Cybersecurity Policy Report, Finnish Ombudsman Questions Draft Bill on Data Processing Powers of Tax Authority, (Oct 6, 2025)

By Tony Foley

The Finnish Office of the Data Protection Ombudsman (DPO) has raised concerns regarding a draft bill that would expand the right of the country’s Tax Administration beginning next year to access information to combat the “grey economy” (i.e., economic activity that is not taxed or otherwise monitored by government).

In a statement Friday, the DPO said the bill would allow the Tax Administration to process bulk data for tax control purposes. Specifically, the administration would receive bulk data from banks on customers’ account transactions. If implemented, the DPO claimed, the bill would allow the administration to process large amounts of personal data, including large amounts of sensitive personal data, that is unnecessary for tax supervision.

The DPO said any legislative amendment that interfered with people’s fundamental rights should be prepared carefully, weighing different aspects of its provisions in a balanced manner. The limited power of public authorities is a cornerstone of democracy, the DPO said, and excessive powers to collect and process personal data can erode people’s trust in the authorities’ activities.

"The bill would significantly reduce people's privacy protection,” Data Protection Commissioner Anu Talus said. “The goal of combating the grey economy is important, but the authority's jurisdiction, the purposes for which data can be used, and what data can be processed for each purpose must be precisely defined. Tax evasion must be combated, but in a targeted and proportionate manner."

The DPO added that the draft bill’s proposal would allow the Tax Administration to retain information unneeded for tax supervision and retain it for two years, a retention period that the regulator considers to be too long, given that there would be no basis to retain the information.

News: InternationalLegislation DataPrivacy