After the first of April 2020, what happens to queued applications or applications whose processing is underway by a controller listed in Section 6 of the Act on the Secondary Use of Health and Social Data (552/2019)?
As of 1 April 2020, Findata is the only competent authority that can issue permits for the secondary use of health and social data when the data is compiled from more than one controller.
If the application concerns data from only a single controller, and the purpose is not to combine the data to data from other controllers, the individual public sector controller remains competent to issue the permit also after 1 April 2020.
A case-by-case description of procedures in different situations is provided below.
1. The data permit application was filed before 1 May 2019
In accordance with the transitional provisions laid down in the Act on the Secondary Use of Health and Social Data, the processing of all applications filed with separate controllers before the act entered into force, i.e. before 1 May 2019, will be completed by the individual controllers.
This means that if the application was filed before 1 May 2019, each controller provides a decision concerning the application as well as extracts and delivers the data even if the processing of the application was not commenced by 1 April 2020.
Example: A researcher applied for data from HUS, Kela and THL in February 2019 with the purpose of combining the data for analysis. They have not yet received all data permit decisions or data.
Procedure: HUS, Kela and THL individually complete the processing of the applications filed with them and deliver the data to the researcher similarly as before.
2. The data permit application was filed after 1 May 2019, and a decision has been made, but the data has not been delivered by 31 March 2020
Even though the data permit application was filed after the Act on the Secondary Use of Health and Social Data entered into force, the processing of the application may be completed by an individual controller if the decision for the application was provided at the latest on 31.3.2020. In that case, the data is delivered to the client in accordance with the permit also after 1 April 2020.
The interpretation is based on observing the permit applicant’s legal protection and legitimate expectations as well as good governance: the applicant must be able to rely on the fact that the administrative decision is final.
Example: A researcher applied for data from HUS, Kela and THL in June 2019 with the purpose of combining the data for analysis. They have received a permit decision from each of the controllers but all (or any) of the data have not yet been delivered.
Procedure: As before, HUS, Kela and THL deliver the data to the researcher in accordance with their decisions.
3. The data permit application was filed after 1 May 2019, and a decision was not made by 31 March 2020
If the application was filed after 1 May 2019, and a decision was not provided by 31 March 2020, the application must be filed again with Findata via the online application system.
If the purpose is to compile data from more than one controller, Findata will be the only competent authority for issuing the data permit as of 1 April 2020.
The complete application must be filed again with Findata after 1 April 2020 because the Act on the Secondary Use of Health and Social Data obliges Findata to use the data request management system for the reception of data permit applications and data requests. Thus, Findata may not accept old applications from individual controllers for processing.
In addition, clarification or supplementation requests required for the processing as well as any reports, supplements and changes concerning the application delivered to Findata by the applicant are processed using the management system.
If an ethical preliminary assessment of the data utilisation plan is a legal requirement for the intended purpose of use, an ethical assessment is commenced, and the statement will be delivered via the management system.
Example: A researcher applied for data from HUS, Kela and THL in February 2020 with the purpose of combining the data for analysis. The application states that they intend to combine the data. The researcher has received a positive permit decision from HUS, but Kela and THL have not yet provided them with a decision. Data has not been delivered by any of the controllers.
Procedure: HUS delivers the data to the researcher in accordance with its decision as before. With regard to the data held by Kela and THL, the researcher must submit a new data permit application via Findata’s online application system after 1 April 2020.
