Use a data request to apply for statistical, anonymous data. Statistical data accessed with a data request is sent to the customer and the same data protection requirements do not apply to its analysis as to the analysis of data on individuals.
We are legally responsible for all data requests regardless of whether the request is for data from one or numerous controller.
Please read the Permits web page before sending a data request. The page includes useful information to take into consideration before applying, while applying and after applying.
What to remember before sending an application
Select the correct application type
There are different types of applications for different information needs
- Data permit application, when you need data on individuals
- Data request, when you need statistical data
- Amendment application, when you are applying for an amendment to a valid data permit
Describe and limit data
Define the data to be applied for at the variable level and remember the principle of minimisation for other information. Utilise the Data Catalogue (https://aineistokatalogi.fi/) and controller’s advisory services
- Where from and how do I extract the target group? Is the definition specific enough?
- Are control subjects/relatives extracted? How will they be defined?
- From which registers will the data be extracted?
- What variables will be included in the extraction?
Other data to be combined
- Have you made sure that the other data is described on the application?
- Are the permits for other data valid or is the permit process pending?
Determine the competent authority
Findata is responsible for the application and the permit decision whenever data are combined from data controllers covered by the Act on secondary use of health and social data. The assessment of the competent authority must therefore consider all the data related to the application.
Check from the application assistant which authority the application should be sent to: Application assistant
General information on data requests
Read up on the general principles that apply to data requests, such as what is confidential and what is public.
Data requests and their attachments are confidential. We will forward all the necessary information for the extraction of data and the formation of a target group, as well as information on the applicant and their contact details to the controller.
The decisions and permits granted by an authority are primarily public. On our website, we will publish the following information on projects that have received favourable data request decisions:
- date of decision
- decision recipient (organisation)
- project name
- a brief description of the intended use for the data.
- purpose of use pursuant to the Act on Secondary Use
This public data can be shared from the website also to other communication channels.
At the moment, we produce either aggregated statistical data in table format or key figures. This information is extracted from a controller at the individual level in accordance with the request, after which we will form anonymous data from them.
It is good to note that the implementation of anonymisation will impact the information content of the ready result, and the production of anonymised results is not possible in all situations, such as for a very small target group.
LOGGING INTO E-SERVICES
To submit a data permit application, log into our e-service at: asiointi.findata.fi using either Suomi.fi e-Identification or Haka login. For more information on logging in see the Logging into services page.
Please always log in using the same identification methods, so that you can see the applications you have sent and the decisions that have been given.
Data permit applications can be submitted in Finnish, Swedish or English
After logging in
- Go to the Data Catalogue tab
- Go to “Apply for new access rights” and select “Data request: Statistical data” by clicking on “Add to basket” on the right and continue by clicking on “Apply”
- Complete the application form utilising the instructions given below and send it to us. Unfortunately, after an application has been sent, it can no longer be edited. If you want to supplement an application that has already been sent, send us an email to info@findata.fi and tell us your application’s ID (e.g. 2022/53). We will return the application so you can supplement it.
See also:
Dates of monthly maintenance outages in 2023
- 23.2.2023
- 3.-6.3.2023 additional outage
- 23.3.2023
- 20.4.2023
- 25.5.2023
- 22.6.2023
- 20.7.2023
- 17.8.2023
- 21.9.2023
- 19.10.2023
- 23.11.2023
- 21.12.2023
At the moment, we produce either aggregated statistical data in table format or key figures. This information will be extracted in accordance with the request at the individual level from the controller, after which we will form anonymous data from it.
It is good to note that the implementation of anonymisation will impact the information content of the ready result, and the production of anonymised results is not possible in all situations, such as for a very small target group.
Instructions for submitting a data request
1. Applicant information
- Applicant refers to the person or organisation named on the data permit application, who the data permit will be issued to.
- Contact person refers to the person who is acting as the applicant’s contact person in matters related to the application and will respond to all questions regarding the application.
- In the application, describe the link between the contact person and applicant. This can be based for example on an employment or public-service employment contract. The contact person’s details can be forwarded to the controller during the processing of an application, if extraction requires more additional information.
More information:
Applicant’s business ID
Enter the applicant’s business ID If the applicant is a private individual, enter 123 into the field. If the applicant organisation is located in a country other than Finland or an EU/EEA member state, please provide the name of the official register in which the organisation is registered.
2. Invoicing details
- Invoicing details for Finnish payers:
- E-invoicing is the primary invoicing method for Finnish payers. In your application, state the connection between the invoiced party and the project. Inconsistencies between the applicant and the invoiced party (e.g. the payer is not the applicant) can be clarified where necessary in the Additional information section.
- If necessary ask for more information from your organisation’s financial department. You can also search for e-invoice addresses on the TIEKE Finnish Information Society Development Centre website: https://verkkolaskuosoite.fi/. A list of e-invoicing addresses is maintained by Finnish e-invoice operators.
- A VAT number is formed from a business ID e.g. 1234567-8. Add the two letter country code FI to its beginning and remove the hyphen from the ID e.g. FI12345678.
- Invoicing details for foreign payers:
- If the payer is not Finnish the payer should have a Peppol-address for the e-invoicing.
- If the payer doesn’t have a Peppol-address, the invoice is sent by mail. In case the payer prefers it being sent as an email the email address used for this should be mentioned during the application processing.
3. Purpose of data use
- The application should provide an overall picture that corresponds with the stated data use, which is pursuant to the Act on the Secondary Use of Health and Social Data.
- The requested information content should match the purpose of processing personal data.
- A thesis must be at least the final assignment for a Bachelor’s degree. The reduced decision price for theses only applies to individual theses. If the thesis is produced as part of a larger project or a project results in a number of theses, this is not the thesis work referred to in the Findata application and should be marked down as a research project.
More information:
Planning and reporting duties of an authority
As a rule, only an authority may carry out the planning and reporting duties of an authority. If an authority does not act as the applicant in a data permit application, the authority must be the controller of the data. As a rule, when work is commissioned, the commissioning party will be the processor of personal data.
Teaching
When data is to be used for teaching, the applied for data will be used to prepare teaching materials for personnel and persons studying to become social welfare and health care personnel who process customer data and social welfare and health care professionals. Please note: Data containing identifiers can only be used in teaching situations if teaching cannot be carried out anonymously due to the exceptional nature of the case, the nature of teaching or a similar reason. The person providing teaching must inform their students of the confidentiality provisions in legislation and the sanctions resulting from their violation.
Scientific research
When data is to be used for scientific research, attach an up-to-date research plan and a research permit from the responsible/target organisation to your application. Also attach an opinion from the Ethics Committee, if the legislation applying to the research and/or the research setup so requires.
Criteria for scientific research (in general):
- an appropriate research plan
- responsible person or group
- results to be published as a scientific publication
- research produces new information.
Statistics
When data is to be used to form statistics, state in the application which party will compile the statistics and for what purpose.
Knowledge management
Knowledge management refers to the processing of data carried out by a service provider in their customer, service and production processes for the purpose of supporting
- operations, production and financial control
- management and
- decision-making.
Development and innovation operations
Development and innovation operations refers to application and use of technical and business data and other existing data together with the personal data referred to in the Secondary Data Act for the purpose of developing new or significantly improved products, processes or services.
In addition, the purpose of the operations must be to
- promote national health or social security
- develop social welfare and health care services for service systems
- protect individuals’ health or well-being or
- secure for them their related rights and freedoms.
4. Definition of subjects
- In the application, describe the formation of the target group as clearly as possible and limit the target group according to the purpose of the work.
- Submit to the form
- Geographic definition of the subjects
- Subject gender
- Age of subjects
- Time period covered by the statistics
- If you want to, you can also
- add information on other delimitation of the subjects or statistics
- describe the potential exclusion criteria for target group extraction
5. Statistics generation
- Tell from which registers will the data for the statistics be extracted. Name both the controller and the register.
- If the generation of statistics requires variable transformations, please define these clearly in the following questions.
- Tell which variables of the registers cited above do you wish to include in the rows and the columns of the statistics.
- Indicate both the register and the variable. Also explain how the variables will be grouped, summed or classified, and describe any delimitations, e.g. by age class, by year.
- If you need several statistics, name them, e.g. Statistics 1, Statistics 2…
- Please provide an empty example table for every statistic table you are requesting where the variables on rows and columns are clearly defined
- Allowed file types: .pdf, .txt, .doc, .docx, .odt, .ppt, .pptx, .odp, .xls, .xlsx, .ods, .csv, .tsv, .jpg, .jpeg, .png, .gif, .webp, .tif, .tiff, .heif, .heic, .svg.
- Allowed maximum size of an attachment: 10 MB.
- Let us know whether you would like the statistics to be handed over as a .pdf file, .xlsx file or a .csv file.
6. Additional information and attachments
- You can give more details in this section on all the application’s previous sections, such as invoicing.
- If you have spoken about your application with a Findata employee in advance, please give the person’s name.
- If you have spoken about your application or about extraction with a contact persons of controllers in advance, please enter the names of these persons here. For example, if you have agreed that extraction will be implemented in a certain way, give the name of the person with whom you agreed on the matter.
- Add possible attachments.
- Please do not attach data to this application
How to expediate the processing of your data request
The application processing time will be affected by the content of the application (in particular, the accuracy of the data request description), the current application processing situation and controllers’ response times. If there are any ambiguities related to your application, contact the controller directly and Findata’s advisory service to expediate processing
You can expediate the processing of your application:
- Complete the application carefully.
- Determine the information need and the register-specific data extractions as accurately as possible before sending the request. Submit an empty sample table for each of the statistics you have requested so that the row and column variables are clearly marked.
- Contact controllers directly if you need more information about the data or variables. In accordance with the Act on Secondary Use of Data, data controllers provide advisory services concerning their own data and are the best placed to do so. For more information, see the Data page. You can also utilise the Data catalogue.
Processing of the data accessed via a data request
A data request can only be used to acquire a ready analysis, the results of which are aggregated data. At the moment, we produce either aggregated statistical data in table format or key figures. This information will be extracted in accordance with the request at the individual level from the controller.
Findata will derive the results from individual-level information, which will then be anonymised before they are sent to the customer. Please note that the implementation of anonymisation will impact the information content of the ready result. The production of anonymised results is not possible in all situations, such as for a very small target group.
How is anonymisation implemented?
Anonymisation is implemented in this context by using threshold five as the sensitivity rate. In this case, aggregated information must be computed at least on the basis of information on five people. This applies to both statical data in table format and key figures.
For example, If a single cell in aggregated statistics in table format contains a number based on the information of less than five people, the data must be edited to reduce the risk of identification.
In the case of the implementation of anonymisation as statistical data in table format information is rendered down to a general level when this is possible taking into consideration the use of the results. Blacking out of cells meaning the removal of values is applied if rendering down to a general level does not provide an anonymised result.
Blacking out includes both the primary covering of sensitive data that is at risk of being exposed and supplementary blacking out. Supplementary blacking out prevents sensitive values from being determined on the basis of possible marginal sums. When implementing anonymisation, the possibility of a group’s information being exposed is reviewed in situations where all the people in a certain group are given the same (sensitive) variable value.
Information on costs
A fee is charged for the decision concerning the data request and for the compiled statistical data. The price of the Findata service comprises the price of the decision and an hourly fee, which will be determined according to the working hours spent on combining and processing the data.
In addition to the fees charged by Findata, the final price is affected by the data extraction and delivery fees based on decrees concerning the controllers.
When we process a data request, we will ask the controller for a maximum cost estimate for extracting the necessary data. We will also give a maximum cost estimate on data processing by Findata.
We will forward these estimates to the applicant before making a decision on the data request. The final price of the statistical data will be confirmed after the data is disclosed, but it cannot exceed the maximum cost estimate. A separate processing fee is charged for any expired and negative decisions.
You’ll find more information on costs on our Pricing page
Data request decisions pricing
| Price category | Criteria | Price |
|---|---|---|
| Data request for a thesis | A data request is related to a thesis for an applicant who is domiciled in Finland or another EU or EEA country. If the project produces several theses or other outputs not related to the thesis, this is a normal or extensive information permit. | 250,00 EUR VAT +0 % |
| Data request | All other data requests. | 2 500,00 EUR VAT +0 % |
