Privacy notice for the Healthy Finland survey

Data form

Privacy notice for the Healthy Finland survey

EU General Data Protection Regulation, Articles 12–14
18 June 2024

The Finnish Institute for Health and Welfare (THL) is carrying out the Healthy Finland survey to produce information on the health, well-being and service use of the population and the factors affecting these areas. This privacy policy describes the processing of personal data and the rights of persons participating in the study. Participation in the trial is voluntary. Section 17 of this description includes more detailed information on your rights and how you may affect the processing of your data.

1. Register controller and contact details

Finnish Institute for Health and Welfare, (“THL”)
P.O. Box 30
FI-00271 Helsinki
Finland
tel. +358 29 524 6000

Contact person for research matters:
Name: Annamari Lundqvist, Chief Researcher
Phone number: +358 29 524 6000 (switchboard)
E-mail: firstname.lastname(at)thl.fi

2. Description of the research project and purpose of the processing of personal data

The aim of the Healthy Finland survey is to provide reliable, up-to-date information on the health, well-being and service use of the population, as well as on the changes and future development of these areas (THL’s statutory duty). The research data will also be utilised in scientific research.

The study collects data through regularly repeated questionnaire surveys, less frequent health examinations and in-depth further examinations. The target group of the Healthy Finland survey is Finnish population aged 20 or over.

In autumn and winter 2024–2025, a data collection by wellbeing services county will be implemented (incl. the City of Helsinki and Åland). Approximately 64,400 randomly selected individuals will be invited to participate in the study and asked to respond to a survey on health, well-being and service use (questionnaire survey).

More information on ongoing and previously implemented data collections is available on the website of the Healthy Finland survey thl.fi/healthyfinland.

The results of the survey will be published on the THL website, in reports and similar publications aimed at the general public, and in scientific peer-reviewed publications. The research data will be used in areas including the evaluation and planning of regional social welfare and healthcare policy.

THL may combine the information obtained through the questionnaires and health examinations with register information from registers maintained by different authorities and health care units. The register data is only used for research and statistical purposes.

Personal data will be used to contact the research subjects and to link the register data mentioned above to the answers provided by a subject in the questionnaire. Once the register data has been combined, any personal identifiers are eliminated from the research data. It is not possible to directly identify individual research subjects from the data used by the researchers.

3. Parties and division of responsibilities for a study carried out as a cooperation project

The Finnish Institute for Health and Welfare (THL) is the data controller in accordance with the EU’s General Data Protection Regulation. THL engages in research collaboration with partners in other organizations within the framework of collaboration agreements. During the term of the collaboration agreement, the partners are joint controllers for certain datasets. The data is transferred to the partners after the personal identifiers have been removed. The joint controllers and the datasets transferred to them are presented in Appendix 1.

THL is in all cases responsible for complying with the data controller obligations defined in the General Data Protection Regulation.

To submit data subject requests (see section 17), research subjects can contact the person mentioned in section 1. If necessary, the contact person will forward the request to the other organizations who are joint controllers.

4. Director or group in charge of the study

Chief Researcher and Docent Annamari Lundqvist is the director in charge of the study.
Address: P.O. Box 30, 00271 Helsinki
Telephone number: +358 29 524 6000 (switchboard)
E-mail: firstname.lastname(at)thl.fi

5. Contact details for THL’s Data Protection Officer

Contact details for THL’s Data Protection Officer: tietosuoja(at)thl.fi

6. Parties carrying out the study

The survey is conducted by the Population Health Unit of THL’s Department of  Public Health and Welfare.

7. Name, nature and duration of the study

Name of the study: Healthy Finland – National study of health, well-being and service use

This is a follow-up study.

The Healthy Finland research project was launched in 2022. Every two years, a new random sample of persons aged 20 or over are invited to participate in the questionnaire survey carried out to collect the survey data. The collection of health examination data is implemented less frequently (approximately every six years). The register follow-up stage of the study will last 70 years. The register data will be updated during the follow-up stage. When the study has ended, the research data will be stored in accordance with section 16.

8. Legal basis for the processing of personal data

In accordance with Article 6(1) of the EU General Data Protection Regulation, the legal basis for the processing of personal data is the following:

  • Compliance with a legal obligation;
  • Scientific or historical research purposes in the public interest, statistical purposes or the exercise of official authority vested in the controller (Data Protection Act, section 4, paragraph 3).

9. Sensitive personal data

The following sensitive personal data are processed in the survey:

  • Race or ethnic origin
  • Genetic data (persons who participated in the health examination)
  • Health data
  • Sexual behaviour
  • Sexual orientation

The processing of sensitive data is based on the following special category under Article 9(2) of the General Data Protection Regulation or special condition under section 6 of the Data Protection Act:

  • scientific or historical research purposes or statistical purposes;
    • the processing is necessary based on a significant public interest;
    • the processing is necessary based on a significant public interest related to national health;
    • processing is provided by law or it is derived directly from a duty set out for the controller by law.

10. Which personal data will be included in the research data

The person’s identification data: name, date of birth, contact information, gender, native language, spatial data coordinates of residence.

Data collected in the research data: data determined by survey data content and data collected during health examinations. The exact data content of the research forms is available on the thl.fi/healthyfinland website.

Data collected from registers:

  • Finnish Institute for Health and Welfare: Care Register for Health Care (HILMO), Register of Primary Health Care Visits (AvoHilmo), Care Register for Social Welfare (SosiaaliHILMO), Cancer Registry, Mass Screening Registry, cancer screenings, Medical Birth Register (birth years, birth and pregnancy monitoring data), Register of Congenital Malformations, Abortion Register, Sterilization Register, National Infectious Diseases Register, Incomes Register, Orthopaedic Endoprosthesis Register, Finnish Register of Visual Impairment.
  • Social Insurance Institution of Finland: Medicine reimbursement rights, medicine purchases, rehabilitation, sickness allowance, disability allowance, insurance information, benefit information, prescription centre and prescription archive (Kanta), medical fees by specialisation, social assistance notifications sent by the Social Insurance Institution of Finland to municipalities, and applications for supplementary support (service needs notifications), basic social assistance, pension information.
  • Statistics Finland: Data on education and occupation, socioeconomic status, main occupation, household income, causes of death, longitudinal data for personal data (FOLK).
  • Finnish Centre for Pensions: pension register (pensions, decisions), earnings register, unpaid periods.
  • Ministry of Economic Affairs and Employment: basic information, job search professions, education qualifications, diagnoses, employment codes, subsidised employment, labour market training, work try-outs, assessments of fitness for work.
  • Digital and Population Data Services Agency: details of the following (incl. history): personal identity code, name, address, email address, municipality of residence, gender, marital status, date of birth, place of birth, municipality of birth, native language, language of service use, nationality, residential building data, residence data, size of household, foreign country of birth, date of immigration, date of death, details of parents (personal identity code, family relationship, country of birth).
  • Tax administration: data on earned income and capital income (salary, pension, dividends, other income).
  • Finnish Register of Kidney Diseases: diagnoses of kidney disease, data on treatments, data on treatment initiation, data on medication, data from end-of-year monitoring, data on deaths.

11. Sources of personal data collected

THL, Social Insurance Institution of Finland, Statistics Finland, Finnish Centre for Pensions, Ministry of Employment and the Economy, Digital and Population Data Services, Finnish Tax Administration, Finnish Register of Kidney Diseases, data provided by the subject through questionnaire forms and data collected during the health examination.

12. Transfer or disclosure of data outside of research group

Personal data is not regularly disclosed or transferred outside of the research group. The research data collected can be used and disclosed in accordance with the Act on the Finnish Institute for Health and Welfare (668/2008) and the Act on the Secondary Use of Social and Health Data (552/2019). For a study that meets the THL criteria for an internal study, the decision is made by THL itself. The Finnish Institute for Health and Welfare has transferred the competence for data access authorisation to the Social and Health Data Permit Authority (Findata), which is primarily responsible for the data access authorisation of other applicant than THL.

For persons who have given biobank consent to THL Biobank, the samples and data can also be used in biobank research (THL Biobank has a separate privacy notice).

13. Transfer of data outside the EU or the European Economic Area

As a rule, no data is transferred or disclosed to parties outside the EU or the European Economic Area. Data permits may be granted to THL’s partners for the purpose of scientific research or statistical investigation. In such cases, all data that would enable direct identification is deleted.

14. Automated decision-making

No automated decision-making will take place in the study.

15. Principles of personal data protection

The data are confidential.

The data processed in the data systems:

  • username
  • password
  • user logs
  • access control.

Processing of direct identifiers:

  • Direct identifiers are eliminated during the analysis phase.

16. Processing of personal data after the end of the survey

The research data will be permanently archived in the National Archives of Finland without direct identifiers.

17. The rights of the data subject and any limitations

Under data protection legislation, research subjects have certain rights. By exercising these rights, research subjects can ensure that the protection of their privacy, which is a fundamental right, is realised. If you would like to exercise your rights, contact THL’s registry [kirjaamo(at)thl.fi] or the contact person mentioned in section 1.

If THL is unable to identify you from the data, rights such as the right of access, the right to rectification and the right to erasure will not be applied.

Withdrawing consent (Article 7 of the General Data Protection Regulation) 

Where the processing of personal data is based on consent, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Right of access (Article 15 of the General Data Protection Regulation)

You have the right to obtain confirmation as to whether or not your personal data are being processed in the survey and which of your personal data are processed in the study. You may also request a copy of the personal data undergoing processing.

Right to rectification (Article 16 of the General Data Protection Regulation)

If your personal data are inaccurate or incorrect, you have the right to request their rectification or supplementation.

Right to erasure (Article 17 of the General Data Protection Regulation)

You have the right to obtain from the controller the erasure of your personal data in the following cases:

  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • you withdraw your consent on which the processing is based and there is no other legal ground for the processing;
  • you object to the processing and there are no overriding legitimate grounds for the processing;
  • the personal data have been unlawfully processed; or
  • the personal data have to be erased for compliance with a legal obligation in Union or Member.

Derogation from the rights

Derogations from the rights described in this section 17 The rights of the data subject and their possible limitations may occur in accordance with the conditions laid down in data protection legislation in so far as the obligation is likely to render impossible or seriously impair the achievement of the objectives of scientific or historical research purposes or statistical purposes. The need for derogation is always assessed on a case-by-case basis.

If you would like to exercise your rights, contact THL’s registry [kirjaamo(at)thl.fi].

Contact requests

If you have any questions about you rights, contact THL’s registry [kirjaamo(at)thl.fi] or the contact person mentioned in section 1.

Right to refer the matter to the Data Protection Ombudsman

You have the right to refer the matter to the Office of the Data Protection Ombudsman if you consider that the valid data protection legislation has been violated in the processing of your personal data.

Contact:

Office of the Data Protection Ombudsman
Visiting address: Lintulahdenkuja 4, 00530 Helsinki, Finland
Mailing address: P.O. Box 800, 00531 Helsinki; Switchboard: +358 29 56 66700 Fax: + 358 29 56 66735
E-mail: tietosuoja(at)om.fi

APPENDIX 1. JOINT CONTROLLERS AND DATASETS

The organisations listed below currently act as joint controllers for the limited sub-data based on data collections performed between 2022 and 2023. The list of joint controllers is kept up to date.

Organisation

Diaconia University of Applied Sciences, Helsinki
City of Espoo: City of Espoo data
City of Helsinki: City of Helsinki data
City of Kaarina: City of Kaarina data
City of Kauniainen: City of Kauniainen data
City of Kuopio: City of Kuopio data
City of Nokia: City of Nokia data
City of Oulu: City of Oulun data
City of Rovaniemi: City of Rovaniemi data
City of Salo: City of Salo data
City of Turku: City of Turku data
Finnish Centre for Pensions, Helsinki
Finnish Institute of Occupational Health, Helsinki
HUS Diagnostic: data from the liver survey
Institute for Molecular Medicine Finland, Helsinki
Parliament of the Åland Islands: data from Åland
Social Insurance Institution of Finland (Kela), Helsinki
University of Eastern Finland, Kuopio, Joensuu: dental examination survey data
University of Helsinki, Helsinki
University of Jyväskylä, Jyväskylä
University of Oulu, Oulu
University of Turku, Turku: microbiome survey data

Updated: