Instructions to the victims of the HUS data protection offence

The National Bureau of Investigation is conducting criminal investigation into a data protection offence relating to searches made in the population information system and the HUS patient data system. One person is suspected of having committed the offence. Persons whose data has been unlawfully accessed in those data systems will be informed by a personal letter. The letter will specify from which system the data was accessed.

The police investigate the criminal acts as a single offence and include in the criminal investigation those, who request that the offender be punished and who give their consent to the police to process their customer data in the HUS patient data system. In order request that the offender be punished, you must report the offence to the police.

If you are a victim of the data protection offence, you can report the offence and give your consent to HUS as to share your patient data with the police. Without your consent, the police will not be able to verify your status as a victim of crime with HUS, nor will they be able to conduct criminal investigation for your part. The police don’t need the victims to give a separate consent for handling the data accessed from the Population Information System; reporting the offence is enough. If you don’t take the above measures the National Bureau of Investigation will investigate the case, but you will not be able to pursue your claim in the matter. 

The police will not interview the victims as part of the criminal investigation, unless there is a specific reason to do so. It is, therefore, important that you complete the crime report carefully, following the guidelines below. 

If you have suffered or are likely to suffer in the future, damage or loss as a result of the offence, you may also be able to claim compensation. You can make that claim when you report the crime or at a later stage in the process. Due to the large number of victims and the nature of possible claims, it may be that the prosecutor will not be able to defend your claim in the criminal proceedings. It means that you may have to defend your claim yourself. The prosecutor will make an independent decision on whether or not to pursue the claims. Please contact Victim Support Finland For advice and further information on matters of compensation.

Once the criminal investigation is complete, the police will refer the criminal investigation report to the prosecutor, who will then decide whether to press charges. The criminal investigation report is usually made public at the start of the trial. In principle, the police cannot conceal the victims’ names from the criminal investigation report. However, if your name is also considered patient data (such as HUS customer data), it will be concealed from the public version of the criminal investigation report. 

Read these instructions before filling in the crime report

Please read the instructions below carefully before filling in the crime report. By doing so and following the instructions, you will make sure that the police do not need to interview you in the case. If you wish, you may report the offence in person at a police station. 

See also Victim Support Finland's guidelines on compensation for damages at Compensation in criminal damages - Rikosuhripäivystys. 

How to report the HUS data protection offence to the police

1. At www.poliisi.fi, click Online services and then Services for private individuals.
2. Under Criminal cases, click Continue. On the next page, click Other offences and then Other offence. On the next page, click Continue.
3. Check and fill-in your personal details carefully. Click Continue. Under Injured party (i.e. the party who suffered the damage), tick “I am the injured party of one of the Injured parties.” Click Continue.
4. Under Time of the Incident, choose the date and time given in the letter as the Start date. Choose the date and time of the latest incident as the End date. If you don’t know the date and time of the incident, choose the current date. 
5. Under Location where the incident, select “Helsinki” as the municipality from the drop-down list. Next, under Crime towards the bottom of the page, select “Other property” and under Details of the crime scene, select “Health care property".
6. On the next page under The object of the offence / Type, tick “Other minor offence (non-urgent)”.
7. Type the following text to the description box: "I have been informed that my personal data has been unlawfully accessed in the HUS patient data system and/or the population information system (please select the correct option for yourself). I consent to the police checking my customer data at HUS." 
   You may also enter here any specific information you wish to make known to the police investigating the case. The police will contact you if necessary. 
8. Under There is video material on the offence of incident, tick “No”. Click Continue.
9. On the next page about the suspect, tick “Yes” to the question “Do you have information on the suspect or can you describe the suspect?” Under Suspect’s details, tick “I have other information on the suspect”. If you wish, you may use the next box to indicate whether you know or do not know the suspect. Click continue. 
10. On the following page, tick “No” to the question Were there witnesses to the offence? Click Continue.
11. The following pages cover different types of requests and consents. Tick the options that apply to you. If you need further assistance in filling in the fields, please contact Victim Support Finland.
12. Check the information on the form and submit.