Legislation

What is the Secondary Use Act?

The Secondary Use Act is a separate act which is officially called the Act on the Secondary Use of Social and Health Data. The Parliament passed the Act at its plenary session on 13 March 2019 and the President approved it on 26 April 2019.

The objective of the Secondary Use Act is to enable efficient and secure processing of personal data collected during the provision of social and health care as well as personal data collected for the purpose of steering, supervision, researching and collecting statistics within the social and health care sector. The Act also seeks to secure the legitimate expectations, rights and freedoms of individuals when processing personal data.

Find out more about the Secondary Use Act (in Finnish):

• Up-to-date legislation: Act on the Secondary Use of Health and Social Data, 552/2019 (finlex.fi)
• Information on the Parliament website on the processing of the Act (eduskunta.fi)

How does the Secondary Data Act improve data protection?

In Finland, social welfare and health data have been used for secondary purposes for decades. Previously, the use of the data has been authorised by an individual controller, the Ministry of Social Affairs and Health or the Finnish Institute for Health and Welfare, and there has been no uniform practices for the processing of data.

The new, centralised authorisation procedure and processing of data will improve data security and citizens’ data protection. The secure, closed Kapseli user environment has been built to serve the work of Findata. When the data is compiled in a centralised manner, its use is better protected and more efficient.

The Secondary Use Act (552/2019) has been drawn up based on the national-level freedom of action provided for by the EU’s General Data Protection Regulation (GDPR). The Constitutional Law Committee and the Social and Health Committee have taken care to ensure that the Secondary Use Act does not contravene the GDPR. Representatives of the Office of the Data Protection Ombudsman have participated in the drafting workgroup for the Act, and the Data Protection Ombudsman has also been given a hearing by the Parliament.

The Secondary Use Act sets the conditions for a data secure environment in which permit holders may process data.

• Primarily, the data is disclosed to the individuals marked in the data permit via a remote access connection and in such a way that the data remains within the Findata data secure user environment.
• In some cases, however, there is no alternative to handing the data over to the permit holder. Disclosure by means other than use of Kapseli is only possible if the operating environment in question has been audited and its data security has been verified in accordance with the Secondary Use Act.

The Secondary Data Act requires that the Information Systems record log data, which means the processing and event history of the data. The log shows, for example, who processed the data, how the data was processed, and when the data was processed. Log data is collected for the work done by data-processing authorities, data controllers, and those processing the data based on a data permit.

How is the implementation of data protection monitored?

Authorisation to process data for purposes permitted by the Secondary Use Act is given through an official decision made by Findata or another authority referred to in the Secondary Act. The decision is legally binding and includes the terms of the permit, the data to be processed, the persons entitled to process the data and the processing environment.

Findata’s operations and the operations of other controllers that issue data permits are supervised by, among others, the Parliamentary Ombudsman, and processing of personal data is monitored by the Data Protection Ombudsman. Findata and other authorities that grant data permissions also have the right to request a statement from the Data Protection Ombudsman before granting the data permit.

Those issuing data permits must give an annual report to the Data Protection Ombudsman regarding the processing of health and social data and the related log data.

The National Supervisory Authority for Welfare and Health Valvira monitors data secure user environments.

What can personal data be used for?

Finland has, for a long time, collected unique register and research data that can be used to promote the health and welfare of citizens.

Secondary use of health and social data means that client and register data of social welfare and health care activities is used for purposes other than the primary purpose for which it was originally stored. Primary purposes relate to, for example, treatment provided to a patient or the processing of benefits.

The Secondary Use Act lays down the uses for which authorisation may be granted. According to section 2 of the Act, data may be disclosed for the compilation of statistics, scientific research, development and innovation activities, education, knowledge management, steering and supervision of social and health care by authorities and the planning and reporting duty of an authority. Information can be obtained only for these permitted purposes.

Social and health data have been used for secondary purposes also before the introduction of the Secondary Act. Prior to the Secondary Use Act, corresponding information has been disclosed for scientific research, statistics and educational use, and the permit has been issued by an individual social welfare and health care authority or, if the data has been gathered from more than one location, by the Ministry of Social Affairs and Health and, later, by the Finnish Institute for Health and Welfare (THL).

Individual public data controllers will also continue to be competent to grant permits and provide data in certain cases. You can read more about permit authorisations on the  Permits page under Which authority should a permit application be submitted to?.

You can find more information on how Findata processes personal data in the Personal data processing statements.

What are the sources of the data?

Findata does not itself possess the personal data but rather collects it from social and health care sector operators and authorities regulated by the Secondary Use Act. The Secondary Law also regulates what kind of data the permit applicant can receive.

You can find a general description of the social and health care data available through Findata on the Data page. Furthermore, Findata does not collect data from individuals themselves. Instead, all the data it processes is received from the registers of operators regulated under the Secondary Data Act.

Key concepts

See also: