Finland.
Section 12 expression, Sananvapauslaki source protection, GDPR-strict enforcement.

Section 12 of the Suomen perustuslaki (Finnish Constitution, 731/1999) is titled "Freedom of expression and right of access to information." Paragraph 1 guarantees the right to express, disseminate and receive information, opinions and other communications without prior prevention. Paragraph 2 establishes the principle of openness — documents and recordings held by authorities are public unless their publication has, for compelling reasons, been specifically restricted by Act. The structure is unusual in European constitutional drafting: positive press freedom and positive transparency obligations are paired in a single constitutional clause.

Sananvapauslaki (Act on the Exercise of Freedom of Expression in Mass Media, 460/2003) is the implementing statute for Section 12 in the mass-media context. Section 16 is the headline: a publisher, an editor and any person who has participated in the preparation of a publication has the right to refuse to disclose the identity of a source, and to refuse to disclose information that would reveal that identity. The right is statutorily framed as a duty to refuse — not a privilege that can be waived by a court order — and Finnish legal scholarship has read it as broader and more absolute than the equivalent in Sweden, with fewer enumerated exceptions.

It applies to "the publisher of a periodic publication and the operator of a programme service" — terms read broadly in case law to include online publications, including small ones. A blog with regular editorial output, an independent newsroom, a leak intake — these fall within the protected class. Pure infrastructure-layer activity (a personal Wireguard exit, a Tor relay) sits under general constitutional Section 12 protection rather than Sananvapauslaki specifically; the protection is still real, it is just a different doctrinal route.

Tietosuojavaltuutettu is the Office of the Data Protection Ombudsman — the Finnish data-protection authority — and the seuraamuslautakunta (sanctions board) attached to it. Finnish enforcement is widely characterised as among the most consistent in the Nordics: fines against telecommunications operators for unlawful retention, multiple decisions narrowing biometric and facial-recognition deployment, and a series of well-publicised actions on dark-patterns and consent in 2023–2025. For a hosting customer this means Article 17 erasure rights and Article 5 minimisation are not theoretical — there is a regulator with real teeth backing them.

It is the part of the picture you should know about. Acts 581/2018 (civilian intelligence) and 582/2018 (military intelligence) gave Suojelupoliisi (Supo) and the Finnish Defence Intelligence Agency expanded powers, including signals-intelligence collection on cross-border traffic, subject to court oversight (Helsinki District Court) and parliamentary supervision (Intelligence Oversight Ombudsman). These regimes target counter-terrorism and counter-intelligence; they are not ordinary legal process aimed at hosting customers. As elsewhere, no jurisdiction substitutes for application-layer encryption against a state-actor adversary.

GDPR is a net positive — Article 5 minimisation is binding by law, Article 17 erasure is enforceable by a regulator with documented willingness to fine, and the European Data Protection Board provides a check on national over-reach. The cost side is the EU e-Evidence package (Regulation (EU) 2023/1543), in full application from 2026, which creates European Production and Preservation Orders that other Member States can serve directly on a Finnish provider. The mitigation is structural: NordBastion does not collect identity, does not retain payment-card data, and rotates infrastructure logs aggressively; orders intersect only with what we actually hold.

This is the historical-honesty section. During the Cold War, Finland's formal posture of neutrality (the YYA Treaty era, 1948–1992) included tacit intelligence accommodations with the Soviet Union that Finnish historians and the post-1992 parliamentary commissions have documented openly. That era ended with the collapse of the Soviet Union, Finland's 1995 EU accession, and — decisively — its 2023 NATO accession. The current Finnish intelligence posture is firmly inside Western alliance structures. We mention the history because honest jurisdictional analysis names it; the current operational reality is a fully Western-aligned EU and NATO member.

Only through a Finnish court order, on a named subject, for data we actually hold — and that intersection is narrow by design. Section 16 of Sananvapauslaki creates a positive duty to refuse for publishers and editorial collaborators; for ordinary hosting customers, the limit is what does not exist. We do not collect identity at signup, we do not retain payment-card data (crypto only, no KYC), and infrastructure logs are kept on the rotation schedule published in the transparency report. What does not exist cannot be compelled.

Finland is a party to the standard EU mutual-legal-assistance instruments (the 2000 EU MLA Convention, the European Investigation Order Directive 2014/41/EU) and to the broader Council of Europe framework. Outside the EU, Finland has bilateral MLATs with the US and others. MLAT remains a slower, judicially-supervised route than direct e-Evidence orders, and it still requires the requesting state to demonstrate dual criminality and necessity. It is part of the picture; it is not a blanket pipe.