Data protection and privacy challenged by the fast development of technology, also in local government

The use of artificial intelligence and software robotics is constantly increasing, including in public administration. Behind all the hype, it has already turned into reality and can be used to develop public administration practices in a more reasonable direction, as long as officials keep a rein on it and the trust of customers is retained.

Espoo’s key value is resident and customer orientation, which is a central theme in the city’s strategy, the Espoo Story. Espoo processes information regarding residents, employees and partners in a safe and responsible manner as required by the legislation.

According to National Cyber Security Centre Finland, the most significant cyber risk in 2018 was e-mail phishing attacks on organisations. Criminals usually use stolen e-mail credentials in an attempt to gain financial benefits by following the organisation’s payment transactions. In addition, phishing involves various risks relating to reputation and regulations. This has also been seen in Espoo, and the city has implemented various data security controls to minimise the threats. The work is still continuing.

The City of Espoo’s data balance sheet describes how the city implemented data protection and privacy measures in 2018. The balance sheet addresses the EU General Data Protection Regulation (GDPR) requirement that obliges organisations to openly describe their data processing practices. In addition, it provides an overview of how the activities have been developed.

A large volume of personal data

In its data balance sheet, the City of Espoo emphasises a responsible approach to processing information.

“There are not many organisations in Finland that process such vast amounts of various confidential personal data as a big city does. Trust is vital for our operations,” says Juho Nurmi, Data Protection Officer at the City of Espoo.

The significance of trust is emphasised when services for residents are digitalised. The development work aims not only at cost savings but also at better, more personalised services. However, data protection and privacy must always be taken into account starting from the design phase.

“The digitalisation of services provides the city with many opportunities, but the revamping also involves risks in terms of data protection. Taking the risks into account and minimising them is essential. We will keep developing our operating methods this year,” Nurmi says.

Investments in staff training

The data balance sheet mentions further training of staff and increasing awareness as development targets for the City of Espoo. Measures to boost the training have already been taken and, starting next autumn, the city’s staff will have access to a new online training application for learning and revising data protection and privacy issues.

In 2018, the City of Espoo created an administrative model for data protection to ensure that data protection work remains part of the daily work.

Data security well highlighted

The City of Espoo’s data security efforts were well highlighted last year even in the media thanks to the ‘Hack with Espoo’ ethical hacking course for upper secondary school students.

A brainchild of Matti Parviainen, Chief Information Security Officer at the City of Espoo, the course was planned and implemented in cooperation with upper secondary schools and an Espoo-based cyber security company. It increased awareness of the significance of data security and new means of cooperation, also within the city organisation. This year, the course will also be organised in Turku and in vocational education in Espoo.