Supervision of the identification service and qualified certificate activities

FICORA ensures

• that the identification service and qualified certificate activities are managed in accordance with the Identification Act and the rules and regulations thereunder;
• that the provided services and systems comply with the related regulations and technical requirements.
  

FICORA must be notified prior to the launch of operations.

Identification service providers and certification authorities providing qualified certificates located in Finland must submit a written notification to FICORA before starting their operations. Based on the notification, FICORA will assess whether the service meets all the legal requirements.

If the notification submitted by an identification service provider is inadequate, FICORA will request that the submitter of the notification provide further information.

If the identification service or identification service provider does not meet the legal requirements in force, FICORA must forbid the service provider from providing its identification service as strong electronic identification. If the deficiency can be considered minor, FICORA may request that the identification service provider remedy it within a certain time.

If a qualified certificate or certification authority does not meet the legal requirements based on its notification, FICORA must forbid the certification authority from offering its certificates as quality certificates. Before this decision is issued, the certification authority is entitled to provide further information and/or rectify the information it has provided in accordance with FICORA's requests.

The contents of the declaration of starting a business are prescribed in further detail in FICORA’s regulation 7 B/2009 M (in Finnish) and in the application instruction related to the regulation.

Launch of operations form for identification-service-providers [DOT, 59 KB] (in Finnish)

Launch of operations form for certification-providers [DOT, 62 KB] (in Finnish)

FICORA must be notified of any changes

The identification service provider and the certification authority providing quality certificates to the public (hereinafter the service provider) must

• notify FICORA of any changes to the information given in the declaration of starting a business;
• provide FICORA with an annual report detailing the extent of the provider’s operations of the previous year;
• notify FICORA of any significant threats or disruptions concerning the information security of the service as well as of the measures performed in order to rectify these; If necessary, FICORA may request that the service provider submit more detailed reports of the above-mentioned changes and disruptions; If necessary, FICORA may also order the service provider to rectify the detected faults.
  

The contents of the declaration of starting a business, the annual report and the contents and delivery of disruption reports are prescribed in further detail in FICORA’s regulation 7 B/2009 M and in the application instruction related to the regulation.

Disturbance notification form [DOT, 64 KB] (in Finnish)

FICORA must also be notified of termination of operations.

The service provider must notify FICORA of the termination of operations or the transfer of operations to another service provider.

Inspection right

FICORA is entitled to carry out an inspection or order an inspection to be carried out of the identification service provider and the service provided by it, if there are grounds for suspecting that the service provider has fundamentally violated the Identification Act or the regulations issued thereunder.

FICORA carries out or issues orders for an annual inspection of certification authorities providing quality certification, and of the service provided by them.

Handling of customer complaints

FICORA acts as the appellate authority in matters concerning

• concerning the operations of identification service providers and quality certification authorities, as well as;
• digital signatures based on quality certificates.
  

Fees

Any identification service provider or consortium of identification service providers must pay FICORA a registration fee of EUR 5,000.

Moreover, the identification service provider or consortium must pay FICORA an annual supervision fee of EUR 12,000.

A certification authority providing quality certificates must pay FICORA an annual supervision fee of EUR 40,000.

Other supervision authorities

The Ministry of Transport and Communications is responsible for the general steering and development of strong electronic identification and electronic signatures.

The Data Protection Ombudsman ensures the compliance of regulations concerning personal data by virtue of the Identification Act.

When necessary, FICORA and the Data Protection Ombudsman work in cooperation with the Financial Supervisory Authority, the Finnish Competition Authority and the Consumer Agency when conducting supervision tasks.