Who grants permission for the secondary use of my data?
The goal of the secondary use of social and health data is to allow researchers and authorities to utilise Finnish registry data as efficiently as possible while ensuring the data is used safely and responsibly.
Permission for the use of registry data is not requested from each patient individually. Instead, authorities are responsible for granting permits. Their task is to ensure that the data is used safely, lawfully, and for a justified purposes.
In Finland, permits for the secondary use of social and health data can be granted by, for example, the data permit authority Findata or a data controller, such as a wellbeing services county or Kela. The authorities ensure that the permit is granted according to the process explained in the previous section.
Why is consent not requested separately from each individual for the secondary use of registry data?
Registry studies often require very large amounts of data for the results to be reliable and generalisable to the entire population.
For this reason, registry data in Finland can be used for secondary purposes without requesting separate permission from every individual whose data is included in the research material.
If registry research required separate consent from every individual, many important population-level studies would be impossible to conduct in practice. Therefore, decision-makers have centralised the permit procedure to authorities and ensured that privacy is protected by strict rules throughout the process.
What kind of research requires patient consent?
Unlike in registry research, participants in medical and clinical research must always provide their consent. These types of studies inherently involve physical intervention or interaction with the subject.
In medical research, a researcher may interfere with a person’s integrity, for example, through experimental research methods.
Clinical drug trials study the effects of a medicine or treatment method directly on human subjects. This might involve testing the efficacy or safety of a medicine.
In contrast, registry research uses existing data without any physical intervention. In this case, the consent of the patient (the data subject) is not required; instead, the permit is granted by an authority.
However, anyone can restrict the use of their data; in other words, you can opt out of the secondary use of your data. We will cover this in more detail in the next section.
Who grants permission for secondary use of Emma’s data?
When the research group applied for a data permit for their study, they did not need to ask for permission from each individual data subject, such as Emma.
They applied for a permit from the competent authority, which verified that the research was appropriate and that the privacy of Emma and other data subjects would be protcted.
If the research group had been required to ask for permission separately from thousands of people, conducting the study would have become significantly more difficult: it would have taken a massive amount of time and resources, and the dataset would likely not have been large enough to yield generalisable results.