Processing of personal data from camera surveillance in city day-care centres, schools and educational institutions

The basis for the processing of personal data is legitimate interests pursued by the City of Vantaa and the performance of a task in the public interest or the exercise of official authority (Article 6(1)(e) and (f) of the EU Data Protection Regulation).

The scope of camera surveillance includes video and audio recordings generated on the premises, including the time and place of recording. The register contains video and audio recordings of persons on the premises. The data is obtained from the image and audio material transmitted by the cameras belonging to the recording surveillance system.

In cases of suspected crime, data may be disclosed to the police if they have grounds to obtain it. Within the city, data may be disclosed to investigate criminal and tort cases.

The information in the register is confidential. Camera surveillance recordings may only be processed by persons who need it in their work duties. The employees processing or viewing the information are bound by confidentiality and secrecy obligations. The confidentiality and secrecy obligations continue after the end of employment. The recordings are kept in locked facilities. Persons with the right to view the recordings have been designated work unit-specifically. The recordings may also be viewed by security guards employed by the security company responsible for the city’s security operations. The monitors are located so that bystanders cannot view them.

In cases where the processor of personal data handles personal data on behalf of the City of Vantaa, the appropriate level of data security and data protection has been agreed to in an agreement with the processor. As a rule, data is only processed in the EU or EEA area, but the processor can also transfer data outside the EU or EEA. However, the transfer is only permitted if it meets the requirements set out in the data protection legislation and the agreement, which ensure an adequate level of protection of personal data.

Despite the protection measures, in some exceptional cases it is possible for personal data to be compromised by a data security breach or end up in the hands of a third party. In these cases, the City of Vantaa will take immediate action to rectify the situation and submit the necessary reports to the national Data Protection Ombudsman and the data subjects affected.  The City of Vantaa will notify the Data Protection Ombudsman of any breach without undue delay and, where possible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to risk the rights and freedoms of any data subjects.

If the breach is likely to cause a high risk with regard to the data subjects’ rights and freedoms, the City of Vantaa will notify the data subjects of the breach without undue delay. In this case, the city will report the breach to those data subjects whose data is affected by the data security breach. If the data breach concerns a large group of people and does not require any immediate action from registered parties, the details of the data breach can also be provided as a general notification.

Data collected in the register is stored only for as long as and to the extent necessary for the original or compatible purposes for which the personal data was collected. As a rule, the recordings must be destroyed as soon as they are no longer necessary for the purpose of surveillance and no later than within one year. Recordings may be stored for a longer period of time if it is necessary for special reasons, such as a legal obligation.

According to Section 17 of the Act on the Protection of Privacy in Working Life, recordings shall be destroyed as soon as they are no longer necessary for achieving the purpose of the camera surveillance and no later than one year after the end of the recording.

However, according to the act, a recording may be retained after this period if it is needed for completing a case related to harassment, molestation or inappropriate behaviour or an occupational accident or occupational safety issue that emerged for investigation before the end of the maximum storage period. A recording may also be retained if the employer needs it to substantiate the appropriateness of terminating an employment relationship or for some other special reason.

The recordings remain on the recorder for 2–4 weeks, after which subsequent recordings will overwrite the old ones. The period for which the recordings are stored depends on the capacity of the recorder, the number of cameras, the recording resolution, the picture frequency and movement within the scope of the cameras.

Your personal data will not be used for profiling or automated decision-making.

The term ‘data subject’ refers to the natural person whose personal data is being processed. Depending on the basis for the processing, the registered party has the right to

• check the information processed by the application
• request the rectification of erroneous or inaccurate information
• request the erasure of personal data
• request the restriction of the data processing
• object to the processing of the data
• right to obtain the data and transfer it to another data controller, and to withdraw their consent at any time, if the processing is based on consent.

You can make a personal data review request via the e-service, in person at Vantaa Info or by posting the review request form to the City of Vantaa Registry Office. More detailed instructions can be found on the City’s Data Protection page.

If you wish to enforce other rights to which you are entitled as a data subject or request additional information on the processing of personal data, please contact the person specified under section 13 below. The legal basis for the enforcement of your rights is verified on a case-by-case basis. In order to enforce your rights, you may have to prove your identity.

We will fulfil the requests without undue delay, but no later than within one month of receiving each request. If necessary, the deadline may be postponed by a maximum of two months based on the complexity of the request and the quantity of the data. If the deadline is postponed, you will be notified.

The exercise of the rights is, in principle, free of charge. However, the City of Vantaa may collect a reasonable fee corresponding to the administrative costs for fulfilling a request or refuse a request if the data subject’s requests are clearly unfounded, unreasonable or recurring. If the intention is to collect a fee for fulfilling a request, the City of Vantaa will contact the person who submitted the request before fulfilment. In the event that the City of Vantaa refuses to fulfil the requested measure, the person who submitted the request will be provided with the grounds for the refusal in writing and informed of the opportunity to refer the matter to the Data Protection Ombudsman and resort to other legal remedies.

If you suspect that your personal details are being processed unlawfully, you can appeal to a supervisory authority in the EU member state of your permanent residence or employment or the member state where you consider the violation to have taken place. In Finland, the relevant supervisory authority is the Data Protection Ombudsman.  More information and instructions for filing a complaint are available on the data protection ombudsman website and helpline:

Office of the Data Protection Ombudsman/www.tietosuoja.fi

Street address: Lintulahdenkuja 4, FI-00530 Helsinki Postal address: PO Box 800, FI-00531 Helsinki

Email: tietosuoja(at)om.fi

Telephone (exchange): +358 29 566 6700

Telephone (helpline for private individuals): +358 29 566 6777

More information on the processing of personal data is available from the contact person specified below. Please note that email is not a safe medium for processing personal data. As such, please do not send sensitive information, such as your personal identity code, via email.

Contact persons of the register

• Day-care centre: day-care centre directors
• Comprehensive school: principals
• Upper secondary education: vocational college and upper secondary school principals

The controller is the City of Vantaa’s Education and Learning Committee. Contact details of the controller and the City of Vantaa data protection officer can be found below:

Controller

City of Vantaa

Education and Learning Committee

Business ID 0124610-9

Asematie 7, FI-01300 Vantaa

Data protection officer

tietosuojavastaava@vantaa.fi

Tel. +358 40 071 3358

Registry office

Postal address: PL 1100, FI-01030 Vantaan kaupunki

Street address: Vantaa Info Centre Tikkurila, Dixi, Ratatie 11,

2nd floor, FI-01300 Vantaa.

Tel. (exchange): +358 9 839 11

Fax +358 9 8392 4163

Email: kirjaamo(at)vantaa.fi