As a fan of Nightwish’s music I’ve been following the controvercy surrounding the firing of Tarja Turunen from the band. Yesterday Marcelo Cabuli’s letter was published on Tarja’s site in which he promises to openly answer questions sent to him. While I’m quite doubtful of the openness that is promised (and generally anything that comes from his mouth), as a advocate of privacy and data security I’m very concerned about the following in his letter:
I wish to be able to answer to the people that might be really interested to know. In order to avoid wasting time with emails of other kind, I will request that every email sent has as subject the following info: complete name of sender (not nickname), ID number and country of origin. Please send the questions in English (or Spanish)
I read the above paragraph several times and I can’t figure out any other interpretation to the ID number other than an ID code that is used to identify an individual . At least in my understanding, this would be equal to a personal identity number as defined in Finland.
The Finnish Data Protection Act (PDF) states the following about gathering personal identity numbers:
A personal identity number may be processed on the unambiguous consent of the data subject
or where so provided in an Act…
While there are exceptions and such in the act, the relevant content for us is the requirement of the unambiguous consent from the subject. Sending an email message with your ID number isn’t adequate to satisfy the requirement in my book. Finnish law also requires that the party responsible for collecting the data states how the data is going to be processed. Using a personal identity number just to filter out spam or questionable messages isn’t an adequate use for an ID number in my book. The relevant act also states several requirements on data security and sending information to officials.
After all of this and based on my own doubts, I strongly recommend everyone to not send their personal ID number as the subject of a message to anyone. There may be even some cause for Finnish officials to take action in this matter.
This post is also published in Finnish in Satunnaisia leiskahduksia. Update: typo in Marcelo’s name fixed.