e-GOVERNMENT IN FINLAND - ePractice.eu

standardisation, to clarify what is already in the law, to make auditing easier and to encourage additional
action.
66. Agencies are increasingly asking for more e-government guidance at all levels, from broad
principles to detailed technical standards. Because many agencies are risk adverse, the latter are especially
important for advancing action. From a government-wide perspective, common guidelines make sense as
they promote interoperability. The multiplication of Web services, accompanied by decentralisation, has
invariably meant that ministries and agencies use different ICTs to implement their Web sites and
electronic services. A framework of interoperability standards can ensure that technical barriers at least can
be overcome as ministries and agencies move towards better integrating their services, a key challenge for
e-government noted by the OECD’s The E-government Imperative (2003). (See also Part 4.3.3 on
standards.)
67. Confusion about the provisions of the law was also a common theme in interviews. Many
agencies repeated a demand for legislation that would provide direction and clarify what they could or
could not do, particularly in the areas of data security and technical standards. Especially in the case of
small agencies with few resources, the cost of developing an e-government project in the wrong direction
or using the wrong standards is potentially disastrous. A legislative initiative is currently under discussion
to combine all existing e-government legislation covering areas such as reducing data collection burdens
and electronic transactions. While nothing is new in the legislation, it would make it easier to have an
overview of legal requirements.
68. Another voice for additional legislation comes from the State Audit Office (SAO). When asked
what their one wish to improve e-government would be, SAO officials said that they would like a central
ministry or unit to have the authority to give orders (i.e. a single data law or rule) which would make it
easier for them to audit compliance. Right now, the MoF can make recommendations but cannot enforce
them. The SAO officials felt that more authority would improve data security, by giving them better
criteria for carrying out their audits. They admitted, however, that ministries already have the authority to
give orders to the agencies under them, especially in the case of big ministries such as Defence or Interior,
even if they do not like to exercise it. Even without the backing of law, strengthening the audit function
could potentially give more weight to ministerial guidelines, especially when the results are published.
69. The Ministry of Justice (MoJ) acknowledged the pressure for additional legislation but is
reluctant to launch new laws since it sees demand as driven by management needs rather than intrinsic
regulatory needs. This view was echoed by some in the MoF when told that some agencies were awaiting
enabling legislation to move forward, “there is nowhere that says they can’t move forward now”. In one
interview, officials cited the legislation on the smart card (the 1999 Identity Card Act) as an example of
unnecessary legislation since there was already sufficient authority under existing legislation to manage
data security and digital signatures. If anything, those officials feel that further deregulation is needed.
70. As noted earlier, there is plenty of room under existing legislation for providing guidance where
needed, and indeed much of the guidance has taken the form of government resolutions, which are more
flexible, but less binding. Another solution is not more guidance, but simply more clarity about existing
guidance. When asked about the barriers to implementing e-government, one official raised the need for
training about new legislation. He cited 20 laws concerning data security, and noted that very few experts
understand them all and how they interact.
71. There seems to be a tendency in Finland to use legislation as a catalyst for action. Many
ministries and agencies are not actively resisting implementing e-government, but simply waiting to be told
that they have to act. This may, in fact, reflect a lack of leadership and political will at the ministry and
agency level for e-government action or inadequate governance frameworks that make responsibility for
39