Processing of personal data in the Kohtaanto +50 project

This document outlines how the City of Vantaa processes your data, if you participate in the Kohtaanto +50 project. The project is based on the EU’s Regional and Structural Policy Programme Innovation and Skills in Finland 2021–2027 and more specifically on its specific objective “Pathways to work” (European Social Fund (ESF+)).

The Häme Centre for Economic Development, Transport and the Environment has granted support by its decision (Record no.: EURA 2021/201020/09 02 01 01/2022/HÄMELY, hereinafter referred to as the project decision) to the City of Vantaa for the implementation of the project under the Act on the Funding of Regional Development and the European Union’s Regional and Structural Policy Projects (757/2021).

The project will run from 1 May 2023 to 30 April 2025. The sole implementer of the project is the City of Vantaa.

1. For what purpose is personal data processed?

When you participate in the Kohtaanto +50 project, we at the City of Vantaa process your personal data for the purpose of implementing the project in accordance with the project decision and project plan. Our aim is to promote the employment of the people involved in the project, to develop the processes of the employment service and to encourage employers to hire jobseekers belonging to the target group.

The target groups of the project are:

1)    long-term unemployed and Vantaa-based jobseekers at risk of long-term unemployment over 50 years of age. As a jobseeker client of the project, you will have access to career guidance and the opportunity to develop your skills and job seeking skills. You will receive information about the progress of the project, coaching opportunities coordinated by the project, hidden jobs and opportunities to participate in the project’s development work.

2)    SMEs in need of labour whose recruitment and job supply practices will be developed to be more in tune with the clients targeted by the project (building an employer network; corporate cooperation, recruitment coaching and job design).

During the project, newsletters on topical issues of the project will be sent to the clients and employers involved in the project. We will never use data for any other purposes, such as direct marketing or commercial aims.

2. What is the basis for the processing of personal data?

The processing of personal data necessary for the organisation of the Kohtaanto +50 project is based on the City of Vantaa’s obligation to collect the personal data of project participants as required by the project decision. The personal data to be collected is governed by Section 56 of the Act on the Funding of Regional Development and the European Union’s Regional and Structural Policy Projects (757/2021). The personal data is stored in the EURA 2021 system, referred to in Section 50 of the act, the controller of which is the Ministry of Economic Affairs and Employment. You can find the EURA 2021 information document at this link.

Once you have joined the Kohtaanto +50 project, you can enter your data into EURA 2021 yourself with the help of suomi.fi e-Identification. If you are unable to do this, our project worker will enter your data into the system after verifying your identity.

Participation in the Kohtaanto +50 project is voluntary for you. As the City of Vantaa determines the purposes and means of processing personal data in the project application, the City of Vantaa (City Board) is also a controller within the meaning of the EU General Data Protection Regulation. For this reason, we will ask you separately for your written consent to process your personal data necessary for the implementation and organisation of the project by the City of Vantaa.

In addition to your consent, the processing of your personal data is based on the performance of a task carried out in the public interest by a public authority. In our opinion, the processing of your personal data in accordance with Section 4(1)(2) of the Data Protection Act (1050/2018) is necessary and proportionate to the purpose of the project. The general interest is related to the duty of the public authorities to promote employment and to seek to secure the right to work for everyone, as laid down in Section 18(2) of the Finnish Constitution (731/1999).

We process the personal data of an employer’s representative on the basis of the performance of a task carried out in the public interest.

Legal basis for the processing:
Article 6(1)(a) and (e) of the EU General Data Protection Regulation (2016/679) 
Section 4 of the Data Protection Act (1020/2018)

3. What personal data is collected by the Kohtaanto +50 project, and from whom is the data obtained?

We collect the following personal data about you:

•    name
•    personal identity code
•    contact information
•    information on education, employment history and professional skills
•    language skills and nationality
•    whether you are unemployed, employed or outside working life and whether you have started looking for a job during the project, whether you have started studying during the project or whether you have found a job
•    the things agreed with the project staff during the consultation process in relation to the promotion of your employment in the project 
•    dates when you started and finished in the project

We obtain the data from you and from the Vantaa-Kerava local government pilot on employment.

We collect the following personal and other identifying information about the employer’s representative: name, job title, telephone number, e-mail address, company sector, business ID, postal address, other company contact details, municipality and company size. We receive information on employers from the Business Information System (YTJ), the Vantaa-Kerava local government pilot on employment (register of public employment services), the City of Vantaa’s Business Information System and from a company’s representative when dealing with that company.

4. Is the provision of personal data necessary?

Yes, it is. We cannot carry out the project without processing the personal data of the participants. In addition, the project decision requires the collection of the personal data of the persons participating in the project, as referred to in Section 56 of the Act on the Funding of Regional Development and the European Union’s Regional and Structural Policy Projects (757/2021).

5. Are personal data disclosed to third parties?

We only disclose your data if the disclosure is based on legislation or if you have given your consent to the disclosure of your data. You can withdraw your consent to the disclosure at any time. The data will never be disclosed to third parties for marketing or other commercial purposes.

6. How are personal data protected?

Data security and data protection have been secured by various technical and organisational measures to ensure your privacy. For example, personal data may be processed only by persons who need them to perform their work or official duties and only to the extent required by an individual task. In the client data system, this is monitored, among other things, by using log information. Paper documents are kept in city archives in a safe place that no outsider can access.

Staff are bound by the obligation of professional confidentiality and will continue to be bound by it
even after the conclusion of their employment.

7. Are personal data transferred outside the EU or EEA?

In cases where the processor of personal data handles personal data on behalf of the City of Vantaa, the appropriate level of data security and data protection has been agreed in an agreement with the processor. “Processor of personal data” means a party that processes personal data for the city, such as a service provider.

As a rule, data is only processed in the EU or EEA territory, but the processor can also transfer data outside the EU or EEA. However, such a transfer is only permitted if it meets the requirements set out in the data protection legislation and the agreement, which ensure an adequate level of protection for personal data.

From the information systems used by the project, personal data will not be transferred outside the EU or EEA, except for the Outlook e-mail system (Microsoft O365 e-mail system), from which the processor of personal data (Microsoft) may transfer data outside the EU or EEA. The transfer is based on the 10 July 2023 decision of the European Commission on the adequacy of data protection level in the United States. The US companies to which data is transferred (such as Microsoft) are certified companies committed to the safeguards agreed between the EU and the US.

8. What does the city do in case of a security breach?

Despite the protection measures, it is possible in exceptional cases that your personal data may be subject to a security breach or end up in the hands of a third party. In these cases, we will take immediate measures to rectify the situation. If the breach causes a risk to you, we will notify the Data Protection Ombudsman. The notification shall be made no later than 72 hours after discovering the breach. If the security breach poses a high risk, we will also notify you of the security breach.

9. How long are the data kept?

The data is kept and destroyed in accordance with the City of Vantaa’s information management plan. The storing times of documents defined in the data management plan are based on legislation, the National Archives of Finland’s provisions concerning permanently stored documents and the Association of Finnish Municipalities’ recommendations concerning documents stored for a definite period of time. At the end of the period, the data will be destroyed.

Personal customer data will be stored for five (5) years, starting from the beginning of the year following the year in which the project ended, i.e. until 31 December 2030. Data relating to financial commitments are kept for 10 years as per the Accounting Act. The data of business partners (employers) related to the project will be stored for 10 years from the last entry of measures in the business information system.

10. Will the data be used for profiling or automatic decision-making?

Your data will not be used for profiling or automatic decision-making.

11. What rights does a data subject have, and how can these rights be exercised? How long does processing a case take?

“Data subject” means the person whose personal data is being processed. If we process your personal data, you have the right to: 
-    check what data of yours are being processed
-    demand the correction of incorrect or inaccurate data
-    demand the erasure of your data
-    demand the restriction of the processing of your data
-    object to the processing of your data
-    the right to receive your data and transfer it to another registry as well as to cancel the consent you have given at any time if the processing is based on that consent.

You can also submit an access request in person at Vantaa Info. Access request forms are available at Vantaa Info and on the vantaa.fi website. Bring along a passport, driving licence or ID card with a photo to prove your identity. The form can also be delivered by post to the address Kirjaamo, PL 1100, 01030 Vantaan kaupunki. In this case, we will check your identity in some other reliable way.

If you wish to enforce other rights to which you are entitled as a registered party or request additional information on the processing of personal data, please contact the person specified under section 14 below. The legal basis for the enforcement of your rights is verified on a case-by-case basis. In order to enforce your rights, you may have to prove your identity.

We will fulfil the requests without undue delay, but no later than within one month of receiving each request. If necessary, the deadline may be postponed by a maximum of two months based on the complexity of the request and the quantity of the information. If the deadline is postponed, you will be notified.

12. Is there a fee for the exercise of one’s rights?

As a general rule, exercising one’s rights is free of charge. However, we may collect a reasonable fee corresponding to the administrative costs or refuse a request if the request in question is clearly unfounded, unreasonable or recurrent. We will contact you if we intend to collect a fee for completing your request. If we refuse to complete your requested measure, you will be informed in writing of the grounds for the refusal and your right to refer the matter to the Data Protection Ombudsman or resort to other legal remedies.

13. How can I submit an appeal to a supervisory authority?

If you suspect that your personal data is being processed unlawfully, you can submit an appeal to the Data Protection Ombudsman. More information and instructions on submitting an appeal are available from the contact person specified in section 14, the city’s data protection officer and on the website of the Office of the Data Protection Ombudsman and the office’s telephone guidance service:

Office of the Data Protection Ombudsman/www.tietosuoja.fi
Visiting address: Lintulahdenkuja 4, FI-00530 Helsinki
Postal address: PL 800, 00531 Helsinki
Email: tietosuoja(at)om.fi 
Tel. (exchange): +358 29 566 6700
Tel. (helpline for private individuals): +358 29 566 6777

14. Where can I request more information, and who is the controller?

More information on the processing of personal data is available from the contact person specified below. Please note that email is not a safe medium for processing personal data. As such, please do not send sensitive information, such as your personal identity code, via email.

Contact person
Titta Suopajärvi, Project Manager, Kohtaanto +50 project, Urban Strategy and Management Department, Employment and Integration Service Area, Employment Services
firstname.lastname(at)vantaa.fi, tel. +358 40 620 1382

Janne Riipinen, Lawyer, Urban Strategy and Management, Employment and Integration Service Area,
firstname.lastname(at)vantaa.fi, tel. +358 40 500 2745
 

The controller is the City of Vantaa, the City Board (Section 1 of Chapter 8 of the Administrative Regulations of the City of Vantaa). Contact details of the controller and the City of Vantaa data protection officer can be found below:

Controller
City of Vantaa
City Board
Business ID 0124610-9
Asematie 7, 01300 Vantaa

Data protection officer
tietosuojavastaava@vantaa.fi

Registry Office    
Postal address: PL 1100, 01030 Vantaan kaupunki
Visiting address: Vantaa Info Centre Tikkurila, Dixi, Ratatie 11, 2nd floor, 01300 Vantaa.
Tel. (exchange): +358 9 839 11
Fax +358 9 8392 4163, email: kirjaamo(at)vantaa.fi