mandate requests stored in the mandate register and the event data connected with them as well as application documents for the registration of mandates.
The data contained in the mandate register is used in the Suomi.fi e-Authorizations service to verify the right of an individual or a company/organisation to act on behalf of another party. The information in the mandate register is also used for end user advice and to investigate problems related to the registration and use of mandates. There are provisions on the mandate register especially in section 10(1) of the Support Services Act.
The data entered in the register is also used for the follow-up and monitoring of the mandate register and in-vestigation of any abuses and data security violations. The data stored in the register is also used for statistical purposes.
Under the Support Services Act, the Digital and Population Data Services Agency may agree with another authority on the provision of customer service related to Suomi.fi e-Authorizations. Based on the agreement, the employees of other authorities may process mandate applications and, based on them, register mandates in the mandate register. The authority only serving in an advisory capacity may review the data in the mandate register.
The Digital and Population Data Services Agency’s IT infrastructure service provider Valtori and its subcontractors manage the IT infrastructure of the Suomi.fi service registers.
The data contained in the mandate register is retained by the controller until further notice. Validated man-dates are retained in the register even if their validity has expired or been cancelled. A mandate request is removed from the register if it has not been validated within six (6) months. The controller will retain the data contained in the mandate register event log file for five (5) years from the moment when the mandate or the mandate request expires (section 13(2) of the Support Services Act).
The Digital and Population Data Services Agency has estimated that with regard to event data, a five-year (5) retention period is necessary, when taking into consideration the limitation periods for the most common offences related to the processing of personal data and the limitation period for offences in office, which is five years.
The contents of the register comprise data on mandates and mandate requests and event data on the users’ activities. The register also contains mandate application documents and their appendices, on the basis of which an employee of the Digital and Population Data Services Agency or another authority has entered mandates in the mandate register.
Details of the assignor (principal):
Details of the individual validating the mandate:
Details of the assignees
There are three types of mandates: validated mandates, expired mandates and mandate requests. The difference between a mandate request and a valid/validated mandate is that a mandate request has not been validated. A valid mandate has been validated.
Start and end date of the mandate
Mandate content (mandate code), which describes the matter that the mandate concerns
Mandate specifier, which specifies the mandate granted by the mandate code (for example, property identifier, register number or sub-organisation ID)
Mandate type:
Unique identifier for the browsing session in which the mandate was created/validated/invalidated/removed
Technical signature of the mandate, which is created automatically when the mandate is validated.
Event data connected with the use of the mandate register:
Updating of changed data
Errors:
Transaction time stamps.
Sources for mandate register data:
Sources for event data:
Information on valid mandates contained in the mandate register is disclosed for Suomi.fi e-Authorizations to specify the right to act on behalf of another party.
The controller may disclose information from the register to organisations using Suomi.fi e-Authorizations in their e-services, if the information has been saved during the use of these e-services or other services and if the organisation necessarily needs the information
On request, the controller may also disclose event data kept in the register to a data subject (individual or organisation) if the data concerns the data subject in question.
The disclosure of information to organisations using Suomi.fi e-Authorizations and the data subjects is based on section 14 of the Act on joint Central Government e-service Support Services.
The controller may also disclose data in the service to
Information may also be disclosed as statistics or in other formats so that individuals cannot be identified.
Information may also be disclosed for other purposes laid down in the law.
No personal data is transferred outside the EU or the EEA.
The data is protected taking into account data security and the management of access rights.
The register does not contain manual material. Manual material that may be created in liquidations is protected taking into account data security in locked facilities where access is monitored.
The data in the register can only be accessed by persons whose duties include processing such data. Log data is saved on the processing of data.
No automated decision-making or profiling is performed on the basis of the data.
You can view your valid and expired mandates and mandate requests at Suomi.fi Web Service.
You and your organisation have the right to request that the controller provides you with access to the data on you, so that you can check the information that is kept on you. The request must be submitted in writing to Digital and Population Data Services Agency’s registry office. Be prepared to prove your identity.
You will receive the information you need within a month of the time your request was registered. However, for justified reasons the Digital and Population Data Services Agency can extend the aforementioned one-month timeline by two months at the most. In this case you will receive a notification.
You can make corrections through Suomi.fi Web Service to valid mandates and mandate requests concerning them that are kept in the mandate register.
Data subjects do not have the right to request corrections to event data or expired/removed mandates and mandate requests.
The data subject does not have the right to request the deletion of their data, as the data processing is based on the law. For the same reason, the data subject does not have the right to object to the processing of their personal data or the right to have their data transferred to another system.
The data subject has the right to lodge a complaint to the supervisory authority on the processing of their personal data.
Additional information by the Office of the Data Protection OmbudsmanOpens in a new window..