Privacy notice 2025–2026

Privacy notice for the Healthy Finland 2025–2026 survey

EU General Data Protection Regulation, Articles 12–14
31 August 2025

The Finnish Institute for Health and Welfare (THL) is carrying out the Healthy Finland survey, which produces information on the health, well-being and service use of the population and the factors affecting these areas. This privacy notice describes the processing of personal data and the rights of persons participating in the study. Participation in the survey is voluntary. The end of this privacy notice contains details on what rights you have and how you can influence the processing of your data.

1. Register controller and contact details

THL determines and is responsible for the processing of personal data for the purpose described in this notice. This means that THL is the data controller for this information.

Contact information:
Finnish Institute for Health and Welfare (THL)
P.O. Box 30
FI-00271 Helsinki, Finland
Tel. +358 29 524 6000

Contact person for research matters:
Name: Suvi Parikka, Research Manager
Telephone number: +358 29 524 6000 (switchboard)
E-mail: firstname.lastname(at)thl.fi
E-mail address for THL’s Data Protection Officer: tietosuoja(at)thl.fi

2. Description of the research project and the purpose of processing personal data

The aim of the Healthy Finland survey is to provide reliable, up-to-date information on the health, well-being and service use of the population, as well as on the changes and future development of these areas (THL’s statutory duty). The research data will also be utilised in scientific research.

For more information please see the Healthy Finland survey web pages at thl.fi/healthyfinland.

The content of the survey is based on the European Health Interview Survey (EHIS wave 4). EHIS is a questionnaire or interview study conducted between European Union (EU) Member States, which provides statistical information on health status, determinants of health and health care activities. The target group is Finnish population aged 15 or over. Approximately 16,000 randomly selected persons are invited to respond to the survey.

Statistics produced from the survey are submitted to Eurostat (EHIS wave 4 microdata). The results of the survey will be published on THL’s website and in Eurostat’s online service. Individual respondents cannot be identified in the result reports. 

THL may combine the information obtained through surveys with register information from registers maintained by different authorities and health care units. The register data are only used for research and statistical purposes. The register data can be maintained and updated for a maximum of 30 years after the end of the study’s data collection.

Personal data will be used to contact the research subjects and to link the register data mentioned above to the answers provided by a subject in the survey. Once the register data have been combined, any personal identifiers are eliminated from the research data. It is not possible to directly identify individual research subjects from the data used by the researchers.

3. Director in charge of the survey

Research Manager Suvi Parikka is the director in charge of the survey.
Address: P.O. Box 30, 00271 Helsinki
Telephone number: +358 29 524 6000 (switchboard)
E-mail: firstname.lastname(at)thl.fi

4. Parties carrying out the study

The survey is conducted by the Welfare Epidemiology and Monitoring Unit of THL’s Department of Public Health.
Personal data contained in the research data are only processed by researchers whose tasks require it. Researchers processing personal data have a legal or contractual obligation to confidentiality.

5. Legal basis for the processing of personal data

The processing of personal data is always based on valid legislation. THL’s tasks are laid down in the Act on the National Institute for Health and Welfare (668/2008).

The lawful grounds for processing personal data described in this notice are:

• Compliance with a legal obligation (General Data Protection Regulation, Article 6(1)(c)).
• The IESS Regulation on EU public health statistics (2019/1700) and the EHIS implementing act (2023/2529), which provides more details on this and the Delegated Regulation on data collection variables (2024/297) specify it.

6.Sensitive personal data

The following data belonging to special categories of personal data are processed in the survey:

• Health data

The processing of special categories of personal data is based on the following special category under Article 9(2) of the General Data Protection Regulation or special condition under section 6 of the Data Protection Act (1050/2018):

• Processing is provided by law, or it is derived directly from a duty set out for the controller by law.

Personal data concerning criminal convictions or offences are not processed in this study.

7. What personal data are processed?

The person’s identification data: name, date of birth, contact information, gender, native language, spatial data coordinates of residence.

Data collected from research data: data according to the data content of the questionnaire. The exact data content of the research forms is available on the website at thl.fi/healthyfinland.

Data collected from registers:

Digital and Population Data Services Agency: details of the following (incl. history): personal identity code, name, address, email address, municipality of residence, gender, marital status, date of birth, place of birth, municipality of birth, native language, language of service use, nationality, residential building data, residence data, size of household, foreign country of birth, date of immigration, date of death, details of parents (personal identity code, family relationship, country of birth).

Statistics Finland: gender, age, residential area, statistical grouping of municipalities, country of residence, country of birth, father’s country of birth, mother’s country of birth, nationality, number of persons in the household, household income, education, socioeconomic status, main occupation, sector, main activity, causes of death. 

Finnish Institute for Health and Welfare (THL): Care Register for Health Care (HILMO), Register of Primary Health Care Visits (AvoHilmo), Vaccinations Register, Care Register for Social Welfare (SosiaaliHILMO), Finnish Cancer Registry, cancer screenings, Medical Birth Register (birth years, birth and pregnancy monitoring data), Abortion Register, National Infectious Diseases Register, Incomes Register.

Social Insurance Institution of Finland:  Medicine reimbursement rights, medicine purchases, rehabilitation, sickness allowance, disability allowance, insurance information, benefit information, prescription centre and prescription archive (Kanta), medical fees by specialisation, social assistance notifications sent by the Social Insurance Institution of Finland to municipalities, and applications for supplementary support (service needs notifications), basic social assistance, pension information

Finnish Centre for Pensions: Pension Register (pensions, decisions), earnings- and accrual register, unpaid periods.

8. From what sources are personal data collected 

Digital and Population Data Services Agency, Statistics Finland, THL, Social Insurance Institution of Finland, Finnish Centre for Pensions, data provided by the subject through questionnaire forms.

9. Disclosure of personal data outside the research group

Personal data is not regularly disclosed or transferred outside the research group. The research data collected can be used and disclosed in accordance with the Act on the Finnish Institute for Health and Welfare (668/2008) and the Act on the Secondary Use of Social and Health Data (552/2019). For a study that meets the THL criteria for an internal study, the decision is made by THL itself. THL has transferred the competence for data access authorisation to the Social and Health Data Permit Authority (Findata), which is primarily responsible for the data access authorisation of another applicant than THL.

10. Transfer of data outside the EU or the European Economic Area or to international organisations

As a rule, no data is transferred or disclosed to parties outside the EU or the European Economic Area. Data permits may be granted to THL’s partners for the purpose of scientific research or statistical investigation. In such cases, all data that would enable direct identification is deleted.

11. Profiling and automated decision-making

THL does not allow automated decision-making.

12. Principles and means of personal data protection

The personal data processed in this study are confidential. 
The data processed in the data systems:

• access management
• data encryption
• logging
• access control
• two-step identification

Processing of direct identifiers:

• Direct identification data will be deleted before the analysis phase, or the data will be pseudonymised.

13. Duration of the study and processing of personal data after completion of the study

This survey is a one-time study.
The register follow-up stage of the survey will last 30 years. The register data will be updated during the follow-up stage.
When the study comes to an end, the research data will be permanently archived in the National Archives of Finland without direct identifiers.

14. What rights do you have?

Under data protection legislation, you have certain rights. By exercising these rights, you can ensure that the protection of your privacy, which is one of your fundamental rights, is realised. If you wish to exercise your right, follow these instructions: thl.fi/thl/tietosuoja or, alternatively, contact THL’s registry (kirjaamo(at)thl.fi) or the contact person mentioned in section 1.

Your rights may be restricted in certain cases, for example due to one of THL’s statutory obligations or if the processing takes place for scientific research or for statistical or archiving purposes. If your rights are restricted, THL will provide for appropriate and necessary safeguards required under the data protection legislation.

If THL cannot identify you from the material, the right to access, rectify and delete data and restrict the processing of the data will not be applied.

Right to withdraw consent

If we are processing your personal data based on your consent, you have the right to withdraw this consent. 
The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

Right to access data concerning you

You have the right to know if your personal data is being processed for the purposes of this study. You also have the right to know which personal data concerning you are processed and how. Additionally, you have the right to receive a copy of the personal data concerning you, provided that giving you this copy will not have adverse effects on the rights and freedoms of others and that THL does not have legal grounds for refusing to disclose the data.

Right to rectification of data

As a rule, you have a right to have inaccurate or incorrect data rectified. 

Right to erasure of your data

You may have the right to have your data deleted from this study. If the processing of your data is based on the performance of THL’s statutory tasks or there is some other legal obligation associated with preserving it, your right to have the data deleted probably is restricted.

Right to restrict processing

You may have a right to restrict the processing of your personal data in cases laid down in the law. The right to restrict processing may exist, for instance, if you believe that the personal data concerning you are inaccurate, they are being processed unlawfully, or you have opposed the processing of your data. The data subject to the restriction can only be processed with your consent, where necessary for the establishment, exercise, or defence of legal claims, or where it is in Finland’s and the EU’s general interest or essential to protect another person’s rights.

Right to oppose the processing of personal data

You may have the right to oppose the processing of your personal data in cases laid down in the law. The right to oppose may apply in situations such as those where data is used for direct marketing purposes.

Right to refer the matter to the supervisory authority

You have the right to request that the Data Protection Ombudsman assess the lawfulness of the processing of your personal data.

Contact information:
Office of the Data Protection Ombudsman
Visiting address: Lintulahdenkuja 4, 00530 Helsinki, Finland
Mailing address: P.O. Box 800, 00531 Helsinki, Finland
Switchboard: +358 29 56 66700
E-mail: tietosuoja(at)om.fi