Processing of personal data at the City of Vantaa’s employment office

The data of employment office customers and employment service providers can be used on the basis of the Act on Public Employment (380/2023), Chapter 13, Section 12:

• for the organization and production of the services and duties set out in the Act on Public Employment (380/2023);
• for carrying out the duties set out for the employment office in the Act on the Promotion of Immigrant Integration, the Unemployment Security Act, the Act on Rehabilitative Work Activity and the Act on Vocational Education;
• for the supervision, development, monitoring, evaluation, gathering of statistics, anticipation and guidance of the aforementioned duties.

In addition, the employment office may process the data of an unemployed person in order to carry out duties pertaining to the joint service model for multi-sectoral support as set out in the Act on the Multi-Sectoral Promotion of Employment (381/2023), as well as for the supervision, development, monitoring, evaluation, gathering of statistics, anticipation, and guidance of these duties.

We will never use the aforementioned data for other purposes such as direct marketing or commercial purposes.

The processing of the personal data necessary for the organization of employment services is based on fulfilling a statutory obligation of the employment office.

Legal basis of processing:

• The EU's General Data Protection Regulation (2016/679), Article 6(1)(c)
• Section 6 of the Data Protection Act (2018/1050)

Key special legislation applicable to the operations of the employment office:

• The Act on Public Employment and Business Service (380/2023)
• The Act on the Enforcement of the Act on Employment and Business Service and Certain Related Acts (383/2023)
• The Act on the Multi-Sectoral Promotion of Employment (381/2023)
• The Unemployment Security Act (1290/2002)
• The Act on the Promotion of Immigrant Integration (681/2023)
• The Act on Rehabilitative Work Activity (189/2001)
• The Act on Vocational Education (521/2017)
• The Act on the Application of European Union Legislation Concerning the Coordination of Social Security Systems (352/2010)

Pursuant to the Act on Public Employment (380/2023), Section 114, Subsection 1, the following data of a personal customer can be processed:

1. identity number;
2. name and contact information;
3. information relating to the employment service customer relationship and the use of the services of the employment office, as well as any necessary special arrangements;
4. information pertaining to education, work history and vocational skills, as well as other data used for employment services;
5. information pertaining to the need for service, plans and the implementation of plans;
6. information about work and education offers and presentations to employers;
7. data from public employment services, services promoting employment referred to in the Unemployment Security Act, other services supporting job seeking and employment, as well as specialist assessments;
8. any data and assessments pertaining to the state of health, work ability and functional capacity that impact the person’s employment and which are necessary for the provision of the service to the person in question;
9. reports relating to unemployment security, employment policy statements and other statements and notices; the aforementioned data and the data necessary for the provision of an employment policy statement or other statement can also be processed in cases where the natural person is not a personal customer;
10. information relating to benefits included in public employment services

For an employer applying for or receiving public employment services, the identification data of the employer’s representative may be processed pursuant to the Act on Public Employment (380/2023), Section 114, Subsection 2.

For an employment service provider, the identification data of the service provider’s representative may be processed pursuant to Section 114, Subsection 3 of the Act on Public Employment.

For an unemployed person taking part in the joint service model for multi-sectoral support to promote employment, the following data may be processed pursuant to Section 11, Subsection 2 of the Act on the Multi-Sectoral Promotion of Employment (381/2023):

1. name, identity number and contact information;
2. information relating to a customer relationship and use of services of the joint service model for multi-sectoral support, as well as any necessary special arrangements;
3. information pertaining to education, work history and vocational skills;
4. any information pertaining to a social situation that impacts the person’s employment and which is necessary for the provision of the service to the person in question;
5. any data or assessments pertaining to the state of health, work ability and functional capacity that impact the person’s employment and which are necessary for the provision of the service to the person in question;
6. information pertaining to the need for service which impacts the person’s employment;
7. information relating to the multi-sectoral employment plan and its implementation, monitoring and reviewing.

Public employment services cannot be arranged for you without your personal data. Simply enrolling as a job seeker requires that the person provides the employment office with the information set out in the Act on Public Employment (380/2023), Chapter 4, Section 27.

Once job seeking begins, your personal data will be required for, among others, assessing your need for service, creating/updating an employment plan or other similar plan and providing unemployment security statements to the party paying the unemployment benefit (Kela, unemployment fund) in order for the benefit to be paid. 

We receive the data for the public employment services’ register from you yourself, and data is gathered in the register from different service situations, such as when visiting in person, using online services, in a Teams video conference and services over the phone.

As an employment office, we also receive data through disclosures from other employment offices, other municipal authorities, state officials, the wellbeing services county, the Social Insurance Institution of Finland, unemployment funds, the Finnish Centre for Pensions, the Employment Fund, the employment services’ provider, other service providers agreed in the employment plan or similar plan organized by the employment office, and work try-out organizers (Act on Public Employment 380/2023, Section 115, Subsection 1).

In addition, as an employment office and in order to assess the requirements for granting wage subsidies and employment subsidies for persons over 55, we are entitled to receive data from the record of fines referred to in the Act on the Enforcement of Fines (672/2002), Section 46, pertaining to the solutions referred to in the Act on Public Employment (380/2023), Section 83, Subsection 3, Paragraph 4.

With your written consent, we will disclose the necessary data about you as a job seeker to the employer for filling a position (Act on Public Employment 380/2023, Chapter 13, Section 118, Subsection 1–2). The necessary data for filling a position as laid out in the law includes:

1. the job seeker's name and contact information, mother tongue, other language skills and nationality;
2. the job seeker’s education and completed vocational qualifications, as well as their content and grades to the extent needed;
3. work history along with other information given on the certificate of employment;
4. the completion of compulsory military service;
5. special expertise, work and education wishes, as well as the job application presentation the job seeker has created for employers;
6. the data necessary for assessing the requirements for concluding a fixed-term employment contract as set out in the Employment Contracts Act, Chapter 1, Section 3 a and the Seafarers’ Employment Contracts Act, Chapter 1, Section 4 a, verifying that the person has been an unemployed job seeker uninterruptedly for the last 12 months.

Data pertaining to the job seeker’s state of health will be disclosed to the employer only if the job seeker grants individual written consent to do so and the data is necessary for filling the vacant position, for fulfilling the specific health requirements of the vocational field in question or for promoting the employment of a job seeker whose disability or illness makes employment difficult (Act on Public Employment 380/2023, Section 118, Subsection 3). 

In addition, the employer is entitled to know whether a former employee identified by the employer is a job seeker at an employment office when fulfilling its obligation to prioritize a terminated employee for subsequent recruitment as set out in legislation pertaining to employment and public-service employment relationships (Act on Public Employment, 380/2023, Section 118, Subsection 4).

Data may also be disclosed to the employment service provider and a provider supporting employment organized by the employment office as specified in the employment plan or similar plan, if the data is necessary for providing and implementing the service. However, disclosing data pertaining to the customer’s state of health to the service provider is only possible if the customer provides individual written consent for the disclosure of the data (Act on Public Employment 380/2023, Section 116, Subsection 4).

Members of a selection group relating to labor market training student selections are, for the purposes of training planning and student selection, entitled to receive data about the application, including appendices, of a person applying for the training, notwithstanding confidentiality provisions (Act on Public Employment 380/2023, Section 117).

The employment office, the Social Insurance Institution of Finland (Kela), unemployment funds and foreign institutions with the jurisdiction to handle duties related to a person’s job seeking and unemployment security, are entitled to exchange data relating to job seeking and unemployment security which impact the person’s right to receive an unemployment benefit (Unemployment Security Act, Chapter 11, Section 4 b and the Act on the Application of European Union Legislation Concerning the Coordination of Social Security Systems, Chapter 13, Section 1 and 3).

The Regional State Administrative Agency (AVI) is entitled to receive the necessary data for oversight of legality from the employment office, notwithstanding confidentiality provisions (Act on Public Employment, Section 116, Subsection 3).

The KEHA Centre is entitled to receive the necessary data from the employment office for carrying out the duties related to the execution, monitoring and assessment of employment services as set out in the Act for Public Employment (380/2023) or other legislation, notwithstanding confidentiality provisions (Act on Public Employment, Section 116, Subsection 1).

Customer information required to be permanently stored on the basis of the Archives Act (831/1994) will be transferred to the National Archives of Finland for storage after deletion from the customer-information system.

We will otherwise only disclose your personal data to another party if the data transfer is based on law or if you have given your consent for the disclosure of your data. You can cancel your consent to disclosing your data to outside parties at any time. The data will not be disclosed to outside parties for other purposes such as direct marketing or commercial purposes.

To ensure your privacy, we have protected your personal data with the help of various technological and organizational measures. Only the employees that need the data to perform their work are allowed to handle the data and only to the extent required by any individual task. In the customer-information system, this is monitored with the help of logfiles, among other things. Paper documents are stored in the city’s various archives, on safe premises that are inaccessible to outside parties.

The employees are bound by confidentiality and professional secrecy, which continues also after termination of employment.

In cases where a party processes personal data on behalf of the City of Vantaa, the level of appropriate information security and data protection has been agreed on in the agreement made with the processor. The processor of personal data refers to a party that processes personal data on behalf of the City of Vantaa, for example, a service provider.

As a general rule, data is processed only within the EU or EEA, but the processor may also transfer data outside the EU or EEA countries. Nevertheless, the transfer is only allowed when it meets the demands of the data protection legislation and contract that ensure a sufficient level of protection of personal data.

The data in the Microsoft M365 services used by the City of Vantaa can be processed outside the EU/EEA, although they are, as a rule, located in the EU area. The transfer is based on the EU Commission's decision, ratified on July 10, 2023, on the sufficient level of the U.S. data protection. The U.S. companies to which data is transferred are certified and committed to the data protection measures agreed between the EU and the U.S. In this case, the transfer of data is compliant with the EU's General Data Protection Regulation.

It is possible that, regardless of protection, your personal data may exceptionally end up as a target of a breach of data as well as in the possession of an outside party. In these cases, we will take immediate measures to rectify the situation and we will inform the data protection ombudsman if the breach of data security causes any risk to you. The notification will be made, at the latest, within 72 hours of noticing the breach of data security. If the breach of data security presents a high risk, we will also inform you about it.

Data will be stored and deleted in accordance with the City of Vantaa’s information management plan. The duration of storing documents specified in the information management plan is based on legislation, the National Archives of Finland's regulations for permanently stored documents, as well as the Association of Finnish Local and Regional Authorities’ recommendations for temporarily stored documents. After the end of the data storage period, the data will be deleted.

All data pertaining to the customer and service provider will be deleted from the national database four (4) years after the termination of the customer or contractual relationship.

However, the data will not be deleted if it is required for carrying out duties based on legislation or for a pending issue (Act on Public Employment 380/2023, Section 122).

The National Archives of Finland have ordered some customer information to be permanently stored pursuant to the Archives Act (831/1994). The data ordered to be permanently stored will be transferred to the storage of the National Archives of Finland after it has been deleted from the customer-information system of the public employment services. The KEHA Centre will be responsible for the deletion of documents from the aforementioned system and documents submitted through Job Market Finland’s E-Services.

The City of Vantaa is an independent records creator insofar as documents contained in or submitted through the aforementioned systems are not concerned. The city is responsible for archiving the documents received and created in connection with carrying out its duties in accordance with the Archives Act. The processing and archiving of the documents received and created by the city takes place in accordance with the City of Vantaa’s information management plan.

Your data will not be used for profiling or automatic decision-making.

The registered person refers to the person whose personal data is being processed. If we process your personal data, based on the EU’s General Data Protection Regulation (GDPR), you are entitled to: 

• check how your data is processed (GDPR, Article 15)
• demand that inaccurate or faulty data be corrected (GDPR, Article 16)
• demand that your data be removed (GDPR, Article 17)
• demand that the use of your data be restricted (GDPR, Article 18)
• object to the processing of your data (GDPR, Article 21)
• obtain your data and transfer it to another controller (GDPR, Article 20) as well as cancel your consent at any time, if processing is based on your consent (GDPR, Article 7(3)).

The right to the removal of data referred to in Article 17 of the GDPR does not apply when the processing is based on compliance with the City of Vantaa's statutory obligation (organization of public employment services) or when the data is processed for the fulfillment of duties in the public interest or for exercising the public authority of the city.

On the basis of Section 114, Subsection 5 of the Act on Public Employment (380/2023), the right to restrict the use of data referred to in Article 18 of the GDPR does not apply.

When canceling your previously given consent to the disclosure/exchange of data, the cancellation of consent does not impact the legality of the processing carried out on the basis of the consent prior to its cancellation (GDPR, Article 7(3)).

You can submit a personal data inspection request through the e-services, on the spot at Vantaa-Info, or by mailing the inspection request to the City of Vantaa’s Registry. You can find more detailed instructions on the city’s Data Protection website.

If you wish to exercise the registered person's other rights or ask for additional information on handling personal data, please contact the person mentioned below in section 14. We will case-specifically verify the preconditions for exercising your rights. Exercising your rights requires verification of your identity.

We will execute information requests without undue delay, but, at the latest, within a month from receiving the request. The deadline can be extended by at most two months, when required, by accounting for the complexity and amount of data of the request. If the deadline is extended, we will inform you about it.

As a general rule, exercising your rights is free of charge. We may, however, charge a reasonable fee, corresponding with the administrative costs, for implementing the request, or decline to perform the measure, if the request is obviously ungrounded, unreasonable, or recurrent. If there is a charge for executing your request, we will contact you. If we decline to perform the measure, we will inform you in writing about the grounds for the refusal as well as about your option to submit the matter to be handled by the data protection ombudsman or to exercise other legal remedies.

If you suspect that your personal data is being illegally processed, you can submit an appeal to the data protection ombudsman. Further information on and instructions for submitting an appeal is provided by the contact person mentioned in section 14, the city's data protection officer, the data protection officer's office website, and phone consultation:

Data protection officer's office / www.tietosuoja.fi
Street address: Lintulahdenkuja 4, 00530 Helsinki
Mailing address: P.O. Box 800, 00531 Helsinki
Email: tietosuoja(at)om.fi 
Phone (switchboard): 029 566 6700
Phone (consultation for private persons): 029 566 6777

The data controller is the City of Vantaa's Director of Employment and Integration Services. The City of Vantaa’s employment office is responsible for the duties of the data controller regarding its customers, as laid out in the law (Act on Public Employment, 380/2023, Section 123).

Joint controllers

The KEHA Centre and the employment offices are the joint controllers of the national database referred to in the Act on Public Employment (380/2023). As data controller, the KEHA Centre is responsible for the data controller’s obligations which are separately set out in the law (Act on Public Employment, 380/2023, Section 123). 

The contact information of the data controller, the City of Vantaa’s data protection officer and the KEHA Centre acting as data controller can be found below:

Data controller (City of Vantaa’s employment office)    
The City of Vantaa                     
Director of Employment and Integration Services
Business ID: 0124610–9             
Asematie 7, 01300 Vantaa        

Data protection officer
tietosuojavastaava@vantaa.fi

Registry    
Mailing address: P.O. Box 1100, 01030 Vantaan kaupunki
Street address: Tikkurilan Vantaa-info, Dixi, Ratatie 11, 2nd floor, 01300 Vantaa.
Phone (switchboard): 09 839 11
Fax: 09 8392 4163, email: kirjaamo(at)vantaa.fi

Joint controller KEHA Centre
tietosuoja.keha@ely-keskus.fi

Processors of personal data
The City of Vantaa may outsource the processing of its customers’ data to another employment office, system provider or service provider through a separate agreement.
In this case, the processing of personal data takes place on behalf of the city and for the purposes designated by the city.

The city remains the data controller of its customers’ personal data. The city and service provider are jointly responsible for the appropriate processing of your personal data.

Additional information on processing personal data is provided by the contact person below. Please note that email is not a safe medium for processing personal data. Be sure not to send, for example, your identity number or any sensitive information by email.