Income data
Purpose of processing data
In addition to loan data reported by lenders, natural persons’ income data received from the Incomes Register is also stored in the Positive credit register. The Positive credit register stores income data that is necessary for the calculation of a natural person's gross and net income. The data is received from the Incomes Register.
The debtor’s income data established for purposes of assessing the debtor’s creditworthiness and reported by lenders and other parties with the reporting obligation are also stored in the Positive credit register. Read more about the processing of the above data on the Loan information page.
The gross and net income of a natural person is calculated for the last 12 full calendar months, and the data is disclosed to lenders on the credit register extract. Income data is also disclosed to authorities that need the data to perform their statutory duties.
Whose data do we process?
We process the income data of all individuals who have a Finnish personal identity code.
Where does the data come from?
We receive the data necessary for the calculation of a natural person's gross and net income from the Incomes Register. We store the data in the Positive credit register by virtue of the Act on the Positive Credit Register.
What data do we process?
We process only data that is necessary for the calculation of a natural person's gross and net income.
Earnings payment data
- earnings payment data
- income earner’s personal identity code
- income type details
- income type identifier
- amount paid
- information on recovery (if any)
- pay period
Benefits
- benefits payment data
- benefit recipient’s personal identity code
- income type details
- income type identifier
- amount paid
- tax details related to income type
- information on recovery (if any)
- details on deductions from benefits
Further information on income types and the calculation of income data
The document below describes in greater detail how the income data displayed on the credit register extract is calculated from the wage income and benefit income reported to the Incomes Register. The document contains a list of the income types that are taken into account in the calculation.
On what basis do we process data?
We process personal data to comply with the Incomes Register Unit’s statutory obligation (General Data Protection Regulation (EU 2016/679), Article 6(1)(c)). The processing is provided for in the Act on the Positive Credit Register (739/2022).
Disclosure of data
According to the Act on the Positive Credit Register, the data stored in the register is confidential. We disclose data from the Positive credit register to lenders and authorities only for the purposes laid down in the Act on the Positive Credit Register.
Disclosing data to lenders
We provide lenders with data on gross and net income for the past 12 full calendar months, separated into wage and benefit income, on credit register extracts.
Under the Act on the Positive Credit Register, lenders and other businesses with the right of access to data can request credit register extracts for the purposes laid down in the act. To request a credit register extract, the business must have a data permission granted by the Incomes Register Unit.
You can view the credit register extracts requested about you in the Positive credit register’s e-service. You can also check the content of the credit register extract there, and see who has requested the register extract, when and for what purpose.
Read more about disclosing data to lenders.
Disclosing data to authorities
We disclose income data to the Bank of Finland and the Financial Supervisory Authority. In addition, we disclose income data to the Consumer Ombudsman on the credit register extract.
We disclose data to these authorities so that they can perform their statutory duties:
Bank of Finland
- ensuring the reliability and efficiency of the financial system, and developing the financial system
- preparing and publishing statistics necessary for the operations of the Bank of Finland
Financial Supervisory Authority
- monitoring and evaluating financial markets, and issuing regulations regarding the financial markets
- supervising financial markets and lenders, including supervision of credit risks and consumer protection
- compiling data on the financial position of parties operating on the financial markets
Consumer Ombudsman
- supervision of compliance with consumer protection legislation, including the supervision of contractual terms, compliance with contractual terms, assessment of creditworthiness and making of credit decisions
We disclose data to the Bank of Finland and the Financial Supervisory Authority in pseudonymised form. This means that the personal data cannot be linked to an individual without additional information. We disclose data to the Consumer Ombudsman both in pseudonymised form and as identifiable data.
The disclosure of data is based on the Act on the Positive Credit Register, which explicitly lays down the tasks for which authorities can receive data from us. After the data has been disclosed, the authorities process the data in the capacity of controllers. Further information about the processing of personal data is available on the authorities' own websites.
Disclosure of data by virtue of the Act on Openness
According to the Act on the Positive Credit Register, we can also disclose information for the following purposes laid down in the Act on the Openness of Government Activities (621/1999, Act on Openness):
- right of access to data of the party concerned
- right of access to a document pertaining to the party concerned
- provision of executive assistance
- processing of advance information, a preliminary ruling or a complaint.
Processors
The Positive credit register has been implemented on the Microsoft Azure cloud service platform. We use the following service providers for application management services, such as troubleshooting: Innofactor Software Ltd, Gofore Plc, Gofore Verify Oy and Advania Finland Oy. When processing personal data, application management uses a service management system provided by ServiceNow. Digia Plc handles the on-call service regarding disruptions in the Positive credit register.
Transfer of personal data to third countries
In principle, we do not disclose data to countries outside the EU/EEA. However, in exceptional individual cases, Microsoft may have access to personal data during support and maintenance activities. In data transfer, the transfer basis under the General Data Protection Regulation is the European Commission's decision on the adequacy of data protection under Article 45(1) (Adequacy decision for the EU-US Data Privacy Framework, C(2023) 4745 final) or, where necessary, standard contractual clauses published by the European Commission.
Retention of data
Data retention periods are defined in the Act on the Positive Credit Register. With regard to data retention, we comply with the Tax Administration's information management plan. After the end of the retention period, data is either destroyed or archived in accordance with the archives act (Arkistolaki 831/1994).
We delete the income data received from the Incomes Register two years after it was stored in the Positive credit register. We delete credit register extracts five years after sharing them with lenders.
Your data protection rights regarding the processing of personal data
As a controller, the Income Register Unit is responsible for enforcing your data protection rights based on the EU's General Data Protection Regulation. You can make a free-form written request regarding your data protection rights and send it to us to the address below:
POSITIVE CREDIT REGISTER
P.O. BOX 2
FI-00055 Incomes Register
You can find more information about your data protection rights on the website of the Office of the Data Protection Ombudsman.
If you need help in exercising your rights, you can contact our customer service.
Right to view personal data
You have the right to know if we are processing your personal data. You are also entitled to receive a copy of your personal data that we process.
You can submit us a request to view your personal data with the paperform or contact form below.
You can access the Positive credit register’s data through the e-service for private individuals. In the e-service, you will see the latest loan data reported by lenders and the credit register extracts requested about you, which contain your gross and net income for the past 12 full calendar months. To use the e-service, you will need your online banking codes, a mobile certificate or a certificate card.
Right to rectify data
You have the right to request us to rectify your inaccurate or incorrect personal data without any undue delay.
The income data shown on the credit register extract is received from the Incomes Register If you suspect an error in the data, you can check your income data in the Incomes Register's e-service. If the data is incorrect, ask the payer to correct the data in the Incomes Register. This way, the corrected data will also be updated to the Positive credit register. The Incomes Register Unit cannot make corrections to the Incomes Register's data.
Right to restriction of processing
If you think the data we are processing about you is incorrect, if the data is processed against the law or if you have opposed the processing of your data, you can request us to restrict the processing of your personal data.
The Act on the Positive Credit Register separately prescribes that we can disclose data to authorities, lenders and other parties having the right of access to data even in situations where the data subject has denied the accuracy of their data and required that the processing should be restricted. In such a case, the credit register extract delivered to the lender will show that you have requested the restriction of processing. This will be indicated on the credit register extract until the matter is settled. The lender or other party using the credit register extract can thus take into account that the accuracy of the data has been questioned.
Right to file a notification with the supervisory authority
You have the right to file a notification with the Data Protection Ombudsman regarding the processing of your personal data. Further information and instructions on how to file a notification are available on the website of the Office of the Data Protection Ombudsman.