Legislation and the classified IT system were developed in parallel
The development of the Incomes Register has been an extremely exceptional project in many ways. During the project, the Tax Administration established a new Incomes Register Unit, and the introduction of various new ways of working was required. The project implementation also required changes to legislation. Holmström says that the legislation applicable to the register was developed in parallel with the technical side of the project.
Over the years, more than one hundred Digia employees participated in the system development. The practical implementation of the project was carried out in three phases. The first phase started at the end of 2016. It focused on the wage reporting functionality for employers, which was introduced in January 2019. After that, focus was on expanding the number of the users of the Incomes Register, with implementation taking place at the beginning of 2020. In the third phase, the functionality of pension and benefit data reporting was added to the system. The entire system was completed in early 2021.
Naturally, there are inevitable challenges in the early stages of such major societal change. Holmström says that the launch of the Incomes Register in 2019 nevertheless went well, considering the scope of the project. When users became familiar with the system, it was even smoother to use. “The deployment of the entire system in 2021 went really well,” says Holmström.
The Incomes Register is a key system for Finnish society, so the information on the technologies or software used in it is not public. However, Holmström can state that the system is not to a major extent based on any off-the-shelf software, even though such software has also been utilised as part of the whole. Most of the Incomes Register was programmed and built by using technologies and applications – including Microsoft technologies – that are also used elsewhere in the Tax Administration's systems.
The entire project was carried out in accordance with the government’s security classification guidelines. This was taken into account in all parts of the project, from architectural design to practical work. The personnel involved in the project has a security clearance, as required by authorities. In addition, work was carried out in state-certified security facilities that Digia has in four different cities. Holmström says that all the sub-entities in the system were required to meet strict data security requirements.