Due to legislative changes, the Act on Secondary Use of Social and Health Data will no longer apply after January 1, 2026, to datasets covered by the laws on clinical drug trials, medical devices, or medical research.
This means that secure processing environments compliant with the Act may continue to contain datasets that are no longer within its scope. These datasets can still be processed in those environments.
Datasets can also be transferred to another environment if the following legal grounds for obtaining and processing the data are met:
- Section 34 of the Clinical Drug Trials Act
- Section 21 c of the Medical Research Act
or - Section 20 a of the Medical Devices Act.
Note that only datasets with one of the above legal bases can be transferred. If some datasets in the environment are still subject to the Act on Secondary Use, they remain under the same requirements as before.
What does this mean in practice?
The permit holder may request the transfer of datasets out of an environment compliant with the Act on Secondary Use. The service provider of the environment is responsible for verifying the conditions for transfer and carrying out the transfer
In practice, this means providing documentation before the transfer to demonstrate the right to access and process personal data:
- The research subject must have given informed consent to participate in the study. This consent must be demonstrable.
- When disclosing data, adequate data protection and security must be ensured. Data cannot be disclosed if there is a justified reason to suspect a threat to national security. If an authority refuses to disclose requested data, it will issue a decision.
- Data must be pseudonymized before disclosure unless there is a specific reason to do otherwise. Datasets under the Act on Secondary Use are always pseudonymized by default, so they can be transferred as they are.
Below are instructions on how to request the transfer of datasets from Kapseli. If the dataset is located in another environment, contact that environment’s service provider.
If you want to transfer a data from Kapseli, follow these steps:
- Terminate your Kapseli subscription.
- Do this via Findata’s e-service. Select the form “Order or update Kapseli environment or data storage service.” Then choose “Update my current Kapseli” and “I want to close Kapseli.”
- Note the one-month processing time.
- Provide, along with the termination, a valid permit (other than Findata’s) under which the dataset will continue to be used, as well as other required information. The permit and information must include:
- The legal basis for processing the dataset
- A variable-level description of the dataset covered by the permit (other than Findata’s)
- The target population (e.g., a cohort based on explicit consent vs. comparators added under the Secondary Use Act)
- Information on where the dataset will be transferred
- Details of the recipient and their connection to the dataset. We cannot transfer personal data without confirmation that the recipient has the right to process it.
- Approve the cost estimate for the data transfer.
- We will review the termination and the reasons for the transfer.
- Once the conditions for transfer are verified, we will prepare a cost estimate and send it for approval.
- Receive the dataset.
- Datasets will be transferred using Findata’s transfer services, Tunneli or Supertunneli.
Please note that processing the transfer may take time. If you need additional instructions, contact Findata’s customer service: info@findata.fi.
These instructions will be updated as needed.