When collecting data, data subject must be informed about the following:
- the controller and its representative if necessary;
- the purpose of the processing;
- regular destinations of disclosed data;
- information on how to proceed in order to make use of the rights of the data subject in respect to the processing operation in question.
- If the processing is based on legitimate interest (6.1(f), legitimate interests pursued by the controller or a third party.
- Is providing the personal data a statutory or contractual requirement or a requirement for concluding a contract, and whether the data subject is obliged to provide the data, along with the possible consequences of not providing the data.
- Information on the source of the personal data and, if necessary, whether the source was public or not.
The aforementioned information shall be provided at the time of collection and recording of the data or, if the data are obtained from elsewhere than from the data subject and intended for disclosure, at the latest at the time of first disclosure of the data.
In Finland, there is no language requirement for privacy notices, but they must be easy to understand and the language must be clear and plain.
The Finnish Data Protection Act lay out a few derogations to the obligation to provide a privacy notice:
- where the processing of personal data is solely for academic, artistic and literary expression purposes; or
- where providing the information could prejudice the prevention or detection of crime or a surveillance assignment relating to taxation or public finances; or
- where the personal data have not been obtained from a data subjectand where providing information would cause damage or harm to the data subject and the stored information are not used in decision-making regarding the data subject.
If the data subject is not provided with a privacy notice, the controller can make an appropriate privacy notice publicly available, provided that it does not compromise the purpose of the mentioned derogation.