Decision on the Deployment of Automated Decision-Making

Chapter 8 b of the Administrative Procedure Act lays down the conditions under which an authority may resolve an administrative matter automatically. Pursuant to section 53 e(1) of the Administrative Procedure Act, an automated decision is a decision concluding the processing of an administrative matter that is made by means of automated data processing without being reviewed and approved by a natural person. Under section 53 e(2), an authority may automatically resolve a matter that does not involve issues requiring individual consideration, or a matter in which any issues requiring individual consideration have already been assessed by a public official or another person responsible for processing the matter. The decision must be based on the applicable legislation and on processing rules prepared on the basis of prior consideration. Finnvera decides through automated decision-making whether to grant or refuse a guarantee applied for in a guarantee application. This constitutes a decision concluding the processing of the matter and, accordingly, the requirements governing the automated decision-making resolution of matters apply. 

The granting of a guarantee through automated decision-making requires that prior consideration has established that the application meets the conditions for a favourable guarantee decision. An automated guarantee decision does not involve individual consideration. Instead, both the customer company and the financing must meet all predetermined conditions for the guarantee. Where those conditions are not met, a negative decision is issued to the customer through automated decision-making, and the customer is provided with guidance on the possibility of using other Finnvera guarantee products. Notwithstanding a negative decision, an application for an automated guarantee may always be resubmitted, and the guarantee may be granted once the applicable conditions are met. 

A guarantee is granted to all companies that meet the predetermined conditions. These conditions include, among others, that all required information is available and complete in public registers, the company's legal form complies with the product terms, the company has been entered in the Trade Register, the business is active, up-to-date financial statements have been registered where required for the relevant legal form, the Rating Alfa rating is sufficient, the company has positive equity, the company meets the EU definition of an SME, the responsible person or persons hold a Finnish personal identity code, and the company has at least one responsible person. These conditions and requirements are described in greater detail in Appendix 2, Processing Rules, of this implementation decision. 

A favourable automated decision is issued where the guarantee application meets the predetermined conditions for an automated decision. If the guarantee application does not meet those conditions, a negative decision is issued through automated decision-making. For example, a negative decision is issued if the company is classified as insolvent or if the company and/or its owner have payment defaults. 

Processing of the guarantee application is discontinued if the information required for processing is unavailable or if the available information does not meet the conditions for an automated guarantee. Appendix 2, Processing Rules, of this implementation decision lists the conditions for which information is required in order for an automated decision to be made. 

Accordingly, the requirement laid down in the Administrative Procedure Act that only matters not involving issues requiring individual consideration may be resolved through an automated procedure is fulfilled in this respect. 

In addition, the automated decision-making of the matter requires that the Financier has submitted the guarantee application after making its own financing decision. The Financier acts as the company's authorised representative and submits the guarantee application through Finnvera's electronic service. 

Guarantee applications submitted other than through the Financier are not resolved through the automated procedure. The Financier submits the application on behalf of the company, acting as its authorised representative, and ensures that the application contains all information necessary for the automated processing and resolution of the matter and that such information is accurate. 

Finnvera does not issue a separate guarantee instrument to the Financier or the company. Instead, the guarantee decision issued through automated decision-making constitutes Finnvera's guarantee instrument and becomes binding on the parties once the Financier has brought the guarantee into effect through Finnvera's electronic service. The rights and obligations of Finnvera and the Financier are governed by the cooperation agreement concluded between Finnvera and the Financier or the relevant banking group. The terms of that agreement supplement the guarantee terms set out in the guarantee instrument. 

The automated decision-making procedure for the application for a guarantee covered by this implementation decision is based directly on legislation and on the processing rules prepared on the basis of that legislation (Appendix 2). The processing rules, prepared by natural persons, govern the processing of the matter and its resolution through the automated decision-making procedure. The processing rules have been designed to ensure that the automated decision-making procedure produces, in every matter resolved automatically, an outcome that complies with the applicable legislation. 

Pursuant to section 53 f(1) of the Administrative Procedure Act, a prerequisite for automated decision-making is that the natural person to whom the decision is addressed may, free of charge and in all respects, request rectification under Chapter 7 a, or submit an equivalent request to be considered by the authority that made the decision or by another authority belonging to the same data controller. However, pursuant to section 53 f(2) of the Administrative Procedure Act, subsection 1 does not apply where an automated decision grants the request of a party and the matter does not concern another party. 

The automated procedure results either in the granting of the guarantee in accordance with the application or in the issuing of a negative decision. Finnvera's guarantee decision constitutes the guarantee instrument once the Financier has brought the guarantee into effect through Finnvera's electronic service. Where Finnvera grants a guarantee through automated decision-making, no separate administrative decision is issued and, accordingly, no instructions on requesting rectification are provided. If an automated guarantee application does not meet the preset conditions, the customer is issued with a negative decision together with instructions explaining how the customer company may apply for another guarantee product offered by Finnvera or reapply for an automated guarantee once the applicable conditions are met. The same procedure applies where the guarantee is granted without the automated decision-making procedure, that is, where the application is processed by a natural person. 

There are no other parties to the matter, as the only matters that are resolved in an automated decision-making process as described above are  those in which the company, acting through the Financier as its authorised representative, applies for a guarantee on its own behalf. 

Pursuant to section 53 g(1) of the Administrative Procedure Act, an administrative decision must indicate whether the matter has been resolved automatically and where the implementation decision referred to in section 28 d of the Information Management Act is available. Section 53 g(2) of the Administrative Procedure Act provides that, where no administrative decision is issued pursuant to other legislation, the information referred to in subsection 1, as well as information on the data on which the automated decision is based, must nevertheless be provided to the party concerned by other means no later than upon completion of the processing of the matter. 

No administrative decision is issued in connection with an automated guarantee decision made by Finnvera. If the conditions are met, Finnvera's decision constitutes the guarantee instrument once the Financier has brought the guarantee into effect through Finnvera's electronic service. If the conditions are not met, a negative decision is issued. 

Pursuant to section 53 g(3) of the Administrative Procedure Act, the name of the person providing further information is not included in the information relating to the automated decision-making procedure. However, the information must include contact details through which the party concerned may request further information, if necessary. The Financier informs the company, in connection with the processing of the financing decision, that the guarantee decision will be made through automated decision-making. The Financier informs the company that the matter will be resolved automatically. In addition, the information provided to the company includes the address of Finnvera's website where the implementation decision relating to Finnvera's automated decision-making procedure is available.

Pursuant to section 28 a(1) of the Information Management Act, an authority must document the division of responsibilities of the persons responsible for fulfilling the obligations laid down in Chapter 6 a of that Act. Finnvera has documented the division of responsibilities in Appendix 1 to this implementation decision. Decision-making authority has been taken into account in the company's internal instructions governing decision-making authority. 

Pursuant to section 28 a(2) of the Information Management Act, an authority must ensure that the processing rules for the automated decision-making procedure are documented in a sufficiently clear and comprehensive manner to demonstrate their compliance with the law. The processing rules must, in particular, describe how the non-discriminatory nature of the decision-making procedure is ensured, how the matter is examined sufficiently and appropriately, including the hearing of parties, and how the decision is reasoned or why reasons for the decision may be omitted. Finnvera has prepared the processing rules documentation required under section 28 a(2) of the Information Management Act (Appendix 2), which describes the automated decision-making procedure covered by this implementation decision. The documentation describes all stages of the automated decision-making procedure that affect the resolution of the matter, together with the processing rules applicable at each stage. The processing rules also describe the selection criteria on the basis of which a matter is referred for automated decision-making process. They also explain why the specific selection criteria were chosen. 

Finnvera's guarantee decision requires certain information relating to natural persons. This information includes, for example, the owner's first name, last name, personal identity code and nationality.  The application must also include information on the beneficial owners. The application identifies the beneficial owners, displaying their names and personal identity codes. 

The automated guarantee decision made by Finnvera does not result in discrimination on grounds such as gender, age, language or ethnic origin. Companies are treated equally, and a guarantee is granted to every company that meets the applicable conditions. Information relating to a natural person's nationality does not affect the decision but forms part of the information collected for the customer register. 

At least 80% of the ownership of the company must be held by owners with a Finnish Business ID or Finnish personal identity code so that the credit information of the applicant company's owners can be verified to a sufficient extent for risk management purposes. Where the required information cannot be obtained automatically, the company may instead apply to Finnvera for another guarantee product. 

The decision-making logic and the grounds for the decision have been documented in the manner required by law and are subject to subsequent review in order to ensure the transparency of the automated decision-making procedure. The documentation is updated regularly, and any deviations in decision-making are analysed and corrected. In addition, the company may at any time request that the decision be reviewed by a natural person. The decision-making procedure is based on predetermined, non-discriminatory criteria that apply equally to all applicants. The needs of different language groups have been taken into account, and the service is available in Finnish, Swedish and English. The accessibility of the documents and online services relating to Finnvera's automated guarantee has been ensured. 

The information is kept up to date by using the providers of company information and payment default information used by Finnvera. 

In accordance with section 28 a(3) of the Information Management Act, the legality of the content of the processing rules documentation prepared under section 28 a(2) has been reviewed and the documentation has been approved. Finnvera retains the approved processing rules documentation for at least five years from the beginning of the calendar year following the withdrawal of the automated decision-making procedure from use. 

In accordance with section 28 a(4) of the Information Management Act, Finnvera has ensured that, on the basis of the processing rules documentation and the implementation of the information systems used to resolve matters, it can be demonstrated, for at least five years after the matter has been resolved, which processing rules were applied in the automated resolution of an individual matter. 

Pursuant to section 28 b of the Information Management Act, an authority must, before introducing an automated decision-making procedure and whenever the procedure is modified while in use, ensure that the procedure complies with the documentation referred to in section 28 a(2) of that Act, namely the processing rules prepared for the procedure. In addition, the authority must ensure that documents generated automatically for the party concerned are drafted in clear and appropriate language and that the key quality assurance measures have been documented. 

Pursuant to section 28 c of the Information Management Act, an authority must monitor the quality and substantive correctness of matters resolved automatically. The provision also lays down requirements concerning risk management and the planning of procedures for correcting identified errors. 

Appendix 3 to this decision provides information on the quality control of the automated decision-making procedure and on compliance with the requirements relating to information security measures. The appendix specifies that the quality assurance and quality control procedures to be followed have been documented and that the persons responsible for quality assurance and quality control have been designated. Before introducing the automated decision-making procedure, Finnvera ensured, by means of comprehensive testing, that the procedure complied with the established processing rules. As part of the quality control process, the documents were reviewed by several people. The review ensured that the documents are written in clear language, use understandable terminology and are free from errors. The language used in decisions issued by Finnvera and in other documents relating to the automated decision-making procedure is reviewed and revised on the basis of observations made. Finnvera has documented how the quality of the automated decision-making procedure is monitored after its introduction. In addition to comprehensive automated testing, quality control is carried out primarily by selecting a random sample of automatically resolved matters for manual review. The procedures for handling potential error situations have been designed and documented. 

The implementation decision and information on the automated decision-making procedure are available from Finnvera's Customer Service by email at [email protected] or by telephone on +358 29 460 2582.

Pursuant to section 28 f of the Information Management Act, an authority must, on the basis of a risk assessment, ensure through appropriate technical measures that the information used in automated decision-making is current and correct. Finnvera has assessed the currency and correctness of the information used in automated decision-making by means of a risk assessment. Within Finnvera, risk assessment means an ongoing assessment of which data sources may be used to support business operations. 

Only guarantee applications submitted by the Financier are referred for the automated decision-making process. The Financier applies for the guarantee on behalf of the customer as its authorised representative. At Finnvera, the guarantee application is decided through an automated procedure. The Financier ensures that the application contains all information necessary for its automated processing. The completion and processing of the application draw on information collected by the Financier, information contained in Finnvera's information systems, and information obtained from external data sources. Finnvera has concluded cooperation agreements with those Financiers or banking groups that have adopted the Loan Guarantee (Fast Lane) product.

Automated decision-making concerning matters relating to natural persons must also comply with the requirements of the General Data Protection Regulation. Article 22 of the General Data Protection Regulation requires national legislation governing automated individual decision-making. The national legal basis for automated decision-making is laid down in Chapter 8 b of the Administrative Procedure Act and Chapter 6 a of the Information Management Act. The legislation establishes the safeguards applicable to automated decision-making. 

The decisions made under the decision-making procedure referred to in this implementation decision are based on legislation and meet the requirements of Article 22 of the General Data Protection Regulation. Under the General Data Protection Regulation, the safeguards relating to automated decisions include, among other things, the right of the data subject to request human intervention in the processing of personal data. However, where the request of the party concerned is granted in full, the party concerned can no longer be considered to have a need, from the perspective of data protection, for the decision to be reviewed by a natural person (Government Proposal HE 145/2022 vp, p. 154). The safeguard required by the General Data Protection Regulation is implemented in the decision-making procedure referred to in this implementation decision by ensuring that only applications in which the guarantee is granted as applied for or the application is refused by issuing a negative decision are resolved automatically. Following a negative decision, the customer company may always submit a new application for a guarantee.

The automated decision is addressed to the company. However, information relating to natural persons is also collected during processing. For the purposes of the automated guarantee decision, the application must include information such as details of the company's owner, beneficial owners, the owner's first name, surname, personal identity code and nationality. Information provided to customers is described above under Notification of automated decision-making.

Article 35 of the General Data Protection Regulation lays down provisions on data protection impact assessments. Under point (a) of paragraph 3 of that Article, a data protection impact assessment is required in particular where a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person.

Article 35 of the General Data Protection Regulation lays down provisions on data protection impact assessments. Finnvera has carried out a data protection impact assessment for the automated decision-making procedure. 

Before submitting a guarantee application, the Financier must, in each individual case, obtain the customer's consent to the exchange of information.