How does the National Archives process your personal data, when materials stored at the National Archive contain your personal data
The purpose of processing the personal data
Why do we process your personal data?
The statutory task of the National Archives of Finland is to ensure that the documents belonging to the national cultural heritage are preserved and remain accessible, and to promote their use for research purposes. Cultural heritage retained in documents also contains personal data. Permanent retention is usually based on archiving with regard to public interest.
Do we make decisions based on automatic profiling?
The National Archives does not use automated decision-making or profiling.
An automated decision refers to a decision related to assessing personal attributes, made solely based on automatic data processing and resulting in legal effects or other significant outcome for the data subject. Examples of automated decision-making include decisions on a person’s creditworthiness. A data subject has the right not to be subjected to automated decision-making.
Why do we have the right to process your personal data?
The National Archives needs to process personal data to fulfil its statutory assignment.
- National Archives Act (1145/2016)
- Archives Act (831/1994)
- Act on the Openness of Government Activities (621/1999)
The controller and contact information
The controller responsible for the processing of your personal data:
The National Archives of Finland
P.O. Box 258, 00171 Helsinki
firstname.lastname@example.org, +358 (0)29 533 7000
Data protection officer for the National Archives of Finland
Vuokko Joki, Director
P.O. Box 258, 00171 Helsinki
email@example.com, tel. +358 (0)29 533 7321
Based on agreements, the National Archive may be the sole controller, joint controller or a processor of personal data for specific materials. As a rule, we are the sole controller, and other parties no longer exercise any control over the use of materials.
We are the joint controller together with another authority in cases where we store data and have ordered its permanent storage and transfer or, in addition to storing the material, independently manage the information service related to the material.
We may take on the role of processor when we merely store data owned by another party, or lease out facilities for storing the data, and if the other party still exercises control over the use and hand-over of the materials.
The personal data being processed
What personal data do we process?
The data stored at the National Archives has been accumulated during centuries. Most of the materials have been generated as a result of the activities of various authorities. The parties who have gathered the data from the data subjects have appropriate legal justification and purpose for processing the data within their own operations. Data protection regulation only applies to the personal data of the living.
As a rule, the data held by the National Archives include information on many different groups of data subjects, such as employees, health care customers, prisoners, convicted persons, pupils, association members, etc. The contents of the information vary and some stored materials include sensitive or special personal data or classified information.
The party that has drafted the document is responsible for the correctness of the information and for the information content in general.
How long do we retain the personal data?
As a rule, we retain the data permanently as part of the national cultural heritage.
Where do we get the personal data that we need to process the matters?
The National Archive stores as part of its task documents of other authorities and private operators; these documents may contain personal data. Most of the materials have been generated as a result of the activities of various authorities. The authorities have received the data for example from other authorities due to various reporting requirements, or they may have gathered the data directly from the data subjects. The party that originally gathered the data must have legal justification and purpose for gathering the data.
The National Archive works in cooperation with the authorities and private operators such as associations who have given materials for storage and promotes data protection as part of this cooperation. The National Archive agrees with the parties who give materials for storage on practices related to the materials and on the fulfilment of requirements set out in the data protection legislation, such as acting as the controller.
Transfer or hand-over of data
Regular transfer or hand-over of data
The National Archives does not hand over the data it stores to other parties regularly. No data are handed over to third parties for marketing purposes.
Information requests may be submitted with regard to the materials that we store, and the requests are complied with in accordance with the legislation on the openness of operations as well as personal data protection principles. The persons who are responsible for the information services of the National Archive work based on specific instructions and always take into account the wishes and rights of the party who has transferred the information.
When responding to information requests, attention is always paid to the general principle of the right of access to public documents, and to the particular requirements of research work and other special purposes.
If the purpose for which information is requested does not require detailed personal data to be included, the personal data may be processed to anonymise or pseudonymise it as far as possible upon hand-over.
Transfer of personal data to countries outside the EU or to an international organisation
No data are transferred to countries outside the EU or to international organisations.
Information systems, cookies and protection of data
Which information systems do we use to process your personal data?
Personal data contained in a single analogue document, that is, a paper document, is only rarely directly available for searches in the National Archives’ information systems.
The National Archive digitises essential source documents for Finnish history and includes them in the Digital archive; the documents are then freely available online or provided for restricted use in the reading rooms of the National Archive. Applicable legislation is always considered when digitising materials and making the digitised materials available.
Reference information concerning the materials stored at the National Archive, and information that has been digitised from paper documents, are managed and used in the following systems:
- Astia service (searches from Vakka and Aarre, links to digitised material)
- Digital archive
- Vakka archive database
- Aarre archive database
- AHAA (will replace Vakka and Aarre)
The National Archives provides an electronic storage service to the state administration (page in finnish). The service was created to store materials that have been ordered to be permanently preserved in a digital format. In addition, the National Archive is currently planning a mass digitisation project (page in finnish) for documents less than 40 years old still retained by various authorities.
How do we protect your personal data?
The National Archive protects the privacy of the personal data that it saves, and complies with the data protection legislation and appropriate data protection practices in all its operations.
The data have been protected against unauthorized viewing, editing and deleting. The protection is based on physical protection of the facilities, physical access control and restriction of access.
Right to access and process information is granted based on an employee’s task description. Data are only processed by persons who need to process them as part of their work.
The facilities and the data are physically located in Finland.
Administrative controls are used to ensure appropriate procedures.
Rights of the data subject
What are the rights of the data subject?
You have the right to make requests that concern gaining access to your personal data, correcting or removing information, restricting the processing of your data, objecting and transferring your data from one system to another. You can deliver a specific request to exercise these rights to the National Archive and each controller or other authority. To exercise your rights, deliver a specific request to the registrar of the National Archive at firstname.lastname@example.org or by post at P.O. Box 258, 00171 Helsinki, Finland. Resolution on the matter will be provided within one month from the request being received, unless special reasons exist for extending this period.
The National Archive is responsible for storing information for archiving purposes, which may allow exceptions from the regular rights of the data subject based on the Finnish Personal Data Act and the General Data Protection Regulation.
The purpose of the information transferred to the National Archive is to promote the preservation of cultural heritage value and to serve the needs of researchers. In both of these, the integrity and reliability of the information is important; as a rule, the National Archive cannot make changes to or remove any of the information that has been handed over to it. This would be counterproductive to the objective of retaining information for later generations to describe the state of matters on which authorities, for example, have based their decisions.
Submission of a request for viewing the data and processing of the request are normally free of charge. However, the management of the materials stored at the National Archives, their descriptions and the related tools do not always allow the fulfilment of the data subject's rights without unreasonable effort and with adequate accuracy. If the requests submitted by a data subject are decidedly unjustified or unreasonable, for example if unspecified requests are presented repeatedly, the National Archives may collect a reasonable fee that corresponds to the administrative costs of the execution of the requested action.
You have the right to file a complaint at the Office of the Data Protection Ombudsman if you believe that your personal data has been processed in breach of the currently valid data protection legislation. Contact information: Office of the Data Protection Ombudsman, P.O. Box 800, 00521 Helsinki, Finland, email@example.com