Privacy notice for the School health promotion study 2025
Privacy notice for those participating in the study
EU General data protection regulation, articles 12–14.
This notice describes how your personal data are processed in the School Health Promotion study carried out by the Finnish Institute for Health and Welfare (THL).
In principal, participation in the study is voluntary. There will be no negative consequences for you if you choose not to participate in the study or if you withdraw from the study. For more information on your rights and how you can affect the processing of your personal data, please see the end of this notice.
1. Data Controller
Finnish Institute for Health and Welfare, THL
P.O. Box 30
FI-00271 Helsinki, Finland
tel. +358 29 524 6000
Contact person in matters concerning the study:
Name: Jenni Helenius
Address: P.O. Box 30, FI-00271 Helsinki, Finland
Tel. +358 29 524 8406
E-mail: [email protected]
The e-mail of the Data Protection Officer in THL is tietosuoja(at)thl.fi.
The organizations listed in Appendix 1 make serve as joint controllers for this study, i.e. they jointly define the purposes and means of the processing of personal data.
2. Description of the research project and purpose of the processing of personal data
The School Health Promotion study produces monitoring information on the self-rated health, well-being, lifestyle habits, schoolwork and
studying of children and young people school-specifically. The data enable the results to be examined from the national level all the way
to the municipal and educational institution level.
In 2025, data are collected from 4th and 5th graders and 8th and 9th graders in basic education and 1st and 2nd year students in upper secondary schools and vocational institutions. The survey was answered on an online form at a school or educational institution during the school day. The language options were Finnish, Swedish, Northern Sami, English and Russian.
Data have been collected from 8th and 9th graders in basic education since 1996, from 1st and 2nd year students in general upper secondary schools since 1999, from 1st and 2nd year students in vocational institutions since 2008 and from 4th and 5th graders in basic education since 2017.
The data are used for scientific research and the development of services.
3. Principal investigator of the study
Name: Jenni Helenius
Address: P.O. Box 30, FI-00271 Helsinki, Finland
Tel. +358 29 524 8406
E-mail: firstname.lastname(at)thl.fi
4. Persons processing personal data in the study
The personal data included in the research material is only processed by those researchers whose work tasks require it. Researchers processing personal data have a legal or contractual obligation of confidentiality.
THL's partners act as joint controller with THL for the sub-materials and sub-studies used in the collaborative research. Joint controllers, as well as the sub-materials transferred to them, are described in Appendix 1.
5. Lawful basis of processing personal data
The processing of personal data is always based on current legislation. THL's duties are defined in the Act on the Finnish Institute for Health and Welfare (668/2008).
The lawful basis for the processing of personal data described in this notice is: Scientific or historical research in the public interest, statistics or
the exercise of official authority vested in the controller (Article 6(1)(e) of the GDPR and Article 4(3) of the Finnish Data Protection Act (1050/2018)).
6. Sensitive personal data
The following sensitive personal data are processed in the study:
- Racial or ethnic origin
- Health data
- Sexual behaviour
- Sexual orientation.
The processing of sensitive data is based on the following special category under Article 9(2) of the General Data Protection Regulation or special condition under section 6 of the Finnish Data Protection Act (1050/2018): Scientific or historical research purposes or statistical purposes.
Personal data relating to criminal convictions and offences, or related security measures will not be processed in the study.
7. Which personal data are processed?
The research data do not contain direct personal data. Indirect identification using data collected from the research subject (school and its location, grade, field of education (only in vocational institutions), gender, experience of gender, age, sexual orientation, country of birth of one's own and parents, area of residence (only in Helsinki), housing arrangements, family characteristics) may be possible.
8. Sources of personal data collected
Questionnaire completed by the research subject. School and municipal information is obtained from Statistics Finland and the registers maintained by the Finnish National Board of Education on the basis of the information attached to the respondent’s ID.
9. Transfer or disclosure of the personal data to third parties
Personal data are not regularly disclosed or transferred outside the research group.
Data may be transferred to those requesting it in accordance with the Act on the Openness of Government Activities (621/1999), the Act on the Secondary Use of Social and Health Data (552/2019) or other mandatory legislation or international agreements.
Research data are stored without personal data in the Finnish Social Science Data Archive (FSD). The FSD will pass on the data for further use in accordance with the decisions of the THL research team. Access licences are granted only to registered customers of the FSD in the European Economic Area for research purposes and higher studies.
10. Transfer of personal data to countries outside the EU/European Economic Area or to international organizations
Personal data are not transferred to non-EU/EEA countries or to international organizations.
However, personal data may be transferred to the UK, in which case the transfer is based on the following transfer mechanism: Commission Decision on the adequacy of data protection.
THL has assessed the risks associated with the transfer of personal data and has implemented sufficient additional protection measures to ensure that the level of data protection in the EU is maintained.
11. Profiling and automated decisions
THL doesn’t make automated decisions.
12. Safeguards to protect the personal data
In this study the personal data are confidential.
Protection of manual material: locked space, access control.
Personal data processed in IT systems:
- access management
- user logs
- access control
- two-factor authentication.
Processing of direct identifiers: Direct identifiers will be removed in the analysis phase, or the data are pseudonymized.
13. Duration of the study and processing of personal data after the completion of the study
This study is a one-time study.
Duration of the study (how long the personal data will be processed): Research material must be permanently stored.
At the end of the study, the research data are stored without identification data in accordance with THL's data management model permanently.
At the end of the storage period, the research material can be archived.
14. What rights do you have?
Under data protection legislation, research subjects have certain rights which they can exercise in order to ensure the protection of their privacy, which is one of their fundamental rights. If you would like to exercise your rights, contact THL's registry office (kirjaamo(at)thl.fi) or the contact person mentioned in section 2.
Data protection legislation grants you certain rights to ensure the protection of your privacy, which is a fundamental right. If you wish to exercise your right, please follow THL's instructions or alternatively contact the THL Registry (kirjaamo(at)thl.fi) or the contact person mentioned in section 1.
More information about data protection
In certain cases, your rights may be limited, for example, due to a statutory obligation of THL or if the processing is for scientific research, statistics or archiving. If your rights are restricted, THL will implement appropriate and necessary safeguards as required by law.
If THL is unable to identify you from the material, the right to inspect, rectify, delete and restrict processing, among other things, does not apply.
Right to withdraw consent
If we process your personal data on the basis of your consent, you have the right to withdraw such consent.
The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of consent before its withdrawal.
Right of access
You have the right to know whether your personal data will be processed in this study. In addition, you have the right to know what personal data relating to you are processed and how they are processed. You also have the right to receive a copy of the personal data concerning you to the extent that the provision of a copy does not adversely affect the rights and freedoms of others or if THL has no legal basis to refuse the disclosure of the data.
Right to rectification
In principle, you have the right to rectification of inaccurate or incorrect data.
Right to erasure
You may have the right to have your data removed from this study. If the processing of the data is based on the performance of a statutory task of THL or there is some other legal obligation to retain the data, your right to erasure is likely to be restricted.
Right to restriction of processing
You may have the right to restrict the processing of personal data in cases provided for by law. The right to restriction may apply, for example, if you believe that the personal data concerning you is incorrect, is processed unlawfully, or you have objected to the processing of your data. We may process data subject to restriction only with your consent, for the establishment, exercise or defence of a legal claim, for the public interest of the EU or Finland, or to protect the rights of another person.
Right to object to the processing of personal data
You may have the right to object to the processing of personal data in cases provided for by law. The right to object may apply, for example, if the data are used for direct marketing purposes.
Right to refer the matter to the Data Protection Ombudsman
You have the right to have the lawfulness of the processing of personal data assessed by the Data Protection Ombudsman.
Contact details:
Data Protection Ombudsman’s Office (Tietosuojavaltuutetun toimisto)
Address: Lintulahdenkuja 4, 00530 Helsinki, Finland
Postal address: P.O. Box 800, FI-00531 Helsinki, Finland
Tel. (switchboard): +358 29 56 66700
E-mail: tietosuoja(at)om.fi.
Appendix 1. Joint controllers
THL's partners act as joint controllers with THL for the sub-materials and sub-studies used in the collaborative research. The sub-study to be conducted with the City of Helsinki concerns educational institutions located in Helsinki.
Contact information:
City of Helsinki
P.O. Box 1
00099 Helsingin kaupunki
Tel. +358 9 310 1691
Data Protection Officer: tietosuoja(at)hel.fi.
The list will be updated as cooperation studies begin.