PROTOCOL REGARDING THE IMPLEMENTATION OF THE AGREEMENT BETWEEN THE GOVERNMENT OF THE REPUBLIC OF ESTONIA AND THE GOVERNMENT OF THE REPUBLIC OF FINLAND ON POPULATION REGISTRATION

r/f /7O 6Q)d3 /Z,C

PROTOCOL REGARDING THE IMPLEMENTATION OF THE AGREEMENT BETWEEN THE GOVERNMENT OF THE REPUBLIC OF ESTONIA AND THE

GOVERNMENT OF THE REPUBLIC OF FINLAND ON POPULATION REGISTRATION

In order to arrange the exchange of personal data between the population registers and to clarify and ensure that agreement provisions are interpreted uniformly and consistently, the Ministry of the Interior of Estonia and the Digital and Population Data Services Agency of Finland (hereinafter referred to individually as “the Contracting Party” or together as “the Contracting Parties”) have on the basis of the Agreement between the Government of the Republic of Estonia and the Government of the Republic of Finland on Population Registration (hereinafter “the Governmental Agreement”) agreed as follows:

Section 1

Scope of the Protocol

1. According to articles 11, 12, 14 and 15 of the Governmental Agreement, this Protocol includes the practical procedures and technical solutions related to the disclosure of data as well as arrangements on the introduction of the disclosure of data and the information of the schedules for starting the different phases of the data exchange in order to ensure the implementation of the Governmental Agreement by the Contracting Parties.

2. Certain technical and practical matters concerning data systems to be used, contacts and other such things will, when mentioned in this Protocol below, be detailed and kept up to date in a separate annex (Annex 1: Detailed Information Annex), which is considered part of this Protocol and will be kept available to both Contracting Parties in an electronic document repository.

3. The Detailed Information Annex according to paragraph 2 of this section can be changed when the Contracting Parties have mutually agreed on it in writing for example by email or letter or in the Minutes of a Meeting between the Contracting Parties. Changes to the Detailed Information Annex do not constitute amendments of the Protocol’s text.

Section 2

Interpretation of articles 8 and 15 in the Governmental Agreement

1. The Contracting Parties agree that there is a need to clarify the interpretation of some provisions in articles 8 and 15 of the Governmental Agreement. The Contracting Parties agree that this clarification does not constitute an amendment of the Governmental Agreement’s text, but only means setting down in writing the mutually agreed interpretation of the Governmental Agreement’s text.

2. According to article 15 paragraph 5 of the Governmental Agreement, the Contracting Parties of this Protocol have the right to agree on when the notifications and registration of data under Chapter II of the Governmental Agreement will commence, and when the measures provided for in articles 8 and 9 of the Governmental Agreement are to be carried out.

3. The provisions in article 15 paragraph 5 of the Governmental Agreement shall be interpreted as meaning that the actual application of Chapter II of the Governmental Agreement starts only at the time agreed in section 7 of this Protocol.

1

4. The measures provided for in articles 8 and 9 of the Governmental Agreement arc taken in order to commence the procedures under Chapter II of the Governmental Agreement. Therefore, these measures must be carried out only when the application of Chapter II of the Governmental Agreement starts.

5. Thus, the date of entry into force referred to in article 8 of the Governmental Agreement is to be interpreted as the start date of the application of Chapter II of the Governmental Agreement as agreed in section 7 of this Protocol.

Section 3

Other matters of interpretation of the Governmental Agreement

Other matters of interpretation of the Governmental Agreement are governed by an Interpretation Description, which is an annex to this Protocol (Annex 2: Interpretation Description Annex). The annex will be kept available in the electronic document repository and can be changed when the Contracting Parties have mutually agreed on it in writing for example by email or letter or in the Minutes of a Meeting between the Contracting Parties. Changes in the Interpretation Description Annex do not constitute amendments of the Protocol’s text.

Section 4

Means and service level of the data exchange

1. The exchange of personal data under the Governmental Agreement shall be carried out through the X-Road. When this is not possible, the data exchange can be carried out through other secure data communication channels by mutual approval of the Contracting Parties. These will be detailed in the electronic document repository.

2. The Contracting Parties shall deliver data under articles 6, 7, 10 and 11 of the Governmental Agreement at least once every working day. As working days shall count the days that are official working days for the state authorities in Estonia, when considering data delivered by Estonia. As working days shall count the days that are official working days for the state authorities in Finland, when considering data delivered by Finland.

3. In case of planned or unplanned service interruptions, the Contacting Party on whose side the service is interrupted must inform the other Contracting Party of the interruption as soon as possible after the interruption has been decided or discovered. Regularly occurring service interruptions will be detailed in the electronic document repository.

4. When delivering data under article 11 paragraph 3 or article 12 of the Governmental Agreement, the data shall be sent in encrypted format through such secure data communication channels which are detailed in the electronic document repository.

Section 5

Information on contact persons

1. The Contracting Parties shall inform each other about the e-mail address or addresses to be used for communication between the Contracting Parties about technical topics, including but not limited to service interruptions and changes in the technical solutions.

2

2. The Contracting Parties shall also inform each other about the e-mail address or addresses to be used for communication between the Contracting Parties on non-technical topics, including but not limited to individual cases and general policy questions.

3. The information in this article shall be detailed in the electronic document repository. Any changes in the contact information shall be entered in the electronic document repository as soon as the change is decided.

Section 6

The documentation of the technical solutions

1. Documentation of the technical solutions for the data exchange and their service levels shall be detailed in the electronic document repository.

2. The other Contracting Party shall be informed well in advance and at least six months before making changes to the technical solutions that affect the other Contracting Party.

3. Any changes to the detailed documentation of the technical solutions for the data exchange shall be approved by both Contracting Parties in writing.

Section 7

Schedules for starting the different phases of the data exchange

1. The exchange of death data referred to in article 15 paragraph 6 of the Governmental Agreement shall commence on 1 5th April 2025.

2. Application of Chapter II of the Governmental Agreement shall commence on 2’ December 2025.

3. The process and data exchange for determining place of residence, provided for in articles 8 and 9 of the Governmental Agreement, shall be carried out as soon as possible after the application of Chapter II of the Governmental Agreement has commenced.

4. The schedules of the following phases of data exchange according to Chapter III of the Governmental Agreement shall be agreed later in a separate Protocol or by amending this Protocol.

Section 8

Entry into force and termination of the Protocol

1. This Protocol shall enter into force when both Contracting Parties have signed it. The Protocol is concluded for an indefinite period of time.

2. This Protocol may be amended by mutual written consent of the Contracting Parties.

3. This Protocol shall cease to have effect when the Governmental Agreement ceases to be in force.

3

Done in duplicate in Tallinn this 20th day of February 2025 in English.

For the Ministry of the Interior of the For the Digital and Population Data Republic of Estonia Services Agency of Finland

E(Pungas Timo Salovaara ad of the Population Facts Department Deputy Director General, Services Division

Torbjörn Sandell Senior Specialist

4

4W9J ,t12 4C7flä-4

ANNEX 1: DETAILED INFORMATION ANNEX 20th February 2025

This document is an Annex to the Protocol Regarding the Implementation of the Agreement between the Government of the Republic of Estonia and the Government of the Republic of Finland on Population Registration. It includes the detailed information according to section 1 paragraph 2 in the Protocol.

Section 3 paragraph 1: Secure data communication channels for the regular data exchange

When the X-Road is not available for regular data exchange, the following channels shall be used:

- For sending data from Estonia from Finland, e-mail with an encrypted attachment containing the personal data. The de-encryption password will be sent to the recipient by text message.

- For sending data from Finland to Estonia, encrypted e-mail service “Turvaviesti”, as provided by Government ICT Centre Valtori. When the recipient’s phone number is available, an extra e-mail de-encryption password will be sent by text message.

Section 3 paragraph 4: Secure data communication channels for data exchange under articles 11 and 12

In these cases, the communication channels detailed under article 3 paragraph 1 above will be used.

Section 4 paragraph 1: Contacts for technical topics

Estonia: abi(àahvastikuregister.ee

Finland: - Population register, VTJ-muutosrajapinta API service:

o General questions, notifications of service intermptions, technical issues: muutostietopalvelu(c4dvv.fi (available on weekdays 08:00—16:00)

o Technical issues, service interruptions outside office hours: Tietoevry service desk dvv.sd(d4ietoevry.com or +358 20 343 433 (on standby 24/7 for error situations)

- Suomi. fi Data Exchange Layer (X-Road): palveluvayla(dpalveluvayla fi

Section 4 paragraph 2: Contacts for Agreement implementation

Estonia: rtomenetlus(d2siseministeerium.cc Finland: info.ee(/4dvv.fi

Section 5 paragraph 1: Documentation of technical data exchange solutions

Documentation of the Estonian technical data exchange solutions is available in a separate document in the repository.

Documentation of the data structure of the data available through the VTJ-muutosraj apinta APT service is available at https : //hiekkalaatikko .muutostictopalvclu.cloud .dvv. fi/. The relevant data groups (tietoryhmä) are listed in a separate document in the repository.

1

Service level agreement (SLA)

Service quality parameters

Estonia ‘inland

Working time A Monday—Sunday at 00:00— vionday—Sunday at 00:00—24:00 class 24:00 (24/7, round the clock) 24/7, round the clock)

Business Critical If the service of the ritical f the service of the information criticality information and nd communication technology

communication technology [oes not work, providing public does not work, providing ervices stops totally or to a public services stops totally arge extent. or to a large extent.

Availability K3 Bigger and equal to 99,9 % 2 lo availability level has been in a year and maximum [efined for the service. Planned allowed single downtime [owntimes are limited to a duration for an active service riaximum of 1 hour. Longer user is up to 1 hour. [owntimes will be notified

eparately. Integrity T2 The source of the E2-T3 ‘he source of the information,

information, the fact of he fact of changing of the changing of the information nformation and the obliterating and the obliterating of the f the information is identified information must be nd maintained in Finnish identified. It is necessary to population Information System. make periodic checks of the correctness, completeness, ll corrections and changes to and timeliness of the he data will be transmitted information. hrough this service.

Confidentiality S2 Confidential information: ;2-S3 confidential information: only only certain user groups are ertain user groups are allowed allowed to use the o use the information, the information, the access to the ccess to the information is information is permissible ennissible on the legitimate on the legitimate interest of nterest of the customer the person who is requesting rganization who is requesting the access. he access.

fhe information to be disclosed md the data processing rules are miways defined for each ustomer organization ndividually.

Maximum 1 hour Maximum duration of a lie service is expected to be duration of a single interruption in a year mvailable 24/7. single is smaller or equal to 1 hour. interruption )ue to unexpected situations,

lowntime may last for more han one hour. Longer

2

Maintenance time

Notification

Planned interruption of the service during the maintenance: Tuesdays at 19.00 —24.00

If the planned interruption of the service does not take place: Tuesdays, Wednesdays, or Thursdays at 18.00 —06.00. Within 15 minutes the notification is made if the interruption of the service lasts more than 5 minutes. During the notification process, the following information is being shared:

• Initial notice that there is an interruption!breakdo wn taking place.

• Every 30 minutes additional information until the incident is solved.

• A notification if the incident is solved.

lowntimes will be notified ;eparately. Fhe maximum downtime for )lanned maintenance is 30 ninutes.

1anned downtime is on fuesday mornings from 9-9.30 interface does not respond to he client or responds more ;lowly) )ther downtimes otified separately.

will bc

ustomers will be notified as ;oon as possible by email of my service downtimes letected.

)uring the notification process, he following information is erng shared:

• Initial notice that there is an interruption/breakdown taking place and estimated completion time.

. notification if the incident is olved.

3

2. uZ2. WXSMZ ‘1-10/At)- 1’

ANNEX 2: INTERPRETATION DESCRIPTION ANNEX 2O February 2025

This document is an Annex to the Protocol Regarding the Implementation of the Agreement between the Government of the Republic of Estonia and the Government of the Republic of Finland on Population Registration. It is intended to serve as a description of the common un derstanding by the Estonian and Finnish population register agencies of how the Agreement should be interpreted and implemented in practice.

The text in blue is the agreement text, while the text in black is the interpretation.

Article 1

Scope of the Agreement

1. This Agreement shall apply between Estonia and Finland (hereinafter referred to as “the states “) as follows:

The provisions in article 1(1) lay out the scope of the two different entities of data exchange that are to be conducted under this agreement.

1. to the notification and registration of data in the states’ population registers concerning persons, regardless of citizenship, who are registered as residents in one of the states and who intend to migrate or have migrated to the other state (hereinafter referred to as “migrants”). The provisions of Chapter 11 shall apply to notification and registration of data. However, the Agreement shall not apply if the migrant’s state of departure has not received the notification referred to in Article 6 within three months of the notified migration;

The first entity of data exchange under the agreement, i.e., the one mentioned in article 1(l)(1), concerns data exchange in connection with a person’s migration from Finland to Estonia or Estonia to Finland, and the specific rules on this are in the agreement’s second chapter. This entity applies to each and every person migrating between the countries, regardless of what citizenship they have (or even if they have no citizenship at all).

What is notable, though, is that this first entity of data exchange applies only when a person has a permanent address in one country and then moves to the other country in such a way that they will have a permanent address in the other country. If the person migrating between the coun tries only has a temporary address in the country they move from or only gets a temporary address in the country they move to, this part of the agreement is not applicable. Still, if the person is a Finnish or an Estonian citizen, the other data exchange entity regulated in article l(l)(2) might apply.

The provisions in this section also set down that the persons moving in this way, from a perma nent address in one country to a permanent address in another country, are called “migrants” in this agreement.

This section also includes a kind of “safety valve” for situations where there is considerable delay in either the data exchange or the processing of the migrant’s case in the state of arrival. If the state of departure has received no notification either that the migrant has been given a permanent address in the state of arrival or that they have not been given a permanent address when three months have passed since the emigration from the state of departure, the state of

1

departure is no longer bound by the provisions in chapter 2 of this agreement, i.e., that the state of arrival decides whether the migration is to be considered permanent.

In the case that no notification whatever has been received within the stipulated three months from the migration, the authorities in the state of departure are free to apply their own legislation and based on that decide whether the migrant can keep their permanent address in the state of departure or not.

The application of this “safety valve” implicitly requires that the state of departure has received a notification of emigration from the migrant themselves — otherwise they cannot, of course, know that there is a migration they will have to process. This also means that if the migrant has no obligation to notify their state of departure of their migration, this “safety valve” will never be used. In Finland, though, the migrant is always required to make a notification of any mi gration, be it within the country, into the country or out of the country. In Estonia, on the other hand, in cases which fall under this agreement, the migrant needs to make a notification of the migration to Estonian authorities only in cases where the “safety valve” is applied. In these cases, the migrant must present a Finnish population register extract indicating their residential address in Finland.

2. to the exchange of data between the states concerning citizens of Estonia who are registered in Finland’s population register and citizens of Finland who are registered in Estoiiia’s population register. The p visions of Chapter 111 shall ap

ply to the exchange of data.

The second entity of data exchange under the agreement is presented in article l(1)(2). This is a data exchange applying to a more limited group of persons: Finnish citizens who have been registered in the Estonian population register, and Estonian citizens who have been registered in the Finnish population register. Under this entity of data exchange, changes in these persons’ personal data is delivered to their country of citizenship, i.e., to Estonia for Estonians registered in Finland and to Finland for Finns registered in Estonia.

Differently from the first entity of data exchange, this data exchange is applied regardless of how permanently or not the citizen is registered in the other country’s population register.

Further provisions on this entity of data exchange are laid out in chapter 3 of this agreement.

2. This Agreement shall apply to personal data in the states’ population registers. Any obliga tion to disclose data shall only apply to a state to the extent that the data is available in its population register.

The meaning of this provision is to make sure that there is no obligation for either party to collect information specifically for any data exchange under this agreement. Instead, any data to be exchanged will be extracted from the data that is otherwise available in the population register of either country.

3. The Agreement shall only apply to personal data in the population registers that is valid at the time of notification, and no obsolete data shall be disclosed unless otherwise provided by this Agreeinent.

This provision makes it clear that neither party has the right to receive or inquire about data that is not valid at that time, e.g., data on previous addresses, names or spouses cannot be exchanged under this agreement.

2

4. Where there is national legislation in place regarding processing restrictions or confidential ity of personal data, including but not limited to protected addresses, that legislation shall apply when data is disclosed under this Agreement.

This provision is quite important. It means that, e.g., secret/protected addresses or other data that are subject to any kind of confidentiality restrictions shall not be included in the data ex change under this agreement.

Each country will decide how this kind of restrictions will be imposed. Estonia has no protected addresses. In Finland, however, there is a type of protected addresses, which cannot be disclosed to other than Finnish authorities with special access. These addresses will not be delivered under this agreement — not even the information on municipality, only the information that the person lives in Finland. Estonia will also receive the information that the person has a protected ad dress. Even though this is not mentioned explicitly in the data content in the agreement, the data is necessary to highlight how the address is to be treated in the Estonian population register. When receiving information on address protection, the previous address will be terminated in the Estonian population register, but not removed. As only certain authorities (for example local governments) have access to a person’s previous addresses, this is considered an appropriate level of protection.

Article 2

Definitions

Article 2 contains the definition of certain terminology used throughout the agreement.

1. For the purposes of this Agreement

a) the term place ojrc’sideiice” means:

i) in Finland, the person’s municipality of residence and their abode there; and

ii) in Estonia. the person’s residential address registered in the population register;

The term “place of residence’ is important for the interpretation of the provisions in chapter 2, since the reallocation of the place of residence from one country to the other is the central determining factor for when the agreement becomes relevant.

It is important to note that place of residence” is not a synonym of the term “domicile” in international private law. Instead, the two ‘sub-definitions” have been modelled after each country’s own national legislation, to make them as understandable as possible and the national application of them as straightforward as possible.

The Finnish definition is taken from the Act regulating the determination of place of residence (Municipality of Residence Act 201/1994, i.a., 1 § and 7 §), “kotikunta ja siinä oleva asuinpaikka”. The place of residence includes both the municipality of residence and the actual house or apartment in question.

The Estonian definition is found in the Population Register Act. According to its § 65, persons shall submit the residential address where they permanently or primarily reside for entry in the population register. If a person uses several residences as his or her permanent or primary resi dence, he or she shall submit the addresses of all such residences for entry in the population register and select one of them as the residential address with legal effect ( residential address).

3

Other residences shall be entered in the population register as so-called additional addresses,and are not covered by this provision.

b) the terni temporaly sta)’” means a stay of less than 12 months in the state of arrival. As arule, a temporary stay shall not be considered to constitute a place of residence referred to inthis Agreement;

This definition is in a way the opposite of the previous definition, at least as regards the implementation of chapter 2 in the agreement. In addition to the definition, this subsection also includes a provision on what the consequences there are if a stay in the other country is to beconsidered temporary.

When a person moves to the other country and the stay will last for less than 12 months, thiswill constitute a “temporary stay”. In this case, the person must never be given a “place ofresidence” in the state of arrival, which also means that the provisions in chapter 2 of the agreement will not apply. Consequently, when the stay in the other country is less than 12 months,the place of residence will never transfer to the state of arrival, but will be kept in the state ofdeparture (“home country”).

In practice, for us as authorities applying the agreement, the deciding feature would be what theperson themselves states in the notification they make to us about the migration. If the personstates that they will stay in the country only for a specified time, and that time is less than 12months, the stay would be considered temporary, and the provisions in chapter 2 in the agreement would not apply. On the other hand, if the person just states that they will be migrating ona certain date, without mentioning that the stay will be for less than 12 months, they will betreated as a person who might be given a “place of residence” in our country (depending onwhat our national legislation stipulates, of course) — even if the stay in fact is intended to lastfor less than 12 months. But if we don’t know it, we can’t take it into account.

c) the term address ‘means the address details of the place of residence recorded in the population register. With regards to Finland, it also refers to the address details of a person’s ternporaiy place of residence recorded in the population register;

This definition sets down what is meant by “address”, especially when applying the provisionsin chapter 3 of the agreement. “Address” then constitutes the complete address details of the“place of residence” defined in article 2(l)(a).

As Finland registers both permanent and temporary places of residence, and these are both relevant for application of chapter 3, the definition states specifically that also the address details of a person’s temporary place of residence is included in the definition. Otherwise, some address changes would never be delivered to Estonia even if they are relevant in practice.

ci) the tenii identijication number” means:

i) the personal identity code (henkilötunnus/personbeteckning) in Finland;

ii) the personal identification code (isikukood) in Estonia; and

iii) any other personal identifier that is considered equivalent to the above-men tioned identification numbers and is recorded in a population register;

This definition combines the ID codes of each country under the common term “identificationnumber”, to make the agreement text more consise.

4

Sub-subsection 3 also provides for the fact that Finland has plans to reform the national ID code system and might, at some point, introduce another ID code with different format and name than the current “henkilötunnus”. The provision makes it possible to use such a new ID code in data transfers under this agreement without having to change the agreement.

e) the term state ofariii’al” means the state in which a person has settled after migrating from the other state;

the term ‘slate ofdeparture” means the state from which a person has migrated to the state of arrival;

These two terms are important for the application and understanding of the provisions in chapter 2 of the agreement. They are each other’s opposites and determine which country has the right to determine the person’s place of residence when migrating between the countries.

The “state of departure” is the country you live permanently in before moving to the other country, and “state of arrival” is the country move to. National legislation then determines whether you are considered to live permanently in the state of arrival.

g) the term “population regis/el authority” means the Ministry of Interior of the Republic of Estonia or the Digital and Population Data Services Agency of Finland;

This definition combines the population register authorities of each country under a common term. These are the government agencies which are the controllers (using GDPR vocabulary) of their respective country’s population register. These agencies are responsible for building and maintaining the data systems which are needed for the implementation of the data ex changes under the agreement.

h) the term “other population register authorities” means the contractual processors of the population register in Estonia and the State Department of Aland in Finland;

This definition combines two different kinds of organisations under a common term, but their relation to the agreement is similar.

In Estonia, according to § 10 in the Population Register Act, the Government shall appoint a state agency or legal person in private law in state ownership as processor (again, using GDPR vocabulaiy) of the population register. These entities are called contractual processors of the population register. CulTently, the only contractual processor is the IT and Development Center of the Ministry of the Interior (SMIT). Under § 11, the processor shall maintain the population register in compliance with legislation and under the supervision of the controller, which is the Ministry of the Interior.

In Estonia, there are also the local authorities, who under § 74 shall receive a notice of residence and under § 81 shall enter (or refuse to enter) the residential address into the population register. These authorities are users of the population register, not controllers nor (contractual) proces sors.

In Finland, the State Department of Aland is, in fact, legally also a controller of the population register, but only as regards the Aland Islands and their population. They don’t have responsi bility for maintaining any data system, but will be the agency determining the place of residence under article 5, if the migrant migrates to the Aland Islands.

5

i) the term ‘population register” means the population register in Estonia and the Population Information System in Finland;

This definition combines the two countries’ population registers under a common term. In Fin land. the population register’s official name is the Population Information System (fi. vaestotietojarjestelmä), which makes this necessary.

j) the term ‘third par/i’” means any natural or legal person, public authority, agency or any other body other than the data subject, the population register authorities and the persons who, under the direct authority of a population register authority, are authorised to process personal data.

The definition of third party is a general clause and is intended to include any and all persons and organisations who in each individual case are not controllers or processors (again, using GDPR vocabulary) of the respective country’s population register nor the person themselves that the piece of personal data in question describes. Everyone else than these are considered “third parties” or outsiders, who are not to have anything to do with the personal data being exchanged under this agreement.

2. The state of arrival and the state of departure shall be determined for each migration in ac cordance with the definitions above and shall remain unchanged after each migration until the person migrates again from one state to the other.

The purpose of this provision is to clarify that the definitions of “state of departure” and “state of arrival” are not fixed, i.e., the state of departure is not always the “home country”. Instead, the state of departure and state of alTival is always determined separately for each migration.

For example, when a person permanently resident in Estonia migrates to Finland and is received as a permanent resident there, Estonia is the state of departure, and Finland is the state of alTival.

Until the person migrates back to Estonia, the countries of departure and arrival remain like this.

Then, if that same person, who has now for some time been permanently resident in Finland, migrates back to Estonia permanently, this is a new migration, and the countries of departure and arrival are determined again. This time, the state of departure is Finland, and the state of arrival is Estonia — the other way round compared to the first migration.

If, on the other hand, a person permanently resident in Estonia migrates to Finland but is not received as a permanent resident there, this is actually not considered a migration under this agreement. This means that when this person moves back to Estonia, that is also not considered as a migration under this agreement (since the person was never permanently resident in Fin land), and should not be treated like one — e.g., no notifications under articles 6 and 7 will be sent.

This concept is vital for the understanding and application of the provisions in chapter 2.

3. The population register authority shall notify the other population register authority if its duties or the duties of other population register authorities are transferred to entities other than those mentioned above.

The purpose of this provision is to make sure that the population register authorities in each country are always aware of who their counterpart(s) in the application of the agreement is, and that organisational changes are notified to the other country.

6

The responsibility to notify the other country lies only with each country’s population register authority according to the definitions above. On the other hand, the obligation to make a noti fication is activated also if the transferring of duties affects any agency that goes under the definition ofother population register authority”.

In practice, it means that the Finnish Digital Agency must inform the Estonian Ministry of the Interior if any of their duties under the agreement — or of the State Department of Aland — are transferred to other government agencies or other organisations.

Correspondingly, the Estonian Ministry of the Interior must inform the Finnish Digital and Population Data Services if any of their duties under the agreement — or of the contractual pro cessors of the population register — are transferred to other organisations.

The provision doesn’t state exactly when this notification should be made iior how it should be done. For the purposes of the application of the agreement, a notification through diplomatic channels will not be necessary, but it should be sufficient with an informal e-mail notification to the record office/general e-mail address of the counterpart in the other country.

As regards the moment of notification, it is sufficient to say that the notification should be made without needless delay as soon as there is publicly available information on the change. Unof ficially, such information could also be exchanged directly between both countries’ contact persons even before public information is available, if this is necessary for reasons of technical implementation of the change, or for other similar reasons.

Article 3

Electronic exchange of data and purpose of exchange of data

I. The notifications specified in this Agreement may be transferred electronically between the population register authorities of the two states.

The purpose of this provision is to allow for electronic/digital data transfer between the coun tries when data is exchanged under this agreement.

2. Each state shall pay its own costs incurred in delivering and receiving data under this Agree ment.

This provision simply states that each country pays its own system and other costs — Finland covers any costs of data system changes in their own population register, including such data systems as are required to receive data sent from Estonia and bring it into the population regis ter, as well as any data systems needed to send the required data to Estonia, and any staffing costs related to the data exchange and the processing of the received data. The same applies to Estonia on their side.

3. Each state may process personal data received from the other state under Chapters II and III of this Agreement only for the purposes ofmaintaining and correcting data in its own population register to the extent that is necessary for the authorities to perform their statutory duties. How ever, after one state has made entries in its population register on the basis of personal data received from the other state, the data in the population register may be processed in accordance with national legislation and European Union legislation.

This provision makes a distinction between the data as it is when received from the other coun try and the data after being entered in the population register.

7

On one hand, the data as such — regardless of whether it has been received under chapter 2 or 3 of the agreement — must not be processed in any other way than for the purpose of entering the relevant parts of it into the receiving country’s population register. This means that the “raw data” received from the other country must never be disclosed even to other government agen cies.

On the other hand, as soon as the data has been entered into the national population register, the data may be distributed to other government agencies and other organisations just like any other data entered into the system and under the same national legislation that otherwise applies to data disclosures from the population register.

Thus, the deciding point in time is when the data is entered into the population register database. Before that point in time, the data must not be disclosed to anyone outside the population reg ister authorities, and after that point in time, the data can be disclosed just as any other popula tion data.

This point in time can be unclear in some cases. For the purpose of the application of this pro vision, data systems or databases (e.g. case management systems, excel files etc.) where the data is stored before and during processing should not be considered as parts of the population register proper, so data in these should not be disclosed, only the data that is subsequently en tered into the population register database.

CHAPTER II: Notification and registration of population register data

Chapter 2 of the agreement contains the provisions on the “Migrant data exchange”, i.e., the data exchange taking place after someone has migrated from Finland to Estonia or the other way round, and the “Domicile determination process”, i.e., the process of determining which persons have a permanent address in both countries (“Double residents”), and which address they decide to keep when the agreement enters into force.

Article 4

Obligations of a migrant

In this article, there are provisions specifically on the obligations of the migrant themselves. The rights and powers of the population register authorities are provided in subsequent articles.

1. A person migrating from either state to the other shall noti’ the population register authority of the state of arrival about their migration in compliance with the legislation and regulations of that state and within the time period specified therein.

The central message of this provision is that the state of arrival decides how and when the migrant should report their immigration to the authorities. The process, deadline, and other requirements are determined under the national legislation of the state of arrival.

It is good to note, though, that this provision does not prohibit the state of departure from re quiring the migrant to notify them, too, about the migration. In Finland, this will be the case: the migrant must notify the Digital and Population Data Services Agency of their emigration, regardless of whether they are moving to Estonia or somewhere else. When the notification says the person is moving to Estonia, the notification is just not processed in Finland until the notification under article 6 has been received from Estonia.

8

2. In connection with this notification, the migrant shall report their former place of residence, including municipality, that was valid in the state of departure prior to the migration, their iden tification number in the state of departure, and any other information required by the legislation of the state of arrival. The migrant shall also identify themselves by such official identification procedure as is required by national legislation or European Union legislation.

This provision stipulates which information at least must be included in the immigration noti fication and what steps must at least be included in the notification process. Indirectly, this provision also stipulates that the state of arrival must require at least some kind of notification.

The compulsory data to be provided by the migrant when making the immigration notification in the state of arrival are 1) former place of residence in the state of departure (not former address in the country you are moving to!) and 2) the ID code in the state of departure. Both pieces of information are needed for the migrant data exchange set down in articles 6 and 7 to work.

Other than this compulsory data, the state of arrival is free to legislate demands for any other information that is necessary for the processing of the notification. Still, since the idea of the Migrant data exchange is that the migrant’s personal data is transferred digitally between the countries and paper (or digital) population data certificates should be made unnecessary as far as possible, it would be against the spirit of the agreement to require the person to provide such data that is later acquired through the Migrant data exchange.

The provision also stipulates that the migrant must present acceptable identification (as required by the state of arrival’s legislation) when submitting the immigration notification. The provision has intentionally been left open to accommodate electronic identification in situations where national legislation does not require a personal appearance at the relevant agency.

3. The migrant’s residence in the state of arrival shall also he legal in accordance with its na tional legislation or European Union legislation. This Agreement does not alter or provide for an exemption from the preconditions for residence in either state or the responsibilities associ ated with this laid down in the national legislation or in European Union legislation.

The purpose of this provision is to clarify that normal immigration procedures and rules apply, depending on the citizenship of the immigrant, even though the Migrant data exchange facili tates the population registration part of the immigration.

For immigration to Finland, Nordic citizens need no residence permit or visa, and do not need to register with the immigration authorities. Other EU/EEA/Swiss citizens (including of course Estonian citizens) have the benefit of free movement but must register their residence with the immigration authorities if they intend to stay in Finland for more than 3 months. This EU resi dence registration is also a prerequisite for having a permanent address in Finland.

Third country nationals (if not family members of an EU/EEA/Swiss citizen) must have the relevant visa or residence permit for entry into Finland. To have a pennanent address, certain types of residence permit (or a family member who already has a permanent address) is re quired.

For immigration to Estonia, third country nationals or aliens as referred in the Estonian Aliens Act must have the relevant visa or residence permit for entry into Estonia. An alien is required to register his or her place of residence in the procedure prescribed by the Population Register Act within one month from the date of arrival into Estonia on the basis of the residence permit. An alien who is residing in Estonia during the issue of a residence permit is obliged to register

9

his or her place of residence in the procedure prescribed by the Population Register Act within one month from the date of notification of the decision on the issue of the residence permit. An alien is required to have a place of residence registered in Estonia during the whole period of validity of the residence permit.

The Citizen of the European Union Act governs the principal aspects of entry to and residence in Estonia of EU citizens and their family members. The Act applies to non-Estonian citizens of the EU and EEA member states and to citizens of the Swiss Confederation, and to their family members. The right of entry is the legal basis for entry to and stay in Estonia of EU citizens and their family members. An EU citizen acquires a temporary right of residence in Estonia for five years when he or she registers his or her residence following the procedure provided in the Population Register Act. Any EU citizen who has resided in Estonia for a period of five consecutive years based on a temporary right of residence is entitled to a permanent right of residence.

According to § 1122 in the Population Register Act, for the purposes of this Act, a citizen of the United Kingdom who was granted right of residence in Estonia before April 2021 is treated as an EU citizen.

Article 5

Competence to make a decision on a person’s place of residence

This article stipulates which country’s population register authorities decide whether a migra tion from one country to the other has taken place or not.

1. The population register authority of the state of arrival shall decide whether or not the migrant shall be registered with a place of residence in the state of arrival. This decision shall be made pursuant to the legislation of the state of arrival.

This provision gives the population register authorities in the state of arrival powers to decide whether the migrant will have a place of residence (and permanent address) in the state of arri val. The decision is made under national legislation of the state or alTival and is binding for the state of departure.

This means that, e.g., if the provisions in the Finnish Municipality of Residence Act makes the Digital and Population Data Services Agency decide that a person moving from Estonia will not have permanent address in Finland, but is registered only with temporary address, Estonia must abide by that decision and not register a permanent migration to Finland in their population register.

Also, if Estonia decides that a person moving from Finland will have a place of residence (per manent address) in Estonia, Finland must register that person as permanently migrated to Esto nia, even though interpreting the Finnish Municipality of Residence Act might give a different result.

Still, there are some provisions in the agreement that restrict the principle of ‘state of arrival decides”. The first one is the provision in article 2(l)(b) about “temporary stay”. Because of this provision, the state of arrival cannot register a person who has migrated from the other country with a “place of residence”, i.e., permanent address, if they have notified that they will stay in the country for less than 12 months. In other words, this provision restricts what deci sions the state of anival can make.

10

The other provision is the one in l(l)(l) stating that this whole agreement shall not apply if there has been no information from the state of arrival within three months of the notified mi gration. This means that if the person has notified Finland of a migration to Estonia, but there never comes data from Estonia that the person has been registered (or not been registered) within three months from the moving date that the person has notified, Finland can apply their own legislation after that time. In this case, the Digital and Population Data Services agency would apply the provisions in the Municipality of Residence Act and based on them decide whether to register the person as migrated to Estonia or not.

2. If the population register authority of the state of arrival decides that the migrant shall be registered with a place of residence in the state of arrival, the migrant shall be assigned an identification number as soon as possible, following the same rules as those which apply to persons migrating to the state of arrival from states other than Estonia or Finland.

The purpose of this provision is to make sure that anyone moving between Finland and Estonia is given a national ID code in the state of arrival as soon as possible. In practice we know that to be registered in the national population register, you will always be given an ID code. This means that this provision doesn’t have much practical significance.

3. The population register authority of the state of departure shall record the migration in its register only after receiving a notification of the registration of a place of residence from the state of arrival.

The purpose of this provision is to make sure that even if the migrant has notified the state of departure of their migration to the other country, that state must not record the emigration in their population register before receiving data from the state of alTival that the person has ac quired a place of residence in that country.

Here again, this is not a provision without exception. Under article l(l)(l) of this agreement, this prohibition is lifted if the migrant has notified the state of departure of the emigration and no data is received from the state of arrival within three months from the notified date of mi gration. In that case, the state of departure can apply their own legislation to the case.

4. If the population register authority of the state of departure disputes the truthfulness of the circumstances on which the registration of a place of residence is based, it may confer on the case with its counterpart in the state of arrival.

This provision is for quite exceptional situations. The background to this provision is when a migrant has been registered with a place of residence (i.e., permanent address) in the state of arrival and the state of departure has received data on this through the migrant data exchange, quite normally according to article 6.

Now, there might be situations when the population register authority in the state of departure has information strongly indicating that the migrant actually hasn’t migrated at all to the state of arrival. In those very rare situations (not sure if there have been any such between the Nordic countries) the Finnish Digital Agency or the Estonian Ministry of the Interior can ask the other party to “confer” on the case.

In practice, this could mean sending an e-mail containing the “disruptive” information to the other party or asking them for a meeting to discuss the case.

[-lowever, this provision says nothing of how the case should be solved, and doesn’t change the main rule, that the state of arrival decides whether the migrant is registered with a place of

11

residence or not. Thus, it is possible that the state of arrival, even after taking part of the infor mation. would still consider the migrant eligible for a place of residence in the state of arrival. In that case, the state of departure will have to abide by that decision.

Article 6

Notification of registration of a migrant

This article contains provisions on how the population register authority in the state of arrival notifies the state of departure that a migrant has been given a place of residence.

1. Once the population register authority of the state of arrival has made a decision on whether the migrant shall be registered with a place of residence in the state of arrival, it shall notify the person in question and the population register authority of the state of departure about its deci sion.

This provision stipulates that once the population register authority in the state of arrival has decided whether the migrant will be given a place of residence or not, notifications on this shall be sent.

First, the migrant themseif must be notified of the decision. The agreement doesn’t require any specific way to do this, so national legislation applies — Estonian, if the migrant has migrated to Estonia and the decision is made there, and Finnish, if the migration was from Estonia to Finland and the decision is made there.

Second, the population register authority in the state of departure must be notified, so that they can abide by the decision and make the necessary entries in their own population register. The notification will in general be made digitally, cf. article 3(1), and the contents of it are laid out on the next section of this article.

Even though here named “first” and “second”, this is not necessarily the order in which the notifications are sent. The important thing is that both the migrant and the other country are informed, in whatever order or in whatever stage of the process.

it is also good to note, that the notifications should be sent regardless of whether the migrant gets a place of residence in the state of arrival or not. This is of course not possible, if the migrant never contacts the relevant authorities in the state of arrival, but in cases where the migrant’s case is handled in the state of arrival with the result that no place of residence is registered there, this “notification of no place of residence” should be sent. In Finland, such situations will arise, since migrants may be registered in the Finnish population register but only with a temporary address, which doesn’t count as a place of residence under this agree ment.

The purpose of sending a notification to the state of departure also in cases when the migrant doesn’t get a place of residence in the state of arrival is to make sure that the population register authorities in the state of departure don’t remove the migrant’s place of residence in the state of departure. Since the migrant didn’t — in these cases — get a place of residence in the state of arrival, that would make the migrant lose their place of residence altogether.

12

2. The following personal data shall be disclosed to the population register authority of the state of departure:

1) identification number in the state of departure; 2) name; 3) date of birth; 4) place of birth; 5) citizenships: 6) gender; 7) identification number in the state of arrival; 8) date on which the person migrated to the state of arrival; 9) place of residence, including municipality; 10) local population register authority in the state of arrival.

This provision enumerates all the personal data to be included in the notification from the state of arrival to the state of departure on a migrant whose case has been handled and a decision made.

The first part (items 1—6) is intended to help identify the person — and as the data is sent to the state of departure and concerns a person who has migrated from the state of departure, there should be no data here that the state of departure does not already have. The only exceptions would probably be cases where 1) the migrant has presented a passport with different personal data to the state of arrival than to the state of departure, or 2) the migrant has never actually had a place of residence in the state of departure but has still indicated it as their previous country of residence when notifying their migration in the state of arrival.

The second part (items 7—10) indicates when and where to the migrant has moved, including both address and the so-called “moving date”, which shall be registered by the state of departure as the date of emigration. It also includes the ID code in the state of arrival. There is no obliga tion to register this in the state of departure’s population register, but for reasons of identifying persons later on, this might be a good idea.

3. The data indicated in subparagraphs 7—10 in paragraph 2 of this Article shall only be dis closed if, according to the decision. the person is registered with a place of residence in the state of arrival.

The data mentioned in this article should be sent regardless of whether the migrant is given a place of residence in the state of arrival or not, cf. article 6(1). In cases where the migrant doesn’t get a place of residence in the state of arrival, it is naturally not possible to send infor mation on the place of residence. Thus, the notification in such cases shall exclude that data, as well as the ID code in the state of arrival — even in the case that the migrant has been given an

ID code.

The exclusion of the ID code in the state of arrival in these cases is not optimal for the data exchange and is something that should be kept in mind for forthcoming revisions of the agree ment. This is because there will almost certainly be cases in Finland where the migrant does get an ID code even though no place of residence has been registered.

In Estonia, there will be no system entries in either the case handling system or the population register in cases where the person is not registered with a residential address. Thus, no data will be sent from Estonia to Finland in these cases.

13

4. If the population register authority of the state of arrival later withdraws an earlier decision on registering a place of residence for a migrant, a notification shall be sent to the state of departure, including the data indicated in subparagraphs 1, 2, 8 and 9 in paragraph 2 of this Article.

It is also possible that the population register authority in the state of arrival later revokes its decision to grant a place of residence. In these (rare) cases, too, the state of departure must be notified. In practice, the state of departure should, when receiving such a notification, remove the entry on emigration and restore the migrant’s place of residence in the state of departure.

This notification will include very few items: only the name, and the ID code in the state of amval, i.e. the country receiving the notification — to identify the person — and the address and migration date to be removed — to identify the migration in question.

It is uncertain, whether this will be done electronically. Finland has a technical solution to send this, but not Estonia.

Article 7

Disclosure of a migrant’s personal data

This article contains provisions on the return message from the state of departure to the state of arrival, when the migrant’s emigration has been registered also in the state of departure.

Once the population register authority of the state of departure has received notification that a migrant has been registered with a place of residence in the state of arrival and has recorded this information in its register, it shall disclose the following personal data on the migrant to the population register authority of the state of arrival:

1) identification number in the state of arrival and the state of departure; 2) name; 3) date and place of birth; 4) gender; 5) citizenships; 6) civil status and the date on which the civil status has changed; 7) name. date of birth and gender of the migrant’s current spouse or partner in a registered partnership; 8) name, date and place of birth. and gender of each of the migrant’s children aged under 18 years, and information on whether or not the migrant is the custodian of each child; 9) if the migrant is aged under 18 years, the name, date and place of birth, gender and identification number in the state of departure of each of the migrant’s parents

and custodians.

In contrast to the notification in article 6, the notification containing the migrant’s data shall be sent only if the migrant was given a place of residence in the state of arrival. For identification, this notification contains much of the same information as the notification in article 6, i.e., ID codes, name, date & place of birth and gender (items 1—4).

Under item 5, all data on citizenships that is available in the state of departure’s register shall be disclosed.

14

Under item 6, the notification includes civil status data and the date of change. This means the date of 1) wedding or divorce, 2) partnership registration or dissolution, 3) death of the mi grant’s spouse, or any other civil status event.

Under item 7, the notification includes data on the migrant’s spouse/registered partner, if appli cable. Only data on the current spouse or registered partner is disclosed, and the data includes name, date of birth (not place of birth), and gender.

Under item 8, the notification includes data on the migrants child or children, if applicable. Only data on under-age children is disclosed, and the data includes name, both date and place of birth, and gender. Additionally, for each child, it will be indicated whether the migrant is that child’s custodian or not.

Under item 9, the notification includes data on an under-age migrant’s parents arid custodians. The data includes name, date and place of birth, gender, and state of departure ID code of each parent, and an indication of whether that parent is the migrant’s custodian or not. If there are also custodians who are not the migrant’s parents, the same data will be disclosed on them, together with an indication that they are only custodians, not parents.

Article 8

Determination of place of resideiice after the Agreenieiit enters into force

Articles 8 and 9 contain provisions for a one-time place of residence determination process, which is to take place in immediate connection with the commencement of the migrant data exchange as set down in articles 4—7. The aim of this process is to make sure no one has two places of residence (i.e., in both countries) after the migrant data exchange starts. The process starts by finding any such persons and finishes by determining which place of residence shall remain, while tenninating the other one.

1. The entry into force of this Agreement shall not affect the l)lace of residence of any person who has a place of residence in either Estonia or Finland only.

This provision only clarifies that the determination process only applies to those who dont have a place of residence in both countries.

2. A person who has a place of residence in both states when this Agreement enters into force shall, under this Agreement, only remain registered with a place of residence in one of the states. The person shall remain registered with the place of residence which they personally consider their place of residence due to their family relations, livelihood or other similar circumstances and with which the person, due to the aforementioned circumstances, has their primary connec tions. If the person’s own opinion on their place of residence cannot be detennined, they shall remain registered with a place of residence in the state where the place of residence last changed.

This provision states the main rule concerning those with place of residence in both countries when the migrant data exchange starts: no one can remain with a place of residence in both countries, and one of them must be terminated.

Following a strictly verbatim reading of this provision, the determining point in time is when the agreement officially enters into force. Still, this would conflict with the coming-into-force provisions in article 15 paragraph 5, according to which the migrant data exchange will not start immediately when the agreement enters into force, but the starting date as well as the timing of

15

the measures provided for in articles 8 and 9 remains to be agreed between the Finnish Digital Agency and the Estonian Ministry of the Interior.

In principle, this means that application of Chapter II in the Agreement starts — or in other words: Chapter II enters into force — only at the time agreed upon under article 15. Furthermore, the measures provided for in articles 8 and 9 are taken in order to commence the migrant data exchange under Chapter II.

In practice, this means that the measures under articles 8 and 9 must be carried out when the application of Chapter II, i.e., the actual migrant data exchange — starts, and that the date of entry into force mentioned in article 8 refers to the starting date of the migrant data exchange, which is the entry into force date of Chapter II.

This provision also sets out how the place of residence is determined, i.e., which place of resi dence remains and which one is terminated. The provision on this is modelled after the Finnish Act on Municipality of Residence, where section 2, paragraph 2 uses a similar wording for how to determine the municipality of residence in situations where a person has two or more apart ments/addresses within Finland (or none at all).

The provision contains both a subjective and an objective part. In other words, it does give the person themseif a great deal of freedom of choice (the subjective opinion of which “they per sonally consider” as their real place of residence), but this choice would still need to be based on some kind of objective facts. Thus, if you have no connection whatever to Finland except the address (no work, no family, no properties etc.), you really couldn’t argue that your place of residence in Finland should be kept and the place of residence in Estonia should be termi nated.

This means that in practice, those with two places of residence should be contacted and asked which of the places of residence they want to keep, and at the same time ask them to provide the grounds for this (i.e., because they work there, or their family lives there, or because they own property there — perhaps owning the very same place where they live).

This paragraph also contains a provision for those situations when we cannot reach the person (or they choose not to answer) — then that place of residence which has a later start date will be kept and the earlier place of residence will be terminated.

How this contacting is done and whether there will be need for an administrative decision in some or all cases will be determined by national legislation. In Finland, this will probably mean contacting the persons in question by ordinary mail (or perhaps Suomi.fi-mnessage, if the person has registered for using that service) and making an administrative decision in cases where the person hasn’t answered or the probably very rare cases where the decision goes against the person’s own subjective opinion.

3. The determination of which place of residence the person shall remain registered with shall be made by the population register authority in the state where the person’s place of residence last changed. The population register authority in question shall notify the population register authority of the other state of its decision.

This provision determines the division of labour, answering the question on which population register authority shall contact which persons (and also cany out the rest of the determination process). This is determined by the start dates of the two places of residence, with the later one giving jurisdiction. Thus, if the address in Estonia has a later starting date than the address in Finland, the Estonian Ministry of the Interior contacts that person and carries out the determi nation process.

16

This provision also states that the agency carrying out the determination process must notify the agency in the other country of the result of the process. This is necessary so that that agency can make any necessary entries in their own population register.

Whether the agency carrying out the determination process must inform the person themself is left to be detenriined by national legislation.

4. No changes concerning the person’s place of residence shall be made in the state where they remain registered with a place of residence. In the other state, where the person loses their place of residence, this place of residence shall be registered as having ceased and the person as hav ing migrated to the other state. The date when this register entry is made shall be entered as the date of the cessation of place of residence and the date of migration.

This provision determines the kind of entries to be made in the population registers based on the outcome of the residence determination process. To put it simply, in the state where the place of residence is kept, no entries whatever are made. In the other state, the address is termi nated as of a certain date, and the entry shall be made as if that person had migrated to the other country on that date. The date to be used is the actual date when the register entry is made, i.e., the date shall not be registered retroactively.

Article 9

Excliaiage of data to enable the determination of a person’s place of resideiice

This article contains provision on the data exchange that is necessary to find those who have places of residence in both countries. Data exchange is needed because finding the persons to whom the residence determination process applies requires cross-referencing of data from both countries’ population registers.

1. To enable the determination of the place of residence in accordance with Article 8, the pop ulation register authority of each state shall disclose to its counterpart in the other state personal data referred to in Article 9, paragraph 2 concerning persons who, on the basis of population register data, can be suspected to have a place of residence in both states. The data shall be delivered for each person who is registered with a place of residence in the state delivering the data and who, according to the population register data in the state delivering the data, also is:

1) a citizen of the other state; or 2) a citizen of a third state, a stateless person or a person with undetermined citi zenship, who

a) has formerly been registered with a place of residence in the other state; b) has or has had a temporary address in the other state; c) was born in the other state; or d) is known to have an identification number issued by the other state.

The data exchange starts with each population register authority extracting certain data from their respective population registers. This first provision determines which persons’ data shall be extracted, while the following provision determines what data is to be extracted for all these persons.

The main idea is to find persons with a place of residence, i.e., permanent address (in Finland more specifically municipality of residence), in ones own country but also some kind of

17

connection to the other country. This connection can be of different types: citizenship, current or former address, birthplace, or ID number of the other state.

There is a problem in this provision as well, which is caused by a translation error, when the agreement draft was translated from English to Finnish and then back to English. In the current English version, subsection 1 mentions citizens of the other state, and subsection 2 citizens of a third state. leaving the country’s own citizens outside of the data exchange altogether. The Finnish version of subsection 2 says “citizen of another state”. with the intention of including not only third country nationals but also the country’s own citizens. This has been both parties’ intention all the way, as an earlier English draft version says “citizen of any other state”, but because the translation error wasn’t spotted in time, both the English and the Estonian language versions have become erroneous.

Applying the erroneous versions of the text would lead to certain persons being left out from the residence determination process altogether. These are such Finnish-Estonian double citizens whose Finnish citizenship is recorded only in the Finnish population register and their Estonian citizenship only in the Estonian population register.

To avert this, the population register authorities of both countries have agreed to adopt the in tended interpretation according to the Finnish language version of the agreement, and thus also include citizens of one’s own country in the data exchange. The population register authorities have agreed to express this in a Memorandum of Understanding to be attached to the diplomatic notes that are exchanged to make the agreement enter into force.

2. For the persons mentioned in the previous paragraph, the following personal data shall be delivered:

1) identification numbers issued by both states; 2) name; 3) date and place of birth; 4) gender; 5) address; 6) date on which the address was registered.

If the previous subsection defined the group of people to be contained in the extract from each population register, this subsection defines which data is to be extracted on these persons. The main contents are identificational data (1—4) and address data (5—6). Item 6 is necessary to determine which of the countries has jurisdiction to carry out the residence determination pro cess.

3. The personal data material received from the other state as referred to in this Article may only be used for the determination of place of residence referred to in Article 8. The material shall be deleted as soon as it is no longer needed for this purpose. After determining the place of residence, the personal data included in the material may only be kept as annexes to decisions or register entries concerning the determination of the place of residence, to the extent that this is necessamy under national legislation or European Union legislation.

When the extract according to the previous provisions has been produced, it is to be sent to the other country’s population register authority, which then cross-checks the data against their own population register. This means that the checking is done by both countries. Any matches, i.e. cases where a person in the extract from the other country turns out to have a place of residence also in one’s own country, will be dealt with according to the provisions in article 8.

18

CHAPTER III: Exchange of data between the states’ population register authorities

With chapter 3, we are moving into the other data exchange entity, i.e., the citizen data ex change. This entity concerns only Finnish and Estonian citizens, and oniy as regards their data in the other country’s population register, e.g., when residing temporarily or permanently in the other country (of which they are not a citizen) or just having been registered in that country’s population register for whatever reason (e.g. real property ownership or other taxational pur poses in Finland, e-Citizenship in Estonia).

In practice, the citizen data exchange under the provisions in this chapter and the migrant data exchange under the provisions in the previous chapter can be applied at the same time, when an Estonian citizen migrates from Estonia to Finland or a Finnish citizen migrates from Finland to Estonia. In these cases, data sets will be made available for the “home country” both under the migrant data exchange and under the citizen data exchange, with slightly different contents.

However, as the living in the other country continues, only the citizen data exchange will con tinue to provide data on any changes in the person’s data. Thus, data updates after the time of migration will only be provided if the migrant is a citizen of the country of departure (i.e., an Estonian moved to Finland or a Finn moved to Estonia).

Article 10

Data to be exchanged between the population register authorities

This article outlines the data content of the citizen data exchange. The data content is slightly different from the migrant data exchange, and as opposed to the migrant data exchange, where all data is listed in the agreement text, the data is only outlined in the agreement text, and the more detailed list is in an annex.

I. The population register authorities shall disclose to each other the following data that has been recorded in the population register of Estonia or Finland regarding the persons mentioned in Article 1, paragraph 1, subparagraph 2:

1. basic personal data; 2. civil status; 3. children aged under 18 years; 4. parents and custodians, if the registered person is aged under 18 years; 5. address.

2. The detailed data that shall be disclosed is listed in the Annex, which is an integral part of this Agreement.

The data content of the citizen data exchange is divided into five different “packages”, which are described in more detail in the agreement annex.

The provision refers back to the definitions in article 1, where it is prescribed that the citizen data exchange will concern the personal data of Estonian citizens registered in the Finnish pop ulation register, whose data will be sent to Estonia, and Finnish citizens registered in the Esto nian population register, whose data will be sent to Finland.

19

Article 11

Delivery of data

This article describes how and when data shall be delivered.

1. The population register authority shall deliver any changes of the data listed in Article 10 and in the Annex of this Agreement which are recorded in the population register to the other population register authority at least once a week. The population register authorities may agree upon more frequent deliveries of data.

This provision shows that the citizen data exchange is there make sure that the population reg ister in the person’s home country is kept up to date of any changes in personal data that occur while the citizen lives abroad in the other country. In this case, also the first registration of an Estonian citizen in Finland or a Finnish citizen in Estonia is interpreted as a change of which a notification will be sent. This means that the citizenship country will be aware also of citizens moving to the other country from abroad (i.e., not directly from the citizenship country) — e.g., and Estonian moving from Poland to Finland.

The provision also repeats that the citizen data exchange concerns only data that is available in the population register. Thus, the population register authority has no obligation under this agreement to acquire data from other registers beyond what is normally required by national legislation — a principle that is already set down in article 1(2).

The minimum frequency of the data exchange is, according to this provision, once a week, but most probably both parties will want to agree on at least daily data exchange. The frequency will be determined on one hand by what the delivering party’s data systems can accommodate and on the other hand by what needs the receiving party has.

This provision does not necessarily require the data exchange frequency to be the same in both directions or for all data items (address, civil status etc.) of the citizen data exchange.

2. The delivery of data under paragraph 1 of this Article shall always include at least the iden tification number. If technically possible, the basic personal data referred to in Article 10, par agraph 1 shall be included.

This provision states that the individual notifications of each change of personal data must in clude the ID code in order to individualise the person. A reasonable interpretation would be that if the ID code of both countries are available, both should be included in the notification.

If the technical solution of the delivering party allows this, then all “basic personal data” should be included in the notification, but this is not a definitive requirement. At this point, neither the Finnish nor the Estonian technical solution will enable this.

This means that the minimum data content of a notification on a change of address is:

1) the ID code of the person in the country that is sending the data

2) the new address and its starting date

If the technical solution allows, also full name and date and place of birth would be included in the notification.

20

3. If it is not possible to identify which person registered in the population register of the re ceiving population register authority the delivered data applies to, the delivering population register authority shall, upon a separate request of the receiving population register authority, and to the extent it is technically possible and possible under national legislation or European union legislation, deliver such additional data as is necessary for identifying the person. Such additional data shall only be used for this purpose.

There might be situations where the receiving party has problems to identify which person in their own register the change-of-data notification concerns. As ID codes are always included in the notification, this should generally not be a problem. Problems could probably arise only in situations where:

1) the person’s ID code in the country receiving the notification (i.e., the citizenship country) is missing from the notification (i.e., only the sending party’s own ID code is included),

2) the country receiving the notification doesn’t have in their register the person’s ID code in the other country.

An example situation could be that an Estonian citizen moves to Finland, and their Estonian ID code is, because of a human en-or, not registered in the Finnish population register. Then the citizen data exchange sends a notification of this person’s data to Estonia, but can only include the Finnish ID code, and there might be many Estonians with the same name and birth date.

If such a situation arises, the population register authority receiving the notification can sepa rately request additional data in order to identify the person. The scope of data that the receiving party can request is generally restricted to the data content of the regular citizen data exchange, which means it excludes data that is not registered in the population register of that country (cf. article 1(2)) as well as obsolete data (cf. article 1(3)). However, the term “obsolete data” shall not be understood as definitively excluding data, e.g., names, which were valid at the person’s initial registration in the other country’s population register, and which could be of crucial im portance to identify the person in their home countiy’s population register. This could be pos sible as a last resort only in situations where it is impossible to identify the person even with the full set of data under the citizen data exchange available. In such cases, the request must include sufficient justifications for why the data is of crucial importance.

Anyway, the scope of additional data is restricted by both technical limitations and the legisla tion applicable in the country providing the additional data. This would, in practice, mean that, i.a., Finland would never disclose protected addresses as additional data, nor documents which are the basis of a certain registration (such as passport copies etc.). The provision also mentions that the additional data must be necessary for identifying the person.

Any additional data received under this provision must be used only for identifying the person and cannot be used to update the population register. It also means that the additional data must be destroyed as soon as the identification has taken place.

This provision does not require that the request for additional data nor the data itself be sent electronically, but on the other hand, article 3(1) gives a general authorisation for sending mes sages electronically, if technical solutions are in place.

21

Article 12

Checking of data

The population register authorities may submit separate requests for data related to persons within the scope of this Chapter for the purposes of checking the accuracy of the data. The population register authority disclosing any such data shall determine the procedure and means for individual disclosure.

This provision enables the population register authorities to submit individual queries for cer tain data in order to make sure that the data they have in their register is up to date, especially in situations where it is suspected that the regular citizen data exchange has failed and some data which should have been sent has actually not been sent. The provisions in this article can also be used to request additional “start batches” before starting the different phases of the citizen data exchange, in addition to the initial “start batch” to be delivered under article 15(3) soon after the agreement has entered into force. For example, such additional batches could include data on only spouses, when the electronic data exchange on spouses is to be started, then later when another part of the data exchange starts, a batch containing that data can be requested. The purpose of this would be to make sure the data in the citizen’s home country is accurate and up to date when the continuous electronic data exchange starts.

The regular citizen data exchange works only in one direction, i.e., data on Finnish citizens flows only from Estonia to Finland, and data on Estonian citizens flows only from Finland to Estonia. Under this article, however, the data flow can be in both directions. For the sake of keeping data accurate and the data exchange working, Estonia can submit a data checking re quest to Finland regarding both Estonian and Finnish citizens, and Finland can submit a data checking request to Estonia regarding both Finnish and Estonian citizens.

An example of this could be the need to make sure that the Estonian population register contains the right Finnish ID codes for any Finnish citizens and that the Finnish population register con tains the right Estonian ID codes for any Estonian citizens. Without these being correct, the data exchange cannot work as intended and certainly not automatically. To do this, Estonia could ask Finland for ID codes of the Finnish citizens registered in the Estonian population register, and Finland could ask Estonia for ID codes of the Estonian citizens registered in the Finnish population register.

Another example could be the need to make sure that death data is up to date in both registers. This would mean that on request, Estonia could provide Finland with dates of death of those Estonian citizens registered in the Finnish population register who are registered as deceased in the Estonian population register. The other way round, Finland could, on request, provide Es tonia with dates of death of those Finnish citizens registered in the Estonian population register who are registered as deceased in the Finnish population register.

It must be noted, though, that the scope of personal data that can be exchanged under this article must remain within the bounds of the Agreement in general. This means, i.a., that data outside of the population register (cf. article 1(2)), obsolete data (cf. article 1(3)), or other data than mentioned in articles 6, 7, 9 and 10 cannot be exchanged under this article either.

Article 13

Security of data processing

1. The population register authorities shall, on the date of entry into force of this Agreement at the latest, inform the other population register authorities of this Agreement and the provisions therein concerning security of data processing and transferring of data.

This provision obligates the Finnish Digital Agency to inform the State Department of Aland of this agreement’s provisions, especially those concerning data security. In the same way, the provision obligates the Estonian Ministry of the Interior to inform the contractual processors of the Estonian population register.

This information must be given no later than when the agreement enters into force, but it will of course be appropriate to inform them as early as possible.

2. If a population register authority discovers, or has reason to suspect, that the confidentiality or integrity of the data received in accordance with this Agreement has been violated, it shall inform the other population register authority thereof and take the necessary protective action without delay.

This provision gives the respective population register authority powers (and duty) to immedi ately inform the population register in the other country of any data security breaches and take action as necessary.

CHAPTER IV: Final provisions

Article 14

Procedures and technical solutions related to disclosure of data

The population register authorities may conclude separate agreements regarding the practical procedures and technical solutions related to the disclosure of data as well as arrangements on the introduction of the disclosure of data.

This provision gives the Finnish Digital Agency and the Estonian Ministry of the Interior the powers to agree on the practicalities and technical solutions of the data exchange as well as on when different portions of the data exchange should start. The only fixed schedule in the agree ment concerns the exchange of death data, which under article 15(6) must stail within a year of the agreement’s coming into force.

Article 15

Entry into force

1. This Agreement shall enter into force on the first day of the second month following the receipt of the last written notification by which the states have notified each other through dip lomatic channels that the national legal requirements for the entry into force of the Agreement have been completed.

The coming into force is tied to the national ratifications. Each party ratifies the agreement as required by their national legislation, and when this is done, informs the other party through

23

normal diplomatic channels. When both countries have done this, the agreement enters into force at the beginning of the month which is between two and three months from that day.

2. This Agreement may be amended by mutual written consent of the Contracting Parties. Any such amendments shall enter into force as stated in the first paragi-aph of this Article.

Any amendments to this agreement will come into force through the same procedure of national ratifications as the agreement itself.

3. Once the Agreement has entered into force, each population register authority shall deliver to the other population register authority the information mentioned in Article 10 regarding citizens of the other state.

This provision functions as a start to the citizen data exchange under chapter 3. In practice, it requires that when the agreement has come into force, Finland provides Estonia with a complete batch of the data mentioned in the annex on each and every Estonian citizen registered in the Finnish population register. Correspondingly, Estonia provides Finland with data on all Finnish citizens in the Estonian population register.

As the regular citizen data exchange starts only gradually, and even the first portion, that of death data, only within a year after the coming into force of the agreement, but this “start batch” is delivered immediately, there is reason to believe that the data will become partly outdated before the complete citizen data exchange is up and running.

However, since article 12 provides for data exchange for the purpose of checking data, request ing a “start batch” prior to different stages of enlarging the data exchange will be possible also after this initial “start batch” has been received (see also article 12).

4. The Agreement Concerning Delivery of Data From Population Register signed between the Ministry of Interior of the Republic of Estonia and the Population Register Centre of Finland on 1 8 Januaiy 2005 shall terminate by a separate agreement when the exchange of data con cerning persons referred to in Article 1, paragraph 1, subparagraph 2 of this Agreement begins.

Since the different data exchanges under this agreement start gradually, it is not appropriate to terminate the old data exchange agreement immediately when the new one comes into force. Instead, the old agreement will be separately terminated when the data exchange under this agreement has made the old agreement obsolete.

5. The population register authorities shall separately agree upon the schedule according to which the notification and registration of data under Chapter II will commence, and according to which the measures provided for in Articles 8 and 9 will be taken in order to commence the procedures under Chapter II.

This provision gives the Finnish Digital Agency and the Estonian Ministry of the Interior pow ers to decide on the schedule for starting the migrant data exchange, and also for the residence determination process to be done in immediate connection with the start of the exchange. How ever, the data forming the basis of the determination process is that corresponding to the situa tion on the exact date of entry into force of the agreement.

24

6. The exchange of data provided for in Article 10 shall commence with the death data men tioned under paragraph 1.4 in the Annex to this Agreement within one year from the date of entry into force of the Agreement. The population register authorities shall separately agree upon the schedule for extending the exchange of data to comprehend all the data mentioned in the Annex to this Agreement.

This provision gives the agencies powers to decide on the schedule and phasing for starting the citizen data exchange. The only fixed date is that the exchange of death data nust start within a year of the agreement’s coming into force.

The schedules for starting the different phases of the migrant and citizen data exchanges shall be agreed between the agencies in writing in a document of suitable dignity (protocol, memo randum of understanding, or such).

Article 16

Ternflnatioii

1. Either Contracting Party may terminate this Agreement by sending a written notification to that effect to the other Contracting Party through diplomatic channels. Termination shall take effect six months after the date on which the other Contracting Party received the notification of termination.

Both parties (the Finnish or the Estonian government, not the agencies) may unilaterally termi nate the agreement, with a notice period of six months.

2. Either population register authority may, at any time, suspend the exchange of data under this Agreement immediately, if it has grounds to suspect that the protection of personal data or the security of data processing is endangered. The population register authority shall notify the other population register authority of the suspension in writing and without unnecessary delay. The population register authorities shall work together in good faith to resolve the issue. If the issue is not resolved, the Contracting Party may terminate this Agreement in accordance with paragraph I.

A similar provision to article 13(2), but more details as regards the process. If the Finnish Dig ital Agency discovers or suspects a data protection or data security breach, they may suspend the data exchange and must inform the Estonian Ministry of the Interior of it, and vice versa.

The notice must be given in writing, but this does not necessarily mean on paper — also digital messages are allowed. It just means that a telephone or Teams call doesn’t qualify as a notifi cation under this section.

If, after trying their best to solve the problem together, either agency is not satisfied with the results, they can terminate the agreement normally. In this case, the suspension may be kept in force during the notice period, until the agreement terminates.

3. If this Agreement is terminated, entries made in either states population register based on data exchanged under the provisions of this Agreement shall continue to be considered reliable unless proven otherwise.

A tennination of this agreement would not affect the reliability or validity of the population data in either country. If there is proof that some of the data is corrupted, invalid or unreliable,

25

the population register authority in question may make any necessary adjustments and amend ments to their data that their own national legislation allows.

In witness whereof the undersigned, being duly authorised thereto by their respective govern ments, have signed this Agreement.

Done in duplicate at Helsinki this 21 day of September 2022 in the Estonian, Finnish and Eng lish languages, all texts being equally authentic. In case of divergence in interpretation, the English text shall prevail.

The agreement is made up in three different language versions. If the interpretation of the agree ment text differs between the parties, the English text is the determining one.

26

ANNEX TO THE AGREEMENT BETWEEN THE GOVERNMENT OF THE REPUBLIC OF ESTONIA AND THE GOVERNMENT OF THE REPUBLIC OF FINLANDON POPULATION REGISTRATION

According to Article 10 of the Agreement between the Government of the Republic of Estoniaand the Government of the Republic of Finland on Population Registration, the population register authorities shall exchange the following data:

I. The registered person’s basic personal data

1. Identification numbers in both states 2. Full name 3. Date and place of birth 4. Date of death

II. Data on the registered person’s civil status

1. Civil status 2. Date of change in civil status 3. Full name and date of birth of the registered person’s spouse or registered partner (as appropriate)

III. Data on the registered person’s chlldreii aged uiider 18 years

1. Full name and date of birth of each child 2. Data on custody of the child a. Data on whether the registered person is the child’s custodian or not b. Date of change in the custody relations 3. The child’s gender and place of birth. but only when one of the following vital statisticsevents takes place: a. A child is born to the registered person. b. The registered person adopts a child. c. The registered person is legally confirmed as a parent of a child. d. Any other case when a child is registered with the registered person for the first time.

IV. Data on the parents and custodiaiis, when the registered person is under the age of 18

1. Full name and date of birth of each parent and custodian 2. Date of change in the custody relations

V. Data on the registered person’s address

1. Address of the permanent place of residence 2. Address of temporaly place of residence 3. Start and end dates of the aforementioned addresses

27