Data protection

PRIVACY STATEMENT, EU General Data Protection Regulation (2016/679), Articles 12–14

1. Controller

National Non-Discrimination and Equality Tribunal
P.O. Box 27
FI-00023 Government
Tel. +358 (0)295 150 035
[email protected]

2. Contact person

Juhani Kortteinen
Secretary-general
Tel. +358 (0)295 150 151
[email protected]

3. Data Protection Officer

Juhani Kortteinen
Secretary-general
Tel. +358 (0)295 150 151
[email protected]

4. Processing measures as a whole

Processing personal data of persons who are not members of the National Non-Discrimination and Equality Tribunal or its employees

5. Purpose and legal basis of the processing of personal data

The purpose of processing of personal data is the recording, monitoring and processing of matters that are or have been handled by the National Non-Discrimination and Equality Tribunal.

The processing of personal data is necessary in order to comply with the legal obligation of the National Non-Discrimination and Equality Tribunal. The legal obligations of the Tribunal can be found in the Constitution of Finland (731/1999), Non-discrimination Act (1325/2014), Act on Equality between Women and Men (609/1986), Act on the National Non-Discrimination and Equality Tribunal (1327/2014), Administrative Procedure Act (434/2003), Administrative Judicial Procedure Act (808/2019), Code of Judicial Procedure (4/1734), Language Act (423/2003), Data Protection Act (1050/2018) and the Act on Information Management in Public Administration (906/2019).

The publicity and secrecy of data are determined based on the following statutes:

• Act on the Openness of Government Activities (621/1999)
• EU General Data Protection Regulation (GDPR) 2016/679
• Personal Data Act (523/1999)

6. Categories of data subjects and categories of personal data being processed

Only the information necessary to process the matter is collected on the persons mentioned above; such information may include:

• name
• date of birth or personal identity code/ business ID
• domicile
• postal address
• e-mail address
• non-disclosure for personal safety reasons referred to in section 36 of the Act on the Population Information System and the certificate services of the Digital and Population Data Services Agency (661/2009)
• information on grounds for discrimination as referred to in section 8(1) of the Non-discrimination Act, which may include age, origin, nationality, language, religion, belief, opinion, political activity, trade union activity, family relationships, state of health, disability, sexual orientation and other personal characteristics.

7. Regular sources of data

Personal data are mainly obtained from the data subjects themselves. In addition, personal data may be obtained from other interested parties, parties requesting a statement, the Population Register Centre (VTJkysely), as well as other parties.

According to section 14(1) of the Act on the National Non-Discrimination and Equality Tribunal, the Tribunal has the right, notwithstanding secrecy provisions, to receive information in possession of the party in question that is necessary to resolve the matter being processed by the Tribunal from authorities and other parties with public administration duties, employers, education providers and educational institutions, labour market organisations or other organisations supervising professional interests, as well as providers of goods or services. According to subsection 2 of the same section, the Tribunal has the right to receive a clarification on matters that is needed for the monitoring of compliance with the Non-Discrimination Act or the Act on Equality between Women and Men from authorities and other parties with public administration duties, employers, education providers and educational institutions, labour market organisations or other organisations supervising professional interests, as well as providers of goods or services in addition to people employed by said parties.

8. Recipients or categories of recipients of personal data

Data can only be disclosed or outsourced within the limits permitted and required by the valid legislation.

Act on the Openness of Government Activities (621/1999) applies to the activities of the National Non-Discrimination and Equality Tribunal. Public documents are disclosed upon request in accordance with the requirements of sections 13 and 16 of the Act on the Openness of Government Activities. Confidential information is disclosed or given to be studied only 1) with the consent of the interested party, 2) to the interested party or 3) based on a legal right.

With the exception of information subject to non-disclosure for personal safety reasons, personal data is disclosed regularly to interested parties, their representatives and attorneys in matters processed by the National Non-Discrimination and Equality Tribunal. In addition, the Tribunal may also request information and clarifications as referred to in section 14(1) and (2) of the Act on the National Non-Discrimination and Equality Tribunal from parties other than the interested parties in the matter. In that case, it may be necessary to provide personal data on interested parties to the party, from which information or clarification is requested.

In exceptional cases, it may be necessary to grant short-term access rights to the disk drives (H and J drives) used by the Tribunal so that the main user responsible for the functionality of the National Non-Discrimination and Equality Tribunal’s data processing system (the Government ICT Centre Valtori) can carry out a task that has been agreed upon in advance.

The processing of personal data has not been outsourced to any party.

9. Transfer of personal data to third countries

The provisions of Chapter V of the GDPR apply to the transfer of personal data to third countries. The transfer of personal data that is being processed or is intended to be processed after a transfer to a third country or an international organisation is only implemented if the controller and the party processing personal data comply with the requirements of the chapter in question and unless otherwise stated by the other provisions of the Regulation.

10. Personal data storage periods

Personal data storage periods are specified in the archiving plan of the National Non-Discrimination and Equality Tribunal. After the end of the period, the documents are destroyed according to the archiving plan.

11. Profiling

Profiling is not used in the processing of personal data.

12. Rights of the data subject

Data subjects have the right to obtain from the controller confirmation as to whether or not personal data concerning them are being processed, and, where that is the case, access to the personal data. If the data are being processed, data subjects have the right to obtain the following information mentioned in Article 15 of the GDPR:

• the purpose of processing personal data;
• the categories of personal data involved;
• the recipients or groups of recipients, especially international organisations or recipients located in third countries, to whom the personal data have been or will be disclosed;
• if possible, the planned storage period of the personal data or, if providing this information is not possible, the criteria for determining said period;
• the data subjects’ right to request the rectification or erasure of personal data concerning them, the right to restriction of processing of the personal data, and the right to object to such processing;
• the right to lodge a complaint with a supervisory authority;
• if the personal data was not collected from the data subject, all available information on the origin of the data; and
• information on automated decision-making, including the profiling referred to in paragraphs 1 and 4 of Article 22 of the GDPR, as well as information relevant to the processing logic, the significance of the processing and its potential consequences for the data subject.

Those wishing to receive the information on themselves as referred to in Article 15 of the GDPR must submit a request to the controller concerning the matter so that the identity of the data subject can be verified.

Data subjects have the right to demand from the controller the rectification of inaccurate personal data concerning them without undue delay.

In addition, data subjects have the right to obtain from the controller the erasure of personal data concerning them without undue delay, provided that one of the grounds of Article 17 of the GDPR applies. Furthermore, data subjects have the right to obtain from the controller restriction of processing, if one of the grounds of Article 18 of the GDPR applies.

Data subjects can institute a matter concerning rectification, erasure or rectification by following the provisions of the Administrative Procedure Act (434/2003) on instituting a matter.

13. Right to lodge a complaint with a supervisory authority

Data subjects have the right to lodge a complaint with a supervisory authority (Data Protection Ombudsman), if they consider that the processing of personal data relating to them infringes the GDPR.

Contact information of the supervisory authority

Office of the Data Protection Ombudsman
Street address: Lintulahdenkuja 4, 00530 Helsinki
Postal address: P. O. Box 800, FI-00531 Helsinki, Finland
Switchboard: +358 (0)29 56 66700
Email (Registry): [email protected]