Security Clearance Procedure
In some cases, the employer has the option of commissioning a security clearance procedure on the applicant or employee, which means investigating the background of the applicant or employee using the government authority registers. A security clearance procedure can be done at the request of a private company, if the company has a strong need to protect valuable trade secrets or other economic interests, such as research and development functions and patents, for example.
The security clearance can be either concise, standard or comprehensive. The procedure is subject to a fee and is requested from the Finnish Security Intelligence Service, which also handles all security clearance procedures. The government authority performing the procedure considers case by case if there is information on the subject of the procedure that is relevant in performing work duties and that is to be given to the company that applied for the security clearance procedure.
A private company may only apply for the concise and standard forms of security clearance, out of which the standard form is clearly more common. Comprehensive security clearance is done on persons who more than occasionally encounter level I (top secret) or II (secret) classified documents or who require a security clearance certificate to be able to be chosen for a position in an international organization or body. During security clearance procedures the protection of the subject’s privacy and personal data needs to be preserved.
The applicant for a standard security clearance must demonstrate that the clearance is intended to protect a significantly valuable trade secret with strong national economic significance, or data security that protects the beforementioned secrets. Significance for the national economy may seem like a high precondition, but in practice, the research and development activities are also of significance to the national economy. The threshold for a concise security clearance procedure is the lowest. It can be applied if an employee in their work has access to such plants or institutions that are exhaustively listed in legislation: nuclear power plants, airports and military garrisons among others.
In addition, a standard or concise security clearance may also be applied for, for example, an employee who would have rights to an employer's or customer's information system the unauthorized use of which could cause large-scale production interruptions or other significant economic damage or if the company employee has access to such trade secrets the misuse of which could cause significant economic damage.
The applicant for a security clearance is always a company. When applied for, all three forms of security clearance require the employee’s consent in writing, which is obtained by asking the employee to sign the security clearance application form. In addition, the employee must always be notified of the application for a security clearance in advance, and, for example, when hiring a new employee, the easiest way is to notify of the security clearance procedure in the job advertisement.
A company applying for a security clearance needs to ensure that the personal data contained in the clearance report is not used for purposes other than those stated in the application and that the data is processed only by those persons whose duties require it. In addition, the proper implementation of the company's data security and other security arrangements and undertaking to implement them is, in practice, a prerequisite for obtaining a security clearance.