Finnish Spine Register (national quality register)

1 Controllers

Finnish Institute for Health and Welfare (THL)
P.O. Box 30, 00271 Helsinki, Finland
+358 29 524 6000

The above-mentioned organisations decide on and are responsible for the processing of personal data for the purpose mentioned in this notice, which means they are controllers of this data.
 

2 Contact person for issues related to processing of personal data

Name: Leena Nuorteva
Phone number: +358 29 524 7606
Email: [email protected]

The email address for THL’s data protection officer is: [email protected]

3 Name of dataset

Finnish Spine Register (national quality register)

4 The purpose of processing personal data

We process your personal data for statistics, research, assessment and co-creation. The operation of the register is aimed at systematically improving the quality of the services and care within the scope of the quality register.  In addition, personal data are processed for the performance of expert tasks.

Personal data are processed in the Finnish Spine Register for monitoring and assessing the treatment results and the safety of lumbar, thoracic and cervical spine surgeries performed on adults in Finland.
 

5 Legal basis for the processing of personal data

The processing of personal data is always based on valid legislation. The legal basis of processing personal data for the purposes covered by this notice is:
Compliance with a legal obligation (General Data Protection Regulation, Article 6(1)(c)).
Other basis: The Act on the National Institute for Health and Welfare (668/2008) lays down provisions on the task of maintaining quality registers relevant for the field. The quality registers that the Finnish Institute for Health and Welfare has an obligation to keep have been determined by the Ministry of Social Affairs and Health Decree (801/2022). To perform its statutory (specified in more detail in section 2, subsection 1, paragraphs 1-3, 4 and 4 d of the Act on THL) tasks, the Finnish Institute for Health and Welfare is entitled to receive free of charge and notwithstanding confidentiality provisions and other limitations on access to information, the necessary information concerning the population, including identification data, in accordance with section 5 of the Act.
Performance of a task carried out in public interest (Article 6(1)(e) of the General Data Protection Regulation).
Performance of a task carried out in the exercise of official authority vested in the controller (Article 6(1)(e) of the General Data Protection Regulation).
 

6 Processed personal data

1. Data collected from healthcare information systems
Service provider:

• name of hospital
• hospital ward (treating unit)

Information describing the patient/client:

• date of birth
• age at the time of surgery
• gender

Details of the procedure:

• principal diagnosis for surgery
• time and date of surgery
• duration of surgery
• objects of surgery
• type of surgery
• principal procedure in surgery
• health and pain at the time of surgery (EQ5D VAS, ODI, NDI)
• antibiotic and thrombosis prophylaxis
• complications i.e. adverse effects
• reoperations

Information collected before and after surgery:

• secondary diagnoses / comorbidity (simultaneous presence of other diseases or disorders)
• use of nicotine products
• body mass index (BMI)
• working status
• duration of pain
• use of pain medication

Follow-up information:

• intensity of pain before surgery, 3 months, 1 year, 2 years, 5 years and 10 years after surgery
• patient’s experience of provided surgery (PROM and PREM) 3 months, 1 year, 2 years, 5 years and 10 years after surgery
• quality of life (EQ-5D) 3 months, 1 year, 2 years, 5 years and 10 years after surgery

2. Information collected from THL and other authorities

• information from outpatient care in specialised healthcare and from primary healthcare
• causes of death
• date of death
• sick leave and pension details
• rehabilitation details
• details of purchases of medicines related to the back disorder and surgery

7 Regular data sources

Information systems of wellbeing services counties/hospitals
Kela’s Prescription Archive
Kela’s benefit register
Pension register of the Finnish Centre for Pensions
Care Register for Health Care (HILMO)
Register of Primary Health Care Visits (AvoHILMO)
Statistics Finland
Digital and Population Data Services Agency
 

8 Transfer or disclosure of personal data

No regular transfers of the data take place to parties outside THL.

9 Transfer of data to non-EU/EEA countries.

Personal data are not transferred to non-EU/EEA countries.

10 Profiling and automated decision-making

The Finnish Institute for Health and Welfare (THL) does not proceed to automated decision-making based on personal profiling.
 

11 Storage of personal data

The storage periods of personal data are determined in compliance with the Archives Act (831/1994) and the organisation’s information management plan.  In compliance with the valid legislation, the organisation stores the personal data referred to in this notice until further notice.

Place of archives:
Storage period:
In compliance with the valid legislation, THL stores the personal data referred to in this notice until further notice.
 

12 What rights do you have?

Under data protection legislation, you have certain rights. By exercising these rights, you can ensure that the protection of your privacy, which is one of your fundamental rights, is realised. If you would like to exercise your rights, contact the organisation’s registry office.

In certain cases and situations, your rights may be restricted, for example due to one of the organisation’s statutory obligations or if the processing takes place for scientific research or for statistical or archiving purposes. If your rights are restricted, the organisation will provide for appropriate and necessary safeguards required under the data protection legislation.

12.1 Right to withdraw consent
If we are processing your personal data based on your consent, you have the right to withdraw this consent.

Please note that the processing of data for purposes other than scientific research is in principle based on legislation rather than your consent.

12.2 Right to access data concerning you
You have the right to know if the organisation is processing personal data concerning you. You also have the right to know which personal data concerning you are processed and how. Additionally, you have the right to receive a copy of the personal data concerning you, provided that giving you this copy will not have adverse effects on the rights and freedoms of others and that the organisation does not have legal grounds for refusing to disclose the data.

12.3 Right to rectification of data
As a point of departure, you have a right to have inaccurate or incorrect data rectified.

12.4 Right to erasure of your data
You may have the right to have your data deleted from the organisation’s register. If the processing of your data is based on the performance of the organisation’s statutory tasks or there is some other legal obligation associated with preserving it, your right to have the data deleted probably is restricted.

12.5 Right to restrict processing
You may have a right to restrict the processing of your personal data in cases laid down in the law.

The right to restrict processing may exist, for instance, if you believe that the personal data concerning you are inaccurate, they are being processed unlawfully, or you have opposed the processing of your data. In this case, we may only process your personal data by your consent, where necessary for the establishment, exercise or defence of legal claims, or where it is in general interest or essential to protect another person’s rights.

12.6 Right to oppose the processing of personal data
You may have the right to oppose the processing of your personal data in cases laid down in the law.

The right to oppose may be relevant when, for example, the processing includes automated decision-making based on the profiling or if the information is used for the purpose of direct marketing.

12.7 Right to lodge a complaint with the supervisory authority
You have the right to request the Data Protection Ombudsman to assess the lawfulness of the organisation’s practices.

Contact information:
Office of the Data Protection Ombudsman
Visiting address: P.O. Box 4, 00530 Helsinki
Mailing address: P.O. Box 800, 00531 Helsinki, Finland
Switchboard: +358 29 56 66700
Facsimile: +358 29 56 66735
Email: [email protected]