Privacy statement for public employment services and Job Market Finland

1. Controller and contact details in matters concerning the register

The Employment, Development and Administration Centre (KEHA Centre) and employment authorities are joint controllers of the national data repository for employment services and the data repository for job applicant profiles. Provisions on the division of responsibilities between joint controllers are laid down in sections 123 and 130 a of the Act on the Organisation of Employment Services (380/2023). The KEHA Centre is responsible for the controller’s obligations related to data protection by design and by default, processing security and informing the data subjects.

Employment authorities are responsible for the controller’s obligations other than those laid down for the KEHA Centre; each employment authority is responsible for its own customers. Therefore, in matters concerning the processing of personal data and the exercise of the data subject’s rights, the data subject should primarily contact the employment authority whose customer the data subject is.

You can find the contact details of employment authorities on the regional pages of Job Market Finland.

The KEHA Centre is responsible for the controller’s obligations concerning the data repository for job applicant profiles in cases where a person is not a customer of an employment authority. In these situations, you can contact the KEHA Centre in matters concerning the processing of personal data.

KEHA-Centre
P.O. Box 1000, 50101 Mikkeli
+358 295 020 000, kirjaamo@kehakeskus.fi

Data Protection Officer of the KEHA Centre:
tietosuoja@keha-keskus.fi

2. Purpose of personal data processing

Data from customers and employment service providers may be used for the following purposes:

• the organisation and provision of services and tasks referred to in the Act on the Organisation of Employment Services (380/2023);
• for tasks laid down for employment officials or the development and administrative centre in the Act on the Promotion of Immigrant Integration, the Unemployment Security Act, the Act on Rehabilitative Work Activities, and the Act on Vocational Education and Training; in addition, for tasks laid down for the development and administrative centre related to international recruitment services and the provision of guidance and advice on employment services and unemployment security as referred to in the Act on Centres for Economic Development, Transport, and the Environment (897/2009); (5 December 2024/728)
• supervision, development, monitoring, evaluation, statistics, foresight, and guidance of the tasks referred to in 1 and 2.

The data in job applicant profiles is used to promote employment and the functioning of the labour market and for compiling statistics.

3. Grounds for personal data processing

The grounds for the processing of personal data are the controller’s statutory obligation. The controllers process data to perform their statutory duties.

4. Personal data to be processed

The following data referred to in the Act on the Organisation of Employment Services (380/2023) may be processed on individual customers:

• personal identity code;
• name and contact information;
• information related to the customer relationship with the employment services and service use with the employment official or the development and administration centre, and any special arrangements required by the service use;
• information on education, employment history, professional skills, and other information used in employment services;
• information on service needs, plans, and implementation of plans;
• information on job and training offers and introductions to employers;
• information on public employment services, services promoting employment as referred to in the Unemployment Security Act, other services supporting job seeking and employment, and specialist assessments;
• information and assessments on health, work ability, and functional capacity that have an impact on a person's employment and are necessary to provide services to the customer;
• reports, labour policy statements, and other statements and notifications related to unemployment security; the information mentioned and the information necessary for issuing a labour policy statement and other statements may also be processed when a natural person is not a personal customer;
• information on benefits related to public employment services.

• To assess the need for services, information from the Incomes Register on such things as wages, income, the periods during which the income was earned and job titles can be processed.

Other data on individual customers contained in job applicant profiles than those mentioned above may be processed if these are necessary for the preparation of the job applicant profile, its publication or for the supervision of the use of the service platform. Such data may include information added by a person themselves in the job applicant profile. The job applicant profile may not contain data that are defined as confidential under the law.

The following information may be processed on an employer applying for or receiving employment services:

• identification data;
• information related to the customer relationship with the employment services and service use with the employment official or the development and administration centre;
• information related to activities and service needs;
• information on jobs and related recruitments, including international recruitment;
• decisions on pay subsidy, employment subsidy for those aged 55 or over, and support referred to in section 111 and the related monitoring and payment data;
• work try-out agreements;
• information other than that referred to in sections 1–6 necessary for the planning, organisation, implementation, and monitoring of the public employment service.

The following information may be processed on employment service providers:

• identification data of the service provider;
• information related to service use with the employment official or the development and administration centre;
• procurement contracts concluded with the service provider and related payment data,
• data concerning the service acquired;
• application, selection, and monitoring data on the service;
• information other than that referred to in sections 1–5 necessary for the planning, organisation, implementation, and monitoring of the employment service.
• information on labour market training referred to in the Act on Vocational Education and Training and its organiser as well as application, admission, and monitoring information related to education and training.

Data subjects do not have the right to restrict the processing of the data referred to in section 114, subsection 1, as laid down in Article 18 of the GDPR.

According to the Act on the Openness of Government Activities, the information concerning personal customers of the Labour Administration and their services is confidential.

As a rule, job applicant profiles are published without the person’s name and other direct identifiers. However, based on the information added to the profile, such as work experience, competence, free-form presentation or links to external services, it may be possible to identify the person, which is why the complete anonymity of the profile cannot be guaranteed. The job applicant profile may not contain data that are defined as confidential under the law.

5. Storage period of personal data

The UF-Centre shall delete all information concerning the customer or service provider from the national data repository four years after the termination of the customer or contractual relationship. At that time, the customer’s data will also be removed from Job Market Finland’s E-services. However, the data does not need to be deleted if it is necessary for carrying out a task based on regulations, or due to a pending matter.

The data in the data repository for job applicant profiles will be deleted when the person deletes their job applicant profile from the service platform, however no later than one year after the person’s last login to the service platform. When a person’s job search is valid, the data will not be deleted on this basis. After the job search has expired, the data will be deleted as described above.

Provisions on archiving data are laid down in the Archives Act (831/1994).

6. Regular data sources

Personal data are stored in personal data files only when there is a justified reason for doing so. Personal data is obtained to the register from the data subjects themselves and also collected during customer transactions in the E-services at Job Market Finland, on the telephone, and in connection with visits.

Notwithstanding confidentiality, the employment official has the right to obtain the data necessary for the implementation of employment services free of charge from another employment official, another municipal authority, state authority, wellbeing services county, Kela, unemployment fund, the Finnish Centre for Pensions, the Employment Fund, provider of employment services, another service provider of a service promoting employment as organised by an employment official and agreed in the employment or similar plan, or organiser of a work try-out.

Information on recruitment decisions related to vacancies and concerning individuals is obtained from employers.

When the source of personal data recorded in the register is not the registered person themselves, an entry is made to the register identifying the source of the information and the party having entered it.

The information in the job applicant profiles is predominantly provided by the data subject themselves, and they are responsible for preparing and maintaining their job applicant profile on the service platform. The employment authority may also supplement or process the information in the job applicant profile in situations laid down in the law.

7. Recipients of personal data

Information disclosed to authorities

Notwithstanding secrecy provisions, the KEHA Centre has the right, free of charge, to obtain information that is necessary for the Centre to carry out tasks related to the implementation, monitoring, and evaluation of employment services laid down in legislation from other government authorities, employment officials, other municipal authorities, the limited liability company called Business Finland, Kela, and the Unemployment Fund.

Notwithstanding secrecy provisions, the Ministry of Economic Affairs and Employment has the right to obtain, free of charge, information that is necessary for the implementation, monitoring, evaluation, and steering of the employment services laid down for the Ministry in legislation from the KEHA Centre, other state authorities, employment officials, and other municipal authorities. The KEHA Centre is also obliged to disclose to the Ministry of Economic Affairs and Employment the data stored in the data repository for the purpose of compiling employment service statistics.

Notwithstanding confidentiality provisions, the Finnish Supervisory Agency has the right, free of charge, to obtain the information necessary for carrying out supervision as referred to in section 25 of the Act on the Organisation of Employment Services (380/2023) from the employment official and the KEHA Centre.

Notwithstanding confidentiality provisions, a member of the admission group for labour market training has the right to receive information on the application and appendices of the person applying for the training.

The employment officials, KEHA Centre, Kela, unemployment funds, and foreign organisations that are authorised to process individuals’ job seeking and unemployment security data have the mutual right to exchange information related to job seeking and unemployment security that have an impact on individuals’ right to receive an unemployment benefit. (Unemployment Security Act 1290/2002, Act on the Application of European Union Legislation Concerning the Coordination of Social Security Systems 352/2010).

Customer information is disclosed to other authorities if the disclosure of the information is provided by law or if the customer gives their consent to such disclosure. The content of the information to be disclosed is determined based on the scope of jurisdiction of the requesting authority. Authorities that have the right to request information about the customer include the Finnish Centre for Pensions, the Local Government Pensions Institution, the Finnish Immigration Service, the police, social welfare authorities, and judgment execution authorities.

Data disclosed to the employment service provider

Notwithstanding confidentiality provisions, the employment service provider and the service provider offering services promoting employment organised by the employment official as agreed in the employment plan or a plan replacing it have the right to obtain, free of charge, information on a personal customer that is necessary for the provision and implementation of the service from the employment official and the KEHA Centre. The disclosure of the customer’s health information to the service provider is only possible if the customer gives their individual written consent to the disclosure.

Information disclosed to the employer

The employment official may disclose information necessary for recruitment on the job seeker to the employer only with the written consent of the job seeker. Information about consent or refusal of consent is recorded in the customer details. Provisions on the information required for hiring are laid down in Section 118 of the Act on the Organisation of Employment Services (380/2023).

Information on the job seeker’s health may only be disclosed to the employer if the job seeker gives their specific written consent to it and if the information is necessary to meet the special health requirements of the job or the field in question or to promote the employment of a job seeker whose disability or illness makes it difficult to find employment.

Notwithstanding confidentiality provisions, an employer has the right to obtain, free of charge, information from the employment official on whether the person specified by the employer is a registered job seeker with the employment services, in order to fulfil the obligation concerning the re-employment of a dismissed employee, official, or public servant as laid down in acts on employment and public-service employment relationships.

Disclosure of information for research purposes

Decisions on granting permission to disclose confidential information in the national data repository of employment services for the purposes of statistics, scientific research, or planning or investigation by authorities as referred to in section 28 of the Act on the Openness of Government Activities are made by the KEHA Centre. The content of the information to be submitted is determined in the research plan attached to the research permit application.

Transfer of job applicant profile data

If the data subject so wishes, they can transfer their job applicant profile data from Job Market Finland to external services to which the transfer of data is technically possible. The data subject will themselves decide on the transfer of data. Data is never transferred automatically.

8. Transferring data outside of the EU or the EEA

Data are not transferred outside the EU or ETA area.

9. Principles of register protection

Only persons who have the right to process the data required for processing the matter can access the data in the service. Only specific and specified controller’s employees or third-party employees authorised by the controller in advance may access information contained in the service register. Personal data is also protected by access control, use control, and guidelines for the processing of personal data. Customer information is confidential and the personnel handling it have a duty of confidentiality.

Provisions on access rights and on granting and revoking these rights are laid down in legislation (sections 124–126 and 130 b of the Act on the Organisation of Employment Services 380/2023).

10. Data subject’s rights

You have the right to know whether personal data concerning you are being processed and the right to receive a copy of your personal data (Article 15 of the GDPR). If a personal customer wishes to check what information has been stored in the customer information system concerning them, the customer must request information from the employment official in charge of the customer relationship. You can print out the information in the job applicant profile from the preview tab in the Job applicant profile management view.

You have the right to request the rectification of incorrect data concerning you (Article 16 of the GDPR). If you wish to rectify data on you, submit a request to the employment official who processes the request and decides on the matter, taking into account the laws and decrees related to the matter.

You do not have the right under Article 18 of the General Data Protection Regulation to restrict the processing of data referred to in section 114, subsection 1, of the Act on the Organisation of Employment Services (Act on the Organisation of Employment Services 380/2023, section 114). A request to withdraw consent to the disclosure of data must be made to the party to which the consent was given. No decisions based on automated decision-making, such as profiling, are made in the processing of personal data.

For more information on the processing of your personal data, contact the employment official of which you are a customer.

If you are not a customer of the employment authority and the matter concerns your job applicant profile, you can contact the KEHA Centre for more information. In this case, requests concerning the exercise of the data subject’s rights are also addressed to the KEHA Centre.

You have the right to lodge a complaint with the supervisory authority if you consider that the processing of your personal data violates applicable data protection legislation. In Finland, the Data Protection Ombudsman acts as the supervisory authority.