Compliance Guide — Finland
Employee Monitoring Laws in Finland: The Act on Privacy in Working Life and Criminal Liability for Violations
Finland's Act on Privacy in Working Life (759/2004) — the laki yksityisyyden suojasta työelämässä — is one of the world's few standalone workplace privacy statutes. It sets strict limits on IT monitoring and camera surveillance, and makes unauthorized access to employee work email a criminal offence punishable by up to one year's imprisonment. This guide explains every compliance obligation Finnish employers face in 2026.
Used by 1,000+ companies. Configurable for Finnish legal requirements.
Legal Disclaimer
This guide provides general information about Finnish employee monitoring law for educational purposes only. It does not constitute legal advice and does not create a solicitor-client relationship. Finnish employment law is complex, collective agreements vary by sector, and the law continues to evolve through TSV guidance and court decisions. Employers should consult a Finnish employment lawyer and the Tietosuojavaltuutettu's published guidance before deploying monitoring systems.
Why Finland Has One of the World's Strictest Workplace Privacy Regimes
Most countries regulate employee monitoring through general data protection law, labor statutes, or sectoral rules. Finland took a different path. The Act on Privacy in Working Life (laki yksityisyyden suojasta työelämässä, 759/2004) created a comprehensive, purpose-built framework specifically for the employment context — one that predates GDPR by over a decade and goes further in several areas.
Finland's approach reflects a broader Nordic consensus that employees retain fundamental privacy rights inside the employment relationship. That view is reinforced by the Finnish Constitution (Section 10), which protects privacy of correspondence and communications as a constitutional right. The result is a layered compliance environment where the Act on Privacy in Working Life, EU GDPR, sector collective agreements, and the Occupational Safety and Health Act all apply simultaneously.
The Three Layers of Finnish Monitoring Law
- Act on Privacy in Working Life (759/2004, as amended): The primary statute. Governs personal data processing in employment, technical monitoring, email access, and camera surveillance with sector-specific procedural requirements beyond GDPR.
- EU GDPR (as implemented by the Finnish Data Protection Act, 1050/2018): Applies to all personal data processing. The Tietosuojavaltuutettu (TSV) enforces both frameworks simultaneously. Fines can reach €20 million or 4% of global annual turnover.
- Sector collective agreements (työehtosopimukset, TES): Cover approximately 89% of Finnish wage earners (Statistics Finland, 2023). Many TES provisions restrict monitoring more tightly than the statutory floor. Non-compliance with a TES can trigger separate penalty proceedings through labor courts.
What the Act on Privacy in Working Life Actually Requires
The Act on Privacy in Working Life (referred to below as "the Act") divides workplace monitoring into three categories, each with its own legal regime: general personal data processing in employment, technical monitoring of IT systems, and camera surveillance. A fourth chapter — the most legally sensitive — addresses employer access to employee work email.
Chapter 2: Personal Data in Employment — The Necessity Principle
Section 3 of the Act establishes that employers may collect and process employee personal data only if the data is directly necessary for the employment relationship, taking into account the employee's tasks and any rights and obligations arising from the employment. This is a stricter standard than GDPR's general proportionality test: the necessity is tied specifically to the employment relationship, not to any legitimate business interest the employer might identify.
In practice, this means productivity data collected through monitoring software must map directly to a documented purpose in the employment relationship — payroll accuracy, performance review, resource allocation — not speculative security purposes or general surveillance. Employers who collect data "in case it is useful later" violate Section 3 even if they never actually access or use the data.
Chapter 3: Technical Monitoring of IT Systems
The Act permits employers to monitor network traffic, IT system logs, and usage data for two purposes: information security and technical administration. Security monitoring — detecting malware, unauthorized access attempts, data exfiltration — is the clearest case. Technical administration monitoring — identifying server load, troubleshooting software conflicts — is equally clear.
What the Act does not permit is using IT system monitoring data as a proxy for employee performance evaluation. If network logs show that an employee spent three hours on non-work websites, that log was collected for a security or technical purpose. Using it in a performance review, disciplinary proceeding, or dismissal without a separate legal basis and explicit disclosure to the employee violates the purpose limitation principle under both the Act and GDPR Article 5(1)(b).
Before deploying any technical monitoring, the employer must:
- Define and document the specific security or technical purpose
- Inform employees in writing through a publicly accessible policy
- Consult employee representatives under the Co-operation Act
- Complete a DPIA if the monitoring is systematic or generates behavioral profiles
Chapter 3a: Email Access — The Criminal Liability Provision
This is the provision that distinguishes Finnish law from most other EU jurisdictions. Unauthorized access to an employee's work email account — even on company-owned servers — is a criminal offence under Penal Code Chapter 38, Section 5 (viestintäsalaisuuden loukkaus, breach of communications confidentiality). The penalty is a fine or up to one year's imprisonment.
Criminal liability is personal. A line manager who accesses a direct report's inbox without authorization, or an IT administrator who reads email content beyond what is technically necessary, is individually exposed — not just the organization. The Finnish prosecutor does not need to prove intent to surveil; unauthorized access itself constitutes the offence.
The Four Conditions for Lawful Email Access
Chapter 3a sets out the narrow conditions under which an employer may access work email without criminal liability. All four must be satisfied simultaneously:
- The employee is absent — on leave, sick leave, or otherwise unavailable for a period that creates business urgency.
- A business-critical message is reasonably expected — not a general search for anything that might be useful, but a specific documented expectation that a time-sensitive client message, contract document, or regulatory communication has arrived.
- The employee cannot redirect or authorize access — the employer must first attempt to reach the employee and ask them to redirect messages or authorize a colleague. Only if this is genuinely impossible may the employer proceed.
- The purpose is business continuity, not performance assessment — accessing email to understand a client matter differs fundamentally from accessing email to monitor how diligently an employee responds. The latter remains prohibited regardless of the employee's absence.
Even when all four conditions are met, the employer must access only headers first (sender, subject, date) and access content only if the header confirms the email is the specific message sought. Any access must be documented and the employee must be informed of what was accessed and why as soon as practicable after their return.
Camera Surveillance in Finnish Workplaces: What Is Permitted and What Is Not
Chapter 5 of the Act on Privacy in Working Life addresses camera surveillance (kameravalvonta) separately from IT monitoring. The rules reflect a similar logic: surveillance for safety and security is permitted; surveillance to assess individual performance is not.
Permitted Purposes for Workplace Cameras
- Protecting the safety of employees and others in the workplace
- Preventing and investigating property crimes (theft, vandalism)
- Monitoring access to controlled areas (server rooms, warehouses, vaults)
- Ensuring the safety of automated production processes
Prohibited Uses
- Monitoring individual employees' work performance or behavior at their workstation
- Targeting specific employees based on suspicion without involving the police
- Any surveillance in break rooms, rest areas, changing facilities, restrooms, or prayer rooms
- Continuous monitoring of employee welfare spaces even for security purposes
Procedural Requirements Before Installing Cameras
Before deploying cameras, Finnish employers must: document the specific purpose in writing; inform all employees clearly and in advance; post visible signage in all monitored areas; consult employee representatives under the Co-operation Act; and notify the Regional State Administrative Agency (Aluehallintovirasto, AVI) for Occupational Safety and Health oversight where required. Failure to give advance notice transforms otherwise lawful surveillance into a potential Act violation, and employees can file complaints with both the TSV and the Occupational Safety authorities.
GDPR in Finland: How the Tietosuojavaltuutettu Enforces Employee Monitoring Rules
Finland implements GDPR through the Data Protection Act (tietosuojalaki, 1050/2018). The TSV is the national supervisory authority responsible for GDPR enforcement, investigation of complaints, and publication of binding guidance. Under GDPR Article 88, Finland has used its Member State latitude to specify additional conditions for processing employee data — primarily through the Act on Privacy in Working Life described above.
GDPR Legal Bases Available for Employee Monitoring in Finland
Finnish employers cannot rely on employee consent (GDPR Article 6(1)(a)) as a legal basis for monitoring because the TSV — consistent with the European Data Protection Board's guidance — holds that consent is not freely given in an employment relationship due to inherent power imbalance. Available legal bases are:
- Article 6(1)(b) — Contract performance: Attendance tracking, time recording for payroll, and basic activity data necessary to administer the employment contract.
- Article 6(1)(c) — Legal obligation: Record-keeping required by Finnish labor law, tax law, or occupational health and safety statutes.
- Article 6(1)(f) — Legitimate interests: Productivity monitoring and IT security monitoring, subject to the Act's proportionality requirements and mandatory balancing test. The TSV applies a strict balancing assessment for this basis in employment contexts.
The EDPB's 2023 guidelines on monitoring in the workplace (Guidelines 08/2020, revised) confirm that continuous keystroke logging, constant screen capture, and tracking of personal communications even on work devices are high-risk processing activities requiring DPIA regardless of the legal basis claimed. A DPIA commissioned to satisfy Finnish TSV standards should follow the TSV's published DPIA methodology and include an explicit assessment of alternatives to the monitoring proposed.
TSV Enforcement Record
The TSV has investigated multiple workplace monitoring complaints in the 2022-2025 period. Published decisions confirm enforcement against: employers who monitored employee browsing without adequate notice; organizations that retained monitoring screenshots beyond stated retention periods; and cases where IT logs were repurposed from security purposes to disciplinary proceedings without a separate legal basis. While the TSV has not published a fine in the hundreds of millions for workplace monitoring, administrative fines of €10,000–€100,000 have been issued in the employment context, and criminal referrals for email access violations are a distinct possibility.
Works Council and Employee Representative Consultation: Non-Negotiable in Finland
The Act on Co-operation within Undertakings (yhteistoimintalaki, 334/2007) — commonly called the Co-operation Act or YT-laki — requires employers with 20 or more employees to negotiate with employee representatives before making decisions that materially affect working conditions. The introduction of monitoring systems falls squarely within this requirement.
What the Consultation Must Cover
Before deploying or substantially modifying a monitoring system, Finnish employers must negotiate with elected shop stewards (luottamusmies) or the works council (yhteistoimintaneuvottelu) on:
- The specific purpose of the monitoring and why it is necessary
- The technical methods and tools used
- Which employees or roles will be monitored
- What data will be collected and how it will be stored
- Who will have access to monitoring data and under what conditions
- How long data will be retained before deletion
- The process by which employees can access and challenge their own data
The Co-operation Act does not give employee representatives a veto over monitoring decisions — the employer retains the final decision-making authority. However, the consultation must be genuine: presenting a fait accompli and asking representatives to sign off after the fact does not satisfy the statutory requirement. Employers who bypass consultation risk enforcement by the Occupational Safety and Health Authority and face weakened legal standing if monitoring-related disputes reach the labor courts.
Collective Agreements: The Sector Layer
Approximately 89% of Finnish wage earners are covered by collective agreements (Statistics Finland, 2023). Many sector agreements in IT services, finance, healthcare, and manufacturing contain monitoring-specific provisions that override the Act's general framework in favor of employees. Before deploying monitoring software, Finnish employers should review the applicable TES with their legal counsel or employer association to identify any sector-specific restrictions on screenshot capture frequency, continuous activity monitoring, or data retention periods.
Does Employee Monitoring Violate Finland's Occupational Safety and Health Act?
This question is more relevant in Finland than most other EU jurisdictions. The Occupational Safety and Health Act (738/2002) places a positive duty on employers to ensure the work environment does not cause employees unnecessary stress, psychological strain, or a sense of being under constant surveillance. Monitoring systems can breach this duty even when they are technically lawful under the Act on Privacy in Working Life and GDPR.
Finnish occupational health research (Finnish Institute of Occupational Health, FIOH) consistently identifies continuous monitoring as a psychosocial risk factor. A 2022 FIOH study found that employees subject to activity-level monitoring reported statistically significantly higher levels of work-related stress compared to employees in non-monitored roles performing equivalent tasks — controlling for workload and management style. This body of research informs how Finnish labor inspectors and courts assess monitoring proportionality.
Practically, this means Finnish employers implementing productivity monitoring should:
- Use aggregate team-level metrics rather than individual-level real-time scoring where operationally feasible
- Avoid displaying real-time "productivity scores" or rankings visible to employees or their colleagues
- Consult the occupational health service (työterveyshuolto) on psychosocial risk before deployment
- Include monitoring in the workplace wellbeing plan (työkyvyn hallintamalli) required under the Occupational Safety and Health Act
Finnish Employee Monitoring Compliance Checklist for 2026
Use this checklist as a starting point for your compliance audit. Each item should be documented with dated evidence before monitoring systems go live.
Legal Basis and Policy Documentation
- Identified the correct GDPR legal basis for each type of monitoring (Article 6(1)(b), (c), or (f))
- Completed and documented a balancing test for any legitimate interests basis
- Conducted a DPIA for all systematic monitoring — documented and approved by management
- Drafted a written monitoring policy disclosing purpose, scope, data types, retention, and access
- Published the policy in a format accessible to all employees (intranet, employee handbook, onboarding materials)
Consultation and Notification
- Completed Co-operation Act consultation with employee representatives — minutes documented
- Reviewed sector collective agreement for monitoring-specific provisions
- Issued written notice to all employees before monitoring begins (not after)
- Documented that employee representatives received all required information prior to negotiation
Email Access Controls
- Implemented a documented email access procedure limiting access to Chapter 3a conditions
- Configured IT systems so only designated authorized personnel can access email accounts
- Access log in place recording every instance of employer email access with reason and scope
- Employee notification procedure ready for use after any access event
- IT and HR staff trained on criminal liability under Penal Code Chapter 38, Section 5
Camera Surveillance
- Cameras placed only in permitted locations — no cameras in welfare facilities
- Visible signage in all monitored areas
- Occupational Safety and Health Authority notified where required
- Retention period defined and technically enforced (TSV recommends minimum necessary)
Ongoing Compliance
- Retention periods technically enforced through automatic deletion or scheduled review
- Employee access requests (GDPR Article 15) response process in place
- Annual review of monitoring scope against current business purposes
- Consultation process in place for any future changes to monitoring tools or scope
For a downloadable version of this checklist with implementation notes, see eMonitor's employee monitoring policy template, which includes Finnish-specific clauses.
Practical Steps: How Finnish Employers Implement Compliant Monitoring in 2026
Understanding the legal framework is necessary but not sufficient. The following implementation pathway draws on published TSV guidance and the experience of Finnish employers who have deployed monitoring systems that survived employee complaints and regulatory inquiries.
Step 1: Audit Current Monitoring Activities
Before implementing any new system, map existing monitoring: IT access logs, any ad hoc productivity tools, CCTV systems, and access control data. Many Finnish employers discover they are already conducting monitoring that lacks proper documentation or consultation. Retroactive compliance is possible but requires re-running the full consultation and notification process.
Step 2: Remove Performance Monitoring From Email Systems
If email or calendar systems are currently used to assess individual productivity — response time tracking, message volume analysis — this use must be stopped or restructured. Email system data may only be used for IT security and business continuity purposes. Performance assessment requires separate tools operating on different data collected under a different legal basis, with separate disclosure.
Step 3: Implement Purpose-Limited IT Security Monitoring
Configure network monitoring and endpoint security tools for their stated IT security purpose. Ensure access to monitoring logs is restricted to IT security personnel. Establish a documented process for when security data may be shared with HR — typically only when a specific security incident has been identified and documented, and only the data directly relevant to that incident is shared.
Step 4: Document Business Continuity Email Access Procedures
Write a step-by-step procedure that IT and HR staff follow before accessing any employee's email account. The procedure should require: documented reason for access, confirmation that the employee has been contacted and cannot redirect messages, confirmation that the purpose is business continuity not performance review, header-only review before content access, and a notification letter ready to send to the employee. Store every completed procedure form in the employee's HR file.
Step 5: Run Co-operation Act Consultation
Schedule a formal consultation with employee representatives at least 6 weeks before any monitoring system goes live. Prepare a written proposal covering all required elements. Minutes of the consultation must be signed by both parties and retained. If the consultation results in proposed changes to monitoring scope, reflect those in the final system configuration before deployment. See our guide on works council compliance for European employers.
Step 6: Train IT and HR Staff
The criminal liability provisions of Penal Code Chapter 38 apply to individuals, not just organizations. Every person with technical access to monitoring systems, email servers, or CCTV footage needs documented training on what access is lawful, what is not, and the personal consequences of unauthorized access. Training records should be retained as evidence of reasonable organizational measures.
For organizations operating across the Nordic region, see how Finland's framework compares to Swedish employee monitoring law, Norwegian monitoring law, and Danish monitoring regulations. For the EU-wide GDPR framework that underpins all four regimes, see our GDPR employee monitoring compliance guide.
How eMonitor Supports Finnish Compliance Requirements
eMonitor is designed from the ground up for transparent, configurable monitoring that aligns with the privacy-first requirements of jurisdictions like Finland. Here is how specific eMonitor features map to Finnish legal obligations.
| Finnish Legal Requirement | eMonitor Feature | Compliance Function |
|---|---|---|
| Work-hours-only monitoring (Act Section 3) | Schedule-based monitoring windows | Tracking activates only during configured work hours — no off-hours data collection |
| Employee transparency (Act Chapter 2, GDPR Art. 13) | Employee-facing dashboard | Every monitored employee sees their own data in real time — no hidden surveillance |
| DPIA requirement (GDPR Art. 35) | Data processing documentation exports | Activity logs, data types, and retention periods documented for DPIA completion |
| Proportionate data collection (Act Section 3) | Configurable screenshot frequency and module selection | Disable unused modules; set screenshot intervals from off to hourly — collect only what you need |
| Access controls (GDPR Art. 32) | Role-based access control | Only designated managers access monitoring data; IT separation of duties configurable |
| Retention minimization (TSV guidance) | Configurable data retention with auto-deletion | Set retention periods per data type; automatic purging enforces policy technically |
| Occupational wellbeing (OHS Act 738/2002) | No real-time individual productivity score display | Aggregate and trend views reduce surveillance pressure; individual scores manager-only |
eMonitor's productivity monitoring and time tracking features operate within work-declared hours only. Screenshot capture frequency is fully configurable. All employee data is accessible through employee-facing dashboards that fulfill Finnish disclosure requirements. For Nordic teams, pricing starts at $3.50/user/month — see how that compares across monitoring tools built for compliance-heavy environments.
Frequently Asked Questions: Employee Monitoring Laws in Finland
What law governs employee monitoring in Finland?
Finland's primary employee monitoring law is the Act on Privacy in Working Life (Laki yksityisyyden suojasta työelämässä, 759/2004, as amended). Finland is one of very few countries worldwide with a standalone workplace privacy statute. The Act covers personal data processing, technical monitoring, camera surveillance, and the narrow circumstances in which employers may access employee work email. EU GDPR applies simultaneously through Finland's national implementing legislation.
Is employee monitoring legal in Finland?
Yes, employee monitoring is lawful in Finland when conducted for specific, disclosed purposes. The Act on Privacy in Working Life permits monitoring of IT systems for security and technical purposes, camera surveillance for workplace safety and property protection, and access to employee email strictly under the absence-and-business-continuity conditions defined in Chapter 4 of the Act. Monitoring purely to assess individual employee performance via email content or covert surveillance is prohibited.
What are the criminal penalties for improper email monitoring in Finland?
Unauthorized access to an employee's work email in Finland is a criminal offence under Penal Code (Rikoslaki) Chapter 38, Section 5 (viestintäsalaisuuden loukkaus, message interception). Penalties include a fine or imprisonment of up to one year. Criminal liability applies to managers and IT administrators personally, not only to the employing organization. This makes Finland one of the strictest EU jurisdictions on email access procedures.
Under what circumstances can a Finnish employer access work email?
Chapter 4 of the Act on Privacy in Working Life defines three cumulative conditions: (1) the employee is absent; (2) a specific business-critical message is reasonably expected; and (3) the employee cannot redirect their messages or authorize a substitute. The employer must first attempt to contact the employee. Access is limited to headers unless content is strictly necessary. The employee must be informed of any access after the fact.
What are Finland's rules for workplace camera surveillance?
Camera surveillance is permitted only for employee safety, crime prevention, controlled area access monitoring, and production safety. Cameras must not monitor individual employee performance or target specific individuals. Employees must be informed in advance, and visible signage is required. Cameras are strictly prohibited in break rooms, changing rooms, restrooms, and other welfare facilities. The Regional State Administrative Agency handles occupational health oversight of CCTV use.
Does Finland require works council consultation before implementing monitoring?
Yes. The Act on Co-operation within Undertakings (334/2007) requires employers with 20 or more employees to negotiate with employee representatives before introducing monitoring systems. Consultation must cover purpose, technical means, data collected, access controls, and retention periods. Failure to consult constitutes a statutory violation and weakens legal standing in any subsequent employee complaints or labor court proceedings.
Who is the Finnish data protection regulator and what powers does it have?
The Tietosuojavaltuutettu (TSV) is Finland's data protection authority and GDPR supervisory authority. The TSV can investigate complaints, conduct audits, issue binding corrective orders, and impose fines up to €20 million or 4% of global annual turnover. The TSV has investigated workplace monitoring cases and published guidance on lawful monitoring configurations that employers should review before deployment.
Is a DPIA required for employee monitoring in Finland?
Yes. A DPIA is required under GDPR Article 35 for systematic monitoring of employees. The TSV has confirmed this obligation applies to continuous productivity monitoring, screen capture programs, and monitoring that generates behavioral profiles. The DPIA must assess necessity, proportionality, risks to employee rights, and mitigation measures. The TSV's published DPIA methodology should be followed for Finnish compliance purposes.
Do collective agreements affect employee monitoring in Finland?
Yes, significantly. Approximately 89% of Finnish wage earners are covered by collective agreements (TES). Many sector agreements in IT, finance, healthcare, and manufacturing contain monitoring-specific provisions more restrictive than the Act on Privacy in Working Life. Employers must review their applicable TES before deploying monitoring tools, as TES violations trigger separate penalty proceedings through labor courts.
How long can Finnish employers retain employee monitoring data?
The Act on Privacy in Working Life does not set a universal limit. The TSV recommends retaining data only for the minimum period necessary for its stated purpose. Payroll-related time records may be held for the legally required period (generally six years). Productivity monitoring screenshots and activity logs should be reviewed at 90 days. Automatic deletion enforced technically is preferable to manually managed review cycles.
How does eMonitor help Finnish employers comply with the Act on Privacy in Working Life?
eMonitor collects data only during declared working hours, eliminating off-hours surveillance concerns. Screenshot frequency, activity log retention, and access controls are fully configurable to align with Finnish proportionality requirements. Employee-facing transparency dashboards fulfill the Act's disclosure obligations. Time tracking and attendance data collection satisfies the employment administration legal basis directly. Contact our compliance team to review your specific Finnish configuration.
Related Compliance Resources
Sweden Monitoring Laws
Sweden's GDPR implementation and sector agreement requirements for workplace monitoring.
Read guide →Norway Monitoring Laws
Norway's stricter-than-GDPR Working Environment Act and 2018 Monitoring Regulations explained.
Read guide →Denmark Monitoring Laws
Danish employee privacy rules, the Act on Processing of Personal Data, and sector agreements.
Read guide →See also: GDPR Employee Monitoring Compliance Guide · Works Council Compliance for European Employers · Employee Monitoring Policy Template
Sources and Further Reading
- Act on Privacy in Working Life (759/2004, as amended), Finlex, finlex.fi
- Finnish Penal Code Chapter 38 Section 5 (Viestintäsalaisuuden loukkaus), Finlex
- Data Protection Act (tietosuojalaki, 1050/2018), Finlex
- Act on Co-operation within Undertakings (334/2007), Finlex
- Occupational Safety and Health Act (738/2002), Finlex
- Tietosuojavaltuutettu (TSV) Workplace Monitoring Guidance, tietosuoja.fi
- European Data Protection Board, Guidelines 08/2020 on the targeting of social media users, and Guidelines on employee monitoring (revised 2023)
- Finnish Institute of Occupational Health (FIOH), Psychosocial Risk Factors in Digital Monitoring Environments, 2022
- Statistics Finland, Labour Market Overview — Collective Agreement Coverage 2023, stat.fi