VISU Privacy Statement

University of Oulu
Visiting address: Pentti Kaiteran katu 1, Linnanmaa
Postal address: P.O. Box 8000, FI-90014 University of Oulu
Tel. +358 294 480 000
Email: ict@oulu.fi

Person Responsible for the Processing Activity

Chief Digital Officer

Person Responsible for the Register

Chief Digital Officer

If necessary, you may contact our Data Protection Officer at:
tietoturva@oulu.fi

Data disclosed under a permit granted pursuant to the Finnish Act on the Secondary Use of Health and Social Data (“Secondary Use Act”) is always provided to the permit holder for processing within a secure processing environment referred to in Section 20 of the Secondary Use Act, unless the data has been transformed into aggregated statistical information.

The University of Oulu (UO) has established a secure processing environment (“the Environment”) in accordance with the Secondary Use Act, where permit holders may process data sets. Personal data contained in these data sets is processed within the Environment solely for the purpose specified in each data permit, typically for scientific research purposes.

Personal data relating to the processors identified in the data permit, as well as University personnel, is processed for the management of user accounts, enabling access to data sets, and monitoring data processing activities.

The Environment complies with the requirements set out in the decree of the Finnish Social and Health Data Permit Authority (Findata) entitled “Requirements for Secure Processing Environments Provided by Other Service Providers” (1/2022, Ref. No. THL/214/14.00.07/2022).

The Environment may also be used for processing data that is not based on a permit issued under the Secondary Use Act. In such cases, the processing of personal data is based on other applicable legislation and any required authorization procedures. Use of the Environment is always subject to an order and order confirmation containing the terms and conditions governing its use.

The Environment processes:

Social and health data relating to individuals included in data sets subject to permits under the Secondary Use Act or other applicable legislation and authorization procedures.

When personal data is processed for user account management, provision of the Environment, enabling data processing, and monitoring processing activities, the processing is performed by individuals employed by the University of Oulu. Processing is primarily carried out by ICT Services personnel. However, University data protection personnel are entitled to process user and log data when performing access monitoring and compliance activities.

Social and health data originates from registers covered by the Secondary Use Act within the scope permitted by each data permit, or from other sources when the Environment is used for purposes outside the Secondary Use Act or when permit-based data is combined with information from other registers.

User names and contact information are obtained from the Environment order form submitted to the University of Oulu by the user’s representative (“the Customer”). Other user and personnel data is generated through the use of the Environment by users and staff.

Personal data is not routinely disclosed to other recipients.

Users of the Environment cannot independently transfer personal data to another processing environment. Any such transfer requires an amendment to the applicable data permit.

User data is not disclosed to other recipients and is processed solely for tasks related to the maintenance and administration of the Environment within the University of Oulu.

Data is processed exclusively within Finland for the purposes of maintaining the Environment and delivering the service.

An exception applies to information stored in the service management system (personal data provided through order forms and attachments), which is stored in a cloud-based database located within the EU/EEA.

Where permitted by the data permit, users may access and process data sets remotely from outside the European Economic Area (EEA). In such situations, the data controller of the permit-based data set is responsible for ensuring an appropriate legal basis for transfer and for implementing the safeguards required under applicable data protection legislation.

A data subject has the right to know whether personal data concerning them is processed and, if so, to obtain access to that data.

Users and representatives of University of Oulu personnel may submit requests regarding the exercise of their rights through the University Registry Office.

Contact: kirjaamo@oulu.fi

Data subjects have the right to request the correction of inaccurate or incorrect personal data concerning them without undue delay.

User and personnel data is maintained as part of normal administrative processes. Consequently, not all corrections constitute GDPR rectification requests; some are routine updates required for maintaining the service relationship.

If a data subject identifies inaccurate information, they may also request rectification under applicable data protection legislation. Such requests should be submitted through the Registry Office for processing by the University’s ICT Services.

A data subject has the right to request restriction of processing where they contest the accuracy of their personal data. In such cases, processing will be restricted until the data controller has verified the accuracy of the data.

However, this right does not apply to processing necessary for compliance with legal obligations or the performance of contractual obligations (including service orders). Consequently, data subjects cannot restrict:

The same limitations apply to University employees with respect to their personal data processed for these purposes.

If a data subject considers that the processing of their personal data violates applicable data protection legislation, they have the right to lodge a complaint with the competent supervisory authority, namely the Office of the Data Protection Ombudsman.