Finnish social security agency broke data request law over missing USB stick

The Finnish Social Insurance Institution (Kela) violated public records law by delaying a data request for over a year, citing a missing encrypted USB drive, according to a reprimand issued by the Parliamentary Ombudsman.

The agency’s Tampere office failed to provide the requested documents within the legally mandated 30-day deadline, instead taking more than 13 months to fulfill the request. The Ombudsman ruled that Kela’s handling of the case was “particularly reprehensible,” emphasizing that the statutory time limit is absolute.

The complainant submitted the data request on February 1, 2025, specifying delivery on a USB stick. Kela claimed its Tampere office had only one encrypted drive in use, which had not been returned by a previous requester. A replacement was ordered in March 2025 but did not arrive until March 2026 due to supplier delays and a change in vendors.

The Ombudsman determined that Kela should have either proposed an alternative delivery method or formally denied the request under public records law. Instead, the agency took no action until the Ombudsman intervened in March 2026. The decision noted that Kela could have sourced a drive from another office or an external supplier rather than waiting for the delayed order.

The requested data was finally delivered to the complainant on March 26, 2026.