Data protection notice for scientific research
General Data Protection Regulation of the EU
Articles 12–14
Date: 8.1.2024
Information on the processing of personal data in the research project entitled Emplacing Heritage
The research project entitled Emplacing Heritage involves processing of personal data. The purpose of this data protection notice is to provide information on the personal data to be processed, from
where they are obtained and how they are used. Detailed information on the rights of data subjects will be provided at the end of this notice.
Your participation in the research project and provision of personal data are voluntary. If you do not wish to participate in the project or you wish to withdraw from it, you can do so without negative
consequences.
1. Data Controller
University of Helsinki
Address: PO Box (Fabianinkatu 33), 00014 University of Helsinki, Finland
2. Contact person and principal investigator
Contact person in matters concerning the research project:
Name: Anna Rauhala
Faculty/department/unit: Faculty of Arts/Department of Cultures/Ethnology
Address: PL 59 (Unioninkatu 38), 00014 University of Helsinki
Phone: +358 50 4781505
Email: anna.rauhala@helsinki.fi
Principal investigator:
Name: Pia Olsson
Address: PL 59 (Unioninkatu 38, 00014 Helsingin yliopisto)
Phone: +358504482890
Email: pia.olsson@helsinki.fi
3. Contact details of the data protection officer
You can contact the University of Helsinki data protection officer via email at tietosuoja@helsinki.fi.
4. Description of the research project and the purpose of processing personal data
The project Emplacing Heritage is conducted at the Department of Cultures at the University of Helsinki. In the project, we are investigating how heritage can serve as a facilitator for adjusting to a new environment and culture. The data will be used for scientific articles and will be destroyed after the publication. The survey Feeling at home? is intended for international students at LUT University and LAB University of Applied Sciences in Lahti Campus. Responses will be handled anonymously in a manner that permanently prevents the
identification of individuals.
5. Personal data included in the research data
No direct identifiers are collected in this survey and the respondents are free to choose the questions they want to answer. However, the survey includes questions such as gender, nationality and majors which can be considered as personal data.
6. Sources of personal data
The personal data will be obtained only via the questionnaire.
7. Sensitive personal data
No special categories of personal data (i.e., sensitive data), as defined in Article 9 of the GDPR, will be processed in this research.
8. Lawful basis for processing personal data
Personal data are processed on the following basis (Article 6(1) of the GDPR):
YES: Task carried out in the public interest:
YES: Scientific or historical research purposes or statistical purposes
NO: Archiving of research material and cultural heritage material
NO: Consent by the research subject
NO: Compliance with a legal obligation to which the controller is
subject
NO: Legitimate interests pursued by the controller or by a third party
Specify the legitimate interest:
If the processing of personal data is based on the research subject’s consent, he or she can withdraw that consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
9. Recipients of data
Data will not be transferred or disclosed to parties outside the University of Helsinki.
10. Transfer of data to countries outside the European Economic Area
Data will not be transferred to countries outside the European Economic Area, they are processed only within the EEA.
11. Automated decision-making
The research project involves no automated decision-making that has a significant effect on data subjects.
12. Protection of personal data
Personal data included in the research dataset will be processed and kept protected so that only those who need the data can access them.
The data processed in data systems will be protected using the following:
YES: Username and password
NO: Registration/log of use
NO: Access control
NO: Encryption
NO: Two-factor identification
NO: Other, please specify:
Physical material (e.g., data in paper form or other tangible form) will be protected using the following: storage in a locked facility in a locked cupboard.
Processing direct identifiers:
YES: The controller collects the personal data without direct identifiers.
NO: Direct identifiers will be removed during the analysis stage and
kept separate from the analysed research data.
NO: The data will be analysed using direct identifiers, because (give grounds for preserving the direct identifiers):
13. Duration of the processing of personal data in this research project:
The project is financed for 2024–2028. The processing of personal data will take place during this time, and if needed until the publication of the the research articles written during this time have been published.
14. Processing of personal data when the research project ends
YES: The research data will be deleted
NO: The research data will be kept for the purposes of validating or
replicating the results of this research project:
NO without identifiers NO: identifiers included
NO: The research data will be kept for later, compatible scientific
research in accordance with the requirements of the GDPR:
NO: without identifiers NO: identifiers included
The storage of the research data is based on Article 5(1)(b) and (e) of the GDPR. Data subjects will receive a new data protection notice on the new use of the research data, unless the controller can no longer identify the subjects from the data.
In addition, the data subjects will not be informed of the new research if delivering this information to them is impossible or involves a disproportionate effort or renders impossible or seriously impairs the achievement of the research objectives (Article 14(5)(b) of the GDPR).
Where and for how long will the data be stored: The data is stored digitally in the University of Helsinki depository secured by password for the duration of the research project (see point 13).
15. Rights of data subjects and derogations from those rights
The contact person in matters related to research subjects’ rights is the contactperson stated in section 1 of this notice.
Rights of data subjects
Under the General Data Protection Regulation, data subjects have the following rights:
Right of access to their own data
Right to rectification of their data
Right to the erasure of their data and to be forgotten
Right to the restriction of processing of their data
Right to data portability from one controller to another
Right to object to the processing of their data
Right not to be subject to automated decision-making
However, data subjects cannot exercise all their rights in all circumstances. The circumstances are affected by, for example, the legal basis for processing personal data.
Further information on the rights of data subjects in various circumstances can be found on the website of the Data Protection Ombudsman: https://tietosuoja.fi/en/what-rights-do-datasubjects-
have-in-different-situations.
Derogations from rights
The General Data Protection Regulation and the Finnish Data Protection Act enable derogations from certain rights of data subjects if personal data are processed for the purposes of scientific research and the rights are likely to render impossible or seriously impair
the achievement of the research purposes.
The need for derogations from the rights of data subjects will always be assessed on a case-bycase basis.
Right to appeal
If you consider that the processing of your personal data has been carried out in breach of data protection laws, you have the right to appeal to the Office of the Data Protection Ombudsman.
Contact details:
Office of the Data Protection Ombudsman
Street address: Ratapihantie 9, 6th floor, 00520 Helsinki
Postal address: PO Box 800, 00521 Helsinki
Phone (switchboard): 029 56 66700
Fax: 029 56 66735
Email: tietosuoja(at)om.fi