Privacy statement for the cross-sectoral joint service

1. Controller and contact details in matters concerning the register

The Development and Administration Centre, employment officials, wellbeing services counties and Kela act as joint controllers of information of the cross-sectoral joint service (Section 11 of the Act on multi-sectoral joint services promoting employment 381/2023). Employment officials, wellbeing service counties and Kela are responsible for the controller’s obligations set out in the GDPR regarding any information they have saved in customer data that have not been separately assigned to the KEHA Centre.

KEHA Centre P.O. Box 1000, 50101 Mikkeli +358 295 020 000, kirjaamo.keha@ely-keskus.fi

Data Protection Officer: tietosuoja.keha@ely-keskus.fi

2. Purpose of personal data processing

Data on unemployed persons and the intended use of the data

The employment official, the wellbeing services county and Kela may process data on an unemployed person in order to carry out their tasks laid down in legislation related to the cross-sectoral support cooperation model and the supervision, development, monitoring, evaluation, statistics, foresight and guidance related to these tasks.

Customer information material and system for the multidisciplinary cooperation model

The KEHA Centre develops and maintains a multidisciplinary cooperation model for customer data and a customer information system for implementing the model.

The employment official, the wellbeing services county and Kela shall store information referred to in section 11 of the Act on multi-sectoral joint services promoting employment 381/2023 in the customer data set of the cooperation model for multi-sectoral support. The data of an unemployed person may be stored in the dataset after the customer relationship in the multi-sectoral joint service model has started.

3. Grounds for personal data processing

The processing of personal data is based on the controller’s statutory obligation (Act on multi-sectoral joint services promoting employment 381/2023).

4. Personal data to be processed

The following information may be processed on the unemployed person:

- name, personal identity code and contact details;

- data related to customer relationships with the cross-sectoral joint model and using services, and any data related to special arrangements in relation to this;

- data concerning education, work experience and expertise;

- information on a social situation which affects employment and is necessary for the provision of services;

- information and assessments on health, work ability and functional capacity that have an impact on employment and are necessary to provide services to the customer;

- information on service needs that affect employment;

- information on the multi-sectoral employment plan and its implementation, monitoring and review.

According to the Act on the Openness of Government Activities, the information concerning personal customers of the Labour Administration and their services is confidential.

5. Storage period of personal data

The Development and Administration Centre shall delete all information on the unemployed person four years after the end of the customer relationship with the cross-sectoral joint services. However, the data does not need to be deleted if it is necessary for carrying out a task based on regulations, or due to a pending matter.

In accordance with the Archives Act (831/1994), some of the customer data have been designated by the National Archive for permanent storage. The data designated for permanent storage is transferred to the National Archive after being removed from the customer data system.

6. Regular data sources Regardless of the consent of the unemployed person, the employment official, the wellbeing services county and Kela have the right, notwithstanding confidentiality and other restrictions on the information, to access the information on the unemployed person under Section 11, subsection 2 of the Act on multi-sectoral joint services promoting employment in order to organise multi-sectoral joint support for the unemployed. (Act on multi-sectoral joint services promoting employment, 381/2023). If necessary, data and documents may be collected and obtained with the customer’s specific consent from the following sources, when necessary:

- the customer and reports provided by the customer

- private persons appointed by the customer

- employer

- organisers of rehabilitative work activities

- providers of services promoting employment

- rehabilitation institution

- pension institution

- health care professionals

- substance abuse services

- A-Clinic

- customer cooperation group in rehabilitation services

- employment register of the Finnish Centre for Pensions

- educational institutions, school services and other parties providing education

- prison facilities

- outsourced service providers

7. Recipients of personal data

Regardless of the consent of the unemployed person, the employment official, the wellbeing services county and Kela have the right, notwithstanding confidentiality and other restrictions on the information, to access the information on the unemployed person under Section 11, subsection 2 of the Act on multi-sectoral joint services promoting employment in order to organise multi-sectoral joint support for the unemployed.

8. Transferring data outside of the EU or the EEA

Data are not transferred outside the EU or ETA area.

9. Principles of register protection

Only persons who have the right to process the data required for processing the matter can access the data in the service. Only specific and specified controller’s employees or third-party employees authorised by the controller in advance may access information contained in the service register. Personal data is also protected by access control, use control and guidelines for the processing of personal data.

The use of the customer information system requires personal access rights. The Development and Administration Centre may grant access rights to a person employed by the employment authority, wellbeing services county or Kela who is carrying out tasks referred to in this Act.

10. Data subject’s rights

You have the right to know whether personal data concerning you are being processed and the right to receive a copy of your personal data (Article 15 of the GDPR). If a personal customer wishes to check what information has been stored in the customer information system concerning them, the customer must request information from the controller in charge.

You have the right to request the rectification of incorrect data concerning you (Article 16 of the GDPR). If you wish to rectify data on you, submit a request to the controller in charge who processes the request and decides on the matter, taking into account the laws and decrees related to the storage of the data.

You do not have the right to restrict the processing of the data referred to in subsection 1 as laid down in Article 18 of the GDPR (Section 12 of the Act on multi-sectoral joint services promoting employment 381/2023).

If you wish to withdraw your consent for the disclosure of data, this must be requested from the party to whom consent was given. Decisions based on automated decision-making, such as profiling, are not made in the processing of personal data.

For more information on the processing of your personal data, contact the employment official of which you are a customer.

You have the right to lodge a complaint with the supervisory authority if you consider that the processing of your personal data violates applicable data protection legislation. In Finland, the Data Protection Ombudsman acts as the supervisory authority.