Automated decisions at Traficom

At Traficom, automation in decision-making is used in official duties that do not include case-by-case consideration by an authority. Automated decisions may constitute decisions issued by Traficom or other measures that conclude the processing by the authority. Automated decisions can be issued in cases instituted by the customer or in cases initiated by the authority.

An automated decision-making procedure means the processing of administrative matters by an authority in which the decision is generated automatically. In automated decision-making, the rules of processing the matter and the operating process have been defined in advance, and a separate check by a human being is not needed at the decision-making stage. Traficom’s customers will be notified of the decision in the same way as if a public official had made the decision. An automated decision-making procedure is a procedure by an authority, and it does not require any new measures from the customer.

Automated decisions can be made when the information related to the processing of the matter and the grounds affecting the decision do not have any issues that should be investigated separately on a case-by-case basis. A public official will decide the matter if it must be investigated further or if a case-by-case assessment is needed to make a decision. Information processing based on learning artificial intelligence applications is not used in making automated decisions.

Automated decision-making is regulated by the Administrative Procedure Act and the Act on Information Management in Public Administration

Automated decision-making is provided for in the Administrative Procedure Act (434/2003) and the Act on Information Management in Public Administration (906/2019). The legislation on automated decision-making entered into force on 1 May 2023. The legislation set requirements on the design, documentation, deployment and monitoring of automated decision-making as well as liability for acts in office.

Automated decision-making has been used before the legislation mentioned above entered into force. The previously used automated decision-making procedures must meet the statutory requirements within 18 months of the entry into force of the legislation.

The deployment of automated decision-making is based on a separate deployment decision made by the authority. The deployment decisions of procedures that have already been used are published within the transition period.

Before the deployment decision, the legality and processing rules of automated decision-making, the information used in the processing of the matter, the quality of automated decision-making as well as the monitoring of the decision-making procedure and the legislation on which the decision is based have been assessed, documented and approved.

Matters related to the processing of personal data, data protection and legal protection methods in connection with automated decision-making are taken into account in automated decision-making.

According to Article 22 of the EU General Data Protection Regulation (GDPR), a data subject shall have the right not to be subject to a decision based solely on automated processing. According to the same Article, the right of refusal shall not apply if the automated decision-making is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests.

The provisions of the Administrative Procedure Act and the Act on Information Management in Public Administration on automated decision-making that entered into force on 1 May 2023 establish the national legal basis required by the GDPR for making automated decisions.

If a right to appeal the decision exists, this is stated separately in the decision. The right of an interested party to appeal the decision is taken into account in automated decision-making in the same way as with other decisions by an authority. The right to appeal (request for an administrative review) is always provided for in the legislation concerning each duty of an authority. Requests for an administrative review are not processed automatically. The matter can be brought to a public official for processing by submitting a request for an administrative review.

Informing a party of an automated decision

The legislation on automated decision-making requires authorities to provide appropriate information about the use of an automated decision-making procedure.

An automated decision must show that it has been made automatically. If no administrative decision is issued on the decision, information about an automated decision being made about the matter must be provided in other ways.

At Traficom, information about automated decisions is provided within the transition period as required by law.