Skip to content

The rights of the data subject and the enforcement of them

The EU General Data Protection Regulation ensures different kinds of rights for the data subject, i.e. the person whose data is processed. The rights are enforced in different manners depending on the reason for the processing.

This is how you enforce your rights

E-services

Please note that you can view your own health data in the My Kanta service to the extent that they have been entered into it.

If you want to access your own data that you cannot find in e-services (for example Helmet), you can file an access request to the City of Helsinki. You also have the right to demand a rectification of inaccurate data about you. You can file a request to access personal data and a demand for rectification of personal data through the City's e-service:

Using e-services requires strong identification so that the user’s identity can be verified.
Services on site

You can also file a request to access your own data or a demand to rectify inaccurate data in person at the service points listed below. To do this you will need an identity card so that your identity can be verified. The request is filed with the following forms:

 All requests can be filed at the City of Helsinki Registry.

  • The City of Helsinki Registry: Pohjoisesplanadi 11-13

In addition to the Registry, a request can be filed at the following service points, if it is related to the division in question:

  • Education Division: Töysänkatu 2 D and schools and day-care centres
  • Urban Environment Division: Työpajankatu 8
  • Social Services and Health Care Division: all service points
  • Occupational Health Helsinki: Helsinginkatu 24, 2nd floor
Proxy request for personal data

It is possible to request your own personal data by proxy. You can give permission for a third party to access your information by making them an authorised representative (agent) who can act on your behalf. The City accepts a general power of attorney with the principle’s signature, name in block letters and the date for this purpose, if the proposed agent is an attorney-at-law, licensed legal counsel or a public legal aid attorney.

If you wish to use someone other than the above-mentioned persons to request your personal data by proxy, the power of attorney must contain the following:

  • the personal information of both the principle and the agent
  • information on what the authorisation concerns (request for proxy access to the principle’s personal data)
  • principle’s signature, name in block letters and date.

Online services: Agents can submit a request for information by logging in to the city’s online services with a strong authentication method. The power of attorney should be attached to the request. The City will verify whether the agent is indeed an attorney-at-law, licensed legal counsel or public legal aid attorney.

Services on site: When agents make an in-person visit to the City Registry or the service points of the relevant municipal divisions, they must be prepared to show the power of attorney and proof of identity. They then fill in a form requesting access to personal data. The form asks the agents to specify the data they are requesting and by what means it should be delivered to them.

Request concerning a person's own data based on the Openness Act

Information concerning a person’s own data can also be requested based on the Openness Act using the form on the site Publicity of the City’s documents.

Rights of the data subject

Right to access data (right of access by the data subject, Article 15 and Article 12)

A person has the right to know, whether his or her personal data is processed and which data have been saved of them.

The City provides the data without undue delay and at the latest within one month of receipt of the request. That time limit may be extended by a further two months maximum where necessary, if the request is exceptionally comprehensive and complicated. If the time limit is extended, the City informs the person who has filed the request within one month of receipt of the request and the reasons for the delay.

The data subject has the right to receive his or her own data free of charge. For any further copies requested by the data subject, the City may charge a reasonable fee based on administrative costs. If the data requests are obviously unfounded or unreasonable and if they are being filed constantly, the City may charge a reasonable fee or refuse to carry out the requested action. In such cases, the City demonstrates the obvious unfounded nature or unreasonableness of the request.

The right to access is not unlimited. For example, the data subject does not have the right to access data collected of them, if providing the data could potentially impair the national security, defence or public order and safety or harm crime prevention or detection. The right does not apply, if providing the data could potentially pose a threat to the health or treatment of the data subject, the data subject's rights or someone else's rights.

If the City does provide the data on the request of the data subject, it informs the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Right to rectification (Article 16 and Article 12)

A person has the right to demand that the City rectifies inaccurate personal data without undue delay. They shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. The possible incompleteness of the data decided by taking into account the purposes of the processing.

If the City does not accept the person's demand to rectify the data, it provides a written testimonial in which it states the reason why the demand has not been accepted. At the same time, it tells of the possibility to lodge a complaint with a supervisory authority and seek a judicial remedy.

Right to erasure (Article 17)

In some exceptional cases, for example if the processing is based on the consent of the data subject and the data subject withdraws the consent, the data subject has the right to obtain the erasure of personal data concerning him or her, in other words the right to be forgotten.

The right to erasure does not exist, if the processing is based on the compliance of the City's statutory obligations or it pertains to the performance of a task carried out in the public interest or in the exercise of official authority vested in the City.

Right to restriction of processing (Article 18)

A person may in certain circumstances have the right to request a restriction of the processing of his or her personal data for a period of time, until his or her data has been duly rectified or completed. Such situations are:

  • the accuracy of the personal data is contested by the person, for a period enabling the City to verify the accuracy of the personal data
  • the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead
  • the City no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims
  • the data subject has objected to processing pending the verification whether the legitimate grounds of the City override those of the data subject
Right to data portability (Article 20)

A person has the right to transmit his or her personal data from the City to another controller, if he or she has provided his or her own personal data to the City and the processing of the data is based on consent or a contract and the processing is carried out by automated means.

That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the City.

Right to object (Article 21)

A person shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on the performance of a task carried out in the public interest or in the exercise of official authority vested in the City. The same right is applied when the processing is based on the legitimate interests of a controller or a third party. In this case, the data can be further processed only if there are compelling legitimate grounds for the processing, which the City can demonstrate. The processing may also continue, if it is necessary for the establishment, exercise or defence of legal claims. 

The right to object shall not apply to the extent that processing of personal data is based on the compliance of the City's statutory obligations.

Right to contest automated individual decision-making (Article 22)

A person has the right not to be subject to a decision which is based on automated processing and which produces legal effects concerning him or her or similarly significantly affects him or her. Such automated decision-making is, for example, profiling of personal data, such as refusal of an online credit application based on automatic processing of personal data or e-recruiting practices without any human intervention.

Right to lodge a complaint with a supervisory authority (Article 77)

A person, whose personal data has been collected in the services of the City, shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes the EU General Data Protection Regulation. In Finland, this supervisory authority is the Data Protection Ombudsman. This right shall be without prejudice to any other administrative or judicial remedy.

Information about data protection and the data subject's rights (pdf)



26.10.2020 10:09