Processing of personal data in the research permit application process

The Education and Learning Department collects information on the research permits applied for and granted. The purpose of the processing of personal data is to enable the granting of a research permit and subsequent research. The processing of data is also aimed at avoiding duplicate research activities. The actual purpose of the research must be clarified in a separate research plan, which is confidential.

The processing of personal data necessary to process research permit applications is based on the performance of a task in the public interest or the exercise of public authority.

Legal basis for the processing:

• Article 6(1)(e) of the EU General Data Protection Regulation (2016/679) 

• Section 4 of the Data Protection Act (1020/2018).

The data collected about the data subjects includes the name, organisation and contact details of the research permit applicant and, in the case of theses/final projects, the school and the work supervisor and their contact details, the city organisation’s contact person and contact details, the research permit application details, and the decision on the granting of the research permit.

The personal data collected by the City of Vantaa is obtained and maintained based on the information provided by the research permit applicant and the data generated in the operating unit.

The research permit process cannot be carried out without personal data.

Your data is only disclosed with your consent or if another authority has a statutory right to access the data. Your data is never passed on for marketing purposes. The data of an individual can be disclosed to other parties with the client’s consent or based on express provisions of the law. If the person is incapable of assessing the significance of the consent, the data can be provided with the consent of their legal representative. Information in the data files will be disclosed upon request to authorities that have a legal right to access it. The submitter of the request must refer to the section of law based on which the data is requested. The disclosure of data must be recorded in the data file.

Information is disclosed to national data files for research, planning and statistical purposes. If data is disclosed from the research permit data file by means of a technical access connection to other personal data files, the client’s consent must be obtained for this, or it must be based on a provision of law that justifies the disclosure. The controller is responsible for the lawfulness of the disclosure. Your data may also be processed by operators outside the City of Vantaa, such as private companies from which Vantaa purchases services. In these cases, the City of Vantaa is responsible for the processing of your data, and the data is processed in the same way as if the service was provided in a City of Vantaa unit. Your data will not be disclosed from such units without your consent outside the City of Vantaa and the authorities.

In order to ensure privacy, data security and data protection have been secured by means of various technical and organisational measures. For example, personal data may be processed only by persons who need it to perform their work or official duties and only to the extent required by an individual task. Research permit applications and attachments are stored in the City of Vantaa’s secure case management system.

Staff are bound by the obligation of professional confidentiality and will continue to be bound by it after the end of their employment.  

In cases where the processor of personal data handles personal data on behalf of the City of Vantaa, the appropriate level of data security and data protection has been agreed to in an agreement with the processor. As a general rule, information is only processed within the EU or EEA area.

Despite the protection measures, in some exceptional cases it is possible for personal data to be compromised by a data security breach or end up in the hands of a third party. In these cases, the City of Vantaa will take immediate action to rectify the situation and submit the necessary reports to the national Data Protection Ombudsman and the data subjects affected.  The City of Vantaa will notify the Data Protection Ombudsman of any breach without undue delay and, where possible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to risk the rights and freedoms of any data subjects.  

If the breach is likely to cause a high risk with regard to the data subjects’ rights and freedoms, the City of Vantaa will notify the data subjects of the breach without undue delay. In this case, the city will report the breach to those data subjects whose data is affected by the data security breach. If the data breach concerns a large group of people and does not require any immediate action from registered parties, the details of the data breach can also be provided as a general notification.  

The data is kept and destroyed in accordance with the City of Vantaa’s information management plan. The storing times of documents defined in the data management plan are based on legislation, the National Archives of Finland’s provisions concerning permanently stored documents and the Association of Finnish Municipalities’ recommendations concerning documents stored for a definite period of time. At the end of the period, the data will be destroyed.

The research application, research application attachments and research plan are kept for 10 years.

Your personal data will not be used for profiling or automated decision-making.

Data subject means the person whose personal data are being processed. If we process your personal data, you have the right to:

• check what data of yours are being processed
• demand the correction of incorrect or inaccurate data
• demand the restriction of the processing of your data
• right to object

You can make a personal data review request via the e-service, in person at Vantaa Info or by posting the review request form to the City of Vantaa Registry Office. More detailed instructions can be found on the City’s Data Protection page.

If you wish to enforce other rights to which you are entitled as a data subject or request additional information on the processing of personal data, please contact the person specified under section 14 below. The legal basis for the enforcement of your rights is verified on a case-by-case basis. In order to enforce your rights, you may have to prove your identity.

We will fulfil the requests without undue delay, but no later than within one month of receiving each request. If necessary, the deadline may be postponed by a maximum of two months based on the complexity of the request and the quantity of the data. If the deadline is postponed, you will be notified.

The exercise of the rights is, in principle, free of charge. However, the City of Vantaa may collect a reasonable fee corresponding to the administrative costs for fulfilling a request or refuse a request if the data subject’s requests are clearly unfounded, unreasonable or recurring. If the intention is to collect a fee for fulfilling a request, the City of Vantaa will contact the person who submitted the request before fulfilment. In the event that the City of Vantaa refuses to fulfil the requested measure, the person who submitted the request will be provided with the grounds for the refusal in writing and informed of the opportunity to refer the matter to the Data Protection Ombudsman and resort to other legal remedies.

If you suspect that your personal details are being processed unlawfully, you can appeal to a supervisory authority in the EU member state of your permanent residence or employment or the member state where you consider the violation to have taken place. In Finland, the relevant supervisory authority is the Data Protection Ombudsman.  More information and instructions for filing a complaint are available on the data protection ombudsman website and helpline:

Office of the Data Protection Ombudsman/www.tietosuoja.fi

Street address: Lintulahdenkuja 4, FI-00530 Helsinki Postal address: PO Box 800, FI-00531 Helsinki

Email: tietosuoja(at)om.fi

Telephone (exchange): +358 29 566 6700

Telephone (helpline for private individuals): +358 29 566 6777 

More information on the processing of personal data is available through the registry office of Vantaa. Please note that email is not a safe medium for processing personal data. As such, please do not send sensitive information, such as your personal identity code, via email. 

The controller is the City of Vantaa’s Education and Learning Committee. Contact details of the controller and the City of Vantaa data protection officer can be found below: 

Controller

City of Vantaa

Education and Learning Committee

Business ID 0124610-9

Asematie 7, FI-01300 Vantaa 

Data protection officer 

tietosuojavastaava@vantaa.fi 

tel. +358 40 071 3358 

Registry office

Postal address: PO Box 1100, FI-01030 City of Vantaa

Street address: Vantaa Info Centre Tikkurila, Dixi, Ratatie 11, 2nd floor, FI-01300 Vantaa. 

Tel. (exchange): +358 9 839 11

Fax +358 9 8392 4163

Email: kirjaamo(at)vantaa.fi