Processing of personal data from camera surveillance on city-managed properties

1. For what purposes is personal data handled?

The purpose of use of the register:
•    The purpose of the recording video-surveillance system is to protect the real estate assets and movables.
•    To ensure the personal safety of the employees and other people on the premises.
•    To protect property.
•    To prevent criminal cases as well as investigate them.
•    The recordings may also be used to prove the grounds for ending an employment relationship; to inspect or prove harassment or inappropriate behavior as specified in the Act on Equality between Women and Men and the Occupational Safety Act, if the employer has a justified reason to suspect that the employee is guilty of such behavior, as well as to clarify occupational accidents.

2. What is processing of personal data based on?

Processing of personal data is based on implementing the City of Vantaa’s justified benefits, performing a public-interest task, or exercising public authority (Article 6.1.e and f of the EU's General Data Protection Regulation).

3. What personal data is collected and who is the data received from?

The recording video-surveillance system entails the video and audio recordings generated on the premises, including the time and place of recording. The register consists of video and audio recordings of people moving in the area. The data is gained from the video and audio material relayed by the cameras included in the recording video-surveillance system.

4. Will your personal data be disclosed to other parties?

In case of suspected crime, the data can be disclosed to the police if they have grounds for gaining the data. Within the city, the data can be disclosed for the purpose of inspecting cases of crime and indemnity.

5. How is personal data protected?

The data in the register is confidential. The recordings generated by the video surveillance system may only be processed by the persons responsible for the task. The employees handling or viewing the data are bound by professional secrecy  that continues after termination of the employees’ employment. The recordings are kept on locked premises. Units have named persons who have the right to view the recordings. In addition, the recordings can be viewed by guards employed by the company responsible for the city’s surveillance operations. The monitors are placed in such a way that outsiders cannot view them.

6. Will the data be transferred outside the European Union (EU) area or the European Economic Area (EEA)?

In cases where a party processes personal data on behalf of the City of Vantaa, the level of appropriate information security and data protection has been agreed on in the agreement made with the processor. As a general rule, data is processed only within the EU or EEA, but the processor may also transfer data outside the EU or EEA countries. Nevertheless, the transfer is only allowed when it meets the contractual demands that ensure a sufficient level of protection of personal data.

7. How will the city act in case of breach of data security?

It is possible that regardless of protection, your personal data may exceptionally end up as a target of a breach of data, as well as in the possession of an outside party. In these cases, the City of Vantaa will immediately act to mend the situation and make the necessary notifications to the national data protection ombudsman and the registered persons.  The City of Vantaa will inform the data protection ombudsman of data seepage immediately or, at the latest, within 72 hours from the time the breach was noticed, if the security breach may cause significant disadvantage to registered persons’ rights or freedoms.

If the breach is likely to present a high risk to the registered persons’ rights or freedoms, the City of Vantaa will inform the registered persons of the matter without any unnecessary delay. In this case, the city will inform the registered persons who are the targets of the  breach of data security of the data seepage. If the security breach applies to many people and the matter does not require that you take any immediate measures, the security breach can also be informed in a general announcement.

8. How long will data be stored?

Data collected in the register will be stored for only as long as and to the extent required by the original or compatible purposes it was collected for. As a general rule, the recordings must be deleted as soon as they are no longer necessary for implementing supervision, and at least within one year. The recordings may be stored for a longer period if necessary for a special reason, for example, a legislative obligation.

According to §17 of the Act on the Protection of Privacy in Working Life, the recordings must be deleted as soon as they are no longer necessary for implementing supervision, and at least within one year.

Nevertheless, the law allows the recordings to be stored even after the deadline, if necessary, in order to complete cases related to harassment or inappropriate behavior. A recording can also be stored, if the employer needs it to prove the appropriateness of terminating an employment relationship, or if there is another reason for storing the recording.

The recordings are stored in the recorder for 2-4 weeks, after which new recordings are saved on top of the old ones. The integrity of the recordings depends on the capacity of the recorder, number of cameras, recording accuracy, image density, and mobility in the cameras’ scope.

9. Will data be used for profiling or automatic decision-making?

Your data will not be used for profiling or automatic decision-making.

10. What are the rights of the registered person and how can the rights be exercised? How long will processing the matter take?

The registered person refers to the person whose personal data is being processed. Depending on the processing basis, the registered person has the right to
•    check what data is processed in the application,
•    demand that inaccurate or faulty data be corrected,
•    demand that your data be removed,
•    demand that handling of your data be restricted,
•    object to handling of your data,
•    get your data and transfer it to another controller, as well as cancel your consent at any time, if processing is based on your consent.

You can submit a personal data inspection request through the online transacting service, on the spot at Vantaa-Info, or by mailing the inspection request to the City of Vantaa’s Registry. You will find more detailed information on the city’s Data Protection website.

If you wish to exercise the registered person's other rights or ask for additional information on handling personal data, please contact the person mentioned below in paragraph 13. Legislative preconditions for exercising your rights will be verified on a case-specific basis. Exercising your rights requires verification of your identity.

We will execute information requests without undue delay, but, at the latest, within a month from receiving the request. The deadline can be extended by at least two months, when required, by accounting for the complexity and amount of data of the request. If the deadline is extended, we will inform you about it.

11. Is exercising my registered person's rights subject to a charge?

As a general rule, exercising your rights is free of charge. Nevertheless, the City of Vantaa may charge a reasonable fee, corresponding with the administrative costs, for implementing the request, or decline to perform the measure, if the request is obviously ungrounded, unreasonable, or recurrent. If implementing the request is subject to a charge, the City of Vantaa will contact the requester before implementing the request. If the City of Vantaa declines to perform the measure, we will inform you in writing about the grounds for the refusal, as well as about your option to submit the matter to be handled by the data protection ombudsman and to exercise other legal remedies.

12. How can I submit an appeal to the supervisory authorities?

If you suspect that your personal data has been handled in an illegal manner, you can submit a complaint to the supervising authority in the EU country where your permanent place of residence or workplace is or where you deem the breach of regulations to have happened. In Finland, the supervising authority is the data protection ombudsman.  More information on and instructions for submitting an appeal is available on the website of the data protection officer's office, as well as over phone consultation.
Data protection officer's office / www.tietosuoja.fi Address: Lintulahdenkuja 4, 00530 Helsinki

Mailing address: PL 800, 00531 Helsinki

email: tietosuoja(at)om.fi

Tel (switchboard): 029 566 6700

Phone (consultation for private persons): tel. 029566 6777

13. Who can I ask for additional information and who is the data controller?

Additional information on processing personal data is provided by the contact person below. Please note that email is not a safe medium for processing personal data. Be sure not to send, for example, your identity number or any delicate information by email.

Contact persons of the register
•    Facility services manager Jari Mattila 

The controller is the City of Vantaa Urban Environment Department. You will find the controller’s and the City of Vantaa’s data protection officer's contact information here:

Controller

City of Vantaa

Urban Environment Department

Business ID. 0124610-9

Address: Asematie 7, 01300 Vantaa
Data protection officer

tietosuojavastaava@vantaa.fi

tel. 040071 3358
Registry's mailing address: PL 1100, 01030 Vantaan kaupunki

Street address: Tikkurila Vantaa-info, Dixi, Ratatie 11,

2nd floor, 01300 Vantaa.

Phone (switchboard): 09 839 11

Fax: 09 8392 4163

email: kirjaamo(at)vantaa.fi