FINLAND Law and Practice Contributed by: Anu Waaralinna, Jukka Paloheimo, Oskari Lindholm and Elmiira Kutvonen, Roschier
7.4 AI AI is increasingly being used in internal investigations, particularly for managing large volumes of data. AI tools may enable efficient review and analysis of substantial amounts of documents and information that would otherwise be time-consuming to process manually. This includes organising evidence, identify - ing relevant documents and extracting key informa - tion from investigation materials. When implementing AI tools, it is crucial to select AI solutions that are safe to use from a data protection perspective. Fur - thermore, the AI tool to be used should not train the language model based on the data fed into it, and AI should not be used to make decisions without human involvement. In addition, an impact assessment may be needed before using an AI tool, and the persons using the tool should be sufficiently trained. Finland has implemented the EU’s whistle-blowing directive through the Act on the Protection of Persons Reporting Violations of European Union and National Law (1171/2022) (the “Finnish WB Act”). As a starting point, the Finnish WB Act concerns only more serious breaches of certain legislation. The Finnish WB Act provides for protection for those reporting (suspect - ed) breaches in the field of, for example, public pro - curement, financial markets, money laundering and terrorist financing, product safety and compliance, environmental protection, food safety and consumer protection. Further, protection under the Finnish WB Act requires that any breach of such legislation would lead to, for example, criminal or administrative sanc - tions. HR matters do not fall within the scope of the Finnish WB Act. 8. Special Cases 8.1 Whistle-Blowing The Finnish WB Act provides protection for whistle- blowers by prohibiting retaliatory action from employ - ers or organisations, including termination, suspen - sion, unfavourable treatment or other actions having negative consequences for those who report viola - tions. Whistle-blowers who have been subjected to retaliatory measures have the right to receive com - pensation for the harm caused.
investigation involving a particular employee). This requirement of necessity cannot be waived with the
employee’s consent. 7.2 Specific Rules
The employer must collect personal data concern - ing the employee primarily from the employee. If the employer collects personal data from a source other than the employee, the employee’s consent must be obtained for the collection of the data. However, consent is not required when an authority discloses data to the employer for the purpose of performing a task prescribed by law, or if the collection or obtain - ing of data is specifically provided for by law. Finnish legislation also contains provisions that address the confidentiality of electronic communications, such as emails, SMS, instant messages and internet brows - ing, alongside related metadata such as IP address - es and timestamps, and accessing such confidential electronic communications is permitted only in very limited situations subject to strict conditions. 7.3 Access The parties involved in the investigation generally have a right to access any of their own personal data col - lected during an HR investigation. As mentioned in the foregoing, the employer must collect personal data concerning an employee primarily from the employ - ee. If information concerning an employee has been collected from sources other than the employee, the employer must inform the employee of the information obtained before it is used in decision-making con - cerning the employee. The Act on the Protection of Privacy in Working Life (759/2004) does not provide explicit exceptions that would allow an employer to deny an employee access to their own personal data in the context of an HR investigation. However, the restrictions to access set out in the Finnish Data Protection Act (1050/2018) – regarding, for example, situations where providing access to the data could hamper the prevention or investigation of offences or seriously endanger the health or treatment of the data subject or the rights of some other person – may apply. In addition, the employer may have the right to refuse the fulfilment of an access request that would adversely affect the rights and freedoms of others.
137 CHAMBERS.COM
Powered by FlippingBook