Purpose of use
You can obtain statistical data from data controllers covered by the Secondary Use Act with a data request. Once we have made a positive data request decision, we combine and pre-process the data needed for the project and hand over the statistical-level data to the data recipient.
Data requests can be issued for the purposes of
- scientific research
- statistics
- planning and reporting duties of an authority and/or guidance and supervision of a social and healthcare authority
- education
- development and innovation operations
- knowledge management (comparative data)
The purpose of the processing of personal data is to form statistical data of the social and health data received from one or more controllers under the scope of the Secondary Use Act. We provide only anonymous statistical data on the basis of a data request.
In statistical-level data, individual personal data have been combined and summarized. The statistics describe groups of persons rather than an individual persons. The data of the groups of persons is formed in such a way that individuals cannot be identified or traced.
We do not use automated decision-making or profiling in the processing of data.
Data processed and data sources
Each data request decision specifies the basis on which the statistics are to be compiled.
In the pre-processing of data under data requests, we process the social and health data received from one or more controllers under the scope of the Secondary Use Act to the extent that it has been assessed to be necessary for each project.
We do not compile statistics on all materials of all data controllers within the scope of the Secondary Use Act. For more detailed restrictions on data, see the Secondary Use Act (finlex.fi).
Data controllers within the scope of the Secondary Use Act:
- Data saved in Kanta services
- Digital and Population Data Services Agency (DVV)
- Finnish Centre for Pensions (ETK)
- Finnish Institute for Health and Welfare (THL)
- Finnish Institute of Occupational Health (TTL)
- Finnish Medicines Agency Fimea
- National Supervisory Authority for Welfare and Health Valvira
- Public and private service providers of social welfare and health care
- Social Insurance Institution of Finland Kela
- Statistics Finland
- Regional state administrative agencies (AVI)
The data is transferred to Findata via a secure transfer service.
Regular disclosure of data and recipients of personal data
We disclose only statistical level data based on data requests. We do not disclose personal data.
We use Tieteen Tietotekniikkakeskus Oy (CSC) to carry out the technical maintenance and development of the information systems we use to transfer the data and compile the statistics. CSC acts as a processor of personal data on behalf of Findata.
There are no other categories of recipients of personal data because we do not disclose personal data based on data requests.
Data retention period
We retain data from controllers for a period of six months after we have disclosed the statistics we have compiled to the data recipient. During the retention period, we use the data to correct any possible errors in the compilation of statistics.
In the case of a rolling data request, i.e. statistics are compiled and delivered at regular intervals on the basis of updated data, we will retain the data for six months from the last delivery.
Transfer and disclosure of personal data to non-EU or EEA countries
We do not disclose personal data outside the EU or EEA.
The statistics compiled on the basis of the data request do not contain personal data, so they can also be disclosed outside the EU member states.
Rights of the data subject
The data subject refers to the person to whom the original social and health information relate. When we process personal data as a data controller, the data subject has the following rights:
- Right to information about the processing of personal data (Article 14 of the GDPR)
- Right of access to one’s personal data (Article 15 of the GDPR)
- Right to rectify one’s data (Article 16 of the GDPR)
- Right to restrict the processing of one’s data (Article 18 of the GDPR)
- Right to object to the processing of one’s data (Article 21 of the GDPR)
The data subject has the right to object to the processing of personal data by us at any time on grounds relating to their particular situation. In this case, we shall no longer process the data relating to this person, unless there are substantial and legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
Read more about your rights as a data subject
Legal basis of processing personal data
The processing of personal data in the pre-processing of the data under a data request is based on the following laws:
- Act on Secondary Use of Social and Health Data (552/2019) Sections 14 and 45,
- General Data Protection Regulation Article 6(1)(e),
- Data Protection Act Section 4(2) and,
- in the case of special categories of personal data, the Data Protection Act Section 6(1)(2) and the General Data Protection Regulation Article 9(2)(g).
