Description to implement document publicity enables the public to specify information requests
The purpose of the description to implement document publicity is to guide people to better specify their requests for Supo documents.
3 Submitting information requests
4 Charges levied on information retrieval in special cases
1 Introduction
Description to implement document publicity
Section 28 of the Act on Information Management in Public Administration (906/2019) requires an information management entity to maintain a description to implement document publicity (hereinafter referred to as the FoI description). The FoI description enables the public to better specify requests for access to a document, as required under section 13 of the Act on the Openness of Government Activities (621/1999, hereinafter referred to as the Freedom of Information Act).
This FoI description provides a structural overview of the Supo case register and service information management, and indicates the scope of information processing. The description contains the case register and service information management information that is public.
The FoI description specifies the information pools of the Supo case register and service information management, the information that is recorded in an information pool, and whether the information is openly accessible via a technical interface. The description also includes information on search criteria and how information may be requested.
Supo case register and service information management
The Supo case register is a logical entity that contains information describing the discharge of functions assigned to Supo in the Act on Police Administration (110/1992), and the handling of cases opened in the course of managing the Agency’s support processes. The case register is a register of cases submitted or instituted, their processing stages, any measures taken, and documents or other information related to these measures. Information in the case register is included in the Supo case management system, special registers and hard copy documentation.
Processing of personal data in the Supo case register is based on statutory functions, and is gathered and processed only to the extent that is necessary for discharging the Agency’s functions.
The Supo case register and service information management comprise 5 information pools. The information pools are the case management information pool, the publication information pool, the operational information pool, the security clearance vetting information pool, and the archive information pool.
The information pools related to the Supo case register and service information management are not openly accessible via a technical interface. The Supo publications in the publication information pool are an exception to this, and are available on the Agency’s public website.
The information pools included in the case register and service information management are individually described below.
2 The information pools
The case management information pool
Purpose of the information pool
The case management information pool is maintained for the purpose of monitoring cases handled by Supo.
Documentation
The case management information pool contains documentation for both temporary and permanent retention, which may be either public or confidential.
The case management information pool contains the following information:
- The case, the completed case management processing stages, the measures taken and related documents, and the metadata describing them
- The case initiator
- The date of arrival or drafting of a document
- Any decision measures and related documents in the case
Case management information pool documentation is entered in a case register. Information pool documentation is transferred to the archive information pool in accordance with an information management plan.
Examples of search criteria include the case ID number, the name of the case or document, the document type, or the initiator.
The publication information pool
Purpose of the information pool
The publication information pool is maintained for managing documentation arising in Supo publishing operations.
Documentation
The publication information pool comprises publications and brochures in electronic and hard copy form created in the publishing operations of Supo. The documentation includes both public and confidential information.
The publication information pool contains the following publication metadata:
- Title of publication
- Publication notes (publisher, year of publication)
- Author(s)
- Language of publication
- Layout
- ISBN
Supo publications and brochures are entered in the case register.
Examples of documentation search criteria include the title, ISBN or publishing date of a publication. Some publication information pool documentation is available on the Agency’s public website.
The operational information pool
Purpose of the information pool
The operational information pool is maintained for the purpose of discharging the Supo functions prescribed in section 10 of the Act on Police Administration (110/1992). The information pool also contains personal data necessary for discharging the functions of Supo in accordance with section 48 of the Act on the Processing of Personal Data by the Police (616/2019).
Documentation
The operational information pool manages operational documentation that arises in discharging Supo functions.
The security clearance vetting information pool
Purpose of the information pool
The security clearance vetting information pool is maintained for the purpose of discharging functions prescribed in the Security Clearance Act (726/2014).
Documentation
The security clearance vetting information pool manages documentation containing information on organisations that have requested a security clearance investigation, and information on individuals and enterprises that have been subject to security clearance vetting under the Security Clearance Act.
The security clearance vetting information pool records the information described in the following paragraphs. Besides the information described in the said paragraphs, the information pool may record the information that is necessary for preparing security clearance vetting reports, notifying the outcome of security clearance vetting, monitoring integrity and reliability, issuing and revoking security clearance vetting certificates, and complying with international data security obligations.
Documentation related to the security clearance vetting information pool is entered in the security clearance vetting register or in the Supo case register.
Examples of documentation search criteria include the case ID number or other unique case identifier, the name or business ID code of an organisation, and the full name, personal ID number and date of birth of an individual.
Personnel security clearance vetting
The following information is recorded from personnel security clearance vetting:
- Personal ID number
- Former personal ID number
- Date of birth
- Surname, first name and changes of name
- Domicile district of birth
- Country of birth
- Native language
- Current nationalities
- Former nationalities
- Statelessness
- Former or current temporary or permanent address details in Finland and abroad, and contact address
- Information on the existence of a non-disclosure order
- Telephone number
- E-mail address
- Information on education
- Former and current public appointments and employment, and information on self-employment
- Employer
- Family and kinship relationships
- Information describing assets, holdings and other financial interests
- Foreign interests
- Aliens register client number (UMA information system)
- Travel document information
Information falling within special categories of personal data is only processed in the security clearance vetting information pool when this is necessary for the intended purpose.
Seeking eligibility for the personnel security clearance vetting procedure
The following information is recorded concerning requests for eligibility for the personnel security clearance procedure
- The case, the completed case management processing stages, the measures taken and related documents, and the metadata describing them
- The initiator
- The date of arrival or drafting of a document
- The decision measures and related documents in the case
Facility security clearance vetting
The following information is recorded concerning facility security clearance vetting reports
- The initiator
- The name and other identifying information of the subject of the investigation
- Contact information
- Subcontractor information
- Report on satisfaction of prescribed eligibility conditions for preparing facility security clearance vetting
- Details of whether facility security clearance vetting is intended to assist in demonstrating that an enterprise meets a specified data security standard
- Details of whether an assessment body approved under the Act on Information Security Assessment Bodies has prepared an assessment of the premises, information systems and other security arrangements of an enterprise or its subcontractor
The archive information pool
Purpose of the information pool
The archive information pool is maintained for archiving cases and documents that have been managed by Supo.
Documentation
The archive information pool comprises documentation retained in the archive, with the information primarily used for research purposes. The documentation includes both public and confidential information.
The archive information pool contains information concerning cases, completed case processing stages, measures and associated documents, and the metadata that describe them. Examples of documentation search criteria include the registry number, the name of a case, document or individual, the type of document or the initiator.
3 Submitting information requests
Principle of public access and grounds for confidentiality
Under the principle of public access (subsection 2 of section 12 of the Constitution of Finland (731/1999), section 1 of the Freedom of Information Act (621/1999)), the documents and recordings of a public authority are public unless their publication has been specifically restricted by Act of Parliament. Everyone has the right of access to public documents and recordings.
The main grounds for secrecy of the documents of a public authority are listed in section 24 of the Freedom of Information Act. Confidentiality criteria are also included in specific legislation, such as the Act on International Information Security Obligations (588/2004). The grounds for restricting public access to documents include maintaining national security and individual privacy. It is typical of Supo that its information pools contain a great deal of confidential documentation concerning the operations of security authorities.
Submission and processing of requests for information
Requests for information addressed to Supo should be sent to the registry for registration in order to monitor deadlines. The registry forwards the requests to the right party in the organisation for responding. There is no set format for requesting information, but the request must specify the requested documents with optimal clarity.
Registry contact details:
E-mail: [email protected]
Postal address: Supo, P.O. Box 151, FI-00121 Helsinki.
Supo will issue a decision on the release of documentation.
4 Charges levied on information retrieval in special cases
According to section 6 of the decree of the Ministry of the Interior on chargeable services of the Finnish Security and Intelligence Service in 2024 (1118/2023), Supo has set charges for its retrieval services (SUPO 1188/01.12.02.05/2023).
A cost-related fee for information retrieval is charged according to section 34(2) of the Act on the openness of Government Activities (the Openness Act) if the request of access to a document requires special measures. Special measures are needed when the request of access concerns a document which cannot be specified and found in the manner referred to in section 13(1) of the Openness Act from document registers of an authority by using the registers’ document classification or the document’s identifying code, nor from electronic registers by using their search functions. The charge for information retrieval may also be levied for the deletion of the secret parts of a document. The retrieval service is charged at an hourly rate.
Charges levied on information retrieval:
The charge for a copy or print-out is €0,60 per A4 page, the minimum charge being €10.
The retrieval service is charged at €40 per hour.