1. Name of the register

DTC (Digital Travel Credentials) Pilot

2. Data controller

Headquarters of the Border Guard
Postal address: P.O. Box 3, 00131 Helsinki, Finland
Street address: Vilhonvuorenkatu 6, 00500 Helsinki
Switchboard: +358 295 42 0000
E-mail address: [email protected]

3. Contact person in matters concerning the register

Lieutenant Commander Maija Laukka
Headquarters of the Border Guard
Postal address: P.O. Box 3, 00131 Helsinki, Finland
Street address: Vilhonvuorenkatu 6, 00500 Helsinki
Switchboard: +358 295 42 0000
E-mail address: [email protected]

4. Data Protection Officer of the Finnish Border Guard

Senior Officer Sami Piispanen
Headquarters of the Border Guard
Postal address: P.O. Box 3, 00131 Helsinki, Finland
Street address: Vilhonvuorenkatu 6, 00500 Helsinki
Switchboard: +358 295 42 0000
E-mail address: [email protected]

5. Legal basis for processing personal data 

Article 6(1)(a) of the GDPR ((EU) 679/2016) – consent of the data subject.

For personal data belonging to special categories of personal data, Article 9(2)(a) of the GDPR – explicit consent of the data subject.

6. Purpose of processing personal data

DTC (Digital Travel Credentials) pilot in air traffic on Finnair routes outside the Schengen Area: South Korea, Hong Kong, India, Ireland, Great Britain, Japan, China, Cyprus, Qatar, Singapore, Thailand, Türkiye, USA and United Arab Emirates. The purpose of the pilot is to examine the usability and functioning of the DTC as part of the European Commission’s project: 101114725 — DTC Pilot — BMVI-2022-TF1-AG-DTC-IBA; European Commission, Directorate-General for Migration and Home Affairs.

The pilot involves generating a digital identifier (DTC) derived from data contained in the chip of an existing travel document and saving said identifier in an application installed on the personal mobile phones of participating air passengers. With the application, passengers can submit the DTC identifier to the Finnish Border Guard before the start of their journey. The Border Guard uses the DTC identifier to carry out the border check. 

The Finnish Border Guard collects statistical data on the functioning of the identifier and its impact on border check processes. For this purpose, pilot participants are also asked to respond to surveys concerning the pilot. The statistical data and survey responses are anonymised so that it is not possible to identify individual passengers from the data.

The Finnish Border Guard processes the digital identifiers it receives for carrying out border checks and performing its other statutory tasks as described in the Finnish Border Guard’s privacy statement. Under section 53 of the Act on the Processing of Personal Data by the Border Guard (639/2019), the Border Guard does not have the right to store DTC identifiers unless otherwise provided.

The DTC is not a replacement for physical travel documents. Passengers must have valid travel documents, such as a passport or identity card, when leaving Finland for above-listed destinations and when arriving in Finland.

7. Categories of data subjects

The pilot participants consist of Finnish citizens who have given their consent and Finnish Border Guard personnel members who have been separately appointed in the Border Guard’s enforcement order RVLDno-2022-1197, Appendix 1 (RVL2314662).

8. Personal data categories

  • name
  • personal identity code
  • gender
  • nationality
  • travel document number
  • facial photo (special category of personal data)
  • telephone number
  • e-mail address.

9. Sources of personal data

Pilot participants are registered at two offices of the Eastern Uusimaa Police Department’s licence administration (Helsinki-Vantaa Airport and Tikkurila). When getting registered, pilot participants must bring a Finnish passport or identity card valid at least until 31 March 2024.

10. Regular disclosure of data

No data is disclosed from the register.

11. Retention period of personal data

The registration made at the police department will be retained until 31 March 2024, which is when the pilot ends.

12. Rights of the data subject

12.1. Right of access to data

Under Article 15 of the GDPR, the data subject has the right to obtain confirmation from the controller as to whether or not personal data concerning them are being processed and, if such personal data are being processed, access the personal data and the following information:

  • the purposes of the processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
  • where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
  • the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
  • the right to lodge a complaint with the supervisory authority;
  • where the personal data are not collected from the data subject, any available information as to their source; and
  • the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Access to the data is provided by the data controller or a person appointed by the controller to manage register matters, who provides the data subject with an opportunity to view their data. The data is provided in writing upon request. 

12.2. Rectification and erasure of personal data and the restriction of processing of personal data

Under Article 16 of the GDPR, the data subject has the right to have the controller rectify or supplement inaccurate or incorrect information concerning them.

Under Article 17 of the GDPR, the data subject has the right to have the data controller erase personal data concerning the data subject without undue delay if

  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
  • the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
  • the personal data have been unlawfully processed; or
  • the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

Under Article 18 of the GDPR, the data subject has the right to the restriction of processing where:

  • the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
  • the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
  • the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or
  • the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

Data subjects are requested to submit a written request with justifications for rectification, erasure or restriction of processing of personal data to the contact person for matters concerning the register.

12.3. Right to data portability, right to object to the processing of personal data and the right not to be subjected to automatic decision-making

Under Article 20 of the GDPR, the data subject has the right to have their data transmitted to another controller.

The data subject does not have the right to object to the processing of their personal data in accordance with Article 21 of the GDPR as the processing of personal data is not based on Article 6(1)(e) or (f) and is not used for direct marketing or scientific or historical research purposes.

The personal data are not processed for automated decision-making or profiling.

12.4. Fees charged for measures and exercising the data subject’s rights

As a rule, exercising the data subject’s rights is free of charge. If requests are manifestly unfounded or unreasonable, a reasonable fee may be charged or the requested action may be refused.

12.5. Exercising of rights through the Data Protection Ombudsman

If the data subject wants to report a problem concerning the processing of their personal data, they must primarily contact the data controller's representative or data protection officer.

The data subject also has the right to lodge a complaint with the supervisory authority about the processing of their data as provided for in Article 77 of the GDPR. In Finland, the supervisory authority is the Data Protection Ombudsman (www.tietosuoja.fi).