The Act on the Secondary Use of Health and Social Data facilitates the use of personal data in social and health activities for secondary purposes, establishing specific conditions regarding the environments in which such data may be analysed. While the Act itself does not impose restrictions on the transfer of personal data, the Social and Health Data Permit Authority has issued Regulation 1/2022, which, in Section 3.1.2 of Annex 1, stipulates that the environment must be physically located within the EU/EEA.

The European Union General Data Protection Regulation (GDPR) provides a comprehensive framework for data protection that applies to all EU Member States. Finland implemented the GDPR in 2019 through the Data Protection Act.

Under the Directive on Data Retention, operators were required to retain certain categories of traffic and location data (excluding the content of those communications) for a period between six months and two years and to make them available, on request, to law enforcement authorities for the purposes of investigating, detecting and prosecuting serious crime and terrorism. On 8 April 2014, the Court of Justice of the European Union (ECJ) declared the Directive invalid. However, not all national laws that implemented the Directive have been overturned.
In Finland, data retention laws are still in force, but as of 2021, they are under review. Chapter 19 of the Electronic Communications Services Act authorises the Finnish Ministry of the Interior to request data retention obligations of telecommunications providers. The retention obligations require telecommunications providers to retain traffic and location data for individuals under investigation for certain crimes for a period of 6-12 months, depending on the type of data. It is also true that following the ECJ ruling invaliding the Data Retention Directive, the scope and the application of the Finnish Information Society Code is limited. For instance, it does not include website browsing. Moreover, small operators are not required to retain their data. The data retention period goes from six months to 12 months, according to the category of the data.

Chapter 19 of the Electronic Communications Services Act allows the Ministry of the Interior to request retention obligations of telecommunications providers without a judicial warrant. These retention obligations require telecommunications providers to retain traffic and location data for certain individuals or between 6-12 months, depending on the type of data, for use by the authorities in solving certain criminal acts. While the contents of communications cannot be accessed by authorities, Chapter 19 gives the Finnish government the ability to amend certain retention obligations by Government Decree. Thus, Chapter 19 essentially allows Finnish authorities to access personal traffic and location data for individuals suspected of committing certain crimes without a warrant.

The Directive 2000/31/EC (E-Commerce Directive) is the legal basis governing the liability of Internet Services Providers (ISPs) in the EU Member States and includes a conditional safe harbour. Not all Member States have transposed the relevant articles consistently, leading to divergent national case law that could cause legal insecurity on an EU level.
In Finland, the Act 458/2002 on Information Society Services and Electronic Commerce implements the E-Commerce Directive almost verbatim, but at the same time, it has some important distinctions, such as not implementing Art. 15 on prohibition of monitoring obligations.

The Directive 2000/31/EC (E-Commerce Directive) is the legal basis governing the liability of Internet Services Providers (ISPs) in the EU Member States and includes a conditional safe harbour. Not all Member States have transposed the relevant articles consistently, leading to divergent national case law that could cause legal insecurity on an EU level.
In Finland, the Act 458/2002 on Information Society Services and Electronic Commerce implements the E-Commerce Directive almost verbatim, but at the same time, it has some important distinctions, such as not implementing Art. 15 on prohibition of monitoring obligations.

Finland is a party to the Patent Cooperation Treaty (PCT).

There is no general principle for the use of copyright-protected material comparable to the fair use/fair dealing principles. Directive 2001/29/EC defines an optional but exhaustive set of limitations from the author´s exclusive rights under the control of the “three-step test” in line with the Berne Convention that establishes three cumulative conditions to the limitations and exceptions of a copyright holder’s rights. The Directive has been transposed by Member States with significant freedom.
The Finnish Copyright Act implements the Directive, with Chapter 2 of the Act enumerating the limitations on copyright protections.

The European Union and Finland have adopted the World Intellectual Property Organization (WIPO) Copyright Treaty. The treaty was ratified on 14 December 2009 and came into effect on 14 March 2010.

The European Union and Finland have adopted the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty. The treaty was ratified on 14 December 2009 and came into effect on 14 March 2010.

The Directive 2016/943 on the protection of undisclosed know-how and business information (trade secrets) is key in harmonising national laws concerning trade secrets. Finland transposed the Directive through a series of amendments to existing legislation in 2018, as well as with the Trade Secrets Act (595/2018) of 2018.

It is reported that passive sharing is mandated in Estonia, and it is practised in the mobile and fixed sectors based on commercial agreements. In addition, Directive 2014/61/EU (Art. 3.2) establishes that Member States shall ensure that, upon written request of an undertaking providing or authorised to provide public communications networks, any network operator must meet all reasonable requests for access to its physical infrastructure under fair and reasonable terms and conditions, including price, with a view to deploying elements of high-speed electronic communications networks. Such written request shall specify the elements of the project for which the access is requested, including a specific time frame.

It is reported that the State of Finland owns 17.59% of the shares of Elisa Corporation. Elisa Corporation is one of the leading telecommunications service providers in the country and offers a wide range of services, including mobile telephony, broadband services, cable television, data services and business solutions.

It is reported that there is no requirement for functional separation for operators with significant market power in the telecom market. However, accounting separation is required in certain cases.

Art. 85 of the Utilities Directive (2014/25/EU) contains provisions allowing contracting public entities to reject foreign goods not covered by any EU international commitments from its tender procedures. In these cases, a tender submitted for the award of a supply contract may be rejected where the proportion of the products originating in third countries exceeds 50% of the total value of the products constituting the tender (Art. 85.2). Additionally, in cases of equivalent offers, the provisions provide for a preference for European tenders and tenders covered by EU's international obligations. In practice, this possibility has rarely been used.
In Finland, the Directive has been transposed with the "Act on Public Contracts and Concessions of Entities Operating in the Water, Energy, Transport and Postal Services Sectors (1398/2016)".