Handling of Personal Data in Vantaa Employment Services

The purpose of the processing of personal data is for Employment Services to provide these services. Personal information collected by Employment Services can also be used for planning services and statistics. Vantaa and Kerava are participating in a co-operative municipal employment trial to be held from 1 March 2021 to 30 June 2023. The tasks assigned to the state employment and economic development offices will be transferred during the trial to the municipalities based on the Municipal Trial for the Promotion of Employment Act (1269/2020). The aim of employment trials is to promote the employment and training of unemployed jobseekers more effectively and to bring new solutions to the availability of a skilled workforce. 

We will not use this data for any other purpose, such as direct marketing or commercial purposes.

The processing of personal data necessary for the organization of employment services is based on the Municipal Trials for the Promotion of Employment Act (1269/2020, “Municipal Trials Act”). Statutory services are those tasks in accordance with the Public Employment and Business Service Act (916/2012) which are provided for in the Municipal Trials Act by the pilot municipalities, the interdisciplinary joint service promoting employment TYP, rehabilitative work, and the employment of wage subsidies with the obligation to employ. 

In addition to statutory activities, Employment Services has other employment-promoting services, such as the Vantaa Skills Center, Ohjaamo Youth Services, work practice in rehabilitation work activities, wage subsidy employment for the long-term unemployed, employment services projects, and additional employment grants for companies and organizations, such as summer job vouchers and the Vantaa bonus. The processing of data in connection with these services is based on consent, which is requested in writing with separate permission. Granting consent is voluntary and can be revoked at any time.   

Legal basis for data processing:

• Article 6 (1a) of the EU General Data Protection Regulation (2016/679): The data subject has consented to the processing of his or her personal data for one or more specific purposes.
• Article 6 (1c) of the EU General Data Protection Regulation: processing is necessary to comply with a legal obligation on the registry controller.
• Article 9 (2) (a) of the EU General Data Regulation: The data subject has given his or her explicit consent to the processing of such personal data for one or more specific purposes.
• Privacy Act (1020/2018) Section 6

Key legislation governing operations:

• Municipal Trial for the Promotion of Employment Act (1269/2020) 
• Act on Public Employment and Business Service (2012/916) 
• Rehabilitation Work Act (189/2001) 
• Social Welfare Act (1301/2014)
• Act on the Promotion of Immigrant Integration (1386/2010) 
• Multidisciplinary Joint Service for the promotion of Employment Act (1369/2014)
• Unemployment Security Act (1290/2002)

Only the information necessary for the provision of the service is collected from customers. Depending on the service, this may include, in addition to the person's basic information, such as name, contact information and personal identity number, also data on employment and training history and professional competence. Certain services may also process the customer's social and health information and benefit information if it is necessary for the organization of the service and there is a legal right to it or the customer's consent. Depending on the activity, other data to be collected may include, for example, wage and employment data of wage subsidy employees or attendance data of participants in an activity.  

The information required to provide the service is obtained from the customer as well as the data generated in connection with the service. Depending on the service, an Employment Services employee may also have the right to receive information or update data systems maintained by another authority or another party, such as the client data systems maintained by the TE Administration, the municipal social and health care patient information system (Apotti) and the Social Security Administration’s benefit register. In addition, the information of those employed with wage subsidies is received from the city's personnel register.

Yes. The information is necessary for arranging legally mandated services. Services based on consent cannot be arranged if personal information is not received.

To ensure your privacy, the security and privacy of your personal information is ensured through a variety of technical and organizational measures. For example, personal data may be processed only by those persons who need the data for the performance of their work or official duties and only to the extent required by an individual task. In the client data system, this is monitored, among other things, by using log information. Paper documents are kept in the city’s archives in a safe place that no outsider can access. 

Staff is bound by the obligation of professional confidentiality and will continue to be bound by it also after the end of their employment.

In cases where the processor of personal data handles personal data on behalf of the City of Vantaa, the appropriate level of data security and data protection has been agreed to in an agreement with the processor. A processor of personal data means an entity that processes personal data on behalf of the city, for example a service provider.  

Generally, data will only be processed within the EU or the EEA, but the processor may also transfer data outside the EU or the EEA. However, the transfer is only permitted if it complies with the requirements of data protection law and the agreement that ensure an adequate level of protection of personal data.

It is possible that, despite the protection, your personal data may in exceptional cases be subject to a security breach and in the possession of a third party. In these situations, we will take immediate action to remedy the situation and notify the Data Protection Officer of the breach if the breach poses a risk to you. The notification shall be made no later than within 72 hours of the discovery of the breach. If the security breach poses a high risk, we will also notify you of the security breach.

The data will be stored and destroyed in accordance with the City of Vantaa's data management plan. The retention periods for documents specified in the information management plan are based on legislation, the regulations of the National Archives on documents to be retained permanently, and the recommendations of the Association of Finnish Municipalities on documents to be retained for a specified period. At the end of the retention period, the data will be destroyed.

Data subject means the person whose personal data are being processed. If we are processing your personal information, then you have the right to

• check what data of yours is being processed
• demand the correction of incorrect or inaccurate data
• demand the removal of your data
• demand the restriction of the processing of your data
• object to the processing of your data
• the right to receive your data and transfer them to another registry as well as to cancel the consent you have given at any time if the processing is based on the consent.

If the processing and storage of data is based on a statutory obligation, the data will only be deleted after the statutory deadline. 

When making requests for checking or correction of data, it must be considered that the Employment Service uses several registers maintained by other authorities or other sectors, in which case the request for checking and correction of data must be addressed to the administrators of the register in question.    

A request for checking is made using a separate form, which is available on the vantaa.fi website and Vantaa info offices. If you would like more information about the processing of your personal data or your rights, please contact the contact person listed in section 14 below. The conditions laid down by law for exercising your rights will be verified on a case-by-case basis once your identity has been verified.  

We will execute requests for information without undue delay, but no later than one month after receipt of the request. If necessary, the time limit may be extended by a maximum of two months, considering the complexity of the request and the amount of information. If the deadline is extended, we will notify you.

The exercise of the rights is, in principle, free of charge. However, we may charge a reasonable fee for the execution of the request, equivalent to the administrative cost, or refuse to perform the requested action if the request is manifestly unfounded, unreasonable, or repetitive. If we intend to charge for your request, we will contact you. If we refuse to take the action you have requested, you will be informed in writing of the reasons for the refusal and of the possibility of bringing the matter before the Data Protection Officer or using other legal remedies.

If you suspect that your personal information is being processed unlawfully, you can lodge a complaint with the Data Protection Officer. Further information and instructions on how to make a complaint can be obtained from the contact person mentioned in section 14, the city’s Data Protection Officer, and the website of the Office of the Data Protection Officer and from the telephone guidance number:

Office of the Data Protection Officer / www.tietosuoja.fi
Visiting address: Lintulahdenkuja 4, 00530 Helsinki
Mailing address: PO Box 800, 00531 Helsinki
E-mail: tietosuoja(at)om.fi
Telephone (switchboard): +358 (0)29 566 6700
Telephone (guidance for individuals): +358 (0)29 566 6777

For more information on the processing of personal data, please contact the contact person listed below. Please note that e-mail is not a secure means of handling personal data, so do not e-mail, for example, your personal identity number or sensitive information.

Contact person

Mervi Aalto, planner, Employment Services
firstname.lastname(at)vantaa.fi 
+358 (0)50 302 4956 

Kirsi Tuovinen, planner, Employment Services
firstname.lastname(at)vantaa.fi 
+358 (0)40 487 8676 

The registrar is the City of Vantaa. Contact information for the registrar and the City of Vantaa's Data Protection Officer can be found below:

Registrar

City of Vantaa
Business ID 0124610–9
Asematie 7, 01300 Vantaa

On the part of the Municipal Trial for the Promotion of Employment, on the basis of Section 14 (3) of the Municipal Trial for the Promotion of Employment Act (hereafter ‘Municipal Trial Act’), the City of Vantaa is a joint registrar as referred to in the EU General Data Protection Regulation together with the KEHA Center, the Employment and Economic Development Offices, and other municipalities of the municipal trial for the data referred to in Chapter 13, Section 2 of the Act on Public Employment and Business Services. The City of Vantaa will then be the registrar for the data of its own customers. The inter-municipal responsibility for the tasks of the registrar in the trial areas is determined on the basis of the registered client relationship. The Employment and Economic Development Office, for its part, must ensure that the information it stores about the customer in the municipality of the trial area is accurate and, if necessary, updated when performing certain tasks in the municipal trial, such as issuing certain labor market policy statements. The division of responsibilities between registrars is regulated in more detail in Chapter 13, Section 4 of the Act on Public Employment and Business Services. The KEHA Center is responsible for e.g., the built-in and default data protection of information system services and the data security of the information system used.

The tasks of the controller under the EU General Data Protection Regulation, which are the responsibility of the municipalities in the trial area, include the obligation under Article 28 (1) to use only data controllers who take adequate safeguards to implement appropriate technical and organizational measures to comply with the Regulation. The tasks of the data controller related to the exercise of the data subject's rights, with the exception of the tasks belonging to the KEHA Center, also belong to the municipalities of the trial areas.

On the part of the interdisciplinary joint service promoting employment (TYP), on the basis of Section 9 b of the Interdisciplinary Joint Service Promoting Employment Act (hereafter the ´TYP Act´), the City of Vantaa is a joint registrar of the information referred to in Section 9 of the same Act together with the KEHA Center, Employment and Economic Development Offices, other municipalities, and the Social Insurance Institution. According to Section 9b (2) of the TYP Act, the KEHA Center is responsible for the built-in and default data protection of the customer information system and data set and on the data security of the information system and data set used.

Pursuant to Section 9b (3) of the TYP Act, the municipalities, the Employment and Economic Development Offices, and the Social Insurance Institution are responsible for the data controller's obligations other than those referred to in subsection 2 of the EU General Data Protection Regulation with regard to the data stored in the customer data file. The tasks of the controller under the General Data Protection Regulation, which are the responsibility of the municipalities, the Employment and Economic Development Offices, and the Social Insurance Institution, are, for example, the obligation under Article 28 (1) to use only personal information processors who take adequate safeguards to implement appropriate technical and organizational measures. The tasks of the data controller related to the exercise of the data subject's rights, with the exception of the tasks belonging to the KEHA Center, are also the responsibility of the municipalities, the Employment and Economic Development offices, and the Social Insurance Institution.

Under Article 26 (3) of the General Data Protection Regulation, the data subject may exercise his or her rights under the Regulation in relation to each controller and against each controller, regardless of the division of responsibilities between the joint controllers. This means that the data subject can initiate a case regardless of the mutual division of responsibility between the data controllers. The exercise of the data subject's rights requires that the request or inquiry made to one of the controllers be forwarded, if necessary, to the controller who, according to the division of responsibilities between the controllers, is responsible for the matter. The above applies both to the joint registrar referred to in Section 14 (3) of the Municipal Trial Act and to the joint registrar referred to in Section 9 b of the TYP Act.  

You can find more information about the client's rights and the employment municipal trial for employment on the TE Office website. 

Data Protection Officer
tietosuojavastaava@vantaa.fi

Registry
Mailing address: PO Box 1100, 01030 City of Vantaa
Visiting Address: Tikkurila’s Vantaa-info, Dixi, Ratatie 11, 2nd floor, 01300 Vantaa.  Telephone (switchboard): +358 (0)9 839 11 
Fax +358 (0)9 8392 4163, e-mail: kirjaamo(at)vantaa.fi   

This document is updated June 1, 2022.