As part of a prior consultation, the Finnish authority considered that a planned migration to a cloud computing service for a penitentiary information system presented a high risk of unlawful data transfers outside the European Union, despite the envisaged encryption measures.

Facts and context

The Finnish Data Protection Authority published an opinion issued as part of a prior consultation concerning a planned migration to the cloud by the Criminal Sanctions Agency (Rikosseuraamuslaitos).

The case originated from a prior consultation request submitted by the Criminal Sanctions Agency in spring 2026, relating to the overhaul of its client information system and its migration to a cloud computing solution, a procedure required when the envisaged processing presents a high risk that the controller cannot mitigate.

Reasons for the decision

The authority analyzed the risk presented by the envisaged processing in light of the applicable legislation.

• Risk of unlawful data transfers outside the European Union: The authority noted that Finnish law on data protection in criminal matters regulates data transfers outside the European Union more strictly than the GDPR. The Criminal Sanctions Agency itself had identified in its analysis that the planned migration could lead to data transfers contrary to this specific legislation. Although the agency had planned measures to reduce this risk, notably through effective encryption solutions and contractual instructions to the processor, the authority considered that these safeguards did not eliminate the high residual risk of unlawful transfers.

Authority's decision

Consequently, the authority concluded in its opinion issued in summer 2026 that the planned cloud migration for the client information system and the potential data transfers resulting from it were likely to be contrary to the law on data protection in criminal matters.

Lessons learned

This decision reminds that:

• The legislation relating to the processing of personal data in criminal matters (transposing Directive (EU) 2016/680) imposes stricter conditions for data transfers outside the EU than the GDPR.
• Technical measures, such as encryption, and contractual instructions addressed to processors may not be sufficient to eliminate a high risk of unlawful transfers, justifying the use of prior consultation with the authority.
• Public authorities, particularly those in the justice and security sectors, must exercise particular vigilance when planning migrations to cloud services likely to involve data transfers outside the EU.