Privacy notice of the KOTT survey

Information for survey participants

EU General Data Protection Regulation, Articles 12–14
30 November 2023

The Finnish Institute for Health and Welfare (THL) is conducting the Finnish Student Health and Wellbeing Survey, which produces up-to-date data on the health, welfare, study ability and health services of higher education students and the changes in these. This privacy notice describes the processing of personal data and the rights of persons participating in the study. Participation in the survey is voluntary. Section 17 of this description includes more detailed information on your rights and how you may influence the processing of your data.

1. Register controller and contact details

Finnish Institute for Health and Welfare, (“THL”)
P.O. Box 30
FI-00271 Helsinki
Finland 
tel. +358 29 524 6000

Contact person for study-related matters:
Name: Suvi Parikka, Development Manager
Tel. +358 29 524 6000 (switchboard)
E-mail: firstname.lastname(at)thl.fi

2. Description of the research project and the purpose of processing personal data

The aim of the Finnish Student Health and Wellbeing Survey is to produce up-to-date data on the health, well-being, ability to study and health services of higher education students and the changes in these (statutory task of the Finnish Institute for Health and Welfare). The research data will also be utilised in scientific research.

The study’s target comprises university and university of applied sciences students aged between 18 and 34 years who have enrolled as present for spring 2024 and are studying for a bachelor’s degree at a Finnish higher education institution. To start, a total of 12,000 people will be randomly selected for the sample. In addition, the persons included in the sample of the KOTT 2021 survey who are still continuing their studies and have registered as present in spring 2024 will be included in the sample. The study’s results will be published on the THL website. 

For more information on the study, see thl.fi/kott.

THL may combine the information obtained through surveys with register information from registers maintained by different authorities and health care units. The register data is only used for research and statistical purposes.

Personal data will be used to contact the research subjects and to link the register data mentioned above to the answers provided by a subject in the survey. Once the register data has been combined, any personal identifiers are eliminated from the research data. It is not possible to directly identify individual research subjects from the data used by the researchers.

3. Parties and division of responsibilities for a study carried out as a cooperation project

THL is the controller as defined in the EU’s General Data Protection Regulation. THL collaborates with partners in other organisations within the framework of cooperation agreements. For the duration of the cooperation agreement, the partners act as joint controllers for limited sub-data. The data will be transferred to the partners in a form where the data enabling the identification of an individual subject has been deleted. 

In all cases, THL is responsible for the obligations of the controller as laid down in more detail in the GDPR.

Research subjects can submit any requests to exercise the data subject’s rights related to this study (see section 17) to the contact person referred to in paragraph 1. If necessary, the contact person also forwards the request to other organisations acting as joint controllers.

4. Director or group in charge of the study

Chief Researcher and Docent Annamari Lundqvist is the director in charge of the study.
Address: P.O. Box 30, 00271 Helsinki
Telephone number: +358 29 524 6000 (switchboard)
E-mail: firstname.lastname(at)thl.fi.

5. Contact details of the data protection officer:

Email address of THL’s data protection officer: tietosuoja(at)thl.fi

6. Parties carrying out the study

The study is being conducted by the Population Health Unit of THL’s Department of  Public Health and  Welfare.

7. Name, nature and duration of the study

Title of the study: The Finnish Student Health and Wellbeing Survey (KOTT)

This is a follow-up study.

The survey study will be conducted between 2023 and 2024. The register follow-up stage of the study will last 10 years from the implementation of the survey. Register data will be updated during this follow-up stage in accordance with the research plan. When the study has ended, the research data will be stored in accordance with section 16.

8. Legal basis for the processing of personal data

In accordance with Article 6(1) of the EU General Data Protection Regulation, the legal basis for the processing of personal data is the following:

Scientific or historical research purposes in the public interest, statistical purposes or the exercise of official authority vested in the controller (Data Protection Act, section 4, paragraph 3).

9. Sensitive personal data

The following sensitive personal data are processed in the study:

  • Health data
  • Sexual behaviour
  • Sexual orientation

The processing of sensitive data is based on the following special category under Article 9(2) of the General Data Protection Regulation or special condition under section 6 of the Data Protection Act:

  • scientific or historical research purposes or statistical purposes

10. Which personal data is contained in the research material

The person’s identification data: personal identity code, name, date of birth, email address and telephone number, gender

Data collected as part of research data: data in accordance with the data content of the survey

Data collected from registers as follows: 

Higher education institutions: email address of the institution and the student’s secondary email address, telephone number

VIRTA database (higher education institutions as controllers): date of birth, gender, mother tongue, higher education institution, most recent valid right to study, field of study under the Ministry of Education and Culture’s steering, start year of studies, credits per semester. 

Digital and Population Data Services Agency: age, gender, country of birth, citizenship, marital status, number of residents in the dwelling, number of under-age residents in the dwelling, number of dependants and municipality of residence.

Finnish Institute for Health and Welfare (THL): Data from the Care Register for Health Care (HILMO) such as diagnoses and taken measures, data from the Register of Primary Health Care Visits (AvoHilmo), data from the Medical Birth Register, such as years of birth and data related to births and monitoring of pregnancy, data from the Incomes Register, data from the Finnish National Infectious Diseases Register (such as COVID cases). 

Social Insurance Institution of Finland: right to special reimbursement of medicines, reimbursement of medicines granted, purchases of medicines, rehabilitation, sickness allowance, pension information.

Statistics Finland: primary activity, causes of death, longitudinal data for personal details (FOLK).

Finnish Centre for Pensions: pension register (pensions, decisions), earnings register, unpaid periods

11. Sources of personal data

Virta database, higher education institutions, the Digital and Population Data Services Agency, the Finnish Institute for Health and Welfare, the Social Insurance Institution of Finland, Statistics Finland, the Finnish Centre for Pensions and the information provided by the subject in the survey.

12. Transfer or disclosure of data outside research group

Personal data will not be regularly disclosed or transferred outside the research group. Collected research data from which a person’s identification data have been eliminated may be disclosed for research purposes against a research proposal and an approved user authorisation application.

13. Transfer of data outside the EU or the European Economic Area

No data will be transferred to parties outside the EU or the European Economic Area.

14. Automated decision-making

No automated decisions are made.

15. The principles of protecting personal data

All data is confidential.

The data processed in the data systems:

  • username
  • password
  • user logs
  • access control.

Processing of direct identifiers:

  • Direct identifiers are eliminated during the analysis phase.

16. Processing of personal data after the end of the study

The research data will be archived in the National Archives of Finland without identifiers.

In addition, an anonymised copy of the research data will be transferred to the Finnish Social Science Data Archive (Yhteiskuntatieteellinen tietoarkisto).

17. The rights of the data subject and their possible limitations

Under data protection legislation, research subjects have certain rights. By exercising these rights, research subjects can ensure that the protection of their privacy, which is a fundamental right, is realised. If you would like to exercise your rights, contact THL’s registry [kirjaamo(at)thl.fi] or the contact person mentioned in section 1.

If THL is unable to identify you from the data, rights such as the right of access, the right to rectification and the right to erasure will not be applied.

Withdrawing consent (Article 7 of the General Data Protection Regulation) 
Where the processing of personal data is based on consent, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Right of data access (Article 15 GDPR)
You have the right to be informed of whether your personal data will be processed in the study and what personal data will be processed in the study. You may also request a copy of the personal data undergoing processing.

Right to rectification (Article 16 of the General Data Protection Regulation)
If your personal data are inaccurate or incorrect, you have the right to request their rectification or supplementation.

Right to erasure (Article 17 of the General Data Protection Regulation)
You can cancel your participation in the study at any stage of the study. In this case, your data will no longer be used as part of the research material. However, any examinations started before the arrival of your withdrawal notification may be completed.

You have the right to obtain from the controller the erasure of your personal data in the following cases:

  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • you withdraw your consent on which the processing is based and there is no other legal ground for the processing;
  • you object to the processing and there are no overriding legitimate grounds for the processing;
  • the personal data have been unlawfully processed; or
  • the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.

Derogation from the rights

Derogations from the rights described in this section 17 The rights of the data subject and their possible limitations may occur in accordance with the conditions laid down in data protection legislation in so far as the obligation is likely to render impossible or seriously impair the achievement of the objectives of scientific or historical research purposes or statistical purposes. The need for derogation is always assessed on a case-by-case basis.

If you would like to exercise your rights, contact THL’s registry [kirjaamo(at)thl.fi].

Contact

If you have any questions about you rights, contact THL’s registry (kirjaamo(at)thl.fi) or the contact person mentioned in section 1.

Right to refer the matter to the Data Protection Ombudsman

You have the right to refer the matter to the Office of the Data Protection Ombudsman if you consider that the valid data protection legislation has been violated in the processing of your personal data.

Contact information:

Office of the Data Protection Ombudsman
Visiting address: Lintulahdenkuja 4, 00530 Helsinki, Finland
Mailing address: P.O. Box 800, 00531 Helsinki; Switchboard: +358 29 56 66700 Fax: + 358 29 56 66735
E-mail: tietosuoja(at)om.fi

Updated: