Permits

We issue permits for the secondary use of social and health data, combine data that is subject to a permit in a secure manner and pre-process these ensuring the privacy of citizens.

What data use can permits be issued for?

A permit can be issued for the purposes laid down in law, which are listed below. Data on individuals will be sent to a secure operating environment for analysis, while statistical data can be sent to the applicant.

Pursuant to the Act on the Secondary Use of Health and Social Data, information can be used without a separate permit also for knowledge management and social welfare and health care official management and supervision.

Note that as a rule, the Secondary Use Act applies to register-based studies. A register-based study is a study which utilises register data usually collected for other purposes or national registers. For example, the Secondary Use Act does not apply to clinical trials reported to Finnish Medicines Agency Fimea or to medical trials under the Medical Research Act.

What data can permits be issued for?

The data you can access via Findata are from social and health sector controllers on which you can find more information on the Data page.

Please note that we cannot issue permits for the data of all controllers within the scope of the Secondary Use Act. More details on these data restrictions can be found in the Secondary Use Act (finlex.fi, in Finnish).

Data descriptions and additional information

In accordance with the Secondary Use Act, data controllers provide advisory services concerning their own data and are the best placed to do so. If you need more information on the variables in a certain controller’s data, contact the controller in question.

You can also make an agreement on the implementation of data extraction in a certain manner with the controller. In the application you send to us, specify the person with whom you have agreed to on the matter.

The National Data Resources Catalogue at aineistokatalogi.fi contains descriptions of some of the data in the scope of the Secondary Use Act.

See the bottom of this page for the application assistant. The assistant can help in determining which authority you should send you data permit or amendment application to. Click here to go to the application assistant.

The Secondary Use Act does not apply to clinical trials reported to Fimea, so these are not within Fimea’s competence. The definitions for interventional clinical trial and noninterventional study can be looked up in Finnish at Fimea Regulation 8/2019 (PDF file, 196 kB). When necessary, Fimea will provide advice on whether a study is considered a clinical trial.

Read more on data permit processing related competences in Finnish in section 44 of the The Secondary Use Act (2019/552, finlex.fi).

Under the Secondary Use Act, public sector social and health controller are divided into two groups. Below is the more detailed division of these groups and their differences in competence.

Logging into the e-service

All applications to Findata are sent in our e-service with an online form. Log into the service at asiointi.findata.fi using Suomi.fi e-Identification or Haka log in.

Always log in using the same identification methods, so that you can see the applications you have sent and the decisions that have been given.

If you encounter any problems, contact Findata’s advisory service: info@findata.fi

For more information on logging in see the Logging into services page.

Selecting and completing an application form

There are different application forms for different information needs

• Data permit application, when you need data on individuals, the analysis of data subject to a data permit will only be possible in audited, secure operating environments.
• Data request, when you need statistical data The statistical data accessed with a data request will be sent to the applicant.
• Amendment application, when you are applying for an amendment to a valid data permit See the Amendment permits page for information on what amendments you can apply for with an amendment application.

Complete the application form carefully. Shortcomings in the application will lead to a request for more information and the return of the application to the applicant.

For detailed instructions on the completion of different application forms see the pages for different types of permits:

• Data permits
• Data requests
• Amendment permits

If you do not know what information to enter into an information field on the form, ask for help well in advance from within your organisation or from our advisory service.

How to expedite the processing of application

The processing time for applications depends on several factors: the accuracy of the data extraction description, the current backlog at Findata, and the response times of data controllers.

By following our guidelines, you can help ensure that your application is processed as quickly and efficiently as possible.

How to speed up the processing of your application:

1. Verify Findata’s authority:
   • Ensure Findata is the competent authority to issue a permit for the data you need.
   • Use the application assistant to help determine this.
   • Note that the Digital and Population Data Services Agency, the Finnish Centre for Pensions, and Statistics Finland handle their own data and permit decisions. If you need information from these controllers, contact them directly.
2. Consult Findata’s help desk:
   • If unsure about where to send your application, contact Findata’s help desk service at info@findata.fi before submitting it.
3. Contact data controllers directly:
   • If you need more information about the data or variables, contact the relevant data controllers. Data controllers provide advisory services for their data and can guide you on data extraction methods. You can also make an agreement on the implementation of data extraction in a certain manner with the controller.
   • In your application, mention the contact person with whom you have discussed the data extraction.
4. Use the Data Catalogue:
   • You can refer to the Data Resources Catalogue (aineistokatalogi.fi) for additional information.
5. Describe your information needs accurately:
   • Clearly define the information needed and specify the register-specific data extractions in your application.
   • If the extraction involves multiple steps, describe the order of extraction using the extraction description form (download Word file, 51.2 kb).
   • Ensure that the data extractions and the data you request are essential and justified.
6. Apply the GDPR minimisation principle:
   • Only request data that is essential for your purposes. The principle of minimisation as defined in the GDPR will be applied, meaning that only necessary data will be disclosed.
7. Complete the application carefully:
   • Pay attention to entering basic data such as the applicant’s details, the data controller, invoicing details, and any other data to be combined.

If you want to complete the application you have already sent, ask us to return your application by sending an email to info@findata.fi. Write in the subject line Return of application and the diary number of your application (e.g. Return of application THL/XXXX/14.0X.00/202X).

Transfer of personal data outside the EU/EEA

The processing of personal data abroad is counted as a transfer of personal data even if the data is in a remote access environment.

Under the EU’s General Data Protection Regulation, data can be transferred within the European Economic Area on the same grounds as within Finland. Countries belonging to the European Economic Area include the EU Member States and Norway, Liechtenstein and Iceland.

If data is to be transferred or processed outside the aforementioned countries, i.e. in so-called third countries, there must be a legal basis for this in keeping with Chapter V of the GDPR.

The acceptable legal bases are listed below. It is sufficient that just one of these bases for data transfer is met.

Further information on the transfer of data to the United Kingdom following Brexit can be found on the website of the Data Protection Ombudsman (tietosuoja.fi).

Permit fees and other costs

A fee will be charged for decisions concerning data permit applications, data requests and amendment applications and the related processing of data. The price of our services comprises the price of the decision and an hourly fee, which will be determined according to the working hours spent on combining and processing the data.

In addition to the fees charged by Findata, the final price is affected by the data extraction and delivery fees based on
decrees concerning the controllers.

When we process applications, we will ask the controller for a maximum cost estimate for extracting the necessary data. We will also give a maximum cost estimate on data processing by Findata.

We will forward these estimates to the applicant before making a decision on the permit. The final price of the data resource is confirmed after disclosing the data. A separate processing fee is charged for any expired and negative decisions.

See the Pricing page for more information.

How does an application’s processing proceed?

The processing of applications can be divided into five stages, which can be preceded by the applicant independently contacting to a controller. The process is shown in text after the graph.

0. Contact controllers directly before sending an application, if you need additional information on the data or variables or help with drawing up an extraction description.
   • The applicant can also make an agreement on the implementation of data extraction in a certain manner with the controller. If the customer and the controller’s contact person have agreed for example that a clinician, who is part of the research team will extract the data free of charge, the application’s Additional information section should include information on who this was agreed on with and in what context.
1. Submit your application or requested additional information to Findata in our e-service.
   • If you are only submitting additional information, the clarifications can, depending on the case, also be submitted by e-mail.
2. Our application processors check your application and its appendices to ensure that they contain all the necessary information.
   • Where necessary, we will return an incomplete application for completion or we will submit a request for further clarification to the applicant.
   • Data permit applications are reviewed within a week or so of receipt and are divided into those that can be processed and those that need to be completed.
3. When all the extraction descriptions have been completed, we will send additional information and cost estimate requests to the controllers whose data is requested in the application.
   • The purpose of the request is to determine the feasibility of the requested extraction and the maximum cost estimate for the extraction.
   • The controllers have 15 working days to respond to this request. Where necessary, controllers may ask for additional details to the request, in which case we will forward the questions to the applicant.
   • At this stage, we will also determine Findata’s internal cost estimate, which comprises our own data processing costs.
4. Once all the cost estimates have been received, you will be presented with a final extraction description and a maximum cost estimate for approval.
   • You must accept both in order for the permit to be granted.
   • Note that it will not be possible to change the extraction conditions after this, and that changes made to the extracted data later on will require a separate application.
5. We will issue a positive data permit or data request decision.
   • Note that data permits are always for a fixed period. If data needs to be saved for a purpose such as the verification of research or the you intend to renew your permit or the extractions must be updated at certain intervals, include these needs in your application.

How will the compilation of the applied for data proceed?

Once we have issued a data permit or made a decision on a data request, there are five different staged for the compilation of data and its pre-processing. The process is shown in text after the graph.

6. We will send the data requests to the controllers so that extraction can begin. Each controller has 30 working days to submit the requested data to Findata.
   • Depending on the nature of the project and the extraction, this phase may include several consecutive parts, such as 1. extraction of the target group; 2. extraction of the controls; 3. extraction of data. As each controller has 30 working days, these three steps can take a total of 3 x 30 = 90 working days.
7. We will begin to process the sent data. As agreed on for each project, we will check, combine and pseudonymise the data or make statistics on them in accordance with a data request.
8. The completed data will be handed over to the permit holder in an agreed-upon secure operating environment in CSV format.
   • Findata’s secure remote processing environment Kapseli is the statutory primary option. The data can be disclosed to other processing environments, if this is necessary for the completion of the project.
   • The target time for the handing over of data is 60 working days. The target time will not be possible if a target group is not given immediately after the decision has been made, data extraction is carried out in several stages, deliveries by data controllers are delayed or the data is exceptionally complex.
9. You have three months to review the material. You must notify Findata within this given time period of any comments they wish to make on the material.
   • Check the data thoroughly as soon as possible. Errors that occur during extraction can accumulate, if, for example, the target group has been formed incorrectly and other controllers must carry out their own extractions all over again for this reason.
   • If you notice any omissions or errors, send a message to Findata at data@findata.fi. In your message, describe as precisely as possible how your data differs from the data described in the extraction description.
10. We will remove the data from our own systems four months after it has been handed over. We retain the code keys for pseudonymised data that will enable the data to be reproduced.
    • Data permits are always for a fixed period. If data needs to be saved for a purpose such as the verification of research or the you intend to renew your permit or the extractions must be updated at certain intervals, include these needs in your application.

Where can the data be analysed?

Data can be accessed with different types of permits. Different conditions apply to data obtained under different permits as to where they may be used and analysed.

The aggregated statistical data accessed via a data request is sent to the customer, and it can be analysed freely in accordance with a data utilisation plan. The statistical data is sent to the customer primarily via the Nextcloud transfer service. If necessary, order Nextcloud credentials from our e-service.

Data on individuals that require a data permit can only be analysed in a secure environment. As a rule, the data will always be disclosed to Findata’s secure processing environment Kapseli. However, the Secondary Use Act makes it possible to disclose information to other processing environments, if necessary. Data received from a controller other than Findata will also always be disclosed in a secure processing environment.

Read more below in the section: Findata’s regulation sets information security requirements for environments.

Amendment permits are also officially data permits (decisions to amend data permits), meaning the same requirements apply to these as to data permits. Read more on the page Amendment Permits.

Findata’s regulation sets information security requirements for environments

We have issued a regulation in accordance with the Secondary Use Act, which describes the requirements laid down other service providers’ secure operating environments.

The regulation concerns the secondary use of social and health data, and it will be applied to all the purposes provided in the Act for which a data permit is required. These purposes include scientific research, statistics, teaching and the planning and investigation tasks of the authorities. With regard to teaching, the regulation pertains to the preparation of teaching materials, not actual teaching.

According to the regulation, data can only be disclosed for processing in a secure environment other than Findata’s secure Kapseli environment if the environment complies with the requirements of the regulation. In addition, the environment must be assessed by an information security assessment body and a certificate of assessment must be provided. These requirements have entered into force on 1 May 2022.

The entry into force of the requirements does not affect existing, valid permits. If data are processed on the basis of a valid permit previously granted, the processing of that data may continue in the same environment after 1 May 2022.

The requirements take into account the solutions in existing environments and enable the utilisation of different technical solutions. At its simplest, a secure environment can be a physically and technically secure space with a terminal device for analysing data that is isolated from the Internet and other devices. On the other hand, technical solutions based on cloud services are also possible, as long as the service provider ensures the required level of data security. The operating environments of foreign researchers must also meet the data protection and security requirements.

Read more on the page Regulation on secure operating environments

Clinically significant findings

Based on the Section 55 of the Secondary Use Act, a data recipient can contact Findata if they make a clinically significant finding where a health-related risk could be prevented or the quality of their treatment improved.

Findata establishes who the finding concerns and then submits the information to a specialist at the Finnish Institute for Health and Welfare (THL). THL’s appointed specialists assess the significance of the data and the expected benefits of taking action. If the benefit is assessed to be so clear that it would be important for the patient to receive treatment, the information is then disclosed to the wellbeing services county responsible for the patient’s treatment. An employee of the wellbeing services county contacts the patient.

Everyone has the right to object to being contacted based on section 55 of the Secondary Use Act. This objection can be done in any operating unit that provides public health care and online via My Kanta. Contact prohibitions cannot be set up via Findata, Kela or THL.

Verifying the anonymity of results

The processor of personal data must produce the results of the analysis in an anonymous format that does not reveal the data or characteristics of an individual.

We ensure anonymity in line with the Secondary Use Act. This applies to all data that have been authorised under the Act. We do not charge a fee to ensure anonymity.

You can find criteria for ensuring the anonymity of results and examples of the most common types of analysis on the page Producing anonymous results

Publishing results

Publication in this context means bringing information to the public and disseminating it to the surrounding society. Publication is defined as the presentation of results outside the working group.

Publication can take the form of a scientific or other journal, a thesis, a textbook or manual, a conference presentation or abstract, a report, a survey or some form of internet publication.

Check the correct address for the application