Content service providers
In the Act on the Protection of Privacy in Electronic Communications, the term information society service provider is used for content service providers. The Act on the Provision of Information Society Services (458/2002) (in Finnish) governs the provision of content services. Additional information on content service providers can be found at Electronic commerce.
Content service providers have the right to obtain from a telecommunications operator data, which is necessary for the billing of their services, if the user of the service has given his consent. There are no separate provisions on the processing of identification data in the provision of content services. A content service provider must, however, process the identification data received from a telecommunications operator confidentially and its personnel must maintain secrecy as far as these data are concerned (section 5 of PPEC).
In addition to confidential communication there is public communication, such as messages written in chat rooms, IRC and in different discussion forums in the Internet. Identification data related to public communications are confidential in a way that the different parties participating in the transmission of communications, such as operators and corporate subscribers, may process these data only for purposes laid down in the law. In addition, they have the obligation of secrecy concerning identification data.
If the content service is, for example, an online store in the Internet, the content service provider is in some situations regarded as the other party to communications and it has the right to process data on the users of the service stored on its server within the limits allowed by the Personal Data Act. Content service providers must also comply with section 7 of the Act on the Protection of Privacy in Electronic Communications on cookies and saving of other data in the user’s terminal device.
The content service provider may also act as a corporate subscriber concerning its own employees, in which case the provisions on corporate subscribers govern the processing of the employees’ communications data.
