Records Management and Archives Formation Plan of FSD, Appendix 2.Privacy Policy

Processing personal data relating to the users of the Finnish Social Science Data Archive (hereinafter "FSD" or "the Archive") confidentially, transparently and lawfully is an important goal for us. The purpose of this policy is to describe the information we collect about you and how we process it.

When you use FSD services and provide us with, for example, your name, email address or phone number, we process your personal data. In some cases, we also receive personal data from other sources than directly from the user. As we process your personal data, you become a data subject and are entitled to certain rights set out in the General Data Protection Regulation of the European Union (2016/679).

It is important to us that we give you all the information on personal data processing and your rights as set out in legislation. We begin with a general description of how we process your personal data. This general description is followed by a more detailed information on personal data processing.

  1. Who is the data controller and who can I contact?
  2. How and for what purposes do you process personal data?
  3. What rights do I have as a user of FSD services?

You can see our detailed privacy policy here. The detailed privacy policy contains more comprehensive information that should be provided to the data subject in accordance with Articles 13 and 14 of the General Data Protection Regulation.

Who is the data controller and who can I contact?

FSD is the data controller of the user registers it maintains and is responsible for fair and appropriate processing of your personal data. We are happy to answer any questions about personal data processing you may have. You may also contact FSD’s Data Protection Officer.

Name and contact information of the data controller

Finnish Social Science Data Archive
FI-33014 Tampere University
Finland
tel. +358 29 452 0411
user-services.fsd@tuni.fi

Visiting address: Åkerlundinkatu 5 B, 4th floor, Tampere, Finland

Data Protection Officer

Arja Kuula-Luumi
dpo.fsd@tuni.fi
tel. +358 40 190 1438

In addition to user data, FSD maintains research data deposited by researchers that may contain personal data of research participants. Primarily, FSD is not the data controller of research data but acts as processor of personal data on behalf of the data depositor, based on an agreement. If you have a question about personal data in these cases, you can contact the body that conducted the study or you can contact FSD and we will forward your request to the data controller. When data are collected using FSD's Penna data collection tool, FSD acts as a joint data controller (read more here).

How and for what purposes do you process personal data?

We collect, store and process personal data needed to provide our services and carry out our activities. Only the necessary and relevant personal data are collected, stored and processed. The purposes of personal data processing are detailed separately. We have established retention periods for personal data storage and personal data are retained only as long as doing so is necessary for the purpose. After the retention period, data are either disposed of or altered so that individual persons are no longer identifiable. We ensure a sufficient level of data protection when processing personal data.

The purpose of personal data processing at FSD varies according to which activity or service the personal data are needed for. Generally, all purposes relate to enabling FSD’s basic functions. These include, for example, acquiring research data for archiving, negotiating the terms of reusing research data, and providing information services. To enable these functions, we use services like the Aila Data Service. We do not profile our users or make decisions based on automated personal data processing.

As a data subject, you have the right to get information on, for instance, the specific purpose of personal data processing, the legal basis for the processing, the recipients and categories of recipients of the personal data, and the period for which the personal data will be stored. To access more detailed information on personal data processing, select the user group that applies to you from the list below. You can also contact us if you need help in selecting the right user group.

Select the user group that applies to you

What rights do I have as a user of FSD's services?

The General Data Protection Regulation entitles you to certain rights. The exact set of rights depends on what the legal basis for processing your personal data is. You can see the legal basis by selecting the user group that applies to you.

We will assist you to the best of our ability in the exercise of your rights. We have facilitated your exercise of rights in certain cases by allowing you to inspect and change your personal data through a user interface. In other cases you can contact us via the channel of your choice. Below is a general description of the rights of the data subject. The exact content of the rights is determined by the General Data Protection Regulation.

Lodging a complaint with a supervisory authority. You always have the right to lodge a complaint with a supervisory authority if you suspect your personal data are not processed in accordance with the data protection legislation. You can lodge the complaint with the Office of the Data Protection Ombudsman, which is the supervisory authority of personal data processing in Finland. Visit the website of the Data Protection Ombudsman to find the up-to-date contact information (www.tietosuoja.fi (Opens in a new tab) ).

If you permanently reside or work in another EU member state or the suspected misuse has occurred in another member state, you may consider lodging the complaint with the local supervisory authority.

Lodging a complaint with a supervisory authority does not preclude you from pursuing other legal remedies or appealing to an administrative authority.

Right to access and rectify data. You have the right to obtain confirmation whether your personal data are being processed. If they are, you have the right to access them and receive certain information relating to their processing. You also have the right to receive a copy of the personal data undergoing processing if providing the copy does not adversely affect the rights and freedoms of others.

As a data subject, you have the right to request that inaccurate personal data concerning you are rectified without undue delay. In addition, you have the right to have incomplete personal data completed if it is necessary for the purposes of processing.

Right to restriction of processing. As a data subject, you may request to restrict personal data processing in certain situations set out in Article 18 of the General Data Protection Regulation. These include situations where you contest the accuracy of the personal data or object to processing based on the legitimate grounds of the controller.

Right to erasure (”right to be forgotten”). You have the right to have your personal data erased on certain grounds. These situations include, for example: the personal data have been processed unlawfully, the data were processed based on your consent and you withdraw it, the personal data are no longer necessary for the purposes of processing, or you have objected to the processing and there are no legitimate grounds for processing.

Right to data portability. As a data subject, you have the right to receive the personal data you have delivered to FSD in a structured, commonly used and machine-readable format and the right to transmit them to another controller. The right pertains to personal data that are processed based on your consent or for the performance of an agreement. If it is technically feasible, you have the right to have the personal data transmitted directly to another controller.

Right to object. As a data subject, you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data that is based on the controller’s legitimate interest or on the need to process personal data for performance of a task in the public interest. In such a case, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing.

Detailed information on personal data processing

Registered user of the Aila Data Service

Name and contact information of the data controller

Finnish Social Science Data Archive
FI-33014 Tampere University
Finland
tel. +358 29 452 0411
user-services.fsd@tuni.fi

Visiting address: Åkerlundinkatu 5 B, 4th floor, Tampere, Finland

Data Protection Officer

Arja Kuula-Luumi
dpo.fsd@tuni.fi
tel. +358 40 190 1438

Purpose of processing personal data

To enable operations needed for the Data Service Portal Aila ("Aila"), for example, enabling FSD to disseminate data and users to download data, and FSD to process data access applications and to record and publish information on the publications based on datasets downloaded by registered users.

Legal basis for processing personal data

Processing personal data is necessary for the performance of a contract (GDPR, Article 6, paragraph 1 (b)).

Recipients or groups of recipients

  1. Depositor of data in cases where permission is needed for data download. When a registered user submits a data access application in Aila for a dataset that requires permission from the depositor of the data, the Archive discloses to the depositor some personal details of the applicant as well as the intended data use purpose supplied in the application.
  2. Finnish copyright society Kopiosto. If the data downloaded by a user contains material (magazine/newspaper articles or photographs) relevant to the agreement made between the Finnish Social Science Data Archive and Kopiosto, the Archive will disclose to Kopiosto personal data related to the user.
  3. Depositor of data, user’s home organisation, research funder and Kopiosto in case of abuse. If a user breaches the terms and conditions set for the use of the dataset, or uses the data for a different purpose than specified, the Archive can report on the breach and disclose the user’s personal information needed for handling the breach.

Transferring personal data across borders outside the European Union

Personal data are not transferred outside the borders of the European Union or the European Economic Area.

Storage period of personal data

Personal data will be stored on the Aila Data Service Portal for two years from the last time the user logged in.

Information on data downloads will be separately stored for 20 years from the point of download.

Requirements for the provision of personal data on statutory grounds, or on the grounds of entering into a contract or the performance of a contract, and the possible consequences of failure to provide such data

Provision of personal data is necessary for the performance of a contract. The Data Service Portal Aila provides access to research data for research, teaching and learning purposes according to specifically determined access conditions. The Archive and the depositor of data sign an agreement on what kind of access conditions apply for the use of the data. Data users’ personal data are needed to estimate whether the user can be allowed access to the dataset according to the conditions set for the data.

To be able to accept the terms and conditions set for Aila use in general and to register with the service, users are required to submit contact information marked as mandatory for registration.

If the user does not provide mandatory personal data, they will not have access to services reserved for registered users. Aila provides some services for unregistered users. They can, for instance, browse datasets in the data service portal.

Automated decision-making and profiling

The Archive does not use personal data for automated decision-making or profiling.

Other rights relating to the personal data stored

Rights of the data subject regarding the Aila Data Service

  • Right to lodge a complaint with a supervisory authority
  • Right to view your personal data (right of access)
  • Right to rectification
  • Right to erasure
  • Right to restriction of processing
  • Right to data portability

You can access and edit your personal data in your profile by logging into Aila and navigating to your profile. You can also browse your downloads and access applications.

You can read a general description of rights and exercising them here.

Some personal data are not collected directly from the data subject. If you use your HAKA identity for registration and log in, FSD receives from the HAKA Identity Federation (Opens in a new tab) the following personal data concerning you in connection with the registration.

Personal data not collected directly from the data subject

First name, surname, email, home organisation, home organisation type, identity attribute (ePPN), date of creation of a identity attribute and Identity Provider (IdP).

Source of personal data not collected directly from the data subject

Home organisation through the Haka Identity Federation. The data are not obtained from a publicly accessible source.

If you notice any errors in the data related to your HAKA identity, please contact your home organisation to rectify them.

Agreement on depositing and archiving

Name and contact information of the data controller

Finnish Social Science Data Archive
FI-33014 Tampere University
Finland
tel. +358 29 452 0411
user-services.fsd@tuni.fi

Visiting address: Åkerlundinkatu 5 B, 4th floor, Tampere, Finland

Data Protection Officer

Arja Kuula-Luumi
dpo.fsd@tuni.fi
tel. +358 40 190 1438

Purpose of processing personal data

The purpose of entering contact details into the deposition agreement is to perform the contract by enabling contacts between signing parties for access applications management, delivery of annual data use reports and other reports, and publication of data creator information in the data catalogue.

The personal data relating to the Data Controller, Data Protection Officer, or other contact persons receiving information and reports specified in the agreement are processed according to the obligations based on GDPR requirements and laid out in the agreement for data processing.

Legal basis for processing personal data

Processing personal data is necessary for the performance of a contract (GDPR, Article 6, paragraph 1 (b)).

Recipients or groups of recipients

The contact details entered into the agreement can be given to the Data Controller or the Data Protection Officer of the depositor’s home organisation, if so requested.

Reports of datasets and dataset depositors are delivered to Kopiosto if the dataset is covered by the licence agreement made between FSD and Kopiosto.

Research data archived at FSD are transferred to the national digital preservation service owned by the Ministry of Education and Culture and provided by CSC - IT Center for Science Ltd. If an archived dataset is pseudonymous or contains personal data, those personal data are also transferred to the service alongside information on the data creators.

Transferring personal data across borders outside the European Union

Personal data are not transferred outside the borders of the European Union or the European Economic Area.

Storage period of personal data

The following personal data items are permanently stored in the delivery history of the dataset for the depositor (signatory), the person authorising access to the data and their deputy, the contact person of the data and for the person receiving use reports: the name, home organisation and role at the time of depositing.

The following information included in the deposition agreement is stored permanently in the delivery history of the data: the name, home organisation and role of the Data Controller, Data Protection Officer, and the person receiving reports regarding personal data.

Requirements for the provision of personal data on statutory grounds, or on the grounds of entering into a contract or the performance of a contract, and the possible consequences of failure to provide such data

Provision of personal data is necessary for the performance of a contract. It is not possible to make these agreements without sufficient personal data.

Automated decision-making and profiling

FSD does not use personal data for automated decision-making or profiling.

Other rights relating to the personal data stored

  • Right to lodge a complaint with a supervisory authority
  • Right to view your personal data (right of access)
  • Right to rectification
  • Right to erasure
  • Right to restriction of processing
  • Right to data portability

You can read a general description of rights and exercising them here.

Some personal data are not collected directly from the data subject. Depending on the situation, the data depositor may give contact details of the Data Protection Officer, or such contact information may be collected from publicly available sources.

Personal data not collected directly from the data subject

  • (if a natural person) contact details of the Data Controller
  • contact details of the Data Protection Officer
  • contact details of a person receiving applications and use reports
  • contact details of the signatory of the deposition agreement

Source of personal data

Data depositor or publicly available information relating to the organisation.

Information services, events, communications and other user services

Name and contact information of the data controller

Finnish Social Science Data Archive
FI-33014 Tampere University
Finland
tel. +358 29 452 0411
user-services.fsd@tuni.fi

Visiting address: Åkerlundinkatu 5 B, 4th floor, Tampere, Finland

Data Protection Officer

Arja Kuula-Luumi
dpo.fsd@tuni.fi
tel. +358 40 190 1438

Purpose of processing personal data

Personal data are used to manage information requests and other contacts handled by the user and information services, to identify and acquire research data, update email lists and publish communications relating to the services and operations of FSD. Personal data are also used to share information about events organised by FSD, take into account event-related special needs, send the registration confirmation and participation link, and share any presentation material and feedback surveys to the participants after an event.

Legal basis for processing personal data

Personal data are processed for the performance of tasks carried out in the public interest (GDPR, Article 6, paragraph 1(e)). The Finnish Social Science Data Archive is a separate unit of Tampere University. The Universities Act (558/2009, Section 2) states that the mission of Finnish universities includes promoting independent academic research and interacting with the surrounding society in carrying out the mission. FSD processes the contact information of its information and user services users and event participants for the performance of tasks in the public interest specified above.

Recipients or groups of recipients

Personal data are not transferred to outsiders.

Transferring personal data across borders outside the European Union

Personal data are not transferred outside the borders of the European Union or the European Economic Area.

Storage period of personal data

Personal data related to a contact person who participates in the data depositing process, for example, in administrative capacity, are stored for three years.

Contact details for members and deputy members of FSD's Advisory Board are stored until the end of their term.

Personal data that are processed for identifying and acquiring research data to be archived (name of the researcher, organisation, preliminary name for the dataset) will be stored until the Archive no longer considers further evaluation of the archiving potential of the research data necessary.

Information provided in contact requests made through information services, communications and projects (name of the contact request sender, subject matter of the request) is stored for a period of 10 years.

Personal data collected for events organised by FSD are deleted when the presentation material has been delivered to the participants and a feedback survey has been conducted.

Requirements for the provision of personal data on statutory grounds, or on the grounds of entering into a contract or the performance of a contract, and the possible consequences of failure to provide such data

There is no necessity to provide personal data based on legislation or contracts.

Automated decision-making and profiling

FSD does not use personal data for automated decision-making or profiling.

Other rights relating to the personal data stored

You have the following rights relating to personal data processing for the purpose mentioned above:

  • Right to lodge a complaint with a supervisory authority
  • Right to view your personal data (right of access)
  • Right to rectification
  • Right to erasure
  • Right to restriction of processing
  • Right to data portability
  • Right to object personal data processing

You can read a general description of rights and exercising them here.

Some personal data are not collected directly from the data subject.

Personal data not collected directly from the data subject

Depending on the case, the following contact details needed: name, email, organisation, phone number

Source of personal data not collected directly from the data subject

Publicly available sources, such as websites of organisations, research bulletins and science publications.

Participant in a Penna qualitative textual data collection

When data are collected using FSD's Penna data collection tool, FSD always acts as a joint data controller.

Name and contact information of the data controller

Finnish Social Science Data Archive
FI-33014 Tampere University
Finland
tel. +358 29 452 0411
user-services.fsd@tuni.fi

Visiting address: Åkerlundinkatu 5 B, 4th floor, Tampere, Finland

Data Protection Officer

Arja Kuula-Luumi
dpo.fsd@tuni.fi
tel. +358 40 190 1438

The contact information of the other joint data controller (cooperation partner) is included in the invitation to participate in the research.

Purpose of processing personal data

Personal data are processed for the purpose of collecting qualitative textual data in collaboration with the cooperation partner, who is organising the data collection as part of a research project defined in the invitation to participate in the research. The research project for which the data are collected is explicitly specified in the invitation to participate. When participating in the collection of qualitative textual data, (registered) writers send their texts to FSD's Penna data collection tool. After data collection has been completed, the texts are also transferred to the cooperation partner acting as the joint data controller.

After data collection has been completed, the data are processed at FSD for the purpose of data archiving in the public interest. When the data are processed, attention is paid to data minimisation and anonymisation in accordance with article 89 of the GDPR.

Legal basis for processing personal data

During data collection, the Archive processes personal data based on the consent of the registered user (article 6, section 1(a) of the GDPR). Special categories of personal data can be processed with the explicit consent of the data subject for one or more specified purposes (article 9, section 2(a) of the GDPR).

You can withdraw your consent to the processing of your personal data at any time. The easiest way to withdraw your consent is by using the unique link provided to you. Alternatively, you can withdraw your consent by contacting FSD or FSD’s Data Protection Officer. The withdrawal of consent will not affect the lawfulness of the processing of personal data conducted before the withdrawal.

After the data collection, personal data are processed in accordance with section 4, subsection 4 of the Finnish Data Protection Act (processing personal data for archiving purposes). For the purpose of data archiving in the public interest, FSD processes, retains and reviews research data for reuse. The rights of data subjects are not derogated based on section 32 of the Finnish Data Protection Act. Special categories of personal data are processed for archiving purposes in the public interest in accordance with section 6, subsection 8 of the Finnish Data Protection Act. FSD acts as the data controller based on the public Archives Formation Plan.

Recipients or groups of recipients

After data collection has been completed, the textual data are transferred to the joint data controller (cooperation partner in data collection). The joint data controller and their contact information are specified in the invitation to participate in the research.

Transferring personal data across borders outside the European Union

Personal data are not transferred outside the borders of the European Union or the European Economic Area.

Storage period of personal data

Personal data are stored by FSD for the duration of the data collection. After data collection has been completed, the textual data with personal data included are stored until the data have been processed to be archived or the data have been reviewed and found unsuitable for archiving, after which the data are deleted.

Requirements for the provision of personal data on statutory grounds, or on the grounds of entering into a contract or the performance of a contract, and the possible consequences of failure to provide such data

There is no necessity to provide personal data based on legislation or contracts.

Automated decision-making and profiling

FSD does not use personal data for automated decision-making or profiling.

Other rights relating to the personal data stored

When personal data are processed based on consent, you have the right to withdraw consent at any time. Additionally, you have the following rights:

  • Right to lodge a complaint with a supervisory authority
  • Right to view your personal data (right of access)
  • Right to rectification
  • Right to erasure
  • Right to restriction of processing
  • Right to data portability
  • Right to object to processing of personal data

When personal data are processed in accordance with section 4, subsection 4 or section 6, subsection 8 of the Finnish Data Protection Act, you have, among other rights, the right to lodge a complaint with a supervisory authority, right to view your personal data, right to rectification, right to restriction of processing, and right to object to processing of personal data. You can contact the Data Protection Officer for more information if necessary.

You can read a general description of rights and exercising them here.

Candidate selector data

The media collects candidate selector data for journalistic purposes in compliance with Section 27 of the Finnish Data Protection Act and provides open access to the data with the consent of the candidates. FSD archives responses given by election candidates to candidate selectors/voting advice applications in Finnish Parliamentary, European Parliamentary and Finnish Presidential elections. The data can be reused for research. Variables that include information on the candidates’ family members or references to any external sources (blogs, social media accounts etc.) are removed from the data archived at FSD. The archived data include the candidate’s political party affiliation, name and other background information provided by the candidates themselves in the responses. No information from any other source is added to the data.

Information on the use of our website, including the cookie policy

Use of cookies

We use cookies to ensure the best experience for the users of our website. We use cookies to compile visitor statistics to improve the functionality and contents of our website.

A cookie is a small text file sent from a web service to the user's computer. Cookies do not harm the user's computer or files, and FSD never utilises cookies in a manner that would infringe on users' privacy.

Web browser applications allow disabling cookies. Browser-specific instructions can be found on the Internet and on the websites of software providers. If you continue without using your cookie settings, we assume you accept the use of cookies on the FSD website.

You should note that most cookies are necessary to enable the use of services on the website. For example, selecting a default language, displaying search results or logging in to services may not function properly if cookies are not allowed.

Web analytics

We use a third-party service on our website (www.fsd.tuni.fi) to collect basic analytics on our website traffic, for instance, with regard to how users navigate on our website. We use the Google Analytics service to collect this information. This information is not collected on Aila Data Service or other services under the web address services.fsd.tuni.fi. By collecting web data, we want to ensure the best experience for our users. We collect compiled information on how different parts of our website are used, how the use develops and whether there are any issues on our website. We report aggregated results of our website use in, for example, our annual report. The web data are only processed in such a manner that individual users cannot be identified. Only select staff members have access to the data. The data are stored for 26 months for reporting purposes.

Search engine

We use Google Custom Search on our public web pages. The search engine targets different parts of our website, but does not search from the Aila Data Service or other services under the web address services.fsd.tuni.fi. Search terms are stored in a log file to enable improving our web services and search options.

Social media channels

FSD uses social media services to reach as many customers as possible. Each service has its own data protection policy. The social media channels and services used by FSD are listed below. The links provide direct access to the privacy and data protection information of each service.