Data protection
At the University of Helsinki, we value your privacy and your right to protect your personal data. Everyone has the right to know what data concerning them are being kept and how those data are processed. On this website, we collect data protection statements pertaining to the processing of personal data at the University of Helsinki.

Information about cookies and the processing of personal information on our website can be found on the page website and cookies.

For questions about data processing, contact details are available in the relevant data protection statement. The data protection officer of the University of Helsinki can be reached at tietosuoja@helsinki.fi.

Studying and services related to studying

Contact information for question about data processing 

 registrar@helsinki.fi

Why do we process your personal data?

The University of Helsinki must process your personal data for purposes including the following:

  • Student admissions
  • Organisation of teaching and decisions concerning studies
  • Student guidance
  • Course registrations
  • Restoration of completed studies, assessment and registration
  • Preparation of degree diplomas

In addition, the University can process your personal data for the following purposes:

  • Development of teaching (e.g., with feedback collected from students)
  • Scientific research or the compilation of statistics
  • Marketing communications related to studies
  • The safety of students and other members of the University community, the physical safety of the study environment and the protection of data, or
  • Other specific purposes

What is the lawful basis for processing?

The use of personal data is primarily based on legislation concerning the University of Helsinki and the organisations operating in the University community. In specific cases, the basis for processing data is consent given by the student.

Therefore, the right of the University as the controller of the data file is based on

  • A task carried out in the public interest or in the exercise of official authority vested in the controller 
  • Compliance with a legal obligation to which the controller is subject 
  • In certain cases, the performance of a contract or consent given by the data subject 

As a rule, the University has the right to process sensitive data as the controller of the data file in the following cases:

  • When necessary for reasons of substantial public interest 
  • In certain cases when the data subject has given explicit consent to the processing of certain personal data 

Relevant regulations

Universities Act (558/2009)
Government Decree on University Degrees (794/2004)
Act on national study and degree registers (Laki valtakunnallisista opinto- ja tutkintorekistereistä) (884/2017)
EU General Data Protection Regulation (2016/679) and supplementing national regulations
Personal Data Act (523/1999) and the Data Protection Act (XXX/2018), which will supersede the former
Act on the Openness of Government Activities (621/1999)
Regulations of the University of Helsinki
Regulations on Degrees and the Protection of Students’ Rights at the University of Helsinki
Decisions by the University and the rector concerning teaching and studying at the University of Helsinki
Standing regulations of the University of Helsinki faculties

What kind of personal data do we process?

The University of Helsinki processes personal data from which you can be identified directly or indirectly. Direct identifiers include the personal identity code and student number. We will also process your name and contact details, in addition to which the University processes other information related to your studies from which a third party may identify you by connecting the details.

The details most commonly processed in conjunction with studying and completed studies are the student’s name, student number and contact details, as well as details on the degrees pursued and the content of studies.

Here are examples of the data processed by the University of Helsinki:

  • Persons applying to study at the University (applicants), their basic details and application information
  • Basic student details (e.g., student number, personal identity code, name and contact details)
  • Students’ study rights
  • Students’ term registrations
  • Students’ completed studies, traineeships and theses/dissertations
  • Teachers and related information on teaching
  • Students’ registrations for teaching
  • Students’ student feedback details
  • Details related to students’ career and employment services and surveys
  • Membership in the Student Union and its special status associations
  • Data related to grants
  • Data related to international student exchange
  • Basic details on the staff involved in supporting students and teachers (e.g., name and work-related contact details)

What are the sources for personal data?

Some required personal details come from yourself, which makes you responsible for their validity. A right to study is personal. Thus, your personal details must be valid.

Certain details have been collected from other parties, including:

  • Details concerning the acceptance of a student place are gained from a national student admissions register (Act 884/2017) maintained by the Finnish National Agency for Education and from documents submitted by the student.
  • The validity of name and contact details is verified from the Population Register Centre.

Retention times

The storage period for personal data stored in University of Helsinki systems and data processed manually is based on legislation in force and the archiving plan of the University of Helsinki.

In observance of the legislation concerning universities (Sections 25 and 27 of act 884/2017), the University of Helsinki stores the following personal details related to teaching permanently:

  • Student numbers and personal identity codes or equivalent identifiers
  • Information on completed degrees and specialist training, as well as all completed studies and their grades
  • Information on rights to complete studies leading to a degree and specialist training, as well as information on the acceptance of a student place and registration for studies leading to a degree and for specialist training.

Information on storage periods for other data is available in the archiving plan of the University of Helsinki.

Do we disclose your personal data to third parties?

Personal data is primarily processed by the staff of Teaching and Learning Services and the teaching staff. In addition, personal data can be processed by the following units: IT Centre, HR Services, Financial Services, as well as Communications and Community Relations.

The University of Helsinki may also use external parties to process personal data, such as businesses that provide system services and process personal data on behalf of the University of Helsinki on the basis of a mandate.

The University of Helsinki discloses required student personal data to the following recipients, either through the national data warehouse for higher education or directly:

  • Finnish Student Health Service
  • Ministry of Culture and Education
  • Internationalisation Services of the Finnish National Agency for Education
  • Student admissions registers
  • Study credit, degree and qualification disclosure service of the Finnish National Agency for Education
  • Social Insurance Institution of Finland Kela
  • National Supervisory Authority for Welfare and Health Valvira
  • Statistics Finland
  • Employment authority
  • The Education Fund
  • Immigration authority
  • Student Union of the University of Helsinki
  • Student nations of the University of Helsinki
  • Monitoring surveys conducted by Aarresaari, a network of career and recruitment services

In addition, the University of Helsinki can disclose students’ personal data

  • For scientific research purposes
  • For the purpose of meeting obligations set by the Act on the Openness of Government Activities (621/1999) or other legislation
  • To other Finnish institutions of higher education for the processing of study rights and transferring completed studies, for example, in teaching cooperation
  • To international institutions of higher education also outside the EU or the European Economic Area for the implementation of dual or joint degree education or for the transfer of completed studies
  • With the student’s consent, regarding contact details outside the University, for restricted purposes supporting studying and other specific purposes

The primary source of transferred data is the academic administration system Oodi and the Mobility Online mobility system. Student data to be permanently stored and the mobility periods of student exchange will be transferred to Virta, the national data warehouse for higher education.

Do we transfer your data outside the EU/European Economic Area? 

According to its data protection policy, the University will exercise particular care if personal data is to be transferred outside the EU or the European Economic Area to countries where data protection regulations do not conform to the EU’s General Data Protection Regulation.

The transfer of personal data outside the EU or the EEA must be carried out in compliance with the requirements of the GDPR.

Contact information for data processing questions

p. 02941 24140, email: hakijapalvelut@helsinki.fi

Why do we process your personal data?

Personal data are processed in conjunction with the application procedure to the international master's degree programmes of the University and as part of completing the student admission process. The data file is used for the production of statistical data for the purposes of disseminating information about educational opportunities, as well as for planning, evaluating and developing education.

Documents attached to applications can be used also for training the Admissions Services staff in the application process. No documents are disclosed outside Admissions Services.

What personal data do we process?

Data pertaining to an applicant:

  • Applicant’s personal and contact details
  • Applicant’s education and other data relevant to the application process
  • Data related to the processing of the applicant’s application and their admission
  • Applicant’s consent to disclosure of their personal data for the purposes of communication and marketing pertaining to education
  • Documents attached by the applicant to the application
  • Applicant’s actions in the system

Data obtained from the applicant and study right register of Finnish higher education institutions (Studyinfo):

  • Applicant’s Studyinfo applicant number (learner ID)
  • Language, country, municipality, post office and basic education codes
  • Data related to University units/departments
  • Applicant’s personal and contact details

What is the lawful basis for processing?

Lawful basis for the processing of personal data:

  • Task carried out in the public interest and exercise of official authority vested in the controller

  • Compliance with a legal obligation to which the controller is subject

What are the sources for personal data?

Applicants use the system user interface to independently store their application data.

Data on higher education studies completed after 1995 by applicants with a Finnish personal identity code are transferred from the VIRTA student information system by automated means. Data are verified directly from the relevant controllers of data files who have given their permission. From the VIRTA database, personal data and data on study rights as well as on completed degrees and studies required for the admissions process are transferred via a technical interface.

Data provided by the applicants in their application or its attachments pertaining to international studies and degrees completed outside Finland can be verified from the awarding institution or from another relevant party

Retention times

Applications and their attachments submitted by the deadline are stored in the University of Helsinki archives for 10 years.

Do we disclose your personal data to third parties?

Applicants’ identification data and data pertaining to student admissions are transferred to the Studyinfo system. Data and documents are disclosed to experts who assess applications.

With the applicant’s consent, data pertaining to them can be transferred to other third parties.

Address details can be disclosed to be used for marketing purposes by the University of Helsinki only with the consent of the data subject.

If the applicant has employed an official education agency partner of the University of Helsinki in the application process, data pertaining to the processing of the application can be disclosed to that partner.

 

Do we transfer your data outside the EU/European Economic Area? 

Data on applicants are not regularly disclosed outside the European Union or the European Economic Area. However, the disclosure of data may be necessary, for example, for the verification of studies completed outside Finland when making decisions related to student admissions. We observe special care in conjunction with any disclosure of data. Data can be transferred to third parties outside the EU or EEA also with the express consent of the applicant.

Contact information for question about data processing 

opintopsykologi@helsinki.fianu.lehtinen@helsinki.fi 

Why do we process your personal data?

Data stored in the University of Helsinki counselling psychologists’ client data file are processed for the purpose of maintaining the counselling psychologists’ client relationships. In addition, contact details and anonymised statistical data stored in the data file will be used to monitor the quality of the counselling psychologists’ services and to develop them further.

What kind of personal data do we process?

first name, last name, personal identity code, gender, faculty, degree programme, first year of current studies, student number, address, phone number, email address, details provided by the student when booking an appointment, appointments made with counselling psychologists and cancellations, consultation records made by counselling psychologists on sessions as well as on related events and tasks, summaries, recommendations and statements.

Counselling psychologists of the University of Helsinki maintain a client data file on individual consultations and comparable work, in addition to which they draw up consultation records on consultation sessions as well as related events and tasks. The counselling psychologists do this in their role as healthcare professionals, and in their work as psychologists they observe the following laws: the Act on Health Care Professionals (559/1994), the Act on the Status and Rights of Patients (785/1992) and the decree of the Ministry of Social Affairs and Health on patient records (298/2009). These records often contain information related to clients’ health.

What is the lawful basis for processing? 

As healthcare professionals, psychologists are obliged to observe the following legislation when providing consultation to individuals: the Act on Health Care Professionals (559/1994), the Act on the Status and Rights of Patients (785/1992) and the decree of the Ministry of Social Affairs and Health on patient records (298/2009). Consultation records related to group sessions outside individual counselling are based on students’ consent.

What are the sources for personal data?

Methods of collecting personal data: data obtained from the data subject, consultation records on consultation sessions as well as related events and tasks, summaries, recommendations, statements

Retention times

Data created in individual consultation sessions are stored in accordance with the laws concerning patient data. Group consultation data that are not considered patient data are stored for four years. Booking data collected through electronic forms and the Vihta system are erased every academic year. Details relevant to the counselling provided by the counselling psychologists, such as students’ personal data and other preliminary information provided by students, are transferred from the booking data associated with individual consultations to the Diarium booking system. In the case of groups, data obtained through the booking system are erased, with the relevant information stored in the counselling psychologists’ digital archive.

Do we disclose your personal data to third parties?

The client’s data can be disclosed to the client at their request. Information can also be disclosed, with the consent of the client, to officials with the statutory right to obtain information. In this case, the official must submit a written request, indicating the legislation on which the right to obtain information is based. Information may be disclosed without the consent of the client in cases with existing separate legislation on disclosing information or on the right to obtain information.

Statistical data where an individual’s personal data are not identifiable can be forwarded and used, for example, in reports and presentations which discuss the nature and extent of students' psychological counselling. In addition, information on clients who have provided a written consent for research use can be used in scientific studies and publications in unidentifiable form.

Do we transfer your data outside the EU/European Economic Area? 

The data in the University of Helsinki counselling psychologists’ client data file will not be transferred outside the European Union or the European Economic Area.

Contact details for enquiries concerning the processing of data 

tietosuoja@hy-norssit.fi  

Purpose of processing personal data 

The teacher training schools of the University of Helsinki need your personal data for the following purposes:  

BASIC EDUCATION  

  • Organisation of teaching  
  • Organisation of pupil admission  
  • Organisation of club activities  
  • Organisation of school health service 
  • Organisation of school meals  
  • Organisation of pupil welfare services (e.g., school social worker and psychologist services)  
  • Organisation of supervised practice teaching  
  • Provision of learning environments and other digital services  

GENERAL UPPER SECONDARY EDUCATION  

  • Organisation of teaching  
  • Organisation of student admission  
  • Organisation of club activities  
  • Organisation of student health service  
  • Organisation of school meals  
  • Organisation of student welfare services (e.g., school social worker and psychologist services)  
  • Organisation of the matriculation examination  
  • Organisation of supervised practice teaching  
  • Provision of learning environments and other digital services  

We store data pertaining to pupils’ and students’ school attendance, teaching arrangements and learning outcomes. The University of Helsinki teacher training schools are part of the University, and the schools conduct research with participation based on consent given by parents/carers and/or pupils and students.  

What data are being processed? 

BASIC EDUCATION  

  • Pupils’ basic and contact details (e.g., personal identity code, name, contact details, special diets, health data related to the organisation of teaching, Wilma credentials)  
  • Parents’ and carers’ names and contact details, data pertaining to custody, Wilma credentials  
  • Decisions pertaining to pupils (e.g., school transport, special needs education, permit applications and decisions)  
  • Data related to school attendance (e.g., school, class, year)  
  • Data related to pupils’ roles (e.g., mode of teaching, teaching in Finnish as a second language, language programme, religion and worldview studies) 
  • Pedagogical documents related to pupil support (general support, intensified support, special support)  
  • Data related to immigration (e.g., date of entry into Finland)  
  • Data related to certificates and assessment discussions as well as subject/course assessments  
  • Pupil-specific lesson entries (e.g., absences)  

  

GENERAL UPPER SECONDARY EDUCATION  

  • Students’ basic and contact details (e.g., personal identity code, name, contact details, special diets, health data related to the organisation of teaching, Wilma credentials)  
  • Parents’ and carers’ names and contact details, data pertaining to custody, Wilma credentials  
  • Decisions pertaining to students  
  • Data related to school attendance (e.g., school, class, year)  
  • Data related to students’ roles (e.g., mode of teaching, language programme, religion and worldview studies)  
  • Pedagogical documents related to student support  
  • Data related to certificates and subject/course assessments  
  • Student-specific lesson entries (e.g., absences)  

Data processed in special categories of personal data:  

  • Religious or philosophical beliefs  
  • Health data (e.g., allergies)  

What are the legal grounds for the processing? 

The processing of personal data is necessary to carry out the statutory duties of the controller of the data file. The teacher training schools are part of the University of Helsinki, and personal data can also be processed for the purposes of scientific research in the public interest. Pupils and students or their parents and carers are always asked to give their consent for participating in a study.  

Legislation pertaining to the operations of the teacher training schools: 

For basic education:  

  • Basic Education Act (628/1998) 
  • Basic Education Decree (852/1998) 
  • Comprehensive School Act (467/1983) 
  • Government Decree on the National Objectives for Education Referred to in the Basic Education Act and in the Distribution of Lesson Hours (1435/2001) 
  • Student Welfare Act (1287/2013) 
  • Act on the National Registers of Education Records, Qualifications and Degrees (884/2017)  

For general upper secondary education:  

  • Government decree on the application process for preparatory education after vocational education and training, general upper secondary education and basic education (294/2014) 
  • Act on General Upper Secondary Education (629/1998) 
  • Government Degree on General Upper Secondary Education (810/1998) 
  • Government Decree on the General National Objectives of General Upper Secondary Education and the Distribution of Lesson Hours (955/2002) 
  • Act on the Matriculation Examination (502/2019) 
  • Government Decree on the Matriculation Examination (915/2005) 
  • Student Welfare Act (1287/2013) 
  • Act on the National Registers of Education Records, Qualifications and Degrees (884/2017) 

Sources of personal data 

Personal data are collected from pupils and students themselves and their parents and carers. Other key sources of data include the following:  

  • Digital and Population Data Services Agency (previously Population Register Centre)  
  • KOSKI data repository  
  • Studyinfo service  
  • Matriculation Examination Board  
  • Pupils’ and students’ previous education institutions  

Storage periods 

We comply with the archiving plan of the University of Helsinki. Examples of stored data and storage periods:  

  • Education certificates and certificates of termination of studies are stored permanently.  
  • Data pertaining to pupils’ and students’ self-assessment and portfolios are stored for the duration of their compulsory education period.  
  • Lists and similar records pertaining to pupils’ and students’ schools and classes are stored for 50 years. 

To whom are your data disclosed? 

Regular disclosure of data includes  

  • Transcripts of record and study rights are stored in the KOSKI data repository (national registry and data transfer service for study rights and completed studies).  
  • Data related to the organisation of the matriculation examination are disclosed to the Finnish Matriculation Examination Board (e.g., registration data).  
  • Disclosure of data to the City of Helsinki for the organisation of school health service  
  • Pupils’ and students’ data can be disclosed to Statistics Finland, the Finnish Education Evaluation Centre (FINEEC), the Social Insurance Institution of Finland (Kela), the Finnish National Agency for Education or other authorities for organising, monitoring and compiling statistics on studies.  
  • Disclosure of data to another education provider in conjunction with transferring between education institutions  

Are data transferred outside the EU?  

We do not transfer or disclose personal data outside the EU. 

Research and Research Services
Communication and Community Relations
Center for information technology
Library, archive and museum services
HR Services

Contact details in matters concerning the processing of your personal data 

 rekrytointi@helsinki.fi, you can modify and erase data by yourself on our recruitment portal: https://rekry.helsinki.fi/start 

What is the purpose for processing personal data?

Processing of applications, assessment of aptitude, and communication related to appointee selection.

We also wish to promote equality in our recruitment as well as ensure smooth integration into Finnish society for employees arriving from abroad. 

What data do we process?

  • Applicant’s personal data (name, gender, date of birth, nationality)

  • Applicant’s address and contact details (street address, country, locality, postcode, email and phone)

  • Applicant’s internet addresses (e.g., applicant’s LinkedIn profile)

  • Applicant’s educational background

  • Applicant’s prior work experience

  • Applicant’s language skills, IT skills and other skills relevant to the position

  • Applicant’s employment preferences

  • Attachments related to the application (e.g., CV, list of publications)

Other details the applicant considers relevant to the position

Certain data are required for related processes and communication. The rest, provided voluntarily by the applicant, help us assess the applicant’s aptitude for the position in question.

For external assessors involved in University of Helsinki recruitment processes, names and email addresses are stored in the system.

What is the legal basis for processing personal data?

The processing of applicants’ personal data is based on consent given by the data subject. 

From which sources we collect your personal data, what is the origin of the data?

Data are collected from the data subject.

In the case of persons employed by the University of Helsinki, their name, date of birth and contact details are transferred to the recruitment system from the University of Helsinki’s SAP HR human resources information system.

In certain recruitment processes, data are also collected with the applicant’s consent from separate external assessors in, for example, aptitude assessments or, in professor recruitment, external academic assessments. 

Retention times

In the case of applicants from outside the University, applicant profile data are stored for 24 months from the last login to the recruitment system. As a rule, application documents (attachments and personal profiles) are stored for 24 months from the appointment decision, with the exception of shortlisted applicants to professorships, whose data are stored permanently for archiving purposes. In the case of applicants employed by the University, personal data are stored for the duration of employment, and for no longer than 12 months from the termination of employment.

Data subjects have the right to access their personal data stored in the system by logging in to it. Data subjects can update and rectify their personal profile data at any time.

To whom do we disclose your personal data? 

In the case of recruitment processes including an aptitude assessment or another assessment by experts, personal data can be disclosed to the assessors involved in the process. In such cases, data can be processed by the assessors within or outside the European Union.

As an institution under public law, all recruitments made by the University are public. This means that, when requesting data from applicants, the Act on the Openness of Government Activities (621/1999) requires the University to disclose application documents and any data pertaining to the recruitment process.

Is personal data transferred outside the EU?

The data contained in the data file are stored within the European Union, and they are not transferred outside the EU or the European Economic Area. As an exception, personal data can be processed by external assessors outside the EU in conjunction with assessments associated with recruitment. When disclosing data outside the EU, we employ the protective measures required by law, such as the standard contractual clauses provided by the European Commission.

Your Rights

If the processing of personal data is based on your consent, you have the right to withdraw your consent. Withdrawal of consent shall not affect the lawfulness of the processing carried out on the basis of the consent prior to its withdrawal. 

You have the right to know whether your personal data is being processed and what data is processed. You may also request us to give you a copy of your personal data. 

If there are inaccuracies or the personal data processed about you are incomplete you have the right to request us to rectify or complete your personal data. 

You have the right to request the deletion of your personal data in the following cases:

a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed

b) You withdraw your consent on which the processing was based and there is no other legal ground for the processing

c) You object for the processing and there are no overriding legitimate grounds for the processing

d) The personal data have been unlawfully processed

e) The personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject

 

You do not have the right to erasure, if the processing is necessary:

a) For compliance with a legal obligation which requires processing by law

b) For the performance of a task carried out in the public interest or in the exercise of official authority

c) For archiving purposes in the public interest, scientific of historical research purposes or statistical purposes if the erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing

d) For the establishment, exercise or defense of legal claims

You have the right to restrict the processing of your personal data. This means that we retain your information but do not process it in any other way. 

You have this right in the following cases: 

a) The accuracy of the personal data is contested by you. Then the processing will be restricted until the accuracy of the data is verified.

b) The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead

c) The university no longer need the data for the purposes of the processing, but you need the data for the establishment, exercise or defense of legal claims

d) You have objected to processing that is based on legitimate interest. Then the processing will be restricted for the time it is verified whether the legitimate ground for the controller override those of the data subject

When the processing is done by automatically means and the processing is based on your consent or a contract between you and the University, you have the right to have your data that you have provided, in a structured, commonly used and machine-readable format and have the right to transmit this data to another controller. 

When it is technically feasible, you have the right to have the data transmitted directly to the other controller.

You have the right to object for the processing of your personal data. Then we shall no longer process the data unless we demonstrate compelling legitimate grounds for the processing which overrides the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims. University can also continue to process your personal data if it is necessary for the performance of a task carried out in the public interest.

You have the right to lodge a complaint with the Data Protection Ombudsman’s Office if you think your personal data has been processed in violation of applicable data protection laws.

 

Contact details:

www.tietosuoja.fi 

Office of the Data Protection Ombudsman

Visiting address: Ratapihantie 9, 6. krs, 00520 Helsinki

Postal address: PL 800, 00521 Helsinki

Switchboard: 029 56 66700

E-mail: tietosuoja@om.fi

Published on
1 month ago