Privacy statements concerning benefit processing

The register is used to record and store customer and service related data on Kela’s appointment booking system. The data are processed as part of Kela’s statutory responsibilities.

Privacy statement for Kela’s appointment booking system

1 Data controller

The Social Insurance Institution of Finland (Kela)
PL 450, 00056 Helsinki or Nordenskiöldinkatu 12, 00250 Helsinki
020 634 11, http://www.kela.fi/administration

2 Contact person for register-related matters

Sanna Manninen
Tel. 020 634 11 (exchange)

3 Name of register

Appointment booking system

4 Purpose and basis for the handling of personal data

The register is used for the booking and administration of appointments made by customers and for the storage of the customers’ personal and service related data. The processing of the data is part of Kela’s statutory benefit administration duties.

5 Data content of the register

Types of data contained in the register:

• reason for appointment
• specifier(s) indicating the reason for the appointment (life situation, benefit)
• type of appointment (e.g. phone appointment)
• language used during the appointment
• whether the customer requires interpreter assistance (yes/no)
• language interpreted
• region or municipality
• service point
• date and time of service
• customer’s name
• customer’s personal identity code
• customer’s phone number
• customer's email address
• type of notifications sent about the appointment (e.g. confirmation of appointment)
• method used to deliver the notifications (e.g. text message)
• whether the customer has been assigned a legal guardian (yes/no, ob-tained from Kela’s registers)
• whether access to the customer’s personal data is restricted (yes/no, obtained from Kela’s registers)
• additional information (free-form description)
• appointment status (e.g. completed, cancelled)
• Person who made or changed the appointment
• change history (what changes made, when and by whom)

6 Regular sources of data

Data are obtained directly from the customers, from Kela’s benefit register (name and contact information) and from the Digital and Population Data Services Agency (name and personal identity code). The data are entered by the customers themselves or by a Kela staff member or collaboration partner (e.g. social services) using the online appointment booking system at kela.fi. Use of the appointment booking system requires customers and partners to verify their identity electronically (suomi.fi). When acting on behalf of another person, use of the service requires electronic authentication (suomi.fi), or the secondary user must be a legal guardian with the statutory right to act on behalf of his or her ward.

7 Regular disclosure of data

No personal data are disclosed.

8 Transfer of data outside the EU or EEA

None.

9 Retention period for personal data

Personal data are retained in the database for six months from the date for which the appointment was made and deleted thereafter. Retention of the data is part of Kela’s statutory benefit administration responsibilities. Personal data are retained for the duration needed for Kela to discharge its statutory responsibilities and to implement its benefit schemes.

10 Principles of register security

Kela exercises due care in all its operations and ensures a high level of data protection and data security.

All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.

11 Right of access to data

Under Article 15 of the EU General Data Protection Regulation (EU 2016/679), data subjects have the right to check the data on their person.

Those who wish to check their data must submit a request to Kela.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

12 Right of correction

According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data.

The request for correction must be submitted to Kela.

The request must specify the following:

• the specific information which is incorrect
• the reason why it is incorrect
• how it should be amended.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

13 Right of erasure
 

Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.

This right does not extend to personal data that Kela needs to carry out its statutory duties.

The request to erase personal data must be made to Kela.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

14 Right to file a complaint with a supervisory authority

According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of Kela personal data relating to him or her infringes this Regulation.

Benefit-related data are used in providing customer service and reviewing claims for benefit as part of a statutory social insurance programme.

Privacy statement for the Kela benefit register

1 Register controller

The Social Insurance Institution of Finland (Kela)
PL 450, 00056 HELSINKI or Nordenskiöldinkatu 12, 00250 HELSINKI
020 634 11
http://www.kela.fi/administration

2 Additional information and contact for register-related matters

Tel. 020 692 352

3 Name of register

Benefit register

4 Purpose and basis for the handling of personal data

Benefit-related data are used in providing customer service and reviewing claims for benefit as part of a statutory social insurance programme.
The data are also used by Kela for planning and research purposes as well as in the context of data exchange.

The handling of the data is based on the fulfilment of Kela’s statutory responsibilities. A list of the relevant statutory provisions is attached as Appendix 2.

5 Data content of the register

The benefit register contains general data on beneficiaries, benefit-related data, information about customer service and claims processing, and statistical data.

The types of data contained in the register are described in Appendix 1.

6 Regular sources of data

Data are obtained from customers personally and from government authorities and other entities, including the Population Register Centre, Finnish Immigration Service, the Finnish Tax Administration and its Income Register Unit, authorised pension providers, insurance companies, workplace funds, social welfare and healthcare authorities, and labour authorities.

Data are also obtained from pharmacies and parties to direct reimbursement agreements (health service providers and transport operators providing services under the Health Insurance Act). Further, data are obtained from the Board of Education’s Opintopolku.fi and KOSKI data resources. Study-related data on higher education students are obtained from the VIRTA data resources administered by the Ministry of Education and Culture.

7 Regular disclosure of data

Provided the requirements set out in law are met, Kela discloses customer data electronically to such entities as the Finnish Tax Administration, the authorised pension providers, employment accident insurance providers, social welfare and healthcare authorities, and pharmacies.

8 Transfer of data outside the EU or EEA

In specific cases, data are transferred outside the EU or EEA in accordance with social security agreements. The data are transferred manually on paper forms.

9 Retention period for personal data

The retention periods for benefit-related data are based on the legislation governing the benefits and the Accounting Act. The standard retention period is 10 years from the discontinuation of the benefit, which is based on the six-year retention period specified in the Accounting Act and the additional time needed for appeal and recovery of overpayment.

Some data, such as the data on prescription medicines reimbursed at the pharmacy, are deleted after three years have elapsed from the end of the accounting year in which the reimbursement was paid. Read more about retention period for personal data.

10 Principles of register security

At Kela, data security and protection of personal data are systematically taken into account in all use and handling of information. Kela handles all personal data with data protection in mind and in the manner determined by law.

All persons at Kela who handle personal data sign a confidentiality agreement. The register data are used only by authorised persons who need them to perform their official duties.

11 Right of access to data

According to Article 15 of EU Regulation 2016/679, the data subject has the right to access personal data concerning him or her, i.e. a right to check information concerning the person himself or herself.

The request can be made by phone, by using the Message function on Kela’s e-service, by submitting a written request to Kela’s Registry, or by contacting a Kela office personally. Please note that our e-service is only available in Finnish and Swedish. The contact information can be found in section 1.

12 Right of correction

According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data concerning him or her.
In the request, they must identify the incorrect information, indicate why it is incorrect and specify how it should be amended.

The request can be made by phone, by using the Message function on Kela’s e-service, by submitting a written request to Kela’s Registry, or by contacting a Kela office personally. The contact information can be found in section 1.

13 Right of erasure

According to Article 17 of EU Regulation 2016/679, the data subject has the right to request the erasure of personal data concerning him or her.
This right does not concern personal data that Kela needs to carry out its statutory duties.

14 Right to file a complaint with a supervisory authority

According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.

Appendix 1: Types of data contained in the register

GENERAL INFORMATION

General information may be used in the administration of benefit schemes. General information includes the following:

• personal information
• address and residential information
• other contact information such as e-mail and telephone
• payment details and payee information
• family and other relationship information
• resident permit information
• tax information
• information about earnings and assets
• tax withholding information
• benefit reference data

BENEFIT-RELATED DATA

The benefits and the data used in connection with them are listed in the order of which customers may encounter them in their lives.

1. PREGNANCY, CHILDBIRTH, CHILDCARE

• Maternity, paternity and parental allowances: Claim, review, determination, payment and processing data
• Maternity grant: Claim, review, determination, delivery and processing data
• Child benefit: Claim, review, determination, decision and payment data
• Child benefit: Overpayment and recovery data
• Child benefit follow-up data
• Child care allowance: Claim, review, determination, payment and processing data
• Child maintenance allowance: Claim, review, determination, payment and processing data
• Payment of child support debt
• Dependent child increase data (unemployment benefits, labour market training subsidy, national pension)
• Compensation for family leave costs: Claim, review, determination, payment and processing data

2. ILLNESS, INJURY OR FUNCTIONAL IMPAIRMENT OF CHILD/FAMILY MEMBER

• Disability allowance for persons under 16 years: Claim, review, determination, payment and processing data
• Special care allowance: Claim, review, determination, payment and processing data
• Spouse supplement data (national pensions)

3. OWN ILLNESS, INJURY OR DISABILITY

• Reimbursements of medical expenses: Claim, determination, payment and processing data
• Cross-border medical care benefits: Determination, payment and processing data
• Entitlement to reimbursement of medicine expenses: Claim, review, determination and processing data
• Reimbursements of medicine expenses: Follow-up and cumulative data
• Sickness allowance: Claim, review, determination, payment and processing data
• Rehabilitation: Claim, review, determination, decision, payment, processing and implementation data
• Rehabilitation follow-up data
• Rehabilitation allowance: Claim, review, determination, payment and processing data
• Disability pension and its components, special assistance to immigrants: Claim, review, determination, payment and processing data
• Individual early retirement pension and its components: Claim, review, determination, payment and processing data
• Disability allowance for persons aged 16 years or over: Claim, review, determination, payment and processing data
• Data on the care allowance for pensioners (disability pension, individual early retirement pension, old-age pension, early old-age pension)
• Data on purchases of medicine with a social assistance voucher

4. STUDENTS

• Financial aid for students: Claim, processing, review, determination, payment and decision data
• Financial aid for students: Overpayment recovery and follow-up data
• School transport subsidy: Claim, processing, review, determination, payment and decision data
• School transport subsidy: Overpayment recovery and follow-up data
• Student loan and interest allowance data
• Financial aid for students: Student selection data
• Financial aid for students: Data on debts repayable under government loan guarantee
• Labour market adult education subsidy: Claim, review, determination, payment and processing data
• Adult education subsidy: Loan guarantee data
• Vocational rehabilitation data (rehabilitation data in section 3)
• Housing data (in section 8)
• Orphan’s pension data (survivor pensions in section 9)

5. UNEMPLOYMENT

• Basic unemployment allowance: Claim, review, determination, payment and processing data
• Basic unemployment allowance follow-up data
• Labour market subsidy: Claim, review, determination, payment and processing data
• Labour market subsidy follow-up data
• Job alternation compensation payment data
• Job alternation compensation follow-up data
• Unemployment pension and its components: Claim, review, determination, payment and processing data
• Pension assistance for the long-term unemployed: Claim, review, determination, payment and processing data
• Integration allowance: Claim, review, determination, payment and processing data
• Integration allowance follow-up data
• Job alternation compensation: Claim, review, determination, payment and processing data
• Travel allowance: Claim, review, determination, payment and processing data
• Travel allowance follow-up data Commuting and relocation allowance: Claim, review, determination, payment and processing data
• Commuting and relocation allowance follow-up data
• Pension assistance: Claim, review, determination, payment and processing data

6. WAR VETERANS, CONSCRIPTS

• Data on supplements paid to front-veterans and to persons having participated in mine clearance operations (national pension)
• Front-veteran's supplement payable abroad: Claim, review, determination, payment and processing data
• Conscript’s allowance: Claim, review, determination, payment and processing data

7. OLD AGE

• Pensions and their components: Claim, review, determination, payment and processing data
• Special assistance to immigrants: Claim, review, determination, payment and processing data
• Guarantee pension: Claim, review, determination, payment and processing data

8. HOUSING AND OTHER ECONOMIC SECURITY

• General housing allowance: Claim, review, determination, decision, payment and processing data
• General housing allowance: Tabulated data, municipality data and exempt income data
• Financial aid for students: Housing supplement data
• Conscript’s allowance: Housing assistance data
• Housing allowance for pensioners: Claim, review, determination, decision, payment and processing data
• Basic social assistance: Claim, review, determination, decision, payment and processing data
• Basic social assistance: Voucher data

9. DEATH OF A FAMILY MEMBER

• Survivor’s pension and its components: Claim, review, determination, payment and processing data

10. OTHER CUSTOMER-RELATED DATA

• tax information
• information about earnings and assets
• Pension directory data
• Pension insurance: Historical data
• Earnings-related pension, worker’s compensation, military injury and traffic accident data, data on voluntary pensions, and data on earnings-related unemployment benefits
• Overpayment recovery data (sickness allowance, reimbursements of medical expenses, allowances for parents, child care allowances, child home care allowance, basic unemployment allowance, labour market adult education, labour market subsidy, rehabilitation benefits, pension benefits, special assistance for immigrants, financial aid for students, interest allowance, school transport subsidy, conscript’s allowance and general housing allowance)
• Amount and recovery of child support debt; Claim, review, determination and processing data for exemptions from payment
• European Health Insurance Card orders
• Non-photo Kela Card/Health Insurance Card orders
• Identity card register
• Annual notifications
• Requests for further information
• Occupational health care for entrepreneurs and other self-employed persons: Claim, determination, payment and processing data
• Data on insurance coverage and residence abroad
• resident permit data
• Additional information
• Personal records
• Electronic records management data
• Technical amendments of register data
• Basic social assistance
• Integration assistance
• Travel allowance
• Job alternation compensation
• Commuting and relocation allowance

11. STATISTICAL DATA

• Pension insurance and special assistance for immigrants
• Health insurance benefits
• Unemployment benefits
• Student benefits Family benefits
• Rehabilitation benefits
• Other social security
• Insurance status
• Basic social assistance

The data content is equivalent to that presented above in the context of each category of benefit.

12. DATA HANDLED MANUALLY

• Personal records (arranged alphabetically by office)
• Benefit claims and supporting documents
• Certain other short document series related to benefit administration

Appendix 2: List of legislation relevant to the Benefit Register

• Section 2, Act on the Social Insurance Institution
• Section 3, Act on National Pensions
• Section 6, Act on Guarantee Pensions
• Section 3, Pensioners’ Housing Allowance Act
• Section 3, Act on Special Assistance for Immigrants
• Section 21, Act on Pension Assistance to the Long-Term Unemployed
• Section 14, Act on Front-Veterans’ Pensions
• Section 8, Act on Front-Veterans’ Supplements Payable Abroad
• Section 3, Act on the Labour Market Subsidy
• Chapter 1, Section 3, chapter 15, section 1Health Insurance Act
• Chapter 1, Section 4, Unemployment Security Act
• Chapter 12, Section 3, Act on Public Employment Service
• Chapter 16, Section 21, Act on Job Alternation Compensations
• Sections 7 and 17, Act on the Integration of Immigrants and the Reception of Asylum Seekers
• Sections 4 and 5, Act on Rehabilitative Work Activity
• Section 8, Act on Child Home Care and Private Day Care Allowances
• Section 3, Act on Child Benefits
• Section 1, Act on the Rehabilitation Services and Cash Benefits Provided by Kela
• Section 11, Housing Allowances Act
• Section 4, Maternity Grants Act
• Section 5, Act on Conscripts’ Allowances
• Section 8, Act on Student Financial Aid
• Section 3, Act on Child Maintenance Allowances
• Sections 7 and 14, Act on School Transport Subsidy of General and Vocational Upper Secondary Education Students
• Section 2, Act on the Application of the Legislation on Residence-Based Social Security
• Section 4, Act on Adult Education Allowances
• Section 2, Government Decree on the Responsibilities of Kela in Implementing Certain Provisions of Regulation (EC) No. 1408/71
• Social security agreements
• Section 4, Act on Social Assistance
• Section 24, Act on Pension Assistance
• Section 2, Act on the Basic Income Experiment

To monitor the management of benefit fraud matters and to produce regional and nationwide statistics for the Kelasto statistical database.

Privacy statement for Kela's benefit fraud register

1 Data controller

The Social Insurance Institution of Finland (Kela)
PL 450, 00056 Helsinki or Nordenskiöldinkatu 12, 00250 Helsinki
020 634 11,  www.kela.fi/administration

2 Contact person for register-related matters

Tiina Niskanen
Tel. 020 634 11 (exchange)

3 Name of register

Benefit fraud register (EVAREK)

4 Purpose and basis for the handling of personal data

Personal data are processed as part of monitoring the management of benefit fraud matters. The data are also processed for purposes of producing regional and national statistics for the Kelasto statistical database.

Closed cases are removed from the register, and the data are only used for statistical purposes. When compiled into statistics, the data are converted into a format that prevents individual persons from being recognised.

The handling of personal data is based on the fulfilment of Kela’s statutory responsibilities.

5 Data content of the register

The register contains the following identifying data:

• name
• personal identity code
• insurance district
• benefit that has been the target of fraud
• how the fraud was committed and discovered
• amount paid as a result of fraud
• Kela’s decision with regard to suspected fraud
• police, prosecutor or court decision.

6 Regular sources of data

Data are received from customers, Kela’s benefit systems and, as provided for by law, other public authorities, such as the Finnish Tax Administration, police, prosecutor’s officer and courts of law.

7 Regular disclosure of data

None.

8 Transfer of data outside the EU or EEA

None.

9 Retention period for personal data

Personal data are retained for fourteen (14) months starting from the data on which the case was registered as closed.

10 Principles of register security

Kela exercises due care in all its operations and ensures a high level of data protection and data security.

All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.

11 Right of access to data

According to Article 15 of EU Regulation 2016/679, data subjects have the right to access personal data concerning them, i.e., to you can check the data concerning their person.

Those who wish to check their data must submit a request to Kela.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

12 Right of correction

According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data.  

The request for correction must be submitted to Kela.

The request must specify the following:

• the specific information which is incorrect
• the reason why it is incorrect
• how it should be amended

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

13 Right of erasure

Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.

This right does not concern personal data that Kela needs to carry out its statutory duties.  

The request to erase personal data must be made to Kela.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

14 Right to file a complaint with a supervisory authority

According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of Kela personal data relating to him or her infringes this Regulation.

To verify on the basis of Kela’s customer data that the criteria for issuing a European Disability Card are fulfilled and to register eligible persons as such in the browser-based system of the Service Foundation for People with an Intellectual Disability.

Privacy statement for the register on permissions to order a European Disability Card

1 Data controller

The Social Insurance Institution of Finland (Kela)
PL 450, 00056 HELSINKI or Nordenskiöldinkatu 12, 00250 HELSINKI
020 634 11
http://www.kela.fi/administration

2 Contact person for register-related matters

Viivi Pelkonen
Tel. 020 634 11 (exchange)

3 Name of register

Register on permissions to order a European Disability Card

4 Purpose and basis for the handling of personal data

To verify on the basis of Kela’s customer data that the criteria for issuing a European Disability Card are fulfilled and to register eligible persons as such in the browser-based system of the Service Foundation for People with an Intellectual Disability.

The processing of the data is based on the consent of the registered persons.

5 Information content of the register

Data used for identification

• Name
• Personal identity code
• E-mail address
• Telephone number

Other data needed for the permission (indication that the customer wishes to order a European Disability Card, A marking, authorisation).

6 Regular sources of data

Data are obtained from the customers or their authorised representatives on Kela’s customer service channels.

7 Regular disclosure of data

Kela may release customer data as specified by law.

8 Transfer of data outside the EU or EEA

None.

9 Retention period for personal data

The permission form and its supporting documents are retained for ten (10) years.

10 Principles of register security

At Kela, data security and protection of personal data are systematically taken into account in all use and handling of information. Kela handles all personal data with data protection in mind and in the manner determined by law.

All persons at Kela who handle personal data sign a confidentiality agreement. The register data are used only by authorised persons who need them to perform their official duties.

11 Right of access to data

According to Article 15 of EU Regulation 2016/679, the data subject has the right to access personal data concerning him or her, i.e. a right to check information concerning the person himself or herself.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

12 Right of correction

According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data concerning him or her.

In the request, they must identify the incorrect information, indicate why it is incorrect and specify how it should be amended.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

13 Right of erasure

According to Article 17 of EU Regulation 2016/679, the data subject has the right to request the erasure of personal data concerning him or her.

This right does not concern personal data that Kela needs in order to carry out its statutory duties.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

14 Right to file a complaint with a supervisory authority

According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.

The personal data contained in the register are used in the Electronic Exchange of Social Security Information (EESSI) system of the EU member states. The data are used to identify persons who will be covered by the Finnish social security system.

Identification of natural persons in EESSI message exchange

1 Data controller

The Social Insurance Institution of Finland (Kela)
PL 450, 00056 KELA or Nordenskiöldinkatu 12, 00250 Helsinki
020 634 11 http://www.kela.fi/administration

2 Contact person for register-related matters

Mia Sundblad
Tel. 020 634 11 (exchange)

3 Name of register

Identification of natural persons in EESSI message exchange

4 Purpose and basis for the handling of personal data

The personal data contained in the register are used in the Electronic Exchange of Social Security Information (EESSI) system of the EU member states. The data are used to identify persons who will be covered by the Finnish social security system. The processing of the data is based on the fulfilment of Kela’s statutory responsibilities.

5 Data content of the register

The register contains data used to identify specific individuals and cases.

Personal identifying data:

• name and address
• nationality
• personal identity code
• foreign social security number or equivalent
• whether access to personal data has been restricted.

6 Regular sources of data

Personal data are received from the data subjects, the institution which sent the EESSI message and the Digital and Population Data Services Agency.

7 Regular disclosure of data

Data are disclosed to the Digital and Population Data Services Agency and to the recipient EESSI institution in Finland.

8 Transfer of data outside the EU or EEA

None.

9 Retention period for personal data

Personal data are retained for ten years. The retention period has been set in accordance with the principles outlined in Article 5 of the EU General Data Protection Regulation.

10 Principles of register security

Kela exercises due care in all its operations and ensures a high level of data protection and data security.

All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.

11 Right of access to data

According to Article 15 of EU Regulation 2016/679, data subjects have the right to access personal data concerning them, i.e., them in can check the data concerning their person.  

Those who wish to check their data must submit a request to Kela.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

12 Right of correction

According to Article 16 of EU Regulation 2016679, the data subject has the right to request the correction of inaccurate personal data.

The request for correction must be submitted to Kela.

The request must specify the following:

• the specific information which is incorrect
• the reason why it is incorrect
• how it should be amended.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

13 Right of erasure

Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.

This right does not extend to personal data that Kela needs to carry out its statutory duties.  

The request to erase personal data must be made to Kela.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

14 Right to file a complaint with a supervisory authority

According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of Kela personal data relating to him or her infringes this Regulation.

Data are handled for the purpose of administering a statutory social insurance programme consisting of a variety of benefit schemes and customer service. The data are used primarily for the purpose of verifying customer service transactions.

Privacy statement for recorded phone calls with customers, second-line support phone calls and chat conversations

1 Data controller

The Social Insurance Institution of Finland (Kela)
PL 450, 00056 HELSINKI or Nordenskiöldinkatu 12, 00250 HELSINKI
020 634 11
http://www.kela.fi/administration

2 Contact person for register-related matters

Esa Hämäläinen
Tel. 020 634 11 (exchange)

3 Name of register

System used to record customer phone calls, second-line support phone calls and chat conversations.

4 Purpose and basis for the handling of personal data

Data are handled for the purpose of administering a statutory social insurance programme consisting of a variety of benefit schemes and customer service. The data are used primarily for the purpose of verifying customer service transactions. The data may also be used to train Kela’s customer service personnel to enhance the quality of the service.

The data are used as part of Kela’s statutory responsibilities.

5 Information content of the register

Kela records all calls made to or routed through its nationwide customer service numbers or the helpline for government organisations. A portion of the calls made or routed through regional customer service numbers are recorded as well. Chat conversations on www.kela.fi are also recorded.

Phone calls to and chat conversations with second-line customer support are recorded.

Phone calls and chat conversations are recorded automatically. The data stored in the register consists of data provided by the customers themselves or by a customer service advisor contacted by phone for second-line support. This includes, for example:

• data used for identification
  • name
  • personal identity code
  • address
  • telephone number
• residential data
• family relationships
• insurance status
• tax details
• earnings and assets
• tax withholding data
• benefit reference data

6 Regular sources of data

In phone calls and chat conversations with customers, data are received from the customers themselves. In second-line support phone calls and chat conversations, data are received from customer service advisors.

7 Regular disclosure of data

None.

8 Transfer of data outside the EU or EEA

None.

9 Retention period for personal data

Recordings of phone calls and chat conversations are retained for one (1) year.

10 Principles of register security

Kela exercises due care in all its operations and ensures a high level of data protection and data security.

All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.

11 Right of access to data

Under Article 15 of the EU General Data Protection Regulation (EU 2016/679), data subjects have the right to access and check their personal data.

Those who wish to check their data must submit a request to Kela.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

12 Right of correction

According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data.

The request for correction must be submitted to Kela.

The request must specify the following:

• the specific information which is incorrect
• the reason why it is incorrect
• how it should be amended.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

13 Right of erasure

Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.

This right does not concern personal data that Kela needs to carry out its statutory duties.

The request to erase personal data must be made to Kela.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

14 Right to file a complaint with a supervisory authority

According to Article 77 of the General Data Protection Regulation, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that Kela, in processing personal data relating to him or her, infringes the Regulation.

The data are used as part of Kela’s statutory responsibilities.

Privacy statement for the service provider register

1 Data controller

The Social Insurance Institution of Finland (Kela)

PL 450, 00056 Helsinki or Nordenskiöldinkatu 12, 00250 Helsinki

020 634 11, http://www.kela.fi/administration

2 Contact person for register-related matters

Merja Larikka (Healthcare service providers, healthcare professionals and transport service providers)

Tomi Mielonen (Rehabilitation service providers)

Auri Syrén (Providers of early childhood education)

Tel. 020 634 11 (exchange)

3 Name of register

Service provider register

4 Purpose and basis for the handling of personal data

The handling of personal data is based on the fulfilment of Kela’s statutory responsibilities.

• Chapters 3 and 4; chapter 15, section 9 of the Health Insurance Act
• Sections 6, 9, 10, 12, 14, 15, 41, 46 and 53 of the Act on the Rehabilitation Benefits and Cash Allowances Provided by the Social Insurance Institution
• Sections 15, 16, 20 and 24c of the Act on Child Home Care and Private Day Care Allowances

Some of the data contained in the rehabilitation service provider register may be looked up without signing in via the rehabilitation service provider search function at www.kela.fi.

The data contained in the register are used by Kela to determine

• whether the person performing examinations and therapies and the service provider have the necessary professional qualifications and legal authorisation to provide a statutory social insurance benefit and
• whether the service provider or pharmacy signed an agreement concerning the claiming of reimbursements,
• whether the provider of early childhood education is a private day care centre, a private group family day care provider, a private family day care provider or a day care provider working under a contract of employment, and whether the data remain current.

5 Data content of the register

The register contains the following types of data:

1. For doctors,

• name, registration number and identifying code
• contact information
• professional and licensing details and related additional information

2. For dentists,

• name, registration number and identifying code
• contact information
• professional and licensing details and related additional information

3. For physiotherapists, nurses, nurse practitioners, midwifes, dental hygienists and medical laboratory technicians,

• name, registration number and identifying code
• contact information
• professional and licensing details and related additional information
• additional rehabilitation data

4. Specialist dental technician data

• name, registration number and identifying code
• contact information
• professional and licensing details and related additional information

5. Psychologist data

• name, registration number and identifying code
• contact information
• professional and licensing details and related additional information
• additional rehabilitation data

6. For rehabilitation service providers,

• name, registration number and identifying code
• contact information
• professional and licensing details and related additional information
• additional rehabilitation data

7. Transport service provider data

• Name and business ID
• contact information
• additional data

8. For providers of early childhood education,

• name and identifying code
• form of operation and incorporation
• contact information
• bank details and payment reference data
• claims data

9. Contractual and confirmation data

• type and term of contract, areas of operation or measures
• contract doctors and dentists
• rehabilitation service provider price data
• supplementary contractual data

10. Data handled manually

• agreements relating to powers of attorney, direct reimbursement and transport services (stored at Kela insurance districts)
• Valvira notifications concerning physicians’ licence to practice (Legal Affairs Unit)
• rehabilitation service agreements (insurance districts and Legal Affairs Unit)
• applications for accreditation and Kela approval notifications for rehabilitative psychotherapy and discretionary neuropsychological rehabilitation service providers (Legal Affairs Unit)

6 Regular sources of data

Data are obtained from the service providers, from benefit applicants and various government authorities, including the National Supervisory Authority for Welfare and Health (Valvira), the Regional State Administrative Agencies (AVI), the National Institute for Health and Welfare (THL), university medical faculties, the Digital and Population Data Services Agency (DVV), and municipal authorities.

7 Regular disclosure of data

Data on physicians and dentists are disclosed to pharmacies as required by the direct reimbursement system.

8 Transfer of data outside the EU or EEA

None.

9 Retention period for personal data

Personal data are stored for the duration needed for Kela to discharge its statutory responsibilities and to implement its benefit schemes.

10 Principles of register security

Kela exercises due care in all its operations and ensures a high level of data protection and data security.

All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.

11 Right of access to data

According to Article 15 of EU Regulation 2016/679, data subjects have the right to access personal data concerning them, i.e., to check the data concerning their person.

Those who wish to check their data must submit a request to Kela.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

12 Right of correction

According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data.

The request for correction must be submitted to Kela.

The request must specify the following:

• the specific information which is incorrect
• the reason why it is incorrect
• how it should be amended.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

13 Right of erasure

Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.

This right does not concern personal data that Kela needs to carry out its statutory duties. 

The request to erase personal data must be made to Kela.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

14 Right to file a complaint with a supervisory authority

According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of Kela personal data relating to him or her infringes this Regulation.

The register is intended for use by Kela in operating the system for the electronic direct reimbursement of taxi fares covered by the Health Insurance Act and the ride sharing and dispatch service.

Privacy statement for a register of personal data related to the direct reimbursement procedure used with taxi trips reimbursable under the Health Insurance Act

1 Data controller

The Social Insurance Institution of Finland (Kela)
PL 450, 00056 Helsinki or Nordenskiöldinkatu 12, 00250 Helsinki
Tel. 020 634 11, http://www.kela.fi/administration

2 Contact person for register-related matters

Anne Hauta
Taina Simonen
Merja Larikka
Tel. 020 634 11 (exchange)

3 Name of register

Privacy statement for a register of personal data related to the direct reimbursement procedure used with taxi trips reimbursable under the Health Insurance Act

4 Purpose and basis for the handling of personal data

The register is used by Kela to provide reimbursement for taxi trips using an electronic direct reimbursement procedure, which also includes a ride sharing and dispatch service. The direct reimbursement procedure and the ride sharing and dispatch services are based on the Health Insurance Act (1224/2004). Under the Act, reimbursements for travel costs can be paid to the service provider if the trip in question is reimbursable under National Health Insurance. The service provider must have an agreement with Kela, and the reimbursement is paid to the service provider in accordance with the agreement.

The data controller is Kela. The service provider and any of its subcontractors (such as a dispatch centre, payment processor or transport operator) process the personal data for and on behalf of Kela. The processing of personal data is based on the Health Insurance Act, with the exception of vouchers related to basic social assistance, where processing is based on the client’s consent. They use the personal data exclusively to produce the direct reimbursement procedure and the ride sharing and dispatch service. The use of the personal data is governed by the agreement between Kela and the service provider. Electronically transmitted data on trips qualifying for a direct reimbursement are only handled by Kela staff members who need access to the data to perform their professional duties.

5 Data content of the register

The register contains

• clients’ first name and surname, personal identity code, and address
• other information needed to arrange and dispatch rides, such as whether the client has a certificate showing that they are entitled to use a taxi on a continuing basis, and whether they have the right to use a familiar taxi driver.
• data on trips, mode of transportation and transport operator which are needed to provide reimbursable transport services in accordance with the Health Insurance Act.
• with the consent of the client, data on vouchers related to basic social assistance

The service provider processes all of the data described above on Kela’s behalf.

6 Regular sources of data

Data are received directly from clients.

Data are also received from transport operators and from service providers that have an agreement with Kela on ride sharing, dispatch and use of the direct electronic reimbursement procedure. Kela is authorised to obtain data from the service providers notwithstanding any confidentiality provisions or other restrictions on access to data. This authority is based on chapter 19, section 1 of the Health Insurance Act.

Address information for the clients is obtained from the Digital and Population Data Services Agency. Kela is authorised to obtain data from the Digital and Population Data Services Agency notwithstanding any confidentiality provisions or other restrictions on access to data. This authority is based on chapter 19, section 1 of the Health Insurance Act.

7 Regular disclosure of data

Under chapter 19, section 5 of the Health Insurance Act, Kela is authorised to release to the service provider, in connection with trips as defined in section 4 of the Health Insurance Act, the client’s first name and surname and any other client information essential for dispatching a ride. Such essential information can include that the client has a continuing right to use a taxi or that the client’s annual initial deductible has been reached (i.e. whether a copayment is charged for the trip or not).  Under the Act, Kela is authorised to release the information notwithstanding any confidentiality provisions or other restrictions on access to information. Kela may, with the consent of the client, disclose data to service providers on any basic social assistance vouchers granted to the client.

Kela may disclose information within the bounds of and as required by the valid legislation. Some of the information used in connection with the services is physically located outside Kela on service providers’ servers. This is due to the technical implementation of the service. Data stored on outside servers are used by electronic and other means.

8 Transfer of data outside the EU or EEA

None.

9 Retention period for personal data

Kela retains data essential to arranging and dispatching rides for six years starting from when the data expires for example because the client is no longer entitled to use a taxi. Data on a client’s basic social assistance vouchers are retained for the period of validity of the vouchers. Service providers retain accounting data for six months starting from the date of the ride. Taxi operators retain ride data transmitted to Kela for two years starting from the ride. Service providers retain data needed for ride dispatching and sharing until the data expires or until the end of the contract term. Calls to the dispatch centre are recorded, and service providers keep the recordings for 12 months, after which they must be deleted within 3 months.

10 Principles of register security

Kela exercises due care in all its operations and ensures a high level of data protection and data security.

Service providers and any subcontractors they may use undertake to comply with the confidentiality and secrecy provisions. All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.

11 Right of access to data

Under Article 15 of the EU General Data Protection Regulation (EU 2016/679), data subjects have the right to access personal data concerning them. This means that persons included in the register have the right to check data concerning themselves.

Those who wish to check their data must submit a request to Kela.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

12 Right of correction

According to Article 16 of the General Data Protection Regulation, the data subject has the right to request the correction of inaccurate personal data.

The request for correction must be submitted to Kela.

The request must specify the following:

• the specific information which is incorrect
• the reason why it is incorrect
• how it should be amended.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

13 Right of erasure

Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.

This right does not extend to personal data that Kela needs to carry out its statutory duties.  

The request to erase personal data must be made to Kela.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

14 Right to withdraw consent

Under Article 7 of the General Data Protection Regulation, the data subject has the right to withdraw his or her consent at any time concerning Kela’s right to store information on the data subject’s basic social assistance vouchers.

The withdrawal of consent can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

15 Right to file a complaint with a supervisory authority

According to Article 77 of the General Data Protection Regulation, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of Kela personal data relating to him or her infringes this Regulation.

The personal data contained in the register are used by Kela to discharge its statutory responsibilities in providing access to interpreter services for persons with disabilities.

Privacy statement for the interpreter service for persons with disabilities

1 Data controller

The Social Insurance Institution of Finland (Kela)
PL 450, 00056 HELSINKI or Nordenskiöldinkatu 12, 00250 HELSINKI
020 634 11
http://www.kela.fi/administration

2 Contact person for register-related matters

Suvi Liuski
Tel. 020 634 11 (exchange)

3 Name of register

Register on the interpreter service for persons with disabilities

4 Purpose and basis for the handling of personal data

The personal data contained in the register are used by Kela to discharge its statutory responsibilities in providing access to interpreter services for persons with disabilities.

Data on remote interpretation services are needed to monitor and compile statistics on the use of the service and to provide equipment and an online connection for remote interpretation and to monitor their usage.

The register data are also needed to troubleshoot errors and to bill for the use of the equipment.

The processing of the personal data is based on the Act on Interpreter Services for Persons with Disabilities (133/2010) and the consent given by the clients at the time of application.Clients have the right to withdraw their consent.

The processing of data on the interpretation service provider and interpreter is based on the procurement contract signed by Kela and the service provider.

5 Data content of the register

The register contains data on persons entitled to interpreter services arranged by Kela.

The register contains data on interpretation service providers that have an agreement with Kela to provide such services. The register also contains data on the interpreters under contract with the service providers.

Types of data contained by the register:

1. Clients receiving interpreter services for persons with disabilities

• name
• personal identity code
• client number
• contact information
• interpreter referral information
• The following data are stored about remote interpretation:
• delivery of remote interpretation equipment and online connection
• data collected when monitoring the use of the remote interpretation service

2. Interpretation service providers

• business ID
• name
• contact information
• service provider number
• employees (interpreters)

3. Interpreters

• name
• date of birth
• interpreter number
• contact information
• interpreter referral information

6 Regular sources of data

Client data stored in the register are obtained from interpreter requests made by the clients, from letters, from remote interpretation usage data, and from reports submitted by the service providers.

The service providers are selected on the basis of bids for a specified contract term. Additional services may be procured during a contract term as needed. Information about the service providers covered by the framework agreement and the interpreters in their employ is entered into the register upon the signing of the contract.

7 Regular disclosure of data

Kela may disclose client data as authorised by the prevailing legislation. Necessary data may be disclosed to the service provider in accordance with section 24 of the governing law for the purpose of providing the interpreter service requested by the client.

The service providers are subject to a confidentiality obligation.

In order to provide the remote interpretation equipment and the required online connection, as well as to troubleshoot errors, data may be released as needed to outside service providers under contract to Kela. In such cases, the release of the information requires the client’s separate written consent, which the client may withdraw.

8 Transfer of data outside the EU or EEA

None.

9 Retention period for personal data

The generally applicable retention period for client data is 10 years from the date on which the payment of a benefit ended, which is based on the 6-year retention period specified in the Accounting Act and the time required to deal with possible appeals and recoveries. Information on service providers and interpreters is retained for the duration of the contract and an additional 10 years.

10 Principles of register security

At Kela, data security and protection of personal data are systematically taken into account in all use and handling of information. Kela handles all personal data with data protection in mind and in the manner determined by law.

All persons at Kela who handle personal data sign a confidentiality agreement. The register data are used only by authorised persons who need them to perform their official duties.

11 Right of access to data

According to Article 15 of EU Regulation 2016/679, the data subject has the right to access personal data concerning him or her, i.e. a right to check information concerning the person himself or herself.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

12 Right of correction

According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data concerning him or her.

In the request, they must identify the incorrect information, indicate why it is incorrect and specify how it should be amended.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

13 Right of erasure

According to Article 17 of EU Regulation 2016/679, the data subject has the right to request the erasure of personal data concerning him or her.

This right does not concern personal data that Kela needs in order to carry out its statutory duties.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

14 Right to file a complaint with a supervisory authority

According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.

Personal data are handled in the course of providing an interpreting service to and from foreign languages (for example as part of Kela’s customer service). The personal data are handled when booking an interpreter for rehabilitation and functional assessment.

Privacy statement for the interpreting service to and from foreign languages

1    Data controller

The Social Insurance Institution of Finland (Kela)
PL 450, 00056 KELA or Nordenskiöldinkatu 12
00250 Helsinki
020 634 11
http://www.kela.fi/administration

2    Contact person for register-related matters

Luhta Jouni, Pouttu Merja, Sola Tuomas
Tel. 020 634 11 (exchange)

3    Name of register

Interpreting service to and from foreign languages.

4    Purpose and basis for the handling of personal data

Personal data are handled in the course of providing an interpreting service to and from foreign languages (for example as part of Kela’s customer service). The personal data are handled when booking an interpreter for rehabilitation and functional assessment. They are used to provide rehabilitation and to carry out the functional assessment.

Interpretation to and from foreign languages is based on the following laws:

• Section 19 of the Constitution Act
• Section 26 of the Administrative Procedure Act §
• Section 61 of the National Pensions Act §
• Chapter 15, Section 13 of the Health Insurance Act §
• Section 3 of the Rehabilitation Act §

5    Data content of the register

The following data are stored in the register for the interpreting service to and from foreign languages:

• name of client
• name of interpreter
• Oiwa ID code
• language interpreted
• date and time of interpretation
• service in which interpretation is used (customer service, rehabilitation or functional assessment)
• type of interpretation (on-site/remote)

6    Regular sources of data

The customer data stored in the register are retrieved from Kela’s Oiwa system. The interpreter data are obtained from the interpretation provider.

7    Regular disclosure of data

None. However, data may be disclosed to outside service providers contracted by Kela for the purpose of enabling them to provide needed interpretation services. In that case, the data needed to produce the service are disclosed to the providers.

8    Transfer of data outside the EU or EEA

None.

9    Retention period for personal data

Client data are generally retained for 10 years starting from the time the benefit was discontinued. This is based on the six-year retention period specified in the Accounting Act and the additional time that may be needed for appeals and the recovery of over-payments. Data on interpreters are retained for the duration of the contract period and an additional 10 years. The data are confidential.

10    Principles of register security

Kela exercises due care in all its operations and ensures a high level of data protection and data security.
All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.

11    Right of access to data

Under Article 15 of the EU General Data Protection Regulation (EU 2016/679), data subjects have the right to check the data on their person.

Those who wish to check their data must submit a request to Kela.

can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

12    Right of correction

According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data.

The request for correction must be submitted to Kela.

The request must specify the following:

• the specific information which is incorrect
• the reason why it is incorrect
• how it should be amended.

can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

13    Right of erasure

Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.

This right does not extend to personal data that Kela needs to carry out its statutory duties.

The request to erase personal data must be made to Kela.

can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).

14     Right to file a complaint with a supervisory authority

According to Article 77 of the General Data Protection Regulation, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of Kela personal data relating to him or her infringes this Regulation.

Queue management system

1    Data controller

The Social Insurance Institution of Finland (Kela)
PL 450, 00056 KELA or Nordenskiöldinkatu 12
00250 Helsinki
020 634 11
http://www.kela.fi/administration

2    Contact person for register-related matters

Marianne Eliander
Tel. 020 634 11 (exchange)

3    Name of register

Queue management system.

4    Purpose and basis for the handling of personal data

The register is used in Kela’s queue management system to process the personal identity code of customers who use the on-site terminal to register. The handling of the personal data is based on the fulfilment of Kela’s statutory responsibilities.

5    Data content of the register

Data contained by the register:

• service point
• time of arrival
• customer’s personal identity code.

6    Regular sources of data

Data are received from the customers themselves. Customers register at the service point by scanning the barcode on their ID card, driving licence or Kela card on the queue management terminal. The terminal reads the customer’s personal identity code, which is embedded in the barcode.

7    Regular disclosure of data

No personal data are disclosed.

8    Transfer of data outside the EU or EEA

None.

9    Retention period for personal data

Personal data are retained in the queue management system database until the end of the day of visit, and are deleted overnight.

10    Principles of register security

Kela exercises due care in all its operations and ensures a high level of data protection and data security.

All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.

11    Right of access to data

Under Article 15 of the EU General Data Protection Regulation (EU 2016/679), data subjects have the right to access personal data concerning them. This means that per-sons included in the register have the right to check data concerning themselves.

Those who wish to check their data must submit a request to Kela.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA (in Swedish).

12    Right of correction

According to Article 16 of EU Regulation 2016679, the data subject has the right to re-quest the correction of inaccurate personal data.

The request for correction must be submitted to Kela.

The request must specify the following:

• the specific information which is incorrect
• the reason why it is incorrect
• how it should be amended.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA (in Swedish).

13    Right of erasure

Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.

This right does not extend to personal data that Kela needs to carry out its statutory duties.  

The request to erase personal data must be made to Kela.

The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.

Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA (in Swedish).

14    Right to file a complaint with a supervisory authority

According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of Kela personal data relating to him or her infringes this Regulation.