Information security and protection of privacy in electronic communications

Finland has no uniform legislation on information security. Provisions on information security management are encompassed in several laws and decrees. Also, provisions related to personal data processing and protection of the confidentiality of communications can be found in numerous different laws.

FICORA’s responsibilities include supervising the compliance with the Act on the Protection of Privacy in Electronic Communications (PPEC 516/2004), unless it is a supervising activity imposed on the Data Protection Ombudsman (see The division of powers between FICORA and the Data Protection Ombudsman). The Act on the Protection of Privacy in Electronic Communications implemented the Directive 2002/58/EC of the European Parliament and of the Council concerning the processing of personal data and on the protection of privacy in the electronic communications sector.

Also, the Communications Market Act (393/2003), which is supervised by FICORA, contains an overall level information security obligation concerning operators. In addition, FICORA’s responsibilities include the supervising of the compliance with the provisions and regulations issued under the Act on the Protection of Privacy in Electronic Communications and the Communications Market Act. In addition to the above-mentioned legislation, FICORA has issued the following regulations and recommendations concerning information security:

FICORA 9 D/2009 M, Regulation on obligation to notify of violations of information security in public telecommunications
Form 1: CERT-FI incident report
Form 2: Notification form of contact details for telecom operators
MPS 9 - The explanatory note of regulation

FICORA 11 A/2008 M, Regulation on the information security and functionality of electronic mail services
MPS 11, The explanatory note of regulation

FICORA 13 A/2008 M, Regulation on the information security and functionality of internet access services
SMS 13, Recommendation on the application of the regulation

FICORA 47 C/2009 M, Regulation on information security management of telecommunications operators
MPS 47 - The explanatory note of regulation

Information security is also a subject in FICORA’s other regulations and recommendations.

The list below consists of legal provisions on the management of information security and protection of privacy in electronic communications. The list does not contain the numbers of amendments to the provisions. This is not an exhaustive list.

The Constitution of Finland (731/1999); 10 §

The Act on the Protection of Privacy on Electronic Communications (516/2004)

Act on the Openness on Government Activities (621/1999); 10 §

Arkistolaki (831/1994) (in Finnish)

Personal Data Act (523/1999)

The Act on the Protection of Privacy on Electronic Communications (516/2004)

Act on the Protection of Privacy in Working Life (759/2004)

Communications Market Act (393/2003)

Radio Act (1015/2001)

The Penal Code, section 38 and 34(9).

Laki eräiden suojauksen purkujärjestelmien kieltämisestä (1117/2001) in Finnish

Act on the Provision of Information Society Services (458/2002)

Act on Electronic Services and Communication in the Public Sector (13/2003)

The Act on Electronic Signatures (14/2003) in Finnish

The Act on the Exercise of Freedom of Expression in Mass Media (460/2003)