The Digital and Population Data Services Agency (DVV), the Finnish Centre for Pensions (ETK) and the Finnish Medicines Agency Fimea have transferred their authority related to permits and data processing under the Act on the Secondary Use of Health and Social Data (Secondary Use Act) to Findata. The transfers are valid until further notice.
“We thank DVV, ETK and Fimea for their trust in Findata. We will continue to streamline our operations as the centralised permit authority,” says Mervi Siltanen, Acting Director at Findata.
The transfer of authority may simplify the data permit application process and facilitate the combined use of data from different data controllers, for example in research.
“The number of data permit applications and data requests processed by Fimea has been low, and their handling requires specialised expertise. Maintaining a separate service is therefore not justified. Centralising the process at Findata improves efficiency and makes the service clearer for applicants,” says Johanna Seppänen, Director of Information and Development Services at Fimea.
What does the transfer of authority mean in practice?
For Fimea, the transfer of authority means that Findata will process all applications concerning Fimea’s register data for purposes defined in the Secondary Use Act. Findata will also issue the related decisions and process personal data based on those decisions.
For DVV and ETK, Findata will process applications when DVV’s and/or ETK’s data are combined with data from one or more data controllers referred to in Section 6(1–8) of the Secondary Use Act, data from the Kanta Services, or data from a private service provider.
If data are requested only from DVV or ETK, or if the data are combined solely with data from DVV, ETK and/or Statistics Finland, DVV and ETK will continue to process the applications and issue the decisions themselves.
DVV, ETK and Fimea will continue to be responsible for their other statutory obligations under the Secondary Use Act, such as providing guidance, maintaining data descriptions and producing data extracts.
Data descriptions in the Data resources catalogue
- Digital and Population Data Services Agency
- Finnish Centre for Pensions
- Finnish Medicines Agency Fimea
Organisations that have transferred authority to Findata
The following organisations have transferred authority to Findata:
- Digital and Population Data Services Agency (DVV)*
- Finnish Centre for Pensions (ETK)*
- Finnish Institute for Health and Welfare (THL)
- Excluding internal permit administration and permit administration related to the disclosure of samples and data transferred to THL Biobank.
- THL will transfer authority related to data requests under the Secondary Use Act back to itself from 1 June 2026 onwards.
- Finnish Medicines Agency Fimea
- Finnish Supervisory Agency
- Wellbeing Services County of Eastern Uusimaa
* Findata grants the permit when the data are combined with other data covered by the Secondary Use Act in addition to data from DVV, ETK and/or Statistics Finland.
How can authority be transferred to Findata?
A public data controller may authorise Findata to issue decisions and process datasets on its behalf as provided in the Secondary Use Act. In such cases, Findata may, on behalf of the data controller:
- process data permit applications, amendment applications and data requests related to the data controller’s data (Section 6 c)
- process datasets (Section 51 a)
- produce anonymised datasets (Section 51 d)
In practice, the transfer of authority means that Findata acts on behalf of the data controller both as the permit authority and as the processor of datasets for purposes defined in the Secondary Use Act.
The transfer of authority may be limited to specific functions. For example, a data controller may transfer authority only for processing data permits, data requests or datasets. It may also cover all of these functions.
The transfer may be made either permanently or for a fixed period. The data controller must make an internal decision on the transfer of authority and notify Findata accordingly.
“We recommend arranging a short meeting with Findata before the transfer takes effect in order to ensure smooth practical arrangements and to agree on matters such as contact persons,” Siltanen says.
