What rights do I have?
When your data is used in registry research or for other secondary use purposes, you have rights related to your personal data in accordance with the EU General Data Protection Regulation (GDPR).
The purpose of these rights is to ensure that your data is processed transparently and securely, and that you have the opportunity to influence how your personal data is handled.
Your rights regarding your personal data
- Right to receive information about how your data is processed
- Right to access to your data
- Right to rectification of data
- Right to restrict processing
- Right to object to the processing of your data
- Right to lodge a complaint with a supervisory authority
What does exercising these rights mean in practice?
As a data subject, you have the right to object to the use of your data for secondary purposes, such as research. In this case, your data will no longer be disclosed for purposes like registry research.
An objection request is always made per data controller. This means the objection must be submitted separately to different data controllers. Data controllers provide information on how to submit an objection on their websites. For Findata, the objection is submitted through Findata’s e-service.
You can also request information about which projects your data has been disclosed to. This request must also be made separately to each data controller.
When do you not have the right to object to secondary use?
Health data is also used secondarily for statutory, ongoing tasks, such as compiling Finland’s official statistics and monitoring various phenomena.
For example, THL has a legal obligation to collect and maintain health-related registers and to use them to monitor and promote the wellbeing and health of the population. In these situations, THL has the right to use and store the data for as long as the task requires.
This type of continuous secondary use cannot be prohibited or objected to. It differs from one-off secondary use, which is conducted for a specific research project, for example. One-off secondary use can be objected to by sending an objection request to the permit-granting data controller, as described above.
What rights does Emma have?
As a data subject, Emma has the right to request access to her data or to prohibit data controllers from disclosing it for secondary use.
While considering the matter, Emma concludes that objecting does not feel necessary. She believes it is important that her data can contribute to research and help develop better care – after all, she herself has benefited from treatment based on scientific research.
Since data protection has been carefully addressed, Emma decides not to submit an objection.
However, Emma wonders what kind of studies her data might have been used for. Before making a data request, she visits Findata’s website to browse the permits they have granted.