Terms and conditions of using an electronic ID card NATIONAL POLICE BOARD POPULATION REGISTER CENTRE INSTRUCTION

Transcription

1 Terms and conditions of using an electronic ID card NATIONAL POLICE BOARD POPULATION REGISTER CENTRE INSTRUCTION ELECTRONIC ID CARD USE AND RESPONSIBILITIES GENERAL The primary purpose of use of an electronic ID card issued by the police is to prove the identity of the holder. The electronic ID card can also be used by Finnish citizens as a travel document when travelling in European Union Member States and in Liechtenstein, San Marino and Switzerland. An electronic ID card on which health insurance information has been included is used as a personal health insurance card (Kela card). The electronic ID card also contains a technical component enabling e-services to be used. The citizen certificate in the technical component of the ID card consists of certificate pairs which have two different purposes of use: an authentication and encryption certificate and a signature certificate, which is a qualified certificate complying with the Act on Strong Electronic Identification and Electronic Signatures. Authenticity of identity is guaranteed by the Population Register Centre. An electronic ID card is valid for five years from the date of issue. As the Certificate Authority the Population Register Centre individualises the certificate by means of the holder's electronic client identifier, which is also an element of the certificate s information content. USING AN ELECTRONIC ID CARD A PIN (Personal Identification Number) must be entered in order to use an ID card. There are two PIN codes. PIN1 is a basic PIN with which the user controls maintenance and electronic identification of the ID card. PIN2 is a signature PIN code, which allows the user to create an electronic signature. If the user enters the PIN1 incorrectly five times, the card locks and the function protection by the PIN code can no longer be used. Locking of PIN1 prevents the use of all applications protected by the PIN code. Locking of PIN2 prevents the use of the electronic signature. Locked PIN codes are released by means of a Pin Unblocking Key (PUK). A HelpDesk for chip embedded ID card use and electronic services are available Monday-Friday at 8 am and 9 pm and Saturdays at 9 am- 3 pm on (local call charge/mobile charge). Closed on Sundays and midweek holidays. Service in Finnish and Swedish. Submit your question online, CHANGING THE PIN CODE An ID card holder may change his PIN code himself on his home computer by using card reader software, which is available free of charge at

2 ORDERING A PUK CODE A PUK code is requested in person at the licence service point of a police department. The identity of the applicant is checked at the same time. The PUK code is sent to the postal address notified by the applicant within a week of the request. Police licence services, however, are public transactions. The Police charges a fee stated in the Ministry of the Interior Decree on Public Charges. This includes the fee charged by the Population Register Centre for ordering the letter in which the PUK code is sent. UNLOCKING LOCKED PIN CODES The certificate holder unlocks the locked PIN himself with card reader software. The software, including additional information, is available from The mpollux DigiSign Client version of the card reader software should be or later. RENEWAL OF AN ELECTRONIC ID CARD An electronic ID card is renewed using the same procedure as when the card was applied for the first time. A person may hold only one valid electronic ID card. RESPONSIBILITY FOR SAFEKEEPING OF ELECTRONIC ID CARD The electronic ID card and related confidential PIN codes may be used only by the card holder or person authorised by him. The card holder must keep the ID card and related PIN codes in such a way that the confidential PIN codes relating to the use of the card are not disclosed to a third party. Personal PIN codes must not be stored in the same place as the ID card. In order to terminate liability for loss of an ID card or for it falling into the possession of a third party, the holder must without delay notify the: General Revocation Service The revocation service is available 24/7 at the following numbers: (free if you are calling from inside Finland), when calling from abroad, (+ local operator's charge) The electronic ID card holder s liability for the use of the citizen certificate ends when he has notified the revocation service of the information needed to revoke the citizen certificate and been notified by the officer receiving the telephone call that the certificate has been entered on the revocation list. In order to terminate liability, the revocation notification must be made as soon as the need arises. If necessary, the notification can also be made by another person, in which case the identity of that person and his connection to the holder of the ID card being cancelled are ascertained. When a revocation notification is received, information enabling the identification of the person making the notification to be verified is checked. With the consent of the person making the notification, the revocation service checks the personal data of said person in the Population Information System.

3 The card holder must take care of the electronic ID card in compliance with these terms and conditions of use and publicly available accepted certificate policy. The ID card must be kept carefully so that it does not fall into the hands of outsiders, is changed or used without authorisation. Acting contrary to these terms and conditions releases the Population Register Centre from any liability arising from use of the ID card. LIABILITY OF THE ELECTRONIC ID CARD HOLDER The electronic ID card holder shall ensure that the information notified to the Certification Authority and Local Registration Authority upon application for the citizen certificate is correct. The citizen certificate holder shall use the certificate only in the manner corresponding to its purpose of use. The citizen certificate is standardised personal data, the electronic identity of its holder, and for this reason it may not be conveyed to the use of another person. The certificate holder is liable for the use of the certificate, the transactions he has concluded with it and for their economic consequences. When leaving the vicinity of a computer the electronic ID card must be removed from the card reader and the applications used closed. The liability of the holder of the electronic ID card for the use of the citizen certificate ends after he has notified the revocation service of the information needed to revoke the certificate and been notified by the officer receiving the telephone call that the citizen certificate has been entered on the revocation list. In order to terminate liability, the revocation notification shall be made as soon as the need arises. RESPONSIBILITY OF THE POPULATION REGISTER CENTRE The liability of the Population Register Centre for damages relating to the provision of certificate services is determined in accordance with the Damages Act (412/1974). The liabilities of the Certification Authority in accordance with the Act on Strong Electronic Identification and Electronic Signatures (617/2009) and the Act on Electronic Communication within Administration (13/2003) also apply to the Population Register Centre. The Population Register Centre shall ensure that the citizen certificate has been created in compliance with the procedures laid down in the Act on the Population Information System and Certificate Services of the Population Register Centre (661/2009), the Act on Strong Electronic Identification and Electronic Signatures, the Act on Electronic Communication within Administration and in the certificate policy and in accordance with the procedures given in the certification practice and the information provided by the certificate applicant. The Population Register Centre shall only be liable for the information that it has stored on the citizen certificate. The Population Register Centre shall ensure that, when the citizen certificate is used properly, it may be used from the time of delivery through the validity of the certificate unless it has been entered in the revocation list. The certificate is delivered to a person who has been identified in the manner required for a citizen certificate.

4 The Population Register Centre is responsible for the operability of the certificate system's hardware and software. The Certification Authority shall ensure that the certificates entered in the revocation list belong to the right person and that they appear in the revocation list within the time referred to in this certification practice. RESTRICTIONS OF POPULATION REGISTER CENTRE LIABILITY The Population Register Centre is not liable for damage caused by disclosure of the PIN codes, the PUK code and the enciphered keys of the citizen certificate holder unless the disclosure is directly attributable to the actions of the Population Register Centre. The Population Register Centre is liable to the certificate holder and the relying party at the most for direct damages caused, if the damage is caused by the direct actions of the Population Register Centre. The Population Register Centre is not liable to the holder of a citizen certificate for indirect or consequential damages. Nor is the Population Register Centre liable for any indirect or consequential damages suffered by a relying party or another contractual partner of the holder of an electronic ID card. The relying party cannot in good faith rely on the correctness of the citizen certificate and the electronic signature if the validity of the certificate has not been checked from the revocation list. Should the certificate be accepted without checking, the Population Register Centre shall be discharged from liability. The relying party shall also ensure that the certificate issued corresponds to its purpose of use in the transaction for which it is used. The Certification Authority shall be entitled to interrupt the service for the duration of alteration or service work. Any changes relating to the revocation list or service work shall be notified in advance. The Certification Authority shall be entitled to develop the certificate service further. The citizen certificate holder or the relying party shall be liable for its own costs arising therefrom and the Certification Authority shall not be liable to compensate the certificate holder or the relying party for costs arising from the development work of the Certification Authority. Upon use of the certificate, the Certification Authority shall not be liable for any errors based on the certificate in the network service or application offered to the citizen or organisation or for the costs arising therefrom. The Population Register Centre shall not be liable for the functionality of public data traffic connections, e.g. the Internet, nor for a circumstance in which the conclusion of a transaction is prevented because the equipment or software used by the citizen certificate holder is not functional nor if the certificate is used contrary to its purpose of use. FORCE MAJEURE The Population Register Centre shall not be liable for any damages arising from force majeure or a similar cause due to the operations of the Population Register Centre becoming unreasonably difficult.

5 An impediment of this kind releasing from liability can be, for example, but not limited to: action by the authorities, war, or threat of war, insurrection or riot, disruption to mail delivery, computer processing, data transfer, other electronic communications or electricity supply beyond the Population Register Centre s control, interruption caused by fire or other accident, delay in the operations of the Population Register Centre, disclosure of the private keys used by the Population Register Centre, or threat of their disclosure or industrial action such as a strike, lockout, boycott or blockade, even though it may not directly concern the Population Register Centre. Force majeure entitles the Population Register Centre to suspend activities until further notice. PREVENTING THE USE OF AN ELECTRONIC ID CARD AND ITS CERTIFICATES As a general rule, the card holder decides himself how he wants to proceed to prevent the use of the card before the expiry of the validity of the card. The use of an electronic ID card and the certificates on it can be prevented in the following ways. 1. Cancellation of an electronic ID card The police always cancel an electronic ID card upon the request of the card holder. An ID card issued to a minor is cancelled also if the guardian of the minor withdraws his consent. An ID card may be cancelled if it has been lost, stolen, or damaged, if the entries on it have been changed or if it is used without authorisation by a person other than the person to whom the ID card has been issued. An electronic ID card can also be cancelled if the information intended for the citizen certificate has been changed. An ID card on which health insurance data has been included may be cancelled if the person is no longer insured in Finland or no longer entitled to the reimbursements entered on the card or if the health insurance data on the ID card has been unlawfully altered. The police notify the revocation service in order to revoke the certificates of an electronic ID card it has cancelled. If the holder of an electronic ID card wishes to submit a revocation notification in order to revoke the certificates before cancellation, he has to notify the revocation service himself. 2. Preventing the use of an electronic ID card and its certificates in other ways Preventing the use of the certificates The card holder is responsible for revoking the citizen certificate. The citizen certificate can be placed on the revocation list upon the notification of the card holder, in which case the use of the citizen certificates on the electronic ID card relating to electronic communication and issued by the Population Register Centre is prevented. Any other applications in the technical component of the card may, on the other hand, still be used in accordance with their purposes. Preventing the use of the citizen certificates does not affect the acceptability of the electronic ID card as an identification card and, in the case of a Finnish citizen, as a travel document. A citizen certificate is revoked by calling the above-mentioned revocation service number. Another person may, where necessary, submit the notification too, in which case the identity of the person submitting the notification as well as his connection to the holder of the ID card being cancelled are ascertained. During the same telephone communication, the revocation service notifies the person making the certificate revocation request of its success. The responsibility of the holder of the electronic ID card for the use of the certificates ends at this moment. A revoked certificate cannot be re-activated.

6 Preventing the use of an ID identification card as an identification card and, in the case of a Finnish citizen, as a travel document The card holder can notify the police of a lost or stolen electronic ID card. The police enter the notification in the Data System for Administrative Matters of the police and the card will not be accepted as an identification card or a travel document. In connection with the notification relating to loss and theft, the police also notify the citizen certificate in the technical part of the card to the revocation list. When the card holder notifies the police that his ID card has been found, an entry is made in the Data System for Administrative Matters. After this, the electronic ID card is again accepted as an identity card or as the travel document of a Finnish citizen and as a Kela card. Upon delivery of a new valid electronic ID card, a police official cuts off the lower right corner of the expired electronic ID card at the point of the photograph. The holder of an electronic ID card may, however, use the invalidated card in electronic transactions to manage the documents and files he has encrypted. REVOCATION OF A CERTIFICATE BY THE POPULATION REGISTER CENTRE The Population Register Centre always revokes a citizen certificate after receipt of information on the death of the certificate holder. The Population Register Centre submits a notification thereof to the holders of the rights of the deceased citizen certificate holder. The Population Register Centre may revoke the citizen certificates signed with an enciphered key if there is reason to suspect that the enciphered keys of the Population Register Centre have been revealed or have ended up in the wrong hands. The Population Register Centre revokes the citizen certificates it has issued if an error has been detected in the data content of the citizen certificate in question. All the citizen certificates issued with a revealed key and in force have to be revoked in one or more revocation lists, which remain in force until the termination of the validity of the last revoked citizen certificate. In the event that the enciphered key or other technical method used by the Population Register Centre in the creation of the citizen certificates has been revealed or otherwise become unusable, the Population Register Centre must notify all card holders and the Finnish Communications Regulatory Authority of this in an appropriate way. The Population Register Centre may revoke a citizen certificate on special grounds. INFORMATION ON THE PROCESSING OF DATA IN ACCORDANCE WITH SECTION 24 OF THE PERSONAL DATA ACT Personal data files and personal data processing are based on the provisions of the Act on the Processing of Personal Data by the Police (761/2003), the Personal Data Act (829/1999) and the Act on the Population Information System and Certificate Services of the Population Register Centre (661/2009). The electronic client identifier is recorded in the Population Information System and other notified data are recorded in the Data System for Administrative Matters. The aforementioned Acts also provide on the supplying of data from registers. The certificates on the

7 electronic ID card and the electronic client identifier are also recorded in a public directory. Everyone has the right to obtain information from a public directory as provided in the Act on the Openness of Government Activities (621/1999). CONTROLLER AND DESCRIPTION OF FILE With respect to the electronic ID card, personal data is collected in the following systems: the Data System for Administrative Matters, the certificate system, the public directory service and the Population Information System. With respect to the Data System for Administrative Matters, the controller is the National Police Board and, with respect to other systems, the controller is the Population Register Centre. The Social Insurance Institution of Finland (Kela) maintains a register of ID card applicants whose electronic ID card includes health insurance data. File descriptions pursuant to the Personal Data Act have been drawn up on the registers which are accessible at police departments, Local Register Offices, the Population Register Centre and Kela offices. A file description with respect to the Data System for Administrative Matters is available also from the police website ( Crimes Checking your personal data). DATA CONTENT OF THE CERTIFICATE The certificate used in electronic communications issued by the Population Register Centre contains the Certification Authority s name, the certificate holder s name, the certificate holder s electronic client identifier, the certificate s period of validity, information about the calculation method used in creating the certificate holder's public key, the Certification Authority's country code, the certificate s serial number, information about the calculation method used by the Certification Authority in the certificate signature, information about the certificate policy to be followed and the use of the certificate, and other essential technical information required for the use of the certificate. The certificate's information content and its authenticity are verified with the electronic signature of the Certification Authority. The Population Register Centre publishes the issued certificates in a public directory. An electronic ID card applicant, if he wishes, may include an address both on the certificate and in the Population Register Centre. The address is entered both on the certificate and in the Population Register Centre in the format notified by the applicant. The address entered on a citizen certificate is recorded in a public directory in the same manner as other data content of the citizen certificate, which means that that the address is available to anyone. The address may not be changed during the citizen certificate s validity. REALISATION OF RIGHT OF ACCESS AND ERROR RECTIFICATION PURSUANT TO THE PERSONAL DATA ACT A data subject s right of access to his own register data and to prohibit a controller from processing register data on him as well as error rectification is provided on in the Personal Data Act (523/1999), the Act on the Processing of Personal Data by the Police (761/2003) and the Act on the Population Information System and Certificate Services of the Population Register Centre (661/2009). Requests for right of access to the data and error rectifications pursuant to the Personal Data Act are addressed to the register controller. RESPONSIBILITY OF THE CONTROLLER AND PROCESSING OF PERSONAL DATA The controller is responsible for ensuring that the data recorded in the aforementioned registers when an electronic ID card is being used is not used for any purposes other than use of the service

8 in question. Data relating to the use of the directory are not stored in the public directory maintained by the Population Register Centre. Data relating to the certificate system may, however, be used as data on numbers for statistical, research and accounting purposes, among others. These data are not disclosed to third parties. FURTHER INFORMATION RELATING TO THE ELECTRONIC ID CARD Further information about the application procedure for an electronic ID card is available at The certificate policy document for the electronic ID card and the software (mpollux DigiSign Client) for changing PIN codes and unlocking locked PIN codes are available at Further information about the electronic ID card with health insurance data is available at