Data protection

Complaints or requests for an investigation to be submitted to the Intelligence Ombudsman must be made in writing. Complaints or requests for an investigation may be submitted by post, by email or by delivering the documents in person to the Intelligence Ombudsman’s office. Contact details and instructions for sending documents containing confidential or sensitive information electronically can be found on the Contact information page.

Our processing is based on

The Intelligence Ombudsman processes personal data in connection with the handling of complaints and requests for investigation falling within their remit, in accordance with the Intelligence Oversight Act (121/2019). The purpose of using the data is to process pending cases in the manner required by law.

Personal data is processed in order to comply with the Intelligence Ombudsman’s statutory obligations:

• General Data Protection Regulation (EU 2016/679), Article 6(1), point c

The status, duties and powers of the Intelligence Ombudsman are laid down in the Intelligence Oversight Act:

• Intelligence Oversight Act (121/2019, in Finnish)

What data do we process?

Complaints and requests for investigation must be submitted in writing. Once a case has been initiated, it is recorded in the case management system and assigned a reference number.

The extent of data processed depends on the nature of the case and on what information has been delivered to us in connection with it

We regularly process at least the following data:

• the name and contact details of the person who instituted the case
• the description of the case and
• information on the phases of processing

The name and contact details of the person who initiated the proceedings, as well as any other information set out in the document initiating the proceedings, are obtained from the person themselves. Any further information required to investigate the matter may be requested from the person who initiated the proceedings or from the supervised entity whose activities are the subject of the matter.

Disclosure of data

Personal data is disclosed to service providers that supply IT services to the Intelligence Ombudsman. These providers process personal data on behalf of the Ombudsmn and are not permitted to process the data for any other purposes than delivering the agreed service.

Data is disclosed in accordance with the Act on the Openness of Government Activities (621/1999). The data and documents are public unless specifically decreed confidential by law. A significant proportion of the matters and documents relating to the oversight activities of the Intelligence Ombudsman are classified as confidential. Consequently, information on them may only be disclosed if this is specifically provided for by law.

Information on the transfer of data to third countries

Data will not be disclosed or transferred outside the European Union or the European Economic Area, or to international organisations.

Data retention period

The retention periods for personal data relating to cases brought before the Intelligence Ombudsman are determined in accordance with the Archives Act (529/2026) and the Intelligence Ombudsman’s data management plan.

Your data protection rights with regard to the processing of personal data

We set out your data protection rights in relation to our processing of your personal data in the section entitled Data protection rights.

The Intelligence Ombudsman processes the personal data of individuals visiting its offices. A person may initiate a matter falling within the Intelligence Ombudsman’s remit by delivering documents to the Ombudsman’s office in person. Visits to the Intelligence Ombudsman’s premises may also be made in connection with a pre-arranged appointment, such as a job interview.

As the data controller, Senate Properties records video footage of people moving around the premises to ensure the safety of individuals and property. Read more about Senate Properties’ processing of personal data on the Senate Properties website: Data protection (in Finnish)

Our processing is based on

Personal data is processed to ensure that appointments are organised appropriately and to ensure compliance with premises security and related guidelines.

Personal data is processed for the purpose of carrying out a task in the public interest and for the exercise of official authority vested in the Intelligence Ombudsman:

• General Data Protection Regulation (EU 2016/679), Article 6(1), point e

What data do we process?

When a visitor comes to the premises, their name and the date and time of their visit are recorded. In the case of stakeholder visits, information about the visitor’s organisation is also recorded.

Disclosure of data

There is a reception service in the entrance of the Intelligence Ombudsman’s premises. The service forms part of the premises letting arrangements organised by Senate Properties. The reception service is provided by Palmia Oy, a contractual partner of Senate Properties. When an appointment has been arranged in advance, we forward the name and organisation of the visiting person to the reception service provider via Senate Properties’ visitor management system.

Where a visit relates to a matter currently being dealt with or to be dealt with by the Intelligence Ombudsman, a record of the visit may also be entered into the Intelligence Ombudsman’s case management system.

Information may be disclosed to the requesting party in accordance with the Act on the Openness of Government Activities (621/1999).

Information on the transfer of data to third countries

As a general rule, data will not be disclosed or transferred outside the European Union or the European Economic Area, or to international organisations. If it is agreed that a data processor may transfer personal data outside the EU or the EEA, the parties shall ensure that the transfer of personal data is carried out in accordance with data protection legislation, using appropriate safeguards.

Data retention period

Visitor data is deleted from Senate Properties’ visitor management system during the night following the visit.

Personal data relating to matters handled by the Intelligence Ombudsman is stored in the Ombudsman’s case management system in accordance with the Ombudsman’s data management plan.

Your data protection rights with regard to the processing of personal data

We set out your data protection rights in relation to our processing of your personal data in the section entitled Data protection rights.

Instituting a case electronically

Cases can be instituted by delivering the materials by e-mail to the Intelligence Ombudsman.

Visiting the website

Our website is open to the public and browsing it does not require registration.

Cookies in our website

When you visit a web page in our online service, our site will save cookies, which are small text files, on your device.

All the cookies used on the website of the Intelligence Ombudsman are technical cookies. They enable our website to function and help us serve you better. For example, a cookie will tell the site which language you normally use to browse it.

Social media cookies

The Intelligence Ombudsman is active on X and there is links to this platform in our website.

The website does not set cookies when displaying these links when you browse our website. By clicking on the X link on our website, you will be redirected to that platform, which has its own cookie and privacy policies.

Our processing is based on

We process personal data for the performance of a task carried out in the public interest and in the exercise of official authority vested in the Intelligence Ombudsman:

• General Data Protection Regulation (EU 2016/679), Article 6(1), point e

We process special categories of personal data for reasons of public interest and by virtue of national legislation:

• General Data Protection Regulation (EU 2016/679), Article 9 (2), point g
• Data Protection Act (1050/2018), Article 6 (1), point 2

We additionally process personal data in connection with the use of electronic services in order to comply with the legislation generally applied to the activities of authorities:

• Administrative Procedure Act (434/2003), section 8
• Act on Electronic Services and Communication in the Public Sector (13/2003), sections 5–6

Disclosure of data

There are no regular disclosures of data.

Data is disclosed in accordance with the Act on the Openness of Government Activities.

No data will be disclosed for direct marketing, survey or market research purposes, unless there are separate provisions regarding disclosure for such purposes.

Your data protection rights with regard to the processing of personal data

We set out your data protection rights in relation to our processing of your personal data in the section entitled Data protection rights.

Data processed in connection with the use of telephone services

The switchboard of the Intelligence Ombudsman connects calls to the public officials working at the Office of the Intelligence Ombudsman. We save the following information on calls made to the switchboard: the time of the call, the caller’s number, the number to which the call was connected and the duration of the call.

The switchboard of the Intelligence Ombudsman is managed by an external service provider. The switchboard service is provided by the Government ICT Centre Valtori and the technical implementation by Elisa Plc.

The Intelligence Ombudsman does not process data concerning the calls made to the switchboard, unless the switchboard forwards a call request made by the caller to the Office of the Intelligence Ombudsman. In this case, the Intelligence Ombudsman processes the data only for the time it takes to clarify the matter that the call request concerns. Data is erased after this.

No calls are recorded.

Our processing is based on

We process personal data for the performance of a task carried out in the public interest and in the exercise of official authority vested in the Intelligence Ombudsman:

• General Data Protection Regulation (EU 2016/679), Article 6(1), point e

Disclosure of data

There are no regular disclosures of data.

Data is disclosed in accordance with the Act on the Openness of Government Activities (621/1999)

No data will be disclosed for direct marketing, survey or market research purposes, unless there are separate provisions regarding disclosure for such purposes.

Your data protection rights with regard to the processing of personal data

We set out your data protection rights in relation to our processing of your personal data in the section entitled Data protection rights.

We publish information on open positions in the Valtiolle.fi service, which is the primary channel for submitting job applications. Through the Valtiolle.fi service, we collect data that is essential to the application process, provided by the applicants themselves in connection with submitting their applications. At the end of the application process, we draw up a memorandum for comparing the merits of the applicants in accordance with the guidelines provided by the Office for the Government as Employer and in the legislation on government officials.

Job applicants may also submit a paper application for a vacant post directly to the Office of the Intelligence Ombudsman, in which case the necessary information will be entered into the Valtiolle.fi system for electronic processing.

Our processing is based on

The Intelligence Ombudsman processes job applicants’ personal data for the purposes of recruitment. Personal data is processed in order to fulfil the statutory rights and obligations of the state as an employer:

• General Data Protection Regulation (EU 2016/679), Article 6(1), point c
• Act on Public Officials in Central Government (750/1994) and Decree (971/1994)
• Act on the Protection of Privacy in Working Life (759/2004)

What personal data do we process?

We process the personal data required for the selection process, which the applicant provides themselves when submitting their application.

The following identifying details are stored in the Valtiolle.fi system: name, address, telephone number, email address, legal gender, date of birth and mother tongue.

Information provided by the job applicant in their application, such as details of their education and work experience as well as language skills, is stored. In addition, other necessary information relating to the job application and the conditions of the post, submitted by the job applicant in support of their application, is recorded, such as a CV or resume and the contact details of any referees.

For individuals attending a job interview at the Intelligence Ombudsman, the time of their visit is also recorded in Senate Properties’ visitor management system.

Recipients of the data

The Government Service Centre for Financial and Human Resources Management (Palkeet) acts as a joint data controller in the processing of job applicants’ personal data within the Valtiolle.fi system. Grade Solutions Oy is responsible for providing support and maintenance services for the Valtiolle.fi system. You can read more about the processing of personal data carried out by Palkeet on the Valtiolle.fi website: Data protection policies

Applications and other documents relating to job applications are transferred to the Intelligence Ombudsman’s case management system, for which the Legal Register Centre is responsible for technical maintenance.

The visitor management system operated by Senate Properties is used when organising job interviews at the Intelligence Ombudsman’s premises.

With the applicant’s consent, a security clearance check may be carried out on a person to be appointed to a post or role, in which case their personal data will be disclosed to the Finnish Security and Intelligence Service for the purposes of the check.

Information about the job applicant and the documents they have submitted are, as a rule, public, unless they are expressly designated as confidential by law. Information may be disclosed to a requesting party in accordance with the Act on the Openness of Government Activities (621/1999). Where necessary, information that must be kept confidential under the Act on the Openness of Government Activities will be redacted from the documents to be disclosed.

Information on the transfer of data to third countries

As a general rule, data will not be disclosed or transferred outside the European Union or the European Economic Area, or to international organisations. If it is agreed that a data processor may transfer personal data outside the EU or the EEA, the parties shall ensure that the transfer of personal data is carried out in accordance with data protection legislation, using appropriate safeguards.

Data retention period

Applications submitted for recruitment posts are retained in the Valtiolle.fi system for two years after the recruitment process has been concluded.

The Intelligence Ombudsman retains documents relating to the recruitment process in its case management system in accordance with its information management plan. Some of the documents are subject to permanent retention by separate decision of the National Archives.

Visitor details are deleted from Senate Properties’ visitor management system during the night following the visit.

Disclosure of data

Personal data is disclosed to service providers that supply IT services to the Intelligence Ombudsman. These providers process personal data on behalf of the Ombudsmn and are not permitted to process the data for any other purposes than delivering the agreed service.

Data is disclosed in accordance with the Act on the Openness of Government Activities (621/1999). The data and documents are public unless specifically decreed confidential by law.

No data will be disclosed for direct marketing, survey or market research purposes, unless there are separate provisions regarding disclosure for such purposes.

Your data protection rights with regard to the processing of personal data

We set out your data protection rights in relation to our processing of your personal data in the section entitled Data protection rights.