Public employment services data protection statement

1. Controller and contact details in matters concerning the register

The KEHA Centre and the employment officials act as joint controllers of the national data repository of employment services. Provisions on the division of responsibilities between joint controllers are laid down in section 123 of the Act on the organisation of employment services (380/2023). The KEHA Centre is responsible for the controller’s obligations related to data protection by design and by default, processing security and informing the data subjects. Employment officials are responsible for the controller’s obligations other than those laid down for the KEHA Centre; each official is responsible for its own customers.

KEHA Centre (Development and administration centre for the ELY Centres)
P.O. Box 1000, 50101 Mikkeli
+358 295 020 000, kirjaamo.keha@ely-keskus.fi

Data Protection Officer of the KEHA Centre:
tietosuoja.keha@ely-keskus.fi

You can find contact information to your local employment authority on the regional pages.

2. Purpose of personal data processing

Data from customers and employment service providers may be used for the following purposes:

• the organisation and provision of services and tasks referred to in the Act on the organisation of employment services (380/2023);
• for tasks laid down for employment officials or the development and administrative centre in the Act on the Promotion of Immigrant Integration, the Unemployment Security Act, the Act on Rehabilitative Work Activities, and the Act on Vocational Education and Training; in addition, for tasks laid down for the development and administrative centre related to international recruitment services and the provision of guidance and advice on employment services and unemployment security as referred to in the Act on Centres for Economic Development, Transport and the Environment (897/2009); (5 December 2024/728)
• supervision, development, monitoring, evaluation, statistics, foresight and guidance of the tasks referred to in 1 and 2.

3. Grounds for personal data processing

The grounds for the processing of personal data are the controller’s statutory obligation. The controllers process data to perform their statutory duties.

4. Personal data to be processed

The following data referred to in the Act on the organisation of employment services (380/2023) may be processed on individual customers:

• personal identity code;
• name and contact information;
• information related to the customer relationship with the employment services and service use with the employment official or the development and administration centre, and any special arrangements required by the service use;
• information on education, employment history, professional skills and other information used in employment services;
• information on service needs, plans and implementation of plans;
• information on job and training offers and introductions to employers;
• information on public employment services, services promoting employment as referred to in the Unemployment Security Act, other services supporting job seeking and employment, and expert assessments;
• information and assessments on health, work ability and functional capacity that have an impact on a person's employment and are necessary to provide services to the customer;
• reports, labour policy statements and other statements and notifications related to unemployment security; the information mentioned and the information necessary for issuing a labour policy statement and other statements may also be processed when a natural person is not a personal customer;
• information on benefits related to public employment services.

The following information may be processed on an employer applying for or receiving employment services:

• identification data;
• information related to the customer relationship with the employment services and service use with the employment official or the development and administration centre;
• information related to activities and service needs;
• information on jobs and related recruitments, including international recruitment;
• decisions on pay subsidy, employment subsidy for those aged 55 or over, and support referred to in section 111 and the related monitoring and payment data;
• work trial agreements;
• information other than that referred to in sections 1–6 necessary for the planning, organisation, implementation and monitoring of the public employment service.

The following information may be processed on employment service providers:

• identification data of the service provider;
• information related to service use with the employment official or the development and administration centre;
• procurement contracts concluded with the service provider and related payment data,
• data concerning the service acquired;
• application, selection, and monitoring data on the service;
• information other than that referred to in sections 1–5 necessary for the planning, organisation, implementation and monitoring of the employment service.
• information on labour market training referred to in the Act on Vocational Education and Training and its organiser as well as application, admission and monitoring information related to education and training.

Data subjects do not have the right to restrict the processing of the data referred to in the subsection 1 as laid down in Article 18 of the GDPR.

According to the Act on the Openness of Government Activities, the information concerning personal customers of the Labour Administration and their services is confidential.

5. Storage period of personal data

The Development and Administration Centre shall delete all information concerning the customer or service provider from the national data repository four years after the termination of the customer or contractual relationship. At that time, the customer’s data will also be removed from the Job Market Finland’s E-Services. However, the data does not need to be deleted if it is necessary for carrying out a task based on regulations, or due to a pending matter.

Provisions on archiving data are laid down in the Archives Act (831/1994).

6. Regular data sources

Personal data are stored in personal data files only when there is a justified reason for doing so. Personal data is obtained to the register from the data subjects themselves and also collected during customer transactions at Job Market Finland’s E-services, on the telephone and in connection with visits.

Notwithstanding confidentiality, the employment official has the right to obtain the data necessary for the implementation of employment services free of charge from another employment official, another municipal authority, state authority, wellbeing services county, Kela, unemployment fund, the Finnish Centre for Pensions, the Employment Fund, provider of employment services, another service provider of a service promoting employment as organised by an employment official and agreed in the employment or similar plan, or organiser of a work trial.

Information on recruitment decisions related to vacancies and concerning individuals is obtained from employers.

When the source of personal data recorded in the register is not the registered person him/herself, an entry is made to the register identifying the source of the information and the party having entered it.

7. Recipients of personal data

Information disclosed to authorities

Notwithstanding secrecy provisions, the Development and Administration Centre has the right, free of charge, to obtain information that is necessary for the Centre to carry out tasks related to the implementation, monitoring and evaluation of employment services laid down in legislation from other government authorities, employment officials, other municipal authorities, the limited liability company called Business Finland, Kela, and the Unemployment Fund.

Notwithstanding secrecy provisions, the Ministry of Economic Affairs and Employment has the right to obtain, free of charge, information that is necessary for the implementation, monitoring, evaluation and steering of the employment services laid down for the Ministry in legislation from the Development and Administrative Centre, other state authorities, employment officials, and other municipal authorities. The Development and Administration Centre is also obliged to disclose to the Ministry of Economic Affairs and Employment the data stored in the data repository for the purpose of compiling employment service statistics.

Notwithstanding confidentiality provisions, the Regional State Administrative Agency has the right, free of charge, to obtain the information necessary for carrying out supervision as referred to in section 25 of the Act on the organisation of employment services (380/2023) from the employment official and the Development and Administrative Centre.

Notwithstanding confidentiality provisions, a member of the admission group for labour market training has the right to receive information on the application and appendices of the person applying for the training.

The employment officials, Development and Administration Centre, Kela, unemployment funds, and foreign organisations that are authorised to process individuals’ job seeking and unemployment security data have the mutual right to exchange information related to job seeking and unemployment security that have an impact on individuals’ right to receive an unemployment benefit.  (Unemployment Security Act 1290/2002, Act on the Application of European Union Legislation Concerning the Coordination of Social Security Systems, 352/2010).

Customer information is disclosed to other authorities if the disclosure of the information is provided by law or if the customer gives their consent to such disclosure. The content of the information to be disclosed is determined based on the scope of jurisdiction of the requesting authority. Authorities that have the right to request information about the customer include the Employment and Economic Development Centre, the Local Government Pensions Institution, the Finnish Immigration Service, the police, social welfare authorities and judgment execution authorities.

Data disclosed to the employment service provider

Notwithstanding confidentiality provisions, the employment service provider and the service provider offering services promoting employment organised by the employment authority as agreed in the employment plan or a plan replacing it have the right to obtain, free of charge, information on a personal customer that is necessary for the provision and implementation of the service from the employment official and the development and administrative centre. The disclosure of the customer’s health information to the service provider is only possible if the customer gives their individual written consent to the disclosure.

Information disclosed to the employer

The employment official may disclose information necessary for recruitment on the job seeker to the employer only with the written consent of the job seeker. Information about consent or refusal of consent is recorded in the customer details. Provisions on the information required for hiring are laid down in Section 118 of the Act on the organisation of employment services (380/2023).

Information on the job seeker’s health may only be disclosed to the employer if the job seeker gives their specific written consent to it and if the information is necessary to meet the special health requirements of the job or the field in question or to promote the employment of a job seeker whose disability or illness makes it difficult to find employment.

Notwithstanding confidentiality provisions, an employer has the right to obtain, free of charge, information from the employment official on whether the person specified by the employer is a registered job seeker with the employment and economic development office, in order to fulfil the obligation concerning the re-employment of a dismissed employee, official, or public servant as laid down in Acts on employment and public-service employment relationships.

Disclosure of information for research purposes

Decisions on granting permission to disclose confidential information in the national data repository of employment services for the purposes of statistics, scientific research or planning or investigation by authorities as referred to in section 28 of the Act on the Openness of Government Activities are made by the KEHA Centre. The content of the information to be submitted is determined in the research plan attached to the research permit application.

8. Transferring data outside of the EU or the EEA

Data are not transferred outside the EU or ETA area.

9. Principles of register protection

Only persons who have the right to process the data required for processing the matter can access the data in the service. Only specific and specified controller’s employees or third-party employees authorised by the controller in advance may access information contained in the service register. Personal data is also protected by access control, use control and guidelines for the processing of personal data. Customer information is confidential and the personnel handling it have a duty of confidentiality.

Provisions on access rights to the customer data system as well as granting and removing those rights are laid down in legislation (Sections 124–126 of the Act on the Organisation of Employment Services 380/2023).

10. Data subject’s rights

You have the right to know whether personal data concerning you are being processed and the right to receive a copy of your personal data (Article 15 of the GDPR). If a personal customer wishes to check what information has been stored in the customer information system concerning them, the customer must request information from the employment official in charge of the customer relationship.

You have the right to request the rectification of incorrect data concerning you (Article 16 of the GDPR). If you wish to rectify data on you, submit a request to the employment official who processes the request and decides on the matter, taking into account the laws and decrees related to the matter.

You do not have the right to restrict the processing of the data referred to in subsection 1 as laid down in Article 18 of the GDPR (Section 114 of the Act on the organisation of employment services 380/2023). If you wish to withdraw your consent for the disclosure of data, this must be requested from the party to whom consent was given. Decisions based on automated decision-making, such as profiling, are not made in the processing of personal data.

For more information on the processing of your personal data, contact the employment official of which you are a customer.

You have the right to lodge a complaint with the supervisory authority if you consider that the processing of your personal data violates applicable data protection legislation. In Finland, the Data Protection Ombudsman acts as the supervisory authority.