Public-interest data basis reaches private handlers of public tasks

Personal data may be processed where necessary for the performance of a task carried out in the public interest or in the exercise of official authority.Telp The public-interest basis always requires a foundation in lawTelp: under the General Data Protection Regulation the Article 6(1)(e) basis must be laid down by Union or Member State lawTelp, and in Finland that foundation is Tietosuojalaki 4 §Finlex.

Tietosuojalaki 4 § permits Article 6(1)(e) processing in four settings.Finlex It covers data describing a person's position, tasks and their performance in a public body, business, organisation or comparable activity, to the extent the purpose serves the public interest and the processing is proportionate to the legitimate aim pursued.Finlex It covers processing necessary and proportionate for an authority's performance of a public-interest task.Finlex Since the 4 § wording that entered into force on 1 September 2026Telp, that second setting also reaches companies, foundations and private individuals when they handle a public administrative task assigned by or under lawTelp. It covers processing necessary for scientific or historical research or statistics that is proportionate to the public-interest objective pursued.Finlex And it covers processing of research material, cultural-heritage material and related descriptive personal data for archiving purposes where necessary and proportionate in view of the public-interest objective and the data subject's rights.Finlex

The provision exists so that authorities can process personal data where the right to process cannot be derived directly from a provision on the authority's tasks or powers or from other specific regulation. Public interest can carry processing needed for scientific or historical research, statistics, or other planning and preparatory work connected with performing a public administrative task.Telp In the earnings-related pension system, research and statistics are often carried on the basis of a statutory duty instead — for example compiling studies and statistics on insured persons, employments, retirements commenced and pensions in payment.

The choice of basis changes which rights the data subject keeps.Telp Where processing rests on public interest, the data subject retains rights that fall away under a statutory duty, including the right to object to processing of personal data concerning them.Telp Controllers must therefore verify, for each research and statistics task, whether the basis is a statutory duty or a public-interest task.Telp Regardless of which of those two bases applies, the data subject keeps the right to inspect their data.Telp Access and the other restricted rights are lost only where the research or statistics meets the conditions of Tietosuojalaki 31 §.Telp

Section 31 allows derogation from the rights of access, rectification, restriction and objection.Finlex For scientific or historical research the derogation requires a proper research plan, a responsible person or accountable group, and use and disclosure of the data only for historical or scientific research or another compatible purpose, organised so that data on an identifiable person is not disclosed to outsiders.Telp For statistical purposes the derogation requires that the statistics cannot be produced, or the underlying information need met, without processing personal data, that producing the statistics has a genuine connection with the controller's activities, and that the data is not processed so that a person is identifiable from it, unless the data is disclosed for public statistics.Telp

Legal basis: EU General Data Protection Regulation (EU) 2016/679 Article 6(1)(e) on processing for a public-interest task or official authorityFinlex, implemented in Tietosuojalaki (1050/2018) 4 § on lawful processing and 31 § on derogations for research and statisticsFinlex.