Legislation

A social and health care regulatory or supervisory authority may request aggregated statistical data from Findata by means of a data request if it needs data under the Secondary Use Act in order to carry out its steering or supervisory task.

Upon reasoned request, the data may also be provided in identifiable form if the supervisory authority is entitled to receive them under other legislation, irrespective of confidentiality obligations.

Secondary purpose of personal data refers to the processing of personal data for a purpose other than its primary purpose. The secondary purposes permitted under the Act are

• scientific research
• statistics
• development and innovation operations
• education
• knowledge-based management
• steering and supervision by authorities and
• authorities’ planning and reporting duties.

In statistical data, individual personal data is combined and added together. Statistics describe groups of individuals rather than particular individuals. The data for these groups is formed in such a way that the individuals cannot be identified.

A data request is a request to obtain aggregated statistics created from personal data for use in accordance with the Secondary Use Act. Any request for information under the Secondary Use Act must to submitted to Findata.

A data permit is a permit issued in accordance with the Secondary Use Act for the processing of the secret personal data specified in the permit for the purpose described in the permit.

Findata is the data permit authority for the social and health care sector which makes data permit and data request decisions regarding the data of other controllers. Findata is responsible for the gathering, combining, previewing and disclosing of data for secondary use in accordance with the decisions it makes.

Findata also monitors compliance with the conditions of the permits it issues. It may cancel the data permit if the permit holder either fails to comply with the law or violates the conditions of the permit.

Data utilisation plan refers to a research plan, project plan or similar plan.

The plan must detail

• the intended purpose of the data referred to in the permit application
• the controller and processors of the data
• the legal ground for the processing and

the essential elements of data protection and data security related to the processing throughout the life-cycle of the data (data storage, erasure or archiving)

Individual, community, institution or foundation

• for which the person register was established and
• has the right to determine the use of the person register

or

• has the legal duty of maintaining the register.

Data utilisation plan

Data utilisation plan refers to a research plan, project plan or similar plan.

The plan must detail

• the intended purpose of the data referred to in the permit application
• the controller and processors of the data
• the legal ground for the processing and
• the essential elements of data protection and data security related to the processing throughout the life-cycle of the data (data storage, erasure or archiving)

A social and health care service provider that has an obligation as an authority to ensure that the customer gets the service of benefit that is due to them based on the law or an official decision. The obligation of a private service provider is to ensure that the customer who purchases the service privately is provided with the service that is due to him or her under the regulations on customer protection.

Personal data refers to all data which refer to an identified or identifiable individual.

The primary purpose of the customer data is the purpose for which the data was originally saved in the customer register and/or patient register. The primary purpose may be, for example, examination, treatment and rehabilitation of the patient, the service received by a social welfare customer, or the processing of benefits by the Social Insurance Institution of Finland (Kela).

By law, customer data is confidential personal data covered by the General Data Protection Regulation which has been stored in a customer register or an associated administrative register as a result of social and health care customership or for processing of benefits.

Aggregation is a statistical procedure through which data is combined and added together. Aggregated data describes a group of individuals rather than one particular individual. The data for these groups is formed in such a way that the individuals cannot be identified.

Knowledge management refers to the processing of data carried out by a service provider in their customer, service and production processes for the purpose of supporting

• operations, production and financial control
• management and
• decision-making.

Development and innovation activities refer to application and use of technical and business data and other existing data together with the personal data referred to in the Secondary Data Act for the purpose of developing new or significantly improved products, processes or services.

In addition, the purpose of the activities must be to

• promote national health or social security
• develop social welfare and health care services for service systems
• protect individuals’ health or well-being or
• secure for them their related rights and freedoms.

A data permit is a fixed-term authorisation granted by a public authority to use individual-level personal data for a specific purpose, for example, for research, compiling statistics or carrying out official duties.

Once a data permit is granted, the dataset is delivered to the processor in a pseudonymised format. This means that identifying information has been replaced with codes, so individuals cannot be directly identified. The data may only be processed in a secure processing environment with no direct internet access.

Data permits are particularly important in registry-based research, where data originally collected in social and healthcare client or patient registers is used for secondary purposes.

Read more:

• Data permits
• Conditions of data permit

Findata is the social and health data permit authority in Finland. It was established in 2019, and its operations are based on the Act on the Secondary Use of Health and Social Data, commonly known as the Secondary Use Act.

We grant data permits for the secondary use of health and social data when the data is needed from multiple public data controllers, from the private sector, from Findata’s ready-made datasets, or from the Kanta Services. We compile and preprocess the datasets with strict attention to protecting individuals’ privacy.

Findata also maintains the secure Kapseli® processing environment, where individual-level data is processed safely.

• Findata as an organisation
• Act on the Secondary Use of Health and Social Data (PDF file, 5.4 mb).

When we grant a data permit, we provide pseudonymised individual-level data. This means that, for example, names and personal identity numbers are replaced with codes, so the data cannot be directly linked to individuals. We only release identifiable data for particularly justified and necessary reasons.

Pseudonymised data is still personal data. It may only be processed in a secure environment with no direct internet access. The data permit holder or data processor commits to conditions that prohibit attempts to identify individuals from pseudonymised data.

The data processor must produce published results in an anonymous form, from which individual persons or their characteristics cannot be identified. Findata ensures that the results meet the anonymity requirements set out in the Secondary Use Act.

If the permit concerns statistical-level data (data request), we provide anonymous data that describes population groups rather than individuals. Statistical data cannot be traced back to or used to identify individuals.

Read more:

• Permits
• Conditions of data permit

The secondary use of social and health data is only permitted for purposes defined by law, such as:

• Education
• Scientific research
• Statistics
• Planning and reporting duty of an authority
• Development and innovation activities
• Knowledge management
• Steering and supervision of social and health care by authorities

Different types of data are available for different purposes:

• Individual-level, pseudonymised data is available for research, statistics, planning and reporting tasks of public authorities, and education.
• Anonymous, aggregated statistical data is available not only for the above-mentioned purposes, but also for development and innovation activities, knowledge management, and the steering and supervision of social and healthcare services.

In addition, wellbeing services counties and other service providers may use the data recorded in their own registers without a separate permit for purposes such as planning and evaluating their operations.

All data permit and data request decisions made by Findata are public. You can view them here: Issued permits

Findata grants permits for the use of register-based data collected from various sources. This refers to information stored in registers maintained by public authorities, private service providers or other data processors.

Information about every Finnish resident is collected in different social and healthcare registers. In Finland, this data can be used for secondary purposes – for example, research aimed at improving public health and wellbeing.

We grant permits when data is needed from several public data controllers, private operators, Findata’s ready-made datasets or from the Kanta Services. Some data controllers have authorised Findata to issue permits on their behalf.

All permits comply with the data minimisation principle under the EU General Data Protection Regulation (GDPR): a permit can only be granted for data that is clearly and justifiably necessary for the stated purpose.

Before any data is released, it is pseudonymised. This means that directly identifying information – such as names or personal identity codes – is removed or replaced with a unique code, so that individuals cannot be directly identified.

Read more: Data

The law does not specifically restrict who can apply for a permit to use social and health data. However, Findata does not grant permits to just anyone or for any purpose. A permit can only be issued for the purposes defined in the Act on the Secondary Use of Health and Social Data and for projects that meet the legal criteria for approval.

Each permit application is assessed individually. Before a permit is granted, the application undergoes a careful review. Under the EU General Data Protection Regulation (GDPR) and the data minimisation principle, a permit can only be granted for the use of data that is essential for the execution of the project.

Data permits are official administrative decisions. The decision process has two stages: the application handler acts as the presenter, and the Director of Findata or their deputy makes the final decision. The proposed decision does not always lead directly to a permit being granted: sometimes the application is returned for further preparation or requires modifications.

Read more: Conditions of data permit

The secondary use of health and social data is governed by several laws that safeguard data protection and define the conditions under which the data may be processed.

The EU General Data Protection Regulation (GDPR) establishes the general principles for processing personal data across the EU. It is complemented by national legislation, such as the Act on the Secondary Use of Health and Social Data (the “Secondary Use Act”), which specifically regulates the secondary use of health and social data in Finland.

The Secondary Use Act centralises the issuance of data permits to Findata and defines in detail the permitted purposes for data use as well as the requirements for data security and oversight.

In the coming years, the European Health Data Space (EHDS) regulation will harmonise the use of health data and permit procedures for secondary use across the EU. EHDS will strengthen individuals’ rights to their data and promote the secure and efficient cross-border use of health data. The provisions concerning secondary use will apply starting in March 2029.

Other key laws include:

• Data Protection Act (Tietosuojalaki)
• Act on the Processing of Client Data in Healthcare and Social Welfare
• Medical Research Act
• Clinical Trials on Medicinal Products for Human Use Act
• Act on the Medical Use of Human Organs, Tissues and Cells
• Biobank Act

Read more:

• Legislation
• European Health Data Space (EHDS)
• Act on the Secondary Use of Health and Social Data (PDF file, 5.4 mb).

The secondary use of health and social data means using already collected client and patient data for purposes other than their original use, such as research, statistics, and service development.

When researchers, authorities and service providers are able to use reliable and comprehensive register data, it generates information that support decision-making and improve the quality of services. This leads to several concrete benefits for citizens:

• Better services and more effective care
  • Data can be used to develop health and social services that better meet people’s needs.
• More effective medicines and health technology
  • Extensive registry data supports medical research and the development of new treatments. It also enables the creation of health-promoting applications and supportive technologies.
• Safer and more agile tools for supervision
  • Data can be used to monitor, for example, adverse effects of medicines and to improve oversight in healthcare.
• Smoother service processes
  • Data enables the development of service systems that are more efficient and customer-oriented.
• Promoting public health and reducing wellbeing gaps
  • Research-based information supports legislation and policymaking, helping to promote health and reduce inequality.

The secondary use of health and social data is strictly regulated. Citizens’ privacy is protected through measures such as pseudonymisation and secure processing environments.

See what types of projects Findata has granted permits for: Issued permits

The Act on the Secondary Use of Health and Social Data (also known as the Secondary Use Act) strengthens the protection of personal data by clearly defining how and under what conditions health and social data can be used for purposes other than their original use, such as research and statistics.

Prior to the implementation of the Secondary Use Act in 2019, the processing of data involved several risks:

• Permit applications were not centralised
  • Permits were granted by individual data controllers, the Ministry of Social Affairs and Health, or the Finnish Institute for Health and Welfare (THL). Practices varied, and there was no consistent process.
• Data could be transferred on physical storage devices
  • Datasets were sometimes delivered directly to permit holders via USB sticks or CDs. This made it impossible to ensure data security or monitor how the data was used.
• There was no way to monitor data usage afterwards
  • There was no way to track whether datasets had been deleted after the permit expired.

The Act has enhanced data protection in several key ways:

1. Centralised permit process at Findata
   • Under the Act, all data permits are issued by Findata, the Finnish Health and Social Data Permit Authority. This has improved both data security and the protection of personal data.
   • Centralised data combining ensures safer processing and enables more effective oversight.
2. Pseudonymisation of datasets
   • Datasets issued under the Act are pseudonymised, meaning direct identifiers are removed before the data is delivered to the permit holder.
   • Pseudonymisation prevents the direct identification of individuals.
3. Secure processing environment
   • Data may only be analysed in a secure processing environment that has no direct internet access. These environments offer strong safeguards:
     • Only users named in the permit may access the data
     • Users log in using two-factor authentication
     • External data cannot be uploaded to the environment
     • Data cannot be exported without Findata’s review
     • Access to the data is terminated once the data permit is no longer valid
4. Enhanced oversight
   • Findata’s operations are overseen by the Parliamentary Ombudsman and the Data Protection Ombudsman
   • Findata may request a statement from the Data Protection Ombudsman before granting a permit
   • Findata submits an annual report to the Data Protection Ombudsman on the processing of social and health data and related logs
   • Finnish Supervisory Agency monitors the security of the processing environments

Several authorities supervise Findata’s operation to ensure that the granting of data permits and the processing of data are carried out in accordance with the law.

• Data Protection Ombudsman
  • Supervises the processing of personal data and ensures that Findata complies with data protection legislation.
  • Receives an annual report from Findata on the processing of social and health data and the related log data.
  • May issue statements at Findata’s request before a data permit is granted.
• Parliamentary Ombudsman
  • Oversees the lawfulness of Findata’s activities.
• Finnish Supervisory Agency
  • Supervises the secure operating environments where data granted by Findata are processed.

In addition, Findata’s operation is guided and developed by a steering group appointed by the Ministry of Social Affairs and Health (STM). The group includes representatives from STM and various data controllers.

When you object to the secondary use of your data through Findata:

• Your request is recorded in the case management system maintained by the Finnish Institute for Health and Welfare (THL).
• Your data will be removed from datasets received by Findata based on your personal identity code. Therefore, we must retain and process your personal identity code to implement the request.

The European Health Data Space (EHDS) is a regulation of the European Union that establishes a common framework for the use and exchange of health data in EU countries. The aim of the regulation is to strengthen citizens’ rights to their own electronic health data and to enable the secure cross-border secondary use of health data.

The EHDS regulation is similar to the current Finnish Secondary Use Act, but it also introduces changes. The regulation includes partly different purposes of use, some of which are reserved only for public or EU entities. In addition, new operating models will be introduced for processing data requests and permit applications.

The regulation entered into force in March 2025 and will be implemented gradually over the coming years. The parts concerning secondary use will begin to apply in March 2029.

Findata’s legal basis for processing personal data are:

• Article 6, (1)(e) of the EU’s General Data Protection Regulation: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• Article 4(1)(2) of the Data Protection Act: processing of data that is provided for by the law or that is directly attributable to the controller for the task prescribed by the law

We also process data belonging to special categories of personal data, formerly known as sensitive data. Such data includes, for example, a person’s health data.

The grounds for processing this kind of personal data are:

• Article 9(2)(g) of the EU General Data Protection Regulation: processing is necessary for the performance of a task carried out in the public interest or the exercise of public authority
• Section 6(1)(2) of the Data Protection Act: processing is necessary and proportionate for the performance of a task carried out in the public interest by a public authority

See more information on how we process personal data

Anonymisation means the transformation of personal data into a form that irreversibly prevents the identification of an individual person. This may mean, for example, removing direct identifiers and simplifying the data to a general level so that personal data cannot be reconstituted in any way.

Pseudonymisation refers to the transformation of personal data, for example into a coded form. In this case, names and personal identifiers can be removed and replaced by another unique identifier, i.e. a code. Often a code key is kept to restore direct personal data to the data. Pseudonymised data are still personal data.

Findata grants most permits to projects based in Finland. However, under the EU General Data Protection Regulation (GDPR), personal data must be able to move freely within the EU. This means that the permit holder may also be located in another EU or EEA country. Even in such cases, the data must be processed in an audited and secure environment, with access granted only to the individuals specified in the permit.

According to the Secondary Use Act, the secure processing environment must not be located outside the EU or EEA. Therefore, Findata does not, as a rule, transfer personal data outside the EU/EEA or to international organisations.

If data is to be transferred to or processed in countries outside the EEA (so-called third countries) a legal basis is required under Chapter V of the GDPR. It is important to note that processing personal data from outside the EEA is considered a data transfer, even if the data remains in a secure remote access environment.

Read more:

• Transfer of personal data outside the EU/EEA
• Regulation on secure processing environments
  

Findata does not sell data. As the data permit authority, we grant fixed-term permits for the secondary use of social and health data only when the conditions set out in the Act on the Secondary Use of Health and Social Data are met.

Each permit is granted for a specific purpose, and it defines which individuals are allowed to process the pseudonymised dataset. Those who process the data must produce analysis results in anonymous form, so that no individual’s information or characteristics can be identified.

Findata is responsible for ensuring the anonymity of results, in accordance with the Secondary Use Act. This applies to all datasets covered by a permit.

When the permit expires, the permit holder’s access to the data is revoked and the dataset is destroyed.

Read more: Conditions of data permit

Everyone has the right to their personal data, including the right to object to the processing of their data. Once you submit an objection request, Findata will no longer disclose your data for secondary use.

• The objection is valid indefinitely from the date it is processed.
• The objection is not retroactive: your data will not be removed from data resources that have already been disclosed to permit holders before the objection was submitted.
• You can submit the objection request via Findata’s e-service, by post or by visiting the Finnish Institute for Health and Welfare (THL) in person.

Instructions on how to exercise your rights: Your data rights

Please note that an objection submitted to Findata does not prevent other data controllers listed in the Act on the Secondary Use of Health and Social Data from disclosing your data for secondary purposes.

There is currently no centralised system in Finland that would allow you to object to the secondary use of your data in a way that would be binding on all controllers. Therefore, objections must be submitted separately to each controller.

• Read more: What data do my rights cover?
• Information on data controllers and the contents of their registers: Data
• Guidance from the Office of the Data Protection Ombudsman on how to object to the use of your data: If you do not want your data processed (tietosuoja.fi)

Primary use means the purpose for which the data was originally saved in the customer register and/or patient register.

The primary purpose may be, for example,

• examination, treatment and rehabilitation of the patient,
• the service received by a social welfare customer,
• or the processing of benefits by the Social Insurance Institution of Finland (Kela).

Secondary use means the use of the same data for purposes other than the primary use.

Legitimate secondary purposes of use include

• scientific research,
• statistics,
• development and innovation activities,
• education,
• knowledge management,
• steering and supervision by authorities and
• the planning and reporting duty of an authority.

Different purposes of use are subject to different regulations. Only aggregated statistics from which individuals cannot be identified may be obtained for development and innovation activities.