Finland: Privacy

Few questions in data protection law carry as much practical weight as this one: when does data stop being personal data? The answer determines whether the GDPR applies at all and with it, whether individuals hold rights of access; whether data can be shared with third parties or transferred outside the EU without GDPR safeguards; and what is permissible in AI development. In short, the boundary between personal data and non-personal data is the watershed of data protection law.

The EU AI Act has been in force since August 2024, but the ink was barely dry before the European Commission proposed changes to it. In November 2025, the Commission published the Digital Omnibus proposal — a package of targeted amendments aimed at simplifying and clarifying the AI Act, alongside broader adjustments to several pieces of EU digital legislation, including the GDPR and Data Act. The proposal came as a response to concerns about legal uncertainty and the practical challenges businesses face in preparing for the new digital legislation.

The Government proposes that an administrative fine may also be imposed on public authorities and public administrative bodies for breaches of data protection legislation in order to make the system of sanctions more consistent across the public and private sectors.

In February 2026, prosecutors brought data protection charges against over 50 healthcare professionals, among them around 20 doctors, at Oulu University Hospital.

In this blog, we will delve into the relationship between privacy and corporate sustainability and ESG, and the rapidly developing regulatory landscape and stakeholder expectations around them

Targeted advertising conducted by the tech giants has been under heated discussion the past years. Meta introduced the so-called "consent or pay" model under...