Use a data request to apply for statistical, anonymous data. Statistical data accessed with a data request is sent to the customer. The same data protection requirements do not apply to its analysis as to the analysis of data on individuals.
We are legally responsible for all data requests regardless of whether the request is for data from one or numerous controller.
If you have already made a data request, the data extracted for that data request can be used for a new analysis without a new extraction fee. In this case, we will only charge you the fee for the decision concerning the data request and the fee for processing the data. We keep the data for six months after their release, which means that you must submit a renewal request within six months of receiving the data.
Please read the Permits web page before sending a data request. The page includes useful information to take into consideration before applying, while applying and after applying.
What to remember before sending an application
Select the correct application type
There are different types of applications for different information needs
- Data permit application, when you need data on individuals
- Data request, when you need statistical data
- Amendment application, when you are applying for an amendment to a valid data permit
Describe and limit data
Define the data to be applied for at the variable level and remember the principle of minimisation for other information. Utilise the Data Catalogue (aineistokatalogi.fi) and controller’s advisory services
- Where from and how do I extract the target group? Is the definition specific enough?
- Are control subjects/relatives extracted? How will they be defined?
- From which registers will the data be extracted?
- What variables will be included in the extraction?
Other data to be combined
- Have you made sure that the other data is described on the application?
- Are the permits for other data valid or is the permit process pending?
Determine the competent authority
Findata is responsible for the application and the permit decision whenever data are combined from data controllers covered by the Act on secondary use of health and social data. The assessment of the competent authority must therefore consider all the data related to the application.
Check from the application assistant which authority the application should be sent to.
General information on data requests
Read up on the general principles that apply to data requests, such as what is confidential and what is public.
Data requests and their attachments are confidential. We will forward all the necessary information for the extraction of data and the formation of a target group, as well as information on the applicant and their contact details to the controller.
The decisions and permits granted by an authority are primarily public. On our website, we will publish the following information on projects that have received favourable data request decisions:
- date of decision
- decision recipient (organisation)
- project name
- a brief description of the intended use for the data.
- purpose of use pursuant to the Act on Secondary Use
This public data can be shared from the website also to other communication channels.
At the moment, we produce either aggregated statistical data in table format or key figures. This information is extracted from a controller at the individual level in accordance with the request, after which we will form anonymous data from them.
Data request application and attachments should include a detailed description of how requested statistics are formed and what kind of statistics tables are created. The content of a data request cannot be changed after a decision on the data request has been made.
It is good to note that the implementation of anonymisation will impact the information content of the ready result, and the production of anonymised results is not possible in all situations, such as for a very small target group.
LOGGING INTO E-SERVICES
To submit a data permit application, log into our e-service at: asiointi.findata.fi using either Suomi.fi e-Identification or Haka login. For more information on logging in see the Logging into services page.
Always log in using the same identification methods, so that you can see the applications you have sent and the decisions that have been given.
Data permit applications can be submitted in Finnish, Swedish or English
After logging in
- Go to the Data Catalogue tab
- Go to “Apply for new access rights” and select “Data request: Statistical data” by clicking on “Add to basket” on the right and continue by clicking on “Apply”
- Complete the application form utilising the instructions given below and send it to us. Unfortunately, after an application has been sent, it can no longer be edited. If you want to supplement an application that has already been sent, send us an email to info@findata.fi and tell us your application’s ID (e.g. 2022/53). We will return the application so you can supplement it.
See also:
Dates of monthly maintenance outages in 2023
- 23.2.2023
- 3.-6.3.2023 additional outage
- 23.3.2023
- 20.4.2023
- 25.5.2023
- 22.6.2023
- 20.7.2023
- 17.8.2023
- 21.9.2023
- 19.10.2023
- 23.11.2023
- 21.12.2023
At the moment, we produce either aggregated statistical data in table format or key figures. This information will be extracted in accordance with the request at the individual level from the controller, after which we will form anonymous data from it.
It is good to note that the implementation of anonymisation will impact the information content of the ready result, and the production of anonymised results is not possible in all situations, such as for a very small target group.
Instructions for submitting a data request
1 Public information about the data request or the project
- Name of the data request or the project
- The name of a project that has been granted a positive data request decision is published on Findata’s web pages. Write the project name so that it does not contain any confidential information.
- A short description of the purpose for which the data will be used
2 Details of the applicant
- Applicant means an organisation or a person who has submitted a data request. Enter the contact person’s information in the “Details of the contact person” section.
- Enter the applicant’s business ID. If the applicant is an individual, enter 123 in the field. If the organisation is located in an EU/EEA country other than Finland, name the official register in which the organisation is registered.
3 Details of the contact person
- Contact person refers to the person who responds to enquiries concerning the application. The contact person’s details can be forwarded to the controller during the processing of an application if additional information is required for defining the data extraction.
- Describe the relationship between the contact person and the applicant in the application. The relationship can be based on, for example, an employment or a public service appointment.
4 Invoicing details
- E-invoice is always the primary method of invoicing. If the invoiced party is different from the applicant, indicate the connection of the invoiced party to the project in the application.
- If necessary, ask your organisation’s financial administration for more information.
- Invoicing details for Finnish payers:
- E-invoicing is the primary invoicing method for Finnish payers. In your application, state the connection between the invoiced party and the project. Inconsistencies between the applicant and the invoiced party (e.g. the payer is not the applicant) can be clarified where necessary in the Additional information section.
- If necessary ask for more information from your organisation’s financial department. You can also search for e-invoice addresses on the TIEKE Finnish Information Society Development Centre website: https://verkkolaskuosoite.fi/. A list of e-invoicing addresses is maintained by Finnish e-invoice operators.
- A VAT number is formed from a business ID e.g. 1234567-8. Add the two letter country code FI to its beginning and remove the hyphen from the ID e.g. FI12345678.
- Invoicing details for foreign payers:
- If the payer is not Finnish the payer should have a Peppol-address for the e-invoicing.
- If the payer doesn’t have a Peppol-address, the invoice is sent by mail. In case the payer prefers it being sent as an email the email address used for this should be mentioned during the application processing.
5 Purpose of data use
- The application should provide an overall picture that corresponds with the stated data use, which is pursuant to the Act on the Secondary Use of Health and Social Data.
- The requested information content should match the purpose of processing personal data.
- A thesis must be at least the final assignment for a Bachelor’s degree. The reduced decision price for theses only applies to individual theses. If the thesis is produced as part of a larger project or a project results in a number of theses, this is not the thesis work referred to in the Findata application and should be marked down as a research project.
Purposes of data use:
Development and innovation operations
Development and innovation operations refers to application and use of technical and business data and other existing data together with the personal data referred to in the Secondary Data Act for the purpose of developing new or significantly improved products, processes or services.
In addition, the purpose of the operations must be to
- promote national health or social security
- develop social welfare and health care services for service systems
- protect individuals’ health or well-being or
- secure for them their related rights and freedoms.
Knowledge management
Knowledge management refers to the processing of data carried out by a service provider in their customer, service and production processes for the purpose of supporting
- operations, production and financial control
- management and
- decision-making.
Education
When data is to be used for education, the applied for data will be used to prepare teaching materials for personnel and persons studying to become social welfare and health care personnel who process customer data and social welfare and health care professionals. Please note: Data containing identifiers can only be used in teaching situations if teaching cannot be carried out anonymously due to the exceptional nature of the case, the nature of teaching or a similar reason. The person providing teaching must inform their students of the confidentiality provisions in legislation and the sanctions resulting from their violation.
Planning and reporting duties of an authority
As a rule, only an authority may carry out the planning and reporting duties of an authority. If an authority does not act as the applicant in a data permit application, the authority must be the controller of the data. As a rule, when work is commissioned, the commissioning party will be the processor of personal data.
Scientific research
When data is to be used for scientific research, attach an up-to-date research plan and a research permit from the responsible/target organisation to your application. Also attach an opinion from the Ethics Committee, if the legislation applying to the research and/or the research setup so requires.
Criteria for scientific research (in general):
- an appropriate research plan
- responsible person or group
- results to be published as a scientific publication
- research produces new information.
Statistics
When data is to be used to form statistics, state in the application which party will compile the statistics and for what purpose.
6 Description of the data request
- The content of a data request must comply with the purpose described above. A data request description must be so detailed that it can be implemented merely on the basis of the information provided in the application and its appendices.
- Justify and describe how the contents of the requested statistics and the variables used in them correspond to the purpose of use stated in the application and meet your data requirements.
- Also indicate whether it is a one-off extraction or recurring.
6.1 Defining the extraction criteria for the target group
- Describe the formation of the target group of the application clearly enough and delimit the target group according to the intended use.
- Pay special attention to which registers the target group is extracted from, and the inclusion criteria for the target group.
- For example, a geographic area location may refer to a place of residence, a place of birth, a place of work, or a place of use of services.
- Define the formation and criteria of the target group using the extraction description form (download Word-file, 51,2 kb). Download and fill in the form according to the instructions.
6.2 Extraction description and compilation of statistics
- Provide this information using the extraction description form (download Word-file, 51,2 kb). Download and fill in the form according to the instructions. Contact the controllers of the register directly and go through the extraction description with the controllers before submitting your application. The controllers will also give an estimate of the costs of the extractions. Note that even if you do not receive cost estimates from the registrars in advance, you can still send your application and the extraction description form to Findata.
- Describe the statistics generation in the tabulation plan: the tabulation plan (download Excel-file, 19,2 kb). Follow the instructions to fill in the form.
7 Additional information and attachments
- You can give more details in this section on all the application’s previous sections, such as invoicing.
- If your application is linked to a previous data request processed by Findata, provide the diary number of the previous data request decision
- If you have discussed in advance with Findata or the data controllers, indicate the names of the persons with their organisation information here.
- Add possible attachments.
- Note! Do not attach data to the application.
8 Confirmation of information
- A fee will be charged for the decision in accordance with the decree valid at the time. In addition, the costs of the controllers for extracting and delivering the data, and the data processing fees by Findata are included in the final costs.
- See the up-to-date price list at Pricing. Findata and controllers reserve the right to alter their charges.
How to expediate the processing of your data request
The application processing time will be affected by the content of the application (in particular, the accuracy of the data request description), the current application processing situation and controllers’ response times. If there are any ambiguities related to your application, contact the controller directly and Findata’s advisory service to expediate processing
You can expediate the processing of your application:
- Complete the application carefully.
- Determine the information need and the register-specific data extractions as accurately as possible before sending the request. Submit an empty sample table for each of the statistics you have requested so that the row and column variables are clearly marked.
- Contact controllers directly if you need more information about the data or variables. In accordance with the Act on Secondary Use of Data, data controllers provide advisory services concerning their own data and are the best placed to do so. For more information, see the Data page. You can also utilise the Data catalogue.
Processing of the data accessed via a data request
A data request can only be used to acquire a ready analysis, the results of which are aggregated data. We deliver the data in CSV format (semicolon as separator, UTF-8 encoding). At the moment, we produce either aggregated statistical data in table format or key figures. This information will be extracted in accordance with the request at the individual level from the controller.
Findata will derive the results from individual-level information, which will then be anonymised before they are sent to the customer. Please note that the implementation of anonymisation will impact the information content of the ready result. The production of anonymised results is not possible in all situations, such as for a very small target group.
How is anonymisation implemented?
Anonymisation is implemented in this context by using threshold five as the sensitivity rate. In this case, aggregated information must be computed at least on the basis of information on five people. This applies to both statical data in table format and key figures.
For example, If a single cell in aggregated statistics in table format contains a number based on the information of less than five people, the data must be edited to reduce the risk of identification.
In the case of the implementation of anonymisation as statistical data in table format information is rendered down to a general level when this is possible taking into consideration the use of the results. Blacking out of cells meaning the removal of values is applied if rendering down to a general level does not provide an anonymised result.
Blacking out includes both the primary covering of sensitive data that is at risk of being exposed and supplementary blacking out. Supplementary blacking out prevents sensitive values from being determined on the basis of possible marginal sums. When implementing anonymisation, the possibility of a group’s information being exposed is reviewed in situations where all the people in a certain group are given the same (sensitive) variable value.
Information on costs
A fee is charged for the decision concerning the data request and for the compiled statistical data. The price of the Findata service comprises the price of the decision and an hourly fee, which will be determined according to the working hours spent on combining and processing the data.
In addition to the fees charged by Findata, the final price is affected by the data extraction and delivery fees based on decrees concerning the controllers.
When we process a data request, we will ask the controller for a maximum cost estimate for extracting the necessary data. We will also give a maximum cost estimate on data processing by Findata.
We will forward these estimates to the applicant before making a decision on the data request. The final price of the statistical data will be confirmed after the data is disclosed, but it cannot exceed the maximum cost estimate. A separate processing fee is charged for any expired and negative decisions.
You’ll find more information on costs on our Pricing page
Data request decisions pricing
| Price category | Criteria | Price |
|---|---|---|
| Data request for a thesis | A data request is related to a thesis for an applicant who is domiciled in Finland or another EU or EEA country. If the project produces several theses or other outputs not related to the thesis, this is a normal or extensive information permit. | 250,00 EUR VAT +0 % |
| Data request | All other data requests. | 2 500,00 EUR VAT +0 % |
