Data protection policy: Youth Nutrition Study

EU General Data Protection Regulation, Articles 12–14

Youth Nutrition Study 14 June 2024

Information for study participants

This document describes how your personal data will be processed in this study. Participation in the study is voluntary. You can refuse or discontinue participation at any time during the study without specifying a reason; this will not affect you negatively in any way. If you discontinue your participation in the study, the material collected before you do so can still be used in the study. Section 18 of this data protection policy explains in more detail what rights you have and how you can influence the processing of your data.

1. Data controllers of the study

Finnish Institute for Health and Welfare (THL)
PO Box 30, 00271 Helsinki, Finland
Tel. +358 29 524 6000

The organisation mentioned above make the decisions on and is responsible for processing personal data for the purposes described in this policy; in other words, they are the controllers for these data.

2. Contact person in matters concerning the study

Sari Niinistö, chief researcher
Phone number: +358 29 524 7249
E-mail: [email protected]

3. Description of the research project and the purpose of processing personal data

The aim of the Youth Nutrition Study is to produce reliable and up-to-date information on young people's food consumption, nutrient intake and nutritional to support health promotion and national and municipal decision-making. The research data will also be utilised in scientific research.

A total of 3,000 young people aged 12 to 18 from different Finnish municipalities and cities are invited to participate in the study. The data will be collected in schools during the academic year 2024–2025. The study consists of interviews on food use, a background information questionnaire and a food propensity questionnaire (FPQ), in addition to which blood samples (N=600) and a food frequency questionnaire (FFQ) (N=200) will be collected from young people. In addition to these, the young people’s guardians will be asked to respond to a background questionnaire aimed at guardians.

THL may combine the data obtained through the questionnaires and interviews with register data from registers maintained by different authorities and healthcare units. The register data are only used for research and statistical purposes. Once the register data have been combined, any personal identifiers will be eliminated from the research data. It is not possible to identify individual research subjects from the data used by the researchers.

4. Parties and division of responsibilities for a study carried out as a cooperation project

THL is the data controller as defined in the EU’s General Data Protection Regulation. THL collaborates with partners in other organisations within the framework of cooperation agreements. The data will be transferred to the partners in a form where the data that allows for an individual subject to be identified has been deleted.

In all cases, THL is responsible for the obligations of the controller as laid down in more detail in the GDPR.

Research subjects can submit any requests to exercise the data subject’s rights related to this study (see section 18) to the contact person referred to in section 2.

5. Director or group in charge of the study

Research Professor Suvi Virtanen is the Study Director for the study.
Telephone: +358 29 524 8729
Email: [email protected]

6. Data protection officer’s contact information

The email address for the organisation’s data protection officer is: [email protected]

7. Parties carrying out the study

The study is carried out by the Welfare and Health Promotion Unit of THL’s Public Health and Welfare Department.

8. Name, nature and duration of the study

Name: Youth Nutrition Study (Nuorten ravitsemustutkimus, NRT)

This is a one-off study.

Duration of study (how long the personal data will be processed):

The study interviews and questionnaires will be carried out in 2024–2026. The register follow-up stage of the study will last 70 years. The register data will be updated during the follow-up stage. The study will be carried out in 2024-2026 as a one-off study, but it is possible that the study will be repeated later by different persons. When the study has ended, the research data will be stored in accordance with section 17.

9. Legal basis for the processing of personal data

In accordance with Article 6(1) of the EU General Data Protection Regulation, the legal basis for the processing of personal data is the following:

  • Compliance with a legal obligation;
  • Scientific or historical research purposes in the public interest, statistical purposes or the exercise of official authority vested in the controller (Data Protection Act, section 4, paragraph 3).

10. Sensitive personal data

The following sensitive personal data are processed in the study:

  • Ethnic origin
  • Health data

The processing of sensitive data is based on the following special category under Article 9(2) of the General Data Protection Regulation or special condition under section 6 of the Data Protection Act:

  • scientific or historical research purposes or statistical purposes;
  • the processing is necessary based on a significant public interest;
  • the processing is necessary based on a significant public interest related to national health;
  • processing is provided by law or it is derived directly from a duty set out for the controller by law.

11. What personal data are processed?

Identifying data of the young person: name, personal identity code, contact details, gender, native language, location data coordinates of their home, school name and class.

Identifying data of the guardian: name, personal identity code, contact details.

Data collected in the research data: data determined by study data content and collected through interviews and laboratory samples.

Data collected from registers:

  • Finnish Institute for Health and Welfare (THL): Care Register for healthcare (HILMO), for data such as diagnoses and operations performed, Register of Primary healthcare Visits (AvoHilmo), Vaccination Register, Care Register for Social Welfare (SosiaaliHILMO), Cancer Registry data on diagnosed cancers, Mass Screening Registry data, cancer screenings, Medical Birth Register (birth years, birth and pregnancy monitoring data), National Infectious Diseases Register, Register of Social Assistance, Register of Child Welfare, FinLapset Register.
  • Social Insurance Institution of Finland: Medicines subject to special reimbursement, medicine purchases, rehabilitation, sickness allowance, disability allowance, insurance information, benefit information, prescription centre and prescription archive (Kanta), medicine reimbursement rights, medical fees by specialisation, social assistance notifications sent by the Social Insurance Institution of Finland to municipalities, and applications for supplementary support (service needs notifications), basic social assistance, pension information.
  • Statistics Finland: Data on education and occupation, socioeconomic status, main occupation, household income, causes of death, longitudinal data for personal data (FOLK).
  • Finnish Centre for Pensions: pension register (pensions, decisions), earnings register, unpaid periods.
  • Ministry of Economic Affairs and Employment: basic information, job search professions, education qualifications, diagnoses, employment codes, subsidised employment, labour market training, work try-outs, assessments of capacity for work.
  • Digital and Population Data Services Agency: Name, address, date and place of birth, municipality of birth, foreign country of birth, date of immigration, nationality, gender, marital status, marital status history, native language, language of service, household size, residential building data, residence data, residence history, parents’ data (personal identity code, relationship, country of birth).
  • Tax administration: data on earned income and capital income (salary, pension, dividends, other income).

All data collected is processed as pseudonymised and the subjects cannot be identified from the research results. Only personal data necessary for the purpose of the study will be recorded in the research register. The data collected will not be provided to parties outside the research project.

12. Sources of personal data

THL, Social Insurance Institution of Finland, Statistics Finland, Finnish Centre for Pensions, Ministry of Employment and the Economy, Digital and Population Data Services Agency, Finnish Tax Administration, data provided by the subject through questionnaire forms, interviews and samples.

13. Transfer or disclosure of data outside the research group

Personal data are not regularly disclosed or transferred outside the research group. The research data collected can be used and disclosed in accordance with the Act on the National Institute for Health and Welfare (668/2008), the Act on the Secondary Use of Health and Social Data (552/2019), and other applicable legislation. The data collected, from which direct identification data have been removed, may be transferred or disclosed to the close partners of this research group for the original purpose in the EU/EEA countries. Data can only be disclosed based on legislation. For a study that meets the THL criteria for an internal study, the decision is made by THL itself. THL has transferred the competence for data access authorisation to the Finnish Social and Health Data Permit Authority (Findata), which is primarily responsible for the data access authorisation of applicants outside THL.

14. Transfer or disclosure of data outside the EU or the European Economic Area

No data will be transferred or disclosed to parties outside the EU or the European Economic Area.

15. Automated decision-making

No automated decision-making will take place in the study.

16. Principles of personal data protection

All data are confidential. The controller has prepared a data protection impact assessment.  The controller is committed to complying with the established code of conduct in its field.

Protection of manual material:

  • Locked space
  • Defined access rights

Data processed in the information system:

  • User ID
  • Password
  • Access logs
  • Access control

Processing of direct identifiers:

  • Direct identifiers are eliminated during the analysis stage.

17. Processing of personal data after the study

The research data will be permanently archived in the National Archives of Finland without direct identifiers.

18. Rights of the data subject and their possible limitation

Under data protection legislation, research subjects have certain rights. By exercising these rights, research subjects can ensure that the protection of their privacy, which is a fundamental right, is realised. If you wish to exercise your rights, please follow the section ‘How can I exercise my rights?’ of the page Data Protection

Alternatively, contact THL’s registry ([email protected]) or the contact person mentioned in section 2.

If THL is unable to identify you from the data, rights such as the right of access, the right to rectification and the right to erasure will not apply.

Withdrawing consent (Article 7 of the General Data Protection Regulation)

Where the processing of personal data is based on consent, you have the right to withdraw your consent at any time. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

Right of data access (Article 15 the General Data Protection Regulation)

You have the right to be informed of whether your personal data will be processed in the study and what personal data will be processed in the study. You may also request a copy of the personal data being processed.

Right to rectification (Article 16 of the General Data Protection Regulation)

If your personal data are inaccurate or incorrect, you have the right to request their rectification or supplementation.

Right to erasure (Article 17 of the General Data Protection Regulation)

You have the right to demand that the controller erase your personal data in the following cases:

  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • you withdraw your consent on which the processing is based and there are no other legal grounds for the processing;
  • you object to the processing and there are no overriding legitimate grounds for the processing;
  • the personal data have been unlawfully processed; or
  • the personal data have to be erased for compliance with a legal obligation provided in Union or Member State law to which the controller is subject.

19. Rights of the data subject and their possible limitation

Derogations from the rights described in this section 19, ‘Rights of the data subject and their possible limitation,’ may occur in accordance with the conditions laid down in data protection legislation in so far as the obligation is likely to render impossible or seriously impair the achievement of the objectives of scientific or historical research purposes or statistical purposes. The need for derogation is always assessed on a case-by-case basis.

If you wish to exercise your rights, please follow the section ‘How can I exercise my rights?’ of the page Data Protection

Alternatively, contact THL’s registry ([email protected]) or the contact person mentioned in section 2.

Contact

If you have any questions about your rights, please contact THL’s registry ([email protected]) or the contact person mentioned in section 2.

Right to refer the matter to the Data Protection Ombudsman

You have the right to refer the matter to the Office of the Data Protection Ombudsman if you consider that the valid data protection legislation has been violated in the processing of your personal data.

Contact information:
Office of the Data Protection Ombudsman
Visiting address: Lintulahdenkuja 4, 00530 Helsinki, Finland
Postal address: PO Box 800, 00531 Helsinki, Finland
Switchboard: +358 29 56 66700
Email: [email protected]

Updated: