Interoperability between Information Systems in Automated Decision-Making in Finland and in the European Union – Blurring Oversight by Unrestricted Access to Public Registers?

ABSTRACT The legislation governing interoperability in the public sector is extensive, and similar rules are starting to cover the private sector as well. Although the introduction of interoperability is justified for its expected positive effects, it is not solely a positive phenomenon. Privacy and data protection may be weakened at the national level, in part because of the abolition of confidentiality safeguards as an oversight mechanism between public authorities. It may also be difficult for individuals to obtain information about the digital communication that takes place between different authorities and registers at authorities when automated administrative decisions are made. These difficulties are likely to be multiplied by the interoperability that should apply to national public authority data within the EU. Increased interoperability can lead to faster processing of cases by authorities, but at the same time, fundamental rights issues may arise, e.g. with regard to the right to privacy. Oversight is not necessarily promoted by increased interoperability. Interoperability is therefore not an entirely positive phenomenon, as there exist legal issues and risks associated with it.

KEYWORDS Automated decision-making - Interoperability - Privacy - Confidentiality - Cross-checking data

TABLE OF CONTENTS 1. Introduction. – 2. Two illustrations of possible problems. – 2.1. Individual level: interoperability in decisions on student loan deductions. – 2.2. Systemic level: interoperability in comprehensive analysis of benefit fraud. – 3. Efforts to increase interoperability between data collections: policy objectives and legislation. – 3.1. National legislation on interoperability: the case of Finland. – 3.1.1. The general framework. – 3.1.2. Legal basis for access. – 3.1.3. The log trail. – 3.1.4. Interoperability in the private sphere. – 3.2. Interoperability within the EU. – 3.2.1. The general framework. – 3.2.2. Sector-specific interoperability. – 3.2.3. Variation in the interoperability terminology. – 4. The role of confidentiality provisions in interoperability contexts. – 4.1. Disclosure of confidential information. – 4.2. Fraud detection in the area of social benefits. – 5. Concluding remarks.