The Finnish government on 22 October submitted a draft law granting the Finnish Security and Intelligence Service (Supo) authority to target foreign state-run information systems that threaten national security—even when those systems are located outside Finland. The bill, detailed by the Interior Ministry and reported on 23 October by Nordic Defence Sector, would also extend the confidentiality period for national-security documents to 60 years and allow the Border Guard to assist Supo in discrete cyber-operations. For global mobility programmes, the headline is not espionage but data. Companies routinely transmit HR and travel data—including passenger name records and assignment dossiers—through international networks that might fall within Supo’s expanded surveillance remit if compromised by a hostile actor. Legal counsel should therefore review data-protection clauses in vendor contracts and ensure encryption standards meet or exceed EU GDPR expectations. The proposal comes amid a spike in state-sponsored cyber activity directed at Nordic transport and border-control systems. In September, Norway disclosed GPS jamming near its Arctic airports, and Estonia reported phishing campaigns against its e-Residency platform. Finnish officials argue that giving Supo clearer authority to probe external servers will help pre-empt similar disruptions to the forthcoming EU Entry/Exit System rollout in 2027. Privacy advocates have already voiced concerns about the 60-year secrecy period, noting that it exceeds the 40-year limit applied to many defence documents. Parliamentary committees will hear expert testimony in November, and the law could be enacted as early as spring 2027. Multinationals should monitor the bill’s passage and be prepared for new compliance guidance—possibly including mandatory incident-reporting obligations—once the Border Guard and Supo publish their joint enforcement protocol.
Source: Nordic Defence Sector
