The rights of the data subject and the enforcement of them
The EU General Data Protection Regulation ensures different kinds of rights for the data subject, i.e. the person whose data is processed. The rights are enforced in different manners depending on the reason for the processing.
This is how you enforce your rights
Please note that you can view your own health data in the My Kanta service to the extent that they have been entered into it.
If you want to access your own data that you cannot find in e-services (for example Wilma, Helmet), you can file an access request to the City of Helsinki. You also have the right to demand a rectification of inaccurate data about you. You can file a request to access personal data and a demand for rectification of personal data through the City's e-service:
Services on site
You can also file a request to access your own data or a demand to rectify inaccurate data in person at the service points listed below. To do this you will need an identity card. The request is filed with the following forms:
All requests can be filed at the City of Helsinki Registry.
- The City of Helsinki Registry: Pohjoisesplanadi 11-13
In addition to the Registry, a request can be filed at the following service points, if it is related to the division in question:
- Education Division: Töysänkatu 2 D and schools and day-care centres
- Urban Environment Division: Sörnäistenkatu 1
- Social Services and Health Care Division: all service points
- Occupational Health Helsinki: Helsinginkatu 24, 2nd floor
Rights of the data subject
Right to access data (right of access by the data subject, Article 15 and Article 12)
A person has the right to know, whether his or her personal data is processed and which data have been saved of them.
The City provides the data without undue delay and at the latest within one month of receipt of the request. That time limit may be extended by a further two months maximum where necessary, if the request is exceptionally comprehensive and complicated. If the time limit is extended, the City informs the person who has filed the request within one month of receipt of the request and the reasons for the delay.
The data subject has the right to receive his or her own data free of charge. For any further copies requested by the data subject, the City may charge a reasonable fee based on administrative costs. If the data requests are obviously unfounded or unreasonable and if they are being filed constantly, the City may charge a reasonable fee or refuse to carry out the requested action. In such cases, the City demonstrates the obvious unfounded nature or unreasonableness of the request.
The right to access is not unlimited. For example, the data subject does not have the right to access data collected of them, if providing the data could potentially impair the national security, defence or public order and safety or harm crime prevention or detection. The right does not apply, if providing the data could potentially pose a threat to the health or treatment of the data subject, the data subject's rights or someone else's rights.
If the City does provide the data on the request of the data subject, it informs the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
Right to rectification (Article 16 and Article 12)
A person has the right to demand that the City rectifies inaccurate personal data without undue delay. They shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. The possible incompleteness of the data decided by taking into account the purposes of the processing.
If the City does not accept the person's demand to rectify the data, it provides a written testimonial in which it states the reason why the demand has not been accepted. At the same time, it tells of the possibility to lodge a complaint with a supervisory authority and seek a judicial remedy.
Right to erasure (Article 17)
In some exceptional cases, for example if the processing is based on the consent of the data subject and the data subject withdraws the consent, the data subject has the right to obtain the erasure of personal data concerning him or her, in other words the right to be forgotten.
The right to erasure does not exist, if the processing is based on the compliance of the City's statutory obligations or it pertains to the performance of a task carried out in the public interest or in the exercise of official authority vested in the City.
Right to restriction of processing (Article 18)
A person may in certain circumstances have the right to request a restriction of the processing of his or her personal data for a period of time, until his or her data has been duly rectified or completed. Such situations are:
- the accuracy of the personal data is contested by the person, for a period enabling the City to verify the accuracy of the personal data
- the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead
- the City no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims
- the data subject has objected to processing pending the verification whether the legitimate grounds of the City override those of the data subject
Right to data portability (Article 20)
A person has the right to transmit his or her personal data from the City to another controller, if he or she has provided his or her own personal data to the City and the processing of the data is based on consent or a contract and the processing is carried out by automated means.
That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the City.
Right to object (Article 21)
A person shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on the performance of a task carried out in the public interest or in the exercise of official authority vested in the City. The same right is applied when the processing is based on the legitimate interests of a controller or a third party. In this case, the data can be further processed only if there are compelling legitimate grounds for the processing, which the City can demonstrate. The processing may also continue, if it is necessary for the establishment, exercise or defence of legal claims.
The right to object shall not apply to the extent that processing of personal data is based on the compliance of the City's statutory obligations.
Right to contest automated individual decision-making (Article 22)
A person has the right not to be subject to a decision which is based on automated processing and which produces legal effects concerning him or her or similarly significantly affects him or her. Such automated decision-making is, for example, profiling of personal data, such as refusal of an online credit application based on automatic processing of personal data or e-recruiting practices without any human intervention.
Right to lodge a complaint with a supervisory authority (Article 77)
A person, whose personal data has been collected in the services of the City, shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes the EU General Data Protection Regulation. In Finland, this supervisory authority is the Data Protection Ombudsman. This right shall be without prejudice to any other administrative or judicial remedy.
Data requests in accordance with the Openness Act
In addition to the Data Protection Regulation, the disclosure of personal data from a person register is also regulated in the Act on the Openness of Government Activities, i.e. the Openness Act (621/1999).
The personal data access request form is not intended for making data requests in accordance with the Act on the Openness of Government Activities, as requests concerning the City of Helsinki's documents can be made directly to the office holder in charge, to the division or to the municipally owned company. If needed, the City of Helsinki Registry gives advice on the fields of activity of the different authorities and the data that is kept.
According to the Openness Act, official documents shall be in the public domain, unless specifically provided otherwise in the Openness Act or another Act. For example, decisions on building permits and appointments to office are public, even though they include personal data. Moreover and barring specific restrictions, every individual has the right of access to information contained in an official document and pertaining to themselves.
Confidential data include, but are not limited to, client data in social and health care, data concerning student welfare, data describing a person's economic standing and business secrets. If the person is a party in some matter, he or she has the right to be provided with classified personal data, even when it does not concern his or her own personal data.