I made an inquiry in the Finnish SIS to see if there are any alerts on me in the SIS database and I received a very ambiguous response hopefully someone here can help me interpret It says
National police board states that no information about you in the Finnish SIS for which you could use your right of access. This does not exclude the possibility that there is an alert issued by another country.
Can you please tell me is that no information or there is something?
This simply means that there's no information they're going to give you. There may or may not be information they aren't going to give you, information related to law enforcement and exempt from subject access rights.
Obviously they couldn't tell everyone either "there's no information, period" or "there's no information we're willing to give you", because the latter would effectively inform the person that there's something. So this response doesn't specifically indicate that there's information they're not willing to give you. It's boilerplate.
There is a bit of a contradiction between privacy laws and law enforcement. The EU likes to think of itself as exemplary when it comes to data protection but law enforcement agencies always seek exemptions from these rules and regulations. Making a file or database easy to probe by the public can also make national agencies more reluctant to share data. The way it has been resolved in the Schengen acquis is by creating this right of access (that does not always exist as such for national police files) but with several safeguards and no obligation for national authorities to be fully transparent.
Under the law, national contact points may therefore restrict access for the following reasons:
The right to access your data can be denied in certain circumstances. The right of access can be restricted when such a restriction, considering your rights, is necessary and proportionate to safeguard
- the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties,
- another official investigation, audit or other such procedure,
- public security,
- national security, or
- the protection of the rights of others.
In theory, they have to provide a justification when they deny the right of access but they can also avoid that if they deem that providing the justification would also jeopardize an investigation, national security etc. etc. etc. (which could easily be extended to all cases where denying access is justified in the first place). That's the reason behind the deliberately vague answer you received.
Unless they abuse the law to basically thwart any request from the public, it would however imply that the Finnish authorities have not imposed a run-of-the-mill alert for the purpose of denying entry (article 24 decision, i.e. ban), i.e. the kind of bans for which you would get some sort of paper and an opportunity to appeal. I am guessing it would also rule out an alert under article 32 (missing persons). There could still be a ban for some sensitive political reason or based on intelligence that the authorities do not want to disclose or maybe another type of alert (arrest, covert surveillance, assistance with a judicial procedure…) as it's easy to see why those should be kept secret.
There is also a bit of leeway on how to deal with alerts issued by other countries. The Finnish national police board has access to those and “may” provide information on them to you after informing the issuing state (article 67 of the regulation) but it's not entirely clear whether they positively have to bother seeking this permission or they can just ignore these alerts.
For context, bans are the most common type of alerts about persons, 56% in 2022. Alerts based on article 36 of the SIS II regulation (discreet or specific checks) are the second most common type after bans.
