Legal Alert – Changes to the Protection of Personal Data Registered with the Finnish Trade Register Proposed to Be Implemented as from 1 January 2014
The Finnish Government has submitted a proposal for an amendment to the Trade Register Act (proposal 59/2013) to the Parliament, restricting access to personal data registered by the Finnish Trade Register.
Up to the beginning of 1994 companies had to submit the full name, nationality and domicile of their directors and officers for registration by the Trade Register. Under the current rules, introduced early 1994, the Trade Register registers the full name, personal identification number (i.e. social security code), full address and nationality of each natural person registered as director or officer or other liable person (e.g. registered holder of proxy) of a Finnish company or housing company. Natural persons living outside of Finland and not holding a Finnish personal identification number register their date of birth instead of the personal identification number. The Trade Register data is, according to an express stipulation in the Trade Register Act, in the public domain, meaning that anyone may have access to information registered in the Trade Register and of related documents (e.g. registration applications) in the possession of the register authority. In certain circumstances, registered persons may apply to the city administrative court for an order to restrict or protect information registered about that person. The process to obtain the restriction order requires some effort and is not widely used. The fact that the full personal identification code and home address are freely accessible at the Trade Register has been criticized as concerns over identity theft cases and cases of real or perceived physical threats have emerged. The governmental bill notes that physical records containing personal data are accessed at the Trade Register more than 2,000 times annually and online databases have vastly increased the spread of registered information. Under the proposed new rules, natural persons domiciled in Finland will still register their full name and personal identification number, but only their home municipality (as opposed to their full address). Authorities and other authorized persons will be able to access address details from the Finnish population register. Persons living outside of Finland will still need to submit their full home address. The restrictions will be implemented in practice by introducing an appendix to the trade register extract. The appendix, which will only be disclosed to authorities and other parties entitled to access the restricted information, will contain the full details of the registered persons personal identification number and, in the case of individuals living abroad, the full address. The public trade register extract will only detail the name, date of birth and home domicile of the registered persons. According to the proposal, the changes will not be implemented retroactively, meaning that the information currently registered and held by the Trade Register will not be restricted or redacted. Hence, persons who are currently registered will continue to have their (historical) addresses and personal identity numbers available to the public. Although the proposed amendment is welcome, it remains to be seen whether the limited data available in the future from the trade register extracts will be viewed as sufficient to unambiguously identify e.g. persons presenting themselves as the authorized registered representatives of a Finnish company or housing companies. One option to consider is whether the registered persons could consent to providing the new trade register extract together with the new appendix containing the otherwise restricted data. The requirements for such consent would need to be separately analyzed from a data protection law perspective.