Most motorists don't know that agencies such as Finland's Transport and Communications Agency (Traficom) sell their personal information to third parties for research and marketing purposes.
Ideapark shopping mall in Seinäjoki is just one of several companies in Finland purchasing personal data from vehicle registration plates.
When customers drive into the shopping mall car park, a camera snaps a picture of their vehicle's registration plate number. The camera was installed by Jyväskylä-based information technology and services firm Nodeon.
Checking the registration number at the Transport and Communications Agency's (Traficom) database, the firm is able to gather personal information about the owners of the vehicles, including their postal codes - and then sells that data to the shopping mall.
"We aim to find out in which geographical areas we should target our advertising," Ideapark Seinäjoki's CEO, Petri Häli, told Svenska Yle, saying that doing so helps to keep track of how many customers arriving by car are coming to the mall from different areas.
Seinäjoki's Ideapark is a new mall, opening last November. The shopping centre announced last week that it had already passed the one million-customer mark. At the time, Häli said the large number of visitors were likely drawn by the firm's geographically-targeted advertising.
According to Häli, the mall plans to continue buying data gleaned from registration plates, saying that he's particularly looking forward to the information that will be gained during the coming winter school vacation and Easter holiday.
Similar data analysis of registration plates is very common across the country, but it is unclear exactly where - and there is no central agency which keeps an eye on who buys such data extrapolating services.
According to estimates from Traficom itself, dozens of clients - including entities ranging from private firms to municipalities - are buying extrapolated data on the movement of vehicles.
Not just companies involved
Southeast regional newspaper Kouvolan Sanomat reported about Nodeon's traffic camera surveillance near Kotka Harbour last summer. It turned out that the city of Kotka wanted to know from where people were coming to attend its annual summer festival Kotkan Meripäivät.
Kotka resident Thomas Freundlich filed a complaint about the data collection to the country's Office of the Data Protection Ombudsman, but the matter has not been processed by the office yet.
Freundlich said he was concerned about the trend of both commercial and private entities wanting to collect an increasing amount of data about people, a practice he said for which there was no legal basis.
"Data collection is happening in more and more areas, and in the long run people are choosing to accept it. It is not necessarily a good development. In any case, public discussion about the rules of the game would be needed, " Freundlich said.
The transport agency Traficom often shares large chunks of registration plate data "for purposes related to transport." The practice, it said, enables entities like municipalities to plan road networks in the future.
The transport agency sells the data chunks at a rate of 30 euros per search, but each search can contain many registration plate numbers.
That data is then packaged and resold in a statistical format - but still anonymous in terms of car owners' personal details - by firms like Nodeon, which markets the service to companies as a better way to target their advertising and marketing campaigns.
Specific vehicle owners' registration numbers are not revealed to data analysis companies or advertisers. However, those companies are able to see how many cars come from a given postal code.
Legal grey area
But is this sale of such information for commercial use even legal in Finland? Nodeon said it is according to the agreement it made with Traficom.
Deputy data protection ombudsman Anu Talus said she was unable to comment on Nodeon's practices at Ideapark, as the agency has not yet made a decision on the monitoring of festival goers in Kotka last summer.
But generally, Talus said that the use limitations of personal data should be the same for private firms as it is for public entities like municipalities.
However, when the data in question is statistical - like in Ideapark's case - there are no limitations regarding data protection regulations because no personal information is shared.
But there is no signage at Ideapark Seinäjoki's carpar announcing that it's collecting vehicle registration plate data - the only mention the shopping mall makes of it is on its website.
The mall's CEO Häli said that is adequate, but Traficom's position is that it isn't.
"Having a sign near the camera saying it is collecting data would be a good way to provide such information. Then all motorists who pass by the camera can see it," Hannu Parkkisenniemi, head of information services at Traficom, said.
Citing the EU's data protection regulation (GDPR), the deputy ombudsman Talus underscored that such monitoring needs to be clearly pointed out.
"The important thing is that affected motorists should actually know that their vehicle's registration numbers are being used this directly when such data is being collected. And they must also be informed that they have the right to forbid the process," Talus said.
Drivers and car owners who do not want the data from their vehicle registration plates used "for transport related services" can do so on Traficom's website or by phone (+358 29 534 5100).
Indeed, data tech analysis firm Nodeon also notes on its own website that people can opt out from data collection via Traficom.
In a statement, Nodeon's director, Timo Majala, noted that the firm deletes personal data from its records after analysing it for clients.
Freundlich and others are still waiting for the Data Protection Ombudsman's office to decide on Nodeon's data collection last summer in Kotka. Once that hurdle is passed, there will be a bit more clarity on Finland's vehicle data protection regulations.