Privacy notice for the School health promotion study 2023

Information for those participating in the study

EU General data protection regulation, articles 12–14.

This document describes how the Finnish Institute for Health and Welfare (THL) processes your personal data in this study. Participation in the study is always voluntary. You will not face any negative consequences if you do not participate in the study or if you discontinue your participation in it. If you discontinue your participation in the study, the material collected before you do so can still be used in the study. Section 18 of this description includes more detailed information on your rights and how you may affect the processing of your data.

1. Controllers of the study

Finnish Institute for Health and Welfare (THL)
P.O. Box 30, 00271 Helsinki, Finland
+358 29 524 6000

The City of Helsinki

University of Helsinki

University of Jyväskylä

The organizations mentioned above make the decisions on and are responsible for processing personal data for the purposes described in this notice; in other words, they are the controllers for these data.

2. Contact person in matters concerning the study

Name: Jenni Helenius
Telephone number: + 358 29 524 8406
Email: [email protected].

3. Description of the research project and purpose of the processing of personal data

The School Health Promotion study collects follow-up information on children's and youth's well-being, health, school work and studies school-specifically. The material enables the results to be examined from the national level all the way to the municipal and educational institution level.

In 2023, data were collected from 4th and 5th graders and 8th and 9th graders in basic education and 1st and 2nd year students in upper secondary schools and vocational institutions. The survey was answered on an online form at a school or educational institution during the school day. The language options were Finnish, Swedish, Northern Sami, English and Russian.

Data have been collected from 8th and 9th graders in basic education since 1996, from 1st and 2nd year students in general upper secondary schools since 1999 and from 1st and 2nd year students in vocational institutions.

The data are used for scientific research and the development of services.

4. Parties and division of responsibilities for a study carried out as a cooperation project

THL's partners act as joint controllers with THL for the sub-materials and sub-studies used in the collaborative study. The sub-study with the City of Helsinki concerns schools located in Helsinki. The substudy with the University of Helsinki concerns school burnout and school enthusiasm. The sub-study with the University of Jyväskylä concerns disabilities.

The organizations listed in section 1 act as joint controllers in this study, meaning that they jointly define the purposes and means of processing personal data.

Research subjects can submit all requests to exercise the data subject's rights related to this study to the contact person below:

Name: Jenni Helenius
Telephone number: + 358 29 524 8406
Email: [email protected].

If necessary, the contact person also forwards the request to other organizations acting as joint controllers.

The research subject may exercise their rights under the Data Protection Act in relation to both controllers. In such cases, the recipient may also, where needed, forward the request or demand to other joint controllers as well.

5. Director or group in charge of the study

Name: Jenni Helenius
Telephone number: + 358 29 524 8406
Email: [email protected]

6. Contact information for data protection officer

The email address for THL’s data protection officer is: tietosuoja(at)thl.fi.

7. Parties carrying out the study

Research group for the School Health Promotion Study.

Based on the internal data access authorization and cooperation agreement, the data are used for research purposes (e.g. research carried out at universities).

Based on the external data access authorization, the data are used for research and service development (e.g. municipalities and universities).

For any material disclosed outside of the research group of the School Health Promotion Study, the possibility of indirect identification is reduced by removing and aggregating variables.

8. Name, nature and duration of the study

Name: School Health Promotion Study 2023.

Type of study: One-time study.

Duration of study (how long the personal data will be processed): 1 March 2023 –

9. Legal basis for the processing of personal data

In accordance with Article 6(1) of the EU General Data Protection Regulation, the legal basis for the processing of personal data is the following: Compliance with a legal obligation (General Data Protection Regulation, Article 6(1)(c)).

10. Sensitive personal data

The study involves processing the following personal data:

  • race or ethnic origin
  • health data
  • sexual behavior or orientation.

In addition, the processing of sensitive data is based on the following special category of Article 9(2) of the General Data Protection Regulation: Other reason: Special condition under Article 9 of the Data Protection Regulation or Article 6 of the Data Protection Act: Processing is provided by law or it is derived directly from a duty set out for the controller by law.

11. What personal data are processed?

The research data does not contain direct personal data. Indirect identification using data collected from the research subject (school, grade, municipality, gender, birth, form of housing) may be possible.

12. Sources of personal data collected

Questionnaire completed by the research subject. School and municipal information is obtained from Statistics Finland and the registers maintained by the Finnish National Board of Education on the basis of the information attached to the respondent's ID.

13. Transfer or disclosure of data outside of research group

Collected research data from which the possibility of indirect identification has been further reduced may be disclosed based on a research plan and an approved user license application for purposes of research and development of services.

14. Transfer or disclosure of data outside the EU or the European Economic Area

Personal data are not transferred to non-EU/EEA countries.

15. Automated decision-making

This scientific study does not involve automated decisions.

16. Principles of protection of personal data

The data are confidential. The controller has prepared a data protection impact assessment. The controller is committed to complying with the established code of conduct in its field.

Protection of manual material: Locked space.

Data processed in the information systems:

  • Username
  • Password
  • Registration of use
  • Passage control.

Processing of direct identifiers: Direct identifiers are eliminated during the analysis phase.

17. Processing of personal data after the end of the study

The research data are archived in anonymous form without direct identifiers.

Location and duration of data archiving: Finnish Institute for Health and Welfare (THL), Mannerheimintie 166, FI-00271 Helsinki, Finland.

Permanent storage.

18. The rights of the data subject and any limitations

Under data protection legislation, research subjects have certain rights which they can exercise in order to ensure the protection of their privacy, which is one of their fundamental rights. If you would like to exercise your rights, contact THL's registry office [kirjaamo(at)thl.fi] or the contact person mentioned in section 2.

Withdrawing consent (Article 7 of the General Data Protection Regulation)

Where the processing of personal data is based on consent, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Right of access (Article 15 of the General Data Protection Regulation)

You have the right to obtain confirmation as to whether or not your personal data are being processed in the study and which of your personal data are processed in the study. You may also request a copy of the personal data undergoing processing.

Right to rectification (Article 16 of the General Data Protection Regulation)

If your personal data are inaccurate or incorrect, you have the right to request their rectification or supplementation.

Right to erasure (Article 17 of the General Data Protection Regulation)

You have the right to obtain from the controller the erasure of your personal data in the following cases:

  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed
  • you withdraw your consent on which the processing is based and there is no other legal ground for the processing
  • you object to the processing and there are no overriding legitimate grounds for the processing
  • the personal data have been unlawfully processed; or
  • the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.

Derogation from the rights

Derogations from the rights described in this section 18 The rights of the data subject and their possible limitations may occur in accordance with the conditions laid down in data protection legislation in so far as the obligation is likely to render impossible or seriously impair the achievement of the objectives of scientific or historical research purposes. The need for derogation is always assessed on a case-by-case basis.

If you would like to exercise your rights, contact the organization’s registry office [kirjaamo(at)thl.fi].

Contact

If you have any questions about you rights, contact THL’s registry [kirjaamo(at)thl.fi] or the contact person mentioned in section 2.

Right to refer the matter to the Data Protection Ombudsman

You have the right to refer the matter to the Office of the Data Protection Ombudsman if you consider that the valid data protection legislation has been violated in the processing of your personal data.

Contact:

Office of the Data Protection Ombudsman
Visiting address: Lintulahdenkuja 4, 005
30 Helsinki
Mailing address: P.O. Box 800, 005
31 Helsinki, Finland
Switchboard: +358 29 566 6700 E-mail: tietosuoja(at)om.fi.