New law gives Migri and Finnish police wider access to personal data

President Alexander Stubb on 10 July 2026 ratified a package of security-sector amendments that will greatly expand data-sharing between the Immigration Service (Migri), the police, Customs, Border Guard and the Defence Forces. From 1 October 2026, the agencies will be able to consult each other’s warrants, apprehension notices and selected administrative registers in real time. Police will, in narrowly defined situations, also be allowed to obtain identifying information from healthcare and social-service providers when investigating serious crime or threats to life and national security. For Migri, the changes mean faster confirmation of an applicant’s identity and legal status: if the police detain a person who is known to Migri, the immigration authority must be informed immediately, and vice-versa. According to Interior Ministry estimates, this could shave three to four weeks off complex residence-permit investigations and reduce the number of duplicate interviews. The government says the reform is a direct response to gaps revealed during the 2023-2024 hybrid-pressure episodes on Finland’s eastern border, when different agencies were unable to see each other’s alerts in real time. Civil-liberties groups have criticised the short consultation period and warn that the law puts additional strain on data-protection safeguards. The Justice Ministry counters that access is limited to “need-to-know” categories and that all queries will be logged for audit purposes. For corporate mobility teams the most tangible effect will be on background-check timelines. Migri anticipates that residence-permit decisions for specialist employees could be issued up to one week faster once the shared system is live. Companies should, however, prepare staff for the fact that authorities may verify information more easily and may contact employers directly if inconsistencies arise. HR and compliance officers are advised to review internal data-handling policies to ensure that any information requested by Migri or the police can be provided quickly without breaching GDPR. Training sessions for line managers who routinely sign employment certificates may be necessary, as providing inaccurate statements could expose firms to criminal liability under the revised Police Act.