Pre-processing of data under data request

Purpose of use

You can obtain statistical data from data controllers covered by the Secondary Use Act with a data request. Once we have made a positive data request decision, we combine and pre-process the data needed for the project and hand over the statistical-level data to the data recipient.

Data requests can be issued for the purposes of

scientific research
statistics
planning and reporting duties of an authority and/or guidance and supervision of a social and healthcare authority
education
development and innovation operations
knowledge management (comparative data)

The purpose of the processing of personal data is to form statistical data of the social and health data received from one or more controllers under the scope of the Secondary Use Act. We provide only anonymous statistical data on the basis of a data request.

In statistical-level data, individual personal data have been combined and summarized. The statistics describe groups of persons rather than an individual persons. The data of the groups of persons is formed in such a way that individuals cannot be identified or traced.

We do not use automated decision-making or profiling in the processing of data.

Data processed and data sources

Each data request decision specifies the basis on which the statistics are to be compiled.

In the pre-processing of data under data requests, we process the social and health data received from one or more controllers under the scope of the Secondary Use Act to the extent that it has been assessed to be necessary for each project.

We do not compile statistics on all materials of all data controllers within the scope of the Secondary Use Act. For more detailed restrictions on data, see the Secondary Use Act (finlex.fi).

Data controllers within the scope of the Secondary Use Act:

Data saved in Kanta services
Digital and Population Data Services Agency (DVV)
Finnish Centre for Pensions (ETK)
Finnish Institute for Health and Welfare (THL)
Finnish Institute of Occupational Health (TTL)
Finnish Medicines Agency Fimea
National Supervisory Authority for Welfare and Health Valvira
Public and private service providers of social welfare and health care
Social Insurance Institution of Finland Kela
Statistics Finland
Regional state administrative agencies (AVI)

The data is transferred to Findata via a secure transfer service.

Regular disclosure of data and recipients of personal data

We disclose only statistical level data based on data requests. We do not disclose personal data.

We use Tieteen Tietotekniikkakeskus Oy (CSC) to carry out the technical maintenance and development of the information systems we use to transfer the data and compile the statistics. CSC acts as a processor of personal data on behalf of Findata.

There are no other categories of recipients of personal data because we do not disclose personal data based on data requests.

Data retention period

We retain data from controllers for a period of six months after we have disclosed the statistics we have compiled to the data recipient. During the retention period, we use the data to correct any possible errors in the compilation of statistics.

In the case of a rolling data request, i.e. statistics are compiled and delivered at regular intervals on the basis of updated data, we will retain the data for six months from the last delivery.

Transfer and disclosure of personal data to non-EU or EEA countries

We do not disclose personal data outside the EU or EEA.

The statistics compiled on the basis of the data request do not contain personal data, so they can also be disclosed outside the EU member states.

Rights of the data subject

The data subject refers to the person to whom the original social and health information relate. When we process personal data as a data controller, the data subject has the following rights:

Right to information about the processing of personal data (Article 14 of the GDPR)
Right of access to one’s personal data (Article 15 of the GDPR)
Right to rectify one’s data (Article 16 of the GDPR)
Right to restrict the processing of one’s data (Article 18 of the GDPR)
Right to object to the processing of one’s data (Article 21 of the GDPR)

The data subject has the right to object to the processing of personal data by us at any time on grounds relating to their particular situation. In this case, we shall no longer process the data relating to this person, unless there are substantial and legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

Legal basis of processing personal data

The processing of personal data in the pre-processing of the data under a data request is based on the following laws:

Act on Secondary Use of Social and Health Data (552/2019) Sections 14 and 45,
General Data Protection Regulation Article 6(1)(e),
Data Protection Act Section 4(2) and,
in the case of special categories of personal data, the Data Protection Act Section 6(1)(2) and the General Data Protection Regulation Article 9(2)(g).