Data protection at Finnish Supervisory Agency

In connection with the Finnish Supervisory Agency, six separate controllers operate, each responsible for the processing of personal data within their respective areas of responsibility as follows:

Adoption Board (an independent body; operates in connection with Social and Health Department)
National Committee on Medical Research Ethics Tukija (an independent body; operates in connection with Social and Health Department)
Occupational Safety and Health Department with regard to the operational registers it uses
Environmental Department with regard to the operational registers it uses
Rescue Services and Preparedness Department with regard to regional cooperation in preparedness
Finnish Supervisory Agency acts as the controller for the Agency’s other activities as well as for its internal services

Finnish Supervisory Agency assumed the majority of the tasks of the Regional State Administrative Agencies, a significant part of the tasks of the Centres for Economic Development, Transport and the Environment (ELY Centres) in the environmental responsibility areas, as well as all the tasks of the National Supervisory Authority for Welfare and Health (Valvira). In accordance with the Act on the Finnish Supervisory Authority (Act 530/2025, Section 32), the archives, registers and data materials necessary for carrying out the tasks intended for the Agency were transferred to it, unless otherwise provided or agreed regarding responsibilities and obligations.

At Finnish Supervisory Agency, personal data processing is mainly based on Finnish Supervisory Agency’s statutory obligations, tasks in the public interest and the exercise of public powers. Finnish Supervisory Agency always processes personal data in accordance with the data protection principles defined in legislation.

Finnish Supervisory Agency follows the following principles for personal data processing:

Personal data is handled lawfully, appropriately and transparently from the point of view of the data subject.

Personal data is collected and handled only for a certain, explicit and legal purpose. Primarily, personal data can only be processed for the mentioned purposes and for as long as the processing is purposeful and necessary in view of the laws.

Only necessary personal data is collected, which minimises the processing of personal data.

Personal data is updated whenever necessary. Imprecise, outdated and incorrect personal data will be deleted or corrected without delay either on Finnish Supervisory Agency’s own initiative or following a request by the data subject.

Personal data is stored in a format in which the data subject can be identified only for as long as necessary for the purpose of personal data processing. The storage period for documents containing personal data have been defined in Finnish Supervisory Agency’s information management plan.

Personal data is processed confidentially and securely. Personal data will only be disclosed in accordance with legislation or on the basis of the data subject’s consent. The data subject has been informed through the privacy statement on how data is disclosed in accordance with regulations.

Principle of openness

Personal data will be disclosed to those requesting it in accordance with the Act on the Openness of Government Activities. Information and documents are public unless specifically determined as confidential under law.

Realisation of a data subject’s rights

As a data subject, you have the right to

know whether Finnish Supervisory Agency is processing your personal data
receive copies of your personal data if Finnish Supervisory Agency is processing your personal data 
request correction of your incorrect or outdated information
request restriction of the processing of your personal data or oppose it under certain conditions.

When we process your information on the basis of a statutory obligation, a task in the public interest or to exercise public powers, you do not generally have the right to request the removal of your data. In some cases, we process your information with your consent. You shall then have the right to revoke your consent at any time.

The processing of personal data and the rights of the data subject are described in more detail in the privacy statements prepared by the Agency’s various controllers, which can be found in connection with each substantive matter on the Finnish Supervisory Agency’s website. Once the Agency’s operations have commenced, the intention is to compile links to the privacy statements also on this data protection page.

The realisation of a data subject’s rights requires that we can identify you from the dataset. To ensure the protection of your privacy, we may ask you to verify your identity when exercising your rights. We will reply to you primarily within one month of your request.

Data protection monitoring at Finnish Supervisory Agency

Finnish Supervisory Agency’s activities as a data controller in accordance with data protection regulations are monitored by Agency’s Data Protection Officer and the office of the Data Protection Ombudsman acting as the national supervisory authority of data protection. The lawfulness of Finnish Supervisory Agency’s activities as an authority is also monitored by the Parliamentary Ombudsman and Chancellor of Justice.

Finnish Supervisory Agency’s Data Protection Officer does not monitor the activities of other authorities or data controllers with regard to data protection matters. Agency’s Data Protection Officer does not provide advice on data protection matters to parties outside the Agency. For such matters, you should contact the Data Protection Officer of the data controller in question, the data controller directly, or the authority monitoring its activities otherwise, such as the office of the Data Protection Ombudsman.

If you have any questions about your data protection rights as a data subject or how your personal data is processed at Finnish Supervisory Agency, you can contact Agency’s Data Protection Officer.

Legislation

Contact information

Finnish Supervisory Agency’s Data Protection Officer
[email protected]

Office of the Data Protection Ombudsman
PO Box 800, FI-00531 Helsinki
[email protected]
tel. +358 29 566 6700 (switchboard)

Finnish Supervisory Agency

Data controller
PO Box 20, FI-13035 LVV
[email protected]
tel. +358 295 254 000 (switchboard)