Data protection at the City of Vaasa
The City of Vaasa follows the EU General Data Protection Regulation (GDPR) and national data protection legislation. Personal data is processed securely and in a way that safeguards the privacy of each individual.
Privacy notices
The City of Vaasa collects personal data for different purposes. Privacy notices regarding the processing of personal data explain the purposes of data processing and provide other necessary information, such as who the data controller is and the contact person for the register. The privacy notices are currently being updated.
View the City of Vaasa’s privacy notices
What does data protection mean?
Data protection is a fundamental right that safeguards the privacy of data subjects – in other words, you – and ensures your rights and freedoms are respected when your personal data is processed. Its aim is to define when and under what conditions personal data can be processed lawfully and responsibly.
What counts as personal data?
Personal data means any information relating to an identified or identifiable natural person, such as their name, personal identity number, home address, phone number, car registration number, or medical records.
How does the City of Vaasa process personal data?
Most services provided by the City of Vaasa are based on statutory obligations, the public interest, or the exercise of public authority. In such cases, the processing of personal data does not require explicit consent from the individual.
Personal data is handled with care and processed only by staff whose duties require it. Personal data is processed securely and in a way that safeguards the privacy of each individual. Those who process the data are bound by confidentiality and receive appropriate training.
Various logging systems are used to track the processing of especially sensitive personal data. Information systems are safeguarded by measures such as firewalls and regularly updated antivirus software.
Where is personal data obtained from, and why is it collected?
Personal data is mainly obtained directly from the individual customer or from various official registers, such as the Social Insurance Institution KELA and the Digital and Population Data Services Agency.
When an individual customer uses a service, the City of Vaasa collects only the personal data necessary to provide that service. The personal data collected varies according to the service being provided.
Transfer and sharing of personal data
Personal data may be transferred to another unit within the City of Vaasa’s organisation, within the limits set by law. We may also transfer data to third parties who process personal data on behalf of the City of Vaasa. These include, for example, various system or service providers. Data may also be shared with authorities, such as the Social Insurance Institution KELA or the Tax Administration, within the limits set by law.
Exercising your rights
As a data subject, you have the right to know what information about you or your dependant is held in the City of Vaasa’s registers and databases. You may request to review your data by making a data access request. We recommend studying the guidelines before making a data access request to ensure you receive the information you need.
Data provided in response to a data access request is usually free of charge. However, a fee may be charged for a data access request if you ask for multiple copies. If the same person makes repeated requests, a fee may be charged or the request may be refused.
Requests are processed without undue delay, and in any case, within one month of receipt. If a data request is very complex, the response time may be extended by two months.
You can make a data access request using a form, in person, by email or post, or through a representative with a power of attorney.
Link to instructions for making a data access request
Request for verification of registry information (pdf, 95kb)
Data subject rights
Under the data protection regulation, individual customers have the right to exercise, among others, the following rights:
The right to be informed
The data subject has the right to receive information about the processing of their personal data, for example, through this privacy notice. You may also contact the data controller or the Data Protection Officer. Learn more about your right to information on data processing (tietosuoja.fi)
The right of access
The data subject or the guardian of a minor data subject has the right to know whether their/the minor’s personal data is being processed. The also have the right to receive copies of the data concerning them. The city has one month to respond to requests for this information. If a data request is complex, the response time may be extended by two months. Learn more about your right of access to your personal data (tietosuoja.fi)
The right to rectification
The data subject has the right to request that the data controller rectifies any inaccurate, incorrect or incomplete personal data concerning them without undue delay. The request must include the grounds for the data rectification request, as well as the exact replacement text, word for word. The request for rectification must be made either in person or with a handwritten, signed informal request for rectification. The request should be submitted completed and signed to the City of Vaasa Registry. Learn more about your right to have your personal data rectified. (tietosuoja.fi)
The right to erasure and the right to be forgotten
The data subject has the right to request the erasure of their personal data. The data controller is obligated to erase personal data without undue delay unless erasure is impossible under the law. The request for erasure should be submitted in writing to the City of Vaasa Registry. This right cannot be exercised for statutory registers. Learn more about your right to erasure and to be forgotten (tietosuoja.fi)
The right to restrict processing
In certain situations, you have the right to request that the processing of your personal data be restricted, for example if you dispute the accuracy of the data or believe the processing is unlawful. Restriction means that the data will not be processed for any purpose other than storage unless there is a specific reason to do so. The written request must be submitted to the City of Vaasa Registry. Learn more about your right to restrict the processing of your personal data (tietosuoja.fi)
The right to data portability
The data subject has the right to transfer their personal data from one system to another when the processing is based on consent or a contract, and the transfer is carried out automatically. The data subject also has the right to have their data transferred from one controller to another, if technically feasible. The right to data portability does not apply to statutory registers. Learn more about your right to data portability (tietosuoja.fi)
The right not to be subject to a decision based solely on automated processing
With certain exceptions, data subjects have the right not to be subject to a decision based solely on automated processing, which produces legal effects concerning them or similarly significantly affects them. The City of Vaasa does not currently use automated decision-making. Learn more about your right not to be subject to a decision based solely on automated processing (tietosuoja.fi)
The right to file a complaint with the Data Protection Ombudsman
The data subject has the right to file a complaint with the supervisory authority, in Finland with the Office of the Data Protection Ombudsman, if they believe their rights have been violated. Learn more about your right to file a complaint with the Office of the Data Protection Ombudsman (tietosuoja.fi)
The right to be informed of a personal data breach
The data subject has the right to be informed in the event of a potential high-risk data breach. The city is obliged to notify the customer without undue delay.
-
Data protection on social media
-
Data protection on the City of Vaasa website
-
Description for the implementation of public access to documents