Processing personal data in the job seeker profile data repository and the AI included in the matching functionality of the service platform (Job Market Finland) when processing job seeker profiles

This document describes, on a general level, how the City of Vantaa’s employment authority processes your personal data when, as a job seeker customer, you create and publish a job seeker profile about yourself in the Job Market Finland service, or when Vantaa's employment authority creates and publishes your job seeker profile on your behalf in situations where you have not fulfilled your statutory obligation to compile one.

Job Market Finland is a digital service implemented by the KEHA Centre (Employment, Development and Administration Centre) and serves as the service platform referred to in Chapter 14 of the Act on the Organization of Employment Services (380/2023). Its purpose is to improve the matching of jobs and employees.  Matching means that employment opportunities and suitable employees are brought together.  The objective of the service platform is to improve the availability of labor and shorten the time required to fill vacant positions.  Compiling and publishing a job seeker profile requires logging into the service platform and verifying the user's identity.  In addition, the user must accept the platform's terms of use.

Information included in the job seeker profiles is stored in the job seeker profile data repository.  Under the Act on the Organization of Employment Services (380/2023), the KEHA Centre and employment authorities act as joint controllers of the job seeker profile data repository.

This document informs you that Job Market Finland’s matching functionality utilizes artificial intelligence (AI) when seeking and identifying correspondences between job seeker profiles and job advertisements, and when presenting employers, recruitment agencies, and job seekers with search results or recommendations based on those correspondences.

1. For what purposes are personal data processed?

Information included in the job seeker profiles is used to promote the functioning of employment and the labor market, as well as to compile statistics (The Act on the Organization of Employment Services, Section 130(1)).

Personal data is processed in more detail:

•    to compile job seeker profiles and to publish them on the service platform;
•    to promote the matching of job seekers and employers;
•    to implement employment mediation services;
•    to promote the functioning of employment and the labor market, as well as to compile statistics
•    to monitor the legality of the content of the job seeker profiles and job vacancies published on the service platform and compliance with the platform's terms of use with regard to job seeker profiles and job advertisements.

Chapter 14 of the Act on the Organization of Employment Services (380/2023) contains more detailed provisions regarding the creation and publication of job seeker profiles, the service platform, and the job seeker profile data repository where the information is stored.  In addition, other provisions of the act also assign duties to employment authorities relating to job seeker profiles.

We will never use the data for other purposes such as direct marketing or commercial purposes.

2. What is processing of personal data based on?

Processing of necessary personal data contained in job seeker profiles is based on the City of Vantaa employment authority's compliance with a statutory obligation arising from the provisions of the Act on the Organization of Employment Services (380/2023).

Legal basis of processing:
•    The EU's General Data Protection Regulation (2016/679), Article 6(1)(c) 
•    The Data protection Act (2018/1050), section 6(1). 2k.
•    The Act on the Organization of Employment Services (380/2023), including its provisions concerning job seeker profiles, particularly Sections 127–131 of Chapter 14.  

3. What personal data is collected in connection with compiling and publishing job seeker profiles and who is the data received from?

By law, a job seeker's profile must contain information that is relevant to job searching and employment regarding the person's:
•    education
•    work experience
•    other skills and competencies
•    employment preferences. 
•    In addition, it may include a free-form presentation of the person compiling the profile, as well as links to services outside the service platform.

According to the Government Proposal for the Act (HE 108/2025 vp., p. 139), the intention is to allow job seekers to choose as freely as possible the information they consider relevant to job searching and employment.

Personal customer data other than that referred to in Section 114(1) of the Act on the Organization of Employment Services may also be processed if such data is necessary for creating or publishing a job seeker profile or for monitoring the use of the service platform (The Act on the Organization of Employment Services, Section 130(2)).

It is important to note that information published in job seeker profiles is considered public personal data (HE 108/2025 vp., impacts on privacy protection, p. 90).  As a general rule, the information stored and published in the profile forms an anonymous job seeker profile. However, your anonymity cannot be guaranteed because your identity may be inferred by combining information contained in the profile, such as your occupational title, professional status, employer's name, or educational background (educational institution attended).

You can promote the anonymity of your job seeker profile by publishing it without personally identifying information, that is, for example, if you do not specify the name of your employer and can provide information at a more general level. If you wish to add a free-form presentation and links to external services to your profile, this may reduce the anonymity of the profile or eliminate it altogether.

No confidential information may be included in a job seeker profile.  According to the preparatory work of the act (Government Proposal HE 108/2025 vp., p. 139), such confidential information includes, for example, information referred to in Sections 24(1)(25) and 24(1)(32) of the Act on the Openness of Government Activities, such as information concerning an individual's status as a customer of employment services and the services provided to that customer, information regarding a person's health, information concerning a person's political beliefs or opinions expressed in private life, or information about a person's lifestyle, participation in associations, leisure activities, family life, or other comparable personal circumstances.

When an employment authority compiles your job seeker profile, the employment authority may include in the job seeker profile only information that is necessary for compiling and publishing the job seeker profile, such as the job seeker's:

1)    work experience relevant to job searching and employment, without information identifying the employer;
2)    education and training relevant to job searching and employment, without information identifying the employer;
3)    information on current permits and skills essential for job searching and employment, without information identifying the employer;
4)    employment preferences, desired work area, and language skills; as well as
5)    information referred to in Section 129(2) of the Act on the Organization of Employment Services that the job seeker has personally published in their job seeker profile or requested to be published.

We will receive the information from you. In situations where the employment authority creates your job seeker profile, the authority uses information concerning you that has been stored in the National Employment Services Information Repository (Section 120 of the Act on the Organization of Employment Services).
(Background: A person registering as a job seeker must provide the employment authority with information necessary for employment and the provision of public employment services, including work experience, education, and other skills and competencies.  In addition, the person is asked about employment preferences and the geographic area in which they are seeking work when registering as a job seeker.  The information in question is stored in the national information repository referred to in Section 120 of the Act on the Organization of Employment Services.)

Assisted automation is used in the compilation of job seeker profiles (HE 108/2025 vp., p. 142).

4. Is it necessary to provide personal data?

Main rule: Under legislation that enters into force on September 1, 2026, a job seeker must create and publish a job seeker profile on the service platform within 15 business days from the start of their job search or from the end of an exception period concerning the obligation to compile and publish a profile as provided in Section 129b(1) of the Act on the Organization of Employment Services. After publishing the job seeker profile, the job seeker must keep their job seeker profile published for the duration of their job seeking (Section 129(1) of the Act on the Organization of Employment Services).

Exception; Section 129b of the Act on the Organization of Employment Services sets out exceptions to the obligation to compile a profile.  Under this provision, a job seeker is not required to compile or publish a job seeker profile under Section 129, and the employment authority may not create or publish a job seeker profile under Section 129a, if:

1)    the job seeker is not subject to a job search obligation under Section 48 of the Act on the Organization of Employment Services;

2)    the job seeker finds full-time employment or is considered a full-time entrepreneur or a full-time student as defined in Chapter 2 of the Unemployment Security Act;

3)    the employment authority determines, based on an assessment of service needs, that the job seeker is unable to independently utilize the service platform to support their job search and employment; or

4)    the employment authority determines that publishing a job seeker profile would, for another reason related to the job seeker, be clearly unjustified.

Transitional provisions (job seekers whose customer relationship began before September 1, 2026):

1.    If a person has registered as a job seeker before the entry into force of a job seeker's obligation to compile a job seeker profile on September 1, 2026, of Section 129, and has continuously maintained active job seeker status until a job search discussion is held, the 15-business-day deadline for compiling and publishing a job seeker profile on the service platform will begin only on the date when the job seeker is provided with a job search discussion referred to in Section 34 of the Act on the Organization of Employment Services.

2.    If a person has registered as a job seeker before the entry into force of a job seeker's obligation to compile a job seeker profile on September 1, 2026 of Section 129,     and the validity of their job seeker status ends after the provision enters into force, the 15-business-day deadline for compiling and publishing a job seeker profile on the service platform will begin on the date when the person registers again as a job seeker.

 

5. Will personal data be disclosed to other parties?

Published job seeker profiles may be searched and viewed by employers and private recruitment agencies that are logged into the service platform.  Employers and private recruitment agencies may process information contained in the job seeker profiles only for recruitment or employment mediation purposes.

Logging into the service platform requires user authentication and acceptance of the platform's terms of use.  Identification requirements for employers and private recruitment agencies using the platform are dictated by Section 6 of the Act on the Provision of Digital Services.

Job seeker profiles may only be searched individually, and searches must be based on at least one of the following criteria: job title, competence, or geographic work area.

We will otherwise only disclose your personal data to another party if the data transfer is based on law or if you have given your consent for the disclosure of your data. You can cancel your consent to the disclosure of your data to outside parties at any time. The data will never be disclosed to outside parties for other purposes such as direct marketing or commercial purposes.

6. How is personal data protected?

To ensure your privacy, we have protected your personal data with the help of various technological and organizational measures. For example, only the employees that need the data to perform their work are allowed to handle the data and only to the extent required by any individual task. In the customer-information system and on the service platform, this is monitored with the help of logfiles, among other things.

Based on Section 130a of the Act on the Organization of Employment Services, the KEHA Centre is responsible for, among other things: data protection by design and by default for the job seeker profile data repository (The EU's General Data Protection Regulation, Article 25);

security of processing (The EU's General Data Protection Regulation, Article 32); controller obligations related to the security of the information systems used (The EU's General Data Protection Regulation. Article 36).

The employees of the employment authority are bound by confidentiality and professional secrecy, which continues also after termination of employment.

 

7. Will the data be transferred outside the European Union (EU) area or the European Economic Area (EEA)?

The KEHA Centre is the administrator of the service platform related to job seeker profiles (Section 128(4) of the Act on the Organization of Employment Services) and is responsible for the technical implementation and development of the job seeker profile data repository.

The KEHA Centre has its own privacy statement containing information regarding any transfer of data.

8. How will the city act in case of a data security breach?

It is possible that, regardless of protection, your personal data may exceptionally end up as a target of a breach of data, as well as in the possession of an outside party. In these cases, we will take immediate measures to rectify the situation, and we will inform the data protection ombudsman if the breach of data security causes any risk to you. The notification will be made, at the latest, within 72 hours of noticing the breach of data security. If the breach of data security presents a high risk, we will also inform you about it.

In case of data breaches affecting the job seeker profile data repository or the service platform, Vantaa’s employment authority will, when required, cooperate with the KEHA Centre in its role as a joint controller. The KEHA Centre is responsible for the technical implementation and security of the systems.

 

9. How long will data be stored?

Based on Section 129d of the Act on the Organization of Employment Services (380/2023), the storage period for data stored in the job seeker profile data repository is determined by as follows:

The information referred to in Sections 128a, 129, and 129a of the Act on the Organization of Employment Services concerning job seeker profiles shall be stored in a separate job seeker profile data repository distinct from the information repository referred to in Section 120.

The KEHA Centre must delete information from the job seeker profile data repository when a person removes their job seeker profile from the service platform, but no later than one year after the person’s most recent login to the service platform.

The provision set out above does not apply to a job seeker while their job search remains active.  After the validity of the job seeker's job search ends, the Employment, Development and Administration Centre must delete the information from the job seeker profile data repository as provided in subsection 2.

10. Artificial intelligence and matching functionality

The matching functionality on the service platform does not constitute a continuously learning system or algorithm. Learning functionality takes place by changing the calculation formula of the algorithm and the weighting assigned to the different types of data used in matching.  In matching processes that utilize natural language, it is possible to refine the system's reasoning afterward, but the matching functionality is not an automatically learning feature.  Training the functionality also requires a manual review of decisions that can be used to train the model (HE 108/2025 vp., p. 42).

According to the preparatory work of the Act (HE 108/2025 vp.), the matching functionality is considered an AI system within the meaning of Article 3(1) of the EU AI Act because it infers suitable job opportunities from job seeker profiles and produces recommendations to facilitate matching between employers and job seekers.  In addition, these recommendations partly influence user behavior on the platform.

In other words, the matching functionality is deemed to be an autonomous actor because it generates recommendations, even though teaching it takes place consciously on behalf of a natural person.

Because the KEHA Centre is responsible for the development and maintenance of the service platform, the preparatory work of the Act states that the KEHA Centre would be considered both a provider under Article 3(3) of the AI Act and a deployer under Article 3(4).

The matching functionality used on the platform presents targeted job recommendations for job seekers on the basis of their job seeker profiles. Even though at issue is a recommendation and all the published vacancies can be browsed by the job seekers, it is assessed that the matching functionally has an impact on who a specific vacancy is shown and on what order the vacancies are shown, depending on the job seeker’s profile.  Furthermore, the matching functionality assesses the job seekers’ job seeker profiles based on the search criteria given by employers, that is, has an impact on what order the employers see the profiles and on the profiles they find, even though the profiles are anonymous. Moreover, the matching functionality utilizes profiling of natural persons. Based on these factors, the matching functionality used on the service platform is considered, according to the preparatory work of the Act (HE 108/2025 vp., p. 43), to be a high-risk AI system within the meaning of the AI Act.

 

11. Will data be used for profiling or automatic decision-making?

The service platform includes a functionality designed to improve matching between job seeker profiles and job advertisements, and this functionality utilizes profiling as defined in the EU General Data Protection Regulation. The matching functionality organizes job vacancy advertisements for a job seeker so that vacancies that best correspond to the education, skills, competencies, and employment preferences provided in the job seeker's profile appear first in the listing of jobs.

The matching functionality does not prevent the job seeker from viewing any job advertisements posted on the platform; it merely arranges the advertisements based on the information provided in a person's job seeker profile, thereby creating a personalized list of available employment opportunities. Meanwhile, the employers are shown job seeker profiles published on the service platform in an order determined by the information and search criteria they have specified.  As a result, personal data contained in job seeker profiles is subject to automated processing.

For job seekers, the matching functionality affects the order in which jobs are presented by displaying positions deemed most suitable for them according to a ranking system.  Legal effects may arise to the extent that the matching functionality influences which job vacancies are shown to the job seeker and the order in which they are presented.

Nevertheless, the matching functionality does not prevent the job seeker from viewing all available vacancies, which is why the preparatory work of the Act (HE 108/2025 vp., p. 83) concludes that the functionality does not produce effects that would significantly affect the job seeker in a manner comparable to legal effects within the meaning of Article 22(1) of the  EU's General Data Protection Regulation. Correspondingly, the matching functionality does not impose any obligation to act on employers or private recruitment agencies.  On this basis, it has been assessed that the obligation to publish a job seeker profile, and the resulting exposure to the matching functionality used on the service platform, does not subject job seekers against their will to a decision within the meaning of Article 22(1) of the  EU's General Data Protection Regulation.

Thus, the legislator has assessed that the EU's General Data Protection Regulation does not prevent the use of the profiling-utilizing matching functionality on the service platform.

12. What are the rights of the data subject and how can the rights be exercised? How long will processing the matter take?

The data subject refers to the person whose personal data is being processed. If we process your personal data, based on the EU’s General Data Protection Regulation (GDPR), you are entitled to: 
-    check how your data is processed
-    demand that inaccurate or faulty data be corrected
-    demand that your data be removed
-    request that handling of your data be restricted
-    object to handling of your data.

You can submit a personal data inspection request through the city’s e-service, in person at Vantaa-Info, or by mailing the inspection request to the City of Vantaa’s Registry. You can find more detailed instructions on the city’s Data Protection webpage.

If you wish to exercise the data subject's other rights or ask for additional information on the processing of personal data, please contact the person mentioned below in section 15. We will case-specifically verify the preconditions for exercising your rights. Exercising your rights may require verification of your identity.

We will execute information requests without undue delay, but, at the latest, within a month of receiving the request. The deadline can be extended by at most two months, when required, by accounting for the complexity and amount of data of the request. If the deadline is extended, we will inform you about it.

 

13. Is exercising my rights subject to a charge?

As a general rule, exercising your rights is free of charge. We may, however, charge a reasonable fee, corresponding with the administrative costs, for implementing the request, or decline to perform the measure, if the request is obviously ungrounded, unreasonable, or recurrent. If there is a charge for executing your request, we will contact you. If we decline to perform the measure, we will inform you in writing about the grounds for the refusal, as well as about the option to submit the matter to be handled by the data protection ombudsman, or to exercise other legal remedies.

 

14. How can I submit an appeal to the supervisory authorities?

If you suspect that your personal data is being illegally processed, you can submit an appeal to the data protection ombudsman. Further information on and instructions for submitting an appeal is provided by the contact person mentioned in section 14, the city's data protection officer, the data protection ombudsman's office website, and phone consultation:

Data protection ombudsman's office / www.tietosuoja.fi
Street address: Lintulahdenkuja 4, 00530 Helsinki
Mailing address: P.O. Box 800, 00531 Helsinki
Email: tietosuoja(at)om.fi 
Phone (switchboard): 029 566 6700
Phone (consultation for private persons): 029 566 6777

 

15. Who can I ask for additional information and who is the data controller?

The KEHA Centre and the employment authorities are joint controllers of the job seeker profile data repository, with responsibilities allocated by law (Section 130a(1) of the Act on the Organization of Employment Services). Each employment authority is responsible for controller duties concerning its own customers.  The KEHA Centre's specific responsibilities as controller are defined in Section 130a(2) of the Act on the Organization of Employment Services.  The contact details of the KEHA Centre's Data Protection Officer can be found at the end of this document.

 

VANTAA's EMPLOYMENT AUTHORITY AS CONTROLLER

Additional information on processing personal data is provided by the employment authority’s contact person below. Please note that email is not a safe medium for processing personal data. Be sure not to send, for example, your identity number or any sensitive information by email.

Contact person of the City of Vantaa's employment authority
Email: tietosuoja-tyko@vantaa.fi

The data controller is the City of Vantaa's Director of Employment and Integration Services.  You will find the contact information of the data controller and the City of Vantaa's data protection officer below:

Controller 

                   
City of Vantaa                     
Director of Employment and Integration Services
contact person of the controller: tietosuoja-tyko@vantaa.fi            Business ID: 0124610–9              
Asematie 7, 01300 Vantaa            

City of Vantaa's data protection officer
tietosuojavastaava@vantaa.fi

Registry    

Mailing address: PL 1100, 01030 Vantaan kaupunki
Street address: Tikkurila Vantaa-info, Dixi, Ratatie 11, 2nd floor, 01300 Vantaa.
Phone (switchboard): 09 839 11
email: kirjaamo (at) vantaa.fi

KEHA CENTRE AS CONTROLLER

data protection officer:
Email: tietosuoja@keha-keskus.fi