To be taken into account when using personal credit information in an electronic web service or in an automated service:
An electronic market place / credit grantor (service provider) has to plan and carry out the registration required from a new credit customer so that the registering person i.e. consumer will understand that, every time he orders goods, he is asking for a binding credit offer or ordering goods on credit, against invoice, or that he will understand he is opening an account with overdraft facility. When selling against cash or cash on delivery, it is not allowed to check personal credit data.
Automated decision-making Decision-making is automated in a case when the making of the decision is based solely on automated data processing. If an automated decision leads to a negative credit decision, the rights of the data subject have to be ensured, for example, by transferring the final decision-making into manual assessment (meaning that the service provider cannot automatically inform of a negative credit decision).The service provider has to notify the Data Protection Ombudsman, if a credit decision is based solely on automated data processing.
Informing the subject of inquiry According to the Credit Information Act, the service provider has to inform all credit applicants that their credit information is checked from Suomen Asiakastieto Oy.
Response to credit applicant It is not allowed to directly inform in the web service that a decision based on credit information is concerned. In this way it will be ensured that other persons’ credit information is not viewed with wrong personal information in an electronic market place or web service.
In cases of adverse credit decisions, the service provider may, for example, give a neutral response stating that the order cannot have been confirmed / the decision-making cannot have been carried out, and that the service provider will later contact the credit applicant, or the person is requested to contact the service provider. When the person contacts the service provider, who in some way can verify the person’s identity, the reasons for the adverse decision can be told to the applicant.
Purpose of use Personal credit information may only be used for purposes according to Section 19 of the Credit Information Act.
- Credit granting
- Credit controlling
- Planning of debt collection
- Status as person in charge (assessment of a company or person in charge)
- Tenancy agreement
- Assessment of a job applicant or employee
- The legal right of the authority to obtain information or granting of authority support
- Guarantee or pledge
- Definition of terms of agreement if it is not possible to refrain from the making of the agreement
- Certificate on the ability to meet engagements and prevention of money laundering
According to the Credit Information Act, the service provider has to be able to establish the purpose of use for the credit information, the time when the information was used and from which register the information was obtained. Asiakastieto provides the data subject information on data disclosed during the preceding 12 months when the person is inspecting his own information.
User identifiers If the user identifier is used only in the web service, in which case the customer’s personnel cannot make inquiries with the user identifier in question, one identifier will be sufficient.
If the credit decision is made in some other function than the web service, it must be possible to identify the end user and purpose of use, when needed. The end user can be identified by using personal user identifiers or group identifiers, in addition to which an end user identifier will be conveyed in the inquiry for identifying the person. End user identifiers need not be entered in Asiakastieto’s user ID file, it is sufficient that the customer unambiguously identifies the user on the basis of the end user identifier.
If no personal identifier (either user identifier or end user data) is used in the inquiry, the service provider has to enter the credit information check transaction (personal identity number, date and end user) to the log. The data has to be stored from the inquiry at least 12 months for credit information and 60 months for population register, the recommendation being 15 and 63 months (cf. purpose of use).
Recording the information The credit information obtained from Asiakastieto as a response can be recorded to the credit decision documents. However, it is not allowed to use the recorded information when making a new decision.
Person in charge The service provider has to define a person, who will be in charge of the inquiries to Asiakastieto and the data subject. The possible requests concerning the credit information inquiries will be addressed to this person.
Disclosure of information abroad It is not allowed to disclose personal credit information outside EU/EEA countries.
Use of Population Register information The use of information of the Population Information System requires a separate license from the Population Register. Suomen Asiakastieto Oy will forward the license application to the Population Register.
Personal information in Asiakastieto’s register In Asiakastieto’s register, some entries that are not payment defaults may be registered to a person, e.g. information about the payment of a debt that caused the payment default (the debt has been paid in full), information about a supervisor of interests being appointed to a person, or if the person’s competence to act has been restricted. In addition, persons have the opportunity to report an own credit stoppage, for example, in a situation in which the person’s identity card has been lost.
OLK Own credit stoppage supplied by the debtor, not a payment default (2) The person has reported to Asiakastieto that a credit stoppage be recorded for them. The credit stoppage will prevent the granting of credit to a person misusing the supplier’s identity.
VLK Voluntary ban on credits, not a payment default The persons has set voluntary ban on credits in the Positive credit register's e-service.
HAE Interests' supervisor appointed to the person A supervisor of interests has been appointed to the person, but the person’s competence to act has not been restricted. The supervisor can have been appointed, for example, to a person living abroad for managing their property here. The Guardianship Services Act, Section 14: The appointment of a supervisor shall not disqualify the ward from self administering their property or entering into transactions, unless otherwise provided elsewhere in the law.
HAR Interests’ supervisor appointed to the person and the person’s competence to act restricted The person’s right to conclude certain kinds of legal acts has been restricted, or the person is only allowed to conclude certain kinds of legal acts. The contents of the restriction are not directly indicated in the guardianship register. The more detailed uncovering of the matter requires, for example, that the supervisor of interests be contacted.
HAV Person declared legally incompetent and interests’ supervisor appointed The person has no right to conclude any kinds of legal acts.