Privacy statement of Avoindata.fi

Public and private organisations and communities, foundations and entrepreneurs can use the avoindata.fi service when offering their open data to the public.  
The data in the service can be browsed and downloaded without registration. You must register to publish new data in the service. 

1. Controller and contact persons

Digital and Population Data Services Agency 
Lintulahdenkuja 2, 00530 Helsinki, Finland
PO Box 123, 00531 Helsinki, Finland
Telephone (switchboard) +358 295 536 000
Email kirjaamo(at)dvv.fi

Contact person in register-related matters
Chief Specialist, Anssi Ahlberg
Lintulahdenkuja 2, 00530 Helsinki, Finland
Telephone (switchboard) +358 295 536 000
Email kirjaamo(at)dvv.fi

2. Data Protection Officer

Telephone (switchboard) +358 295 536 000
Email tietosuoja@dvv.fi

3. Purpose and legal basis for processing of personal data

The provision and development of the open data and interoperability service (the avoindata.fi service) is laid down in the first section of the decree of Ministry of Finance on the provision of certain shared support services for the electronic services of the public administration (607/2016).

The EU directive on open data and the re-use of public sector information, Article 9 of which contains provisions on a national contact point, also applies to the provision of the service. In practice, the avoindata.fi service serves as a centralised contact point in Finland.

Users registered in the Avoindata.fi service can publish open data and comment on published content.

Data is processed for the following purposes:

  • The data registered in the user register is used to provide the service to users.
  • In the service, you can comment on published materials using the comment tool Disqus.
  • You can give feedback on the service with a feedback form.
  • The data can also be used to communicate on the service.

An event log is kept on the actions taken by logged-in users. The data in the event log will be used, where necessary, for the retrospective investigation of data processing activities that have taken place in the service and actions taken by the user. Personal data are processed as part of the provision of the Digital and Population Data Services Agency’s statutory services, i.e., on the basis of Article 6(1)(c) of the EU General Data Protection Regulation, in order to comply with the controller’s statutory obligation.

4. Personal data retention period

The data in the user register is retained until it is requested to be deleted. Users can request the deletion of their data by contacting the Digital and Population Data Services Agency by email at kirjaamo(at)dvv.fi or by mail (contact information can be found in section 1 of this statement).

The data in the event log is retained for as long as it is deemed necessary.

5. Processed personal data

The following have been recorded in the user register:

  • username and password selected by the person
  • email address, which can also be used for information purposes
  • time zone selected by the person (optional)
  • photo (optional)
  • user role applied for by the person and granted to the person by the service in the service
  • user role applied for by the person and granted to the person by the service as a representative of an organisation

The service also has admin users.

The comment tool Disqus has announced that it will process the following categories of personal data:

  • the person’s name, username and password, date of birth, email address, telephone number and home address
  • the user’s IP address, cookie ID, login information, time zone, location, browser information, and other specifications
  • interests, preferences, possible feedback and survey responses, marital status, gender and title
  • how the user uses the comment tool, the content of the comments, and various user statistics

The feedback form records the following:

  • name
  • email address
  • date and time the feedback was sent

Details of the event log for the logged-in user:

  • user ID
  • event data time stamps
  • actions taken by the user, such as logging in and out, publishing, modifying and commenting on data, and other possible actions

6. Standard sources of data

The data in the user register can be obtained via the person’s own notification or when the person registers on the website for opening of data. Service administrators and admin users grant users the roles needed to open and maintain data.

For the comment tool Disqus, the person provides their data in connection with Disqus’s own registration process. Disqus collects some data through automated technology, login information, cookies, and third parties.

For the feedback form, the data is obtained via the individual’s own notification.

The data in the event log is saved on events made by the service user or admin user in the avoindata.fi service.

7. Disclosure of data

The username and email address selected by the user are displayed in the service in connection with any data published by the user. Data stored on the user in the user register and the event log may be disclosed to the organisation represented by the user and to the user themselves.

The Disqus ID of the user is displayed on the website with the user’s comments. Disqus may also disclose personal data to third parties.

The feedback provided can be passed on to parties that have published the data in the service.

On request, data from the event log can be disclosed, for example, to investigate error conditions.

Disclosure of information is carried out on the basis of legislation. 

8. Transferring data outside the EU or the EEA

With regard to the user register, feedback form and event log, personal data will not be transferred outside the EU or EEA countries or to international organisations.

Disqus, the comment tool used in the service, may transfer data outside the EU/EEA. The company is based in California, United States of America. The company reserves the right to sell and disclose data to third parties. For additional information, see Other Information.

9. Automated decision-making

The Digital and Population Data Services Agency does not use the personal data in the avoindata.fi service in automated decision-making.

10. Data subject’s rights

Right of inspection

You have the right to gain access to your personal data and check its content.

When you have logged in to the service, you can view some of the data stored about you:

  • user ID
  • email address
  • name
  • picture
  • some of the events, such as the publication dates and update information of the material you have published

You can view the information stored in the user register via your profile by logging in to the avoindata.fi service at www.avoindata.fi.

For the comment tool Disqus, you can check the personal data you provided when registering for the Disqus service and the comments you have made through the service by logging in to the service in question. For information collected by Disqus, you can submit a request to check using the Privacy Web Form.

If you cannot check your information via electronic services, you can send a request for an inspection to the Digital and Population Data Services Agency’s registry. Be prepared to provide proof of identity.
Right to revision

You have the right to correct your personal data when you observe that it is inaccurate or incorrect. You can change some of your details by logging in to the service. If this is not possible, submit a written request to the registry’s contact person. In the request for revision, state the information to be corrected and its exact change or addition. Be prepared to provide proof of identity.

For the comment tool Disqus, you can correct the data you entered in when you registered into the service in question by logging in to the Disqus service.However, you do not have the right to demand that the data in the event log register be corrected due to their nature, as there is a justified requirement for event data, or log data, to remain unchanged.

Limitations to the rights of the data subject

Most of the Digital and Population Data Services Agency’s services are based on compliance with the controller’s statutory obligation. In such cases, you cannot request that your personal data be deleted or transferred to another system, and you cannot oppose the processing of your personal data.

For the comment tool Disqus, see Other information. For more information on the limitations to the rights of the data subject and the right to erase data, see Disqus’s own website. You can request the deletion of your personal information through the Privacy Web Form. In this case, you will no longer be able to use the comment tool.

11. Right to lodge a complaint with the supervisory authority

If you think that your personal data is being processed unlawfully, you can file a complaint with the Office of the Data Protection Ombudsman.
Office of the Data Protection Ombudsman
Street address Lintulahdenkuja 4, 00530 Helsinki, Finland
Postal address PO Box 800, 00531 Helsinki, Finland
Email tietosuoja(at)om.fi
Switchboard +358 29 566 6700
Registry +358 29 566 6768
For additional information on filing a complaint, see the Office of the Data Protection Ombudsman website at https://tietosuoja.fi/.

12. Other information

This description of file can be accessed in the avoindata.fi service at www.avoindata.fi and at the registry of the Digital and Population Data Services Agency.
For more information on the data protection of the Digital and Population Data Services Agency, see the Digital and Population Data Services Agency’s website at https://dvv.fi/en/data-protection.
For Disqus, privacy information can be found on the Disqus website at https://help.disqus.com/en/articles/1717103-disqus-privacy-policy.