Skip to content

The rights of the data subject and the enforcement of them

The EU General Data Protection Regulation ensures different kinds of rights for the data subject, i.e. the person whose data is processed. The rights are enforced in different manners depending on the reason for the processing.

Right to access data

A person has the right to know, whether his or her personal data is processed and which data have been saved of them.

The City provides the data without undue delay and at the latest within one month of receipt of the request. That time limit may be extended by a further two months maximum where necessary, if the request is exceptionally comprehensive and complicated. If the time limit is extended, the City informs the person who has filed the request within one month of receipt of the request and the reasons for the delay.

The data subject has the right to receive his or her own data free of charge. For any further copies requested by the data subject, the City may charge a reasonable fee based on administrative costs. If the data requests are obviously unfounded or unreasonable and if they are being filed constantly, the City may charge a reasonable fee or refuse to carry out the requested action. In such cases, the City demonstrates the obvious unfounded nature or unreasonableness of the request.

The right to access is not unlimited. For example, the data subject does not have the right to access data collected of them, if providing the data could potentially impair the national security, defence or public order and safety or harm crime prevention or detection. The right does not apply, if providing the data could potentially pose a threat to the health or treatment of the data subject, the data subject's rights or someone else's rights.

If the City does provide the data on the request of the data subject, it informs the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

(GDPR: 12 article 15 article and Data Protection Act: 34 §)

Right to rectification

A person has the right to demand that the City rectifies inaccurate personal data without undue delay. They shall also have the right to have incomplete personal data completed. The possible incompleteness of the data decided by taking into account the purposes of the processing.

If the City does not accept the person's demand to rectify the data, it provides a written testimonial in which it states the reason why the demand has not been accepted. At the same time, it tells of the possibility to lodge a complaint with a supervisory authority and seek a judicial remedy.

(GDPR: 12 article, 16 article)

Right to erasure

In some exceptional cases, for example if the processing is based on the consent of the data subject and the data subject withdraws the consent, the data subject has the right to obtain the erasure of personal data concerning him or her, in other words the right to be forgotten.

If the City does not accept the person's demand to erasure, it provides a written testimonial in which it states the reason why the demand has not been accepted. At the same time, it tells of the possibility to lodge a complaint with a supervisory authority and seek a judicial remedy.

The right to erasure does not exist, if the processing is based on the compliance of the City's statutory obligations or it pertains to the performance of a task carried out in the public interest or in the exercise of official authority vested in the City.

(GDPR: 17 article.)

Right to restriction of processing

A person may in certain circumstances have the right to request a restriction of the processing of his or her personal data for a period of time until his or her data has been duly rectified or completed. Such situations are for example if a person contests the accuracy of the personal data and the processing of such data is restricted for a period enabling the City to verify the accuracy of the personal data.

(GDPR: 18 article)

Right to data portability

A person has the right to transmit his or her personal data from one controller to another if he or she has provided his or her own personal data to the controller, the processing of the data is based on consent or a contract and the processing is carried out by automated means.

That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the City.

(GDPR: 20 article)

Right to object

A person shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on the performance of a task carried out in the public interest or in the exercise of official authority vested in the City. In this case, the data can be further processed only if there are compelling legitimate grounds for the processing, which the City can demonstrate. The processing may also continue, if it is necessary for the establishment, exercise or defence of legal claims.

 (GDPR: 21 article)

Right to contest automated individual decision-making

A person has the right not to be subject to a decision which is based on automated processing and which produces legal effects concerning him or her or similarly significantly affects him or her. Automated decision-making means that no person is involved in making the decision and decision is made only by a machine based on personal data.

(GDPR: 22 article)

Right to lodge a complaint with a supervisory authority

A person, whose personal data has been collected in the services of the City, shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes the EU General Data Protection Regulation. In Finland, this supervisory authority is the Data Protection Ombudsman. This right shall be without prejudice to any other administrative or judicial remedy.

(GDPR: 77 article)

This is how you enforce your rights

Request for personal data and demand for rectification of personal data

If you want to access your own data that you cannot find in e-services (for example Helmet or My Kanta service), you can file an access request to the City of Helsinki. You also have the right to demand a rectification of inaccurate data about you and the right to have incomplete personal data completed.

You can file a request to access personal data and a demand for rectification of personal data through the City's e-service:

You can also file a request to access your own data or a demand to rectify inaccurate data on site. To do this you will need an identity card. All requests can be filed at the City of Helsinki Registry:

  • The City of Helsinki Registry: Pohjoisesplanadi 11-13

In addition to the Registry, a request can be filed at the following service points, if it is related to the division in question:

  • Education Division: Töysänkatu 2 D and schools and day-care centres
  • Urban Environment Division: Työpajankatu 8
  • Social Services and Health Care Division: all service points
  • Occupational Health Helsinki: Helsinginkatu 24, 2nd floor

The request on site is filed with the following forms:

Proxy request for personal data and demand for rectification of personal data

It is possible to request personal data and demand for rectification of personal data by proxy. You can give permission for a third party to access your information by making them an authorised representative (agent) who can act on your behalf. The City accepts a general power of attorney with the principle’s signature, name in block letters and the date for this purpose, if the proposed agent is an attorney-at-law, licensed legal counsel or a public legal aid attorney. The City will verify, that the representative is indeed an attorney-at-law, licensed legal counsel or a public legal aid attorney.

If you wish to use someone other than the above-mentioned persons to request your personal data by proxy, the power of attorney must contain the following:

  • the personal information of both the principle and the agent
  • information on what the authorisation concerns (request for proxy access to the principle’s personal data)
  • principle’s signature, name in block letters and date.

Online services: The agent submits a request for personal data or demand for rectification of personal data on behalf of the principle by logging in to the city’s online services with a strong authentication method. The power of attorney should be attached to the request.

Services on site: The agent makes an in-person visit to the City Registry or a service point of the relevant municipal division and shows the power of attorney and a proof of identity. The agent then fills in a form requesting access to personal data or a form demanding for rectification of personal data. 



 11.11.2022 11:46

Publicity of the City’s documents

Information concerning a person’s own data can also be requested based on the Openness Act using the form “Information request concerning a person’s own data” on the site Publicity of the City’s documents.