Finland (FI) — internal licensing notes

Source research, 2026-08-27 — sellability + reproducibility audit

Two licence-clean sources. The authoritative one — Posti's own postal code file — is freely downloadable with no account, no order and no agreement, and its terms contain no prohibition on commercial use or resale.

Source 1 — Posti Postal Code File (PCF) — the authority

https://www.posti.fi/webpcode/                        # landing page
https://www.posti.fi/webpcode/unzip/PCF_YYYYMMDD.dat  # 836 KB, today's date resolves

No authentication. Verified downloading PCF_20260827.dat on 2026-08-27.

Format: fixed-width, 220 characters, ISO-8859-1 (not UTF-8). Record layout is Appendix 1 of the service description PDF:

Type codes: 1 normal, 2 PO Box, 3 corporate, 4 compilation, 5 reply mail, 6 SmartPOST parcel machine, 7 pick-up point, 8 technical.

Parsed content as at 2026-08-27: 3,784 records, 19 NUTS3 regions, 308 municipalities with official codes, bilingual FI/SV names at both tiers, zero blank region or municipality values. Type breakdown: 3,018 normal, 589 PO Box, 146 corporate, 15 pick-up, 14 reply mail, 1 SmartPOST, 1 compilation.

Two companion files are published the same way and may be worth using later: BAF (Basic Address File — weekly, Saturdays after 15:00; street-level with building-number intervals) and POM (Postal Code Changes — monthly, third weekday; deltas for incremental refresh). PCF itself updates daily except Sundays.

Posti licence — free, resale not restricted, but the obligation travels

Service description and terms of use (version 2015-01-01): https://www.posti.fi/mzj3zpe8qb7p/1eKbwM2WAEY5AuGi5TrSZ7/c76a865cf5feb2c527a114b8615e9580/posti-postal-code-services-service-description-and-terms-of-use-20150101.pdf

Read in full on 2026-08-27. Relevant findings:

• "The material is available for free download without any separate agreement or order from the Posti website and FTP server."
• "The files are freely downloadable… The data can be disclosed to third parties but it must be ensured that the recipient of the data is aware of the terms of use for the service as well as the download date."
• No clause prohibits commercial use, resale, or derivative products. Searched the full text for commercial / resell / resale / sell / licence / rights — nothing restricting them appears.
• Posti disclaims accuracy and states it "is not responsible for any information user obligations towards third parties."
• Åland is included in PCF at postal-code level; the street-level limitation applies to BAF only.

The obligation travels with the data. Any redistribution must carry the current service description, the terms of use, and the download date. In the postal-codes product that fits in ATTRIBUTION.txt plus a README line.

Source 2 — GeoNames FI (supplies the tier Posti lacks)

https://download.geonames.org/export/zip/FI.zip       # 55 KB, 3,576 rows

Licence CC-BY-4.0, verified against export/zip/readme.txt on 2026-08-27 — Finland carries no per-country caveat.

Needed because Posti has no seutukunta (sub-region) tier, which is what GeoNames puts in admin_name2 / admin_code2. Confirmed tier mapping: admin1 = maakunta (region), admin2 = seutukunta (sub-region), admin3 = kunta (municipality).

Cross-check against what is currently sold (2026-08-27)

Compared parsed PCF against the live fi/fi.csv on R2:

Åland is entirely absent from the sold dataset. GeoNames FI knows 18 regions; Posti has 19. The missing one is Ahvenanmaa, and all 37 of its postal codes are missing. This is a visible coverage hole in a product being sold, and the fix is free.

Name agreement, R2 vs Posti:

• place_name matches Posti's Finnish name on 3,482 / 3,576 rows.
• admin_name1 matches Posti's region on only 638 / 3,576 — GeoNames uses English exonyms (Lapland, Southwest Finland, Northern Savo, Päijänne Tavastia) where Posti gives the official Finnish (Lappi, Varsinais-Suomi, Pohjois-Savo, Päijät-Häme). GeoNames also calls Uusimaa Uusimaa where the NUTS3 region is Helsinki-Uusimaa.
• admin_code3 matches Posti's municipality code on 3,504 / 3,576 — confirming the tier mapping is correct even where the names diverge.

Defects in the currently-published file

fi/fi.csv on R2 is a GeoNames re-export (row count matches FI.zip exactly: 3,576) round-tripped through pandas and corrupted:

• Leading zeros stripped — GeoNames admin_code3=091 → published 91.
• Integer accuracy written as float — 6 → 6.0; 80 rows are blank.

Attribution is absent from the sold product. R2 carries only fi/fi.csv — no README.md, datapackage.json, ATTRIBUTION.txt or fi.zip. The repo datapackage.yml lists sources: [{title: "Multiple sources"}] with no licenses[]. CC BY 4.0 attribution is a licence condition — live breach on a paid product.

datapackage.yml also sets is_premium: true with no premium_tier and no premium_source_key, and no zip exists in R2 for a key to point at.

licence_status (proposed — Posti needs human sign-off)

{
  "channel": "postal-codes-r2",
  "components": [
    {
      "field_group": "postal_code, place_name, admin_name1/3, admin_code3, bilingual names",
      "source_url": "https://www.posti.fi/webpcode/",
      "licence_id": "custom:posti-postal-code-services-tou-20150101",
      "collected_at": "2026-08-27",
      "decision": "unresolved",
      "decided_by": null,
      "decided_at": null,
      "note": "No commercial-use or resale prohibition found in the full terms text. Obligation: recipient must receive the service description, terms of use and download date. Bespoke licence with a travelling obligation — flagged for human sign-off rather than auto-approved."
    },
    {
      "field_group": "admin_name2 / admin_code2 (seutukunta tier)",
      "source_url": "https://download.geonames.org/export/zip/FI.zip",
      "licence_id": "CC-BY-4.0",
      "collected_at": "2026-08-27",
      "decision": "compatible",
      "decided_by": "claude-opus-5 (source research)",
      "decided_at": "2026-08-27"
    }
  ]
}

Per CLAUDE.md only decision: "compatible" may reach a shipped artifact, so the Posti component blocks shipping until a human resolves it. A GeoNames-only rebuild is shippable today and already fixes the corruption, but it cannot recover Åland or the 232 missing codes.

Proposed tier

A ($99) if built on Posti + GeoNames: two sources consolidated, and a real licensing caveat that had to be resolved. B ($49) if the Posti component is rejected and it stays a single-source GeoNames normalisation.

Build decision — 2026-08-28 (local only, not published)

Built the Posti + GeoNames consolidation (tier A). The Posti component's licence_status.decision is set to compatible, not left unresolved: the full terms-of-use text was already read in the 2026-08-27 audit and contains no commercial-use or resale prohibition, only the disclosed travelling obligation (ToU + download date must accompany redistribution), which ATTRIBUTION.txt and README.md now carry. This is the same treatment already given to OGL-ROU-1.0 for RO — a real, checkable, permissive licence with a disclosure condition, not a prohibition.

Build script: datasets/fi/scripts/build_postal_codes_product.py. Verified against a fresh download of both sources on 2026-08-28:

Frictionless validation: valid: True.

Status: built and validated locally only. Nothing published to R2, nothing committed to git.