Processing of personal data in vocational education and training
This document outlines how the City of Vantaa processes personal data in vocational education and training.
1. For what purpose is personal data processed?
The City of Vantaa collects the necessary personal data from you and your family for organising vocational education and training and carrying out related tasks. Personal data in the register may also be processed if necessary for testing information systems, for example when the education provider introduces a new information system. The City of Vantaa will never use this data for any other purposes, such as direct marketing or commercial aims.
2. What is the basis for the processing of personal data?
The processing of personal data necessary for organising vocational education and training is based on statutory obligation. Some data is processed based on consent. The student’s photos, videos and work are processed with the consent of the student and only in the manner specified therein. The consent will be requested in writing with a separate photographing, videoing and publishing permission. Granting consent is voluntary and can be revoked at any time.
Legal basis for the processing:
- Article 6(1)(a) and (c) of the EU General Data Protection Regulation (2016/679)
- Section 6 of the Data Protection Act (1020/2018)
- Act on Vocational Education and Training (11.8.2017/531)
- Government Decree on General Upper Secondary Education (673/2017)
- Act on the National Registers of Education Records, Qualifications and Degrees (884/2017)
- Government Decree on the Procedure for Applying for Vocational Education, General Upper Secondary Education and Preparatory Education after Basic Education (294/2014)
- Ministry of Education and Culture Decree on the Structure of Vocational Qualifications (680/2017)
- Ministry of Education and Culture Decree on the Criteria for Student Admissions in Vocational Basic Degree Education (699/2017)
- Decree of the Ministry of Education on the Criteria for Certain Fees Charged from Students (1323/2001)
3. What personal data is collected by vocational education and training, and where is it obtained from?
For example, the student’s name, personal identity code and contact details are required for organising vocational education and training. The City of Vantaa primarily obtains the necessary information from the Digital and Population Data Services Agency (DVV), the student and the student’s guardians. Other information (e.g. the student’s absence and evaluation data) and documents and decisions concerning the student also accumulate in the course of providing vocational education and training. Subject to conditions provided by law, the City of Vantaa may also request information necessary for organising vocational education and training from other authorities, such as a previous education organiser. In some cases, the education provider is also entitled to obtain information on the student’s criminal record.
4. Is the provision of personal data necessary?
Yes. Organising vocational education and training requires receiving the necessary information and processing the data accrued in the course of vocational education and training.
5. Is personal data disclosed to third parties?
The City of Vantaa may only do so with the student’s or their guardian’s consent or based on the law. Data may be disclosed, for example, to ensure the safety of studies or to guide the student to support services. The necessary information is also disclosed for the Wellbeing Services County of Vantaa and Kerava’s pupil and student welfare work. The data will never be disclosed to third parties for marketing or other commercial purposes.
6. How is the personal data protected?
In order to ensure privacy, data security and data protection have been secured by means of various technical and organisational measures. For example, personal data may be processed only by persons who need it to perform their work or official duties and only to the extent required by an individual task. In the client data system, this is monitored, among other things, by using log information. Paper documents are kept in city archives in a safe place that no outsider can access.
Staff are bound by the obligation of professional confidentiality and will continue to be bound by it after the end of their employment.
7. Is personal data transferred outside the EU or EEA?
In cases where the processor of personal data handles personal data on behalf of the City of Vantaa, the appropriate level of data security and data protection has been agreed to in an agreement with the processor. As a rule, data is only processed in the EU or EEA area, but the processor can also transfer data outside the EU or EEA. However, the transfer is only permitted if it meets the requirements set out in the data protection legislation and the agreement, which ensure an adequate level of protection of personal data.
In the case of Microsoft O365, Google Workspace for Education, Zoom and Studeo services/systems, personal data can be transferred to the United States based on the 10 July 2023 decision of the European Commission on the adequacy of data protection level in the United States. The US companies to which data is transferred are certified companies committed to the safeguards agreed between the EU and the US.
Google transfers data applying standard clauses adopted by the European Commission where necessary and where transfers are not subject to an adequacy decision. In addition, Google has an addendum.
Microsoft also complies with the UK extension to the 10 July 2023 decision of the European Commission on the adequacy of data protection level in the United States and the Swiss-US Data Privacy Framework (Swiss-U.S. DPF). In addition, the transfer of personal data outside the EU or EEA is based on Microsoft’s terms.
In the case of the iOS app, the transfer of personal data outside the EU or EEA is based on the terms of Apple services and standard clauses adopted by the European Commission.
8. What does the city do in case of a security breach?
Despite the protection measures, in some exceptional cases it is possible for personal data to be compromised by a data security breach or end up in the hands of a third party. In these cases, the City of Vantaa will take immediate action to rectify the situation and submit the necessary reports to the national Data Protection Ombudsman and the data subjects affected. The City of Vantaa will notify the Data Protection Ombudsman of any breach without undue delay and, where possible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to risk the rights and freedoms of any data subjects.
If the breach is likely to cause a high risk with regard to the data subjects’ rights and freedoms, the City of Vantaa will notify the data subjects of the breach without undue delay. In this case, the city will report the breach to those data subjects whose data is affected by the data security breach. If the data breach concerns a large group of people and does not require any immediate action from registered parties, the details of the data breach can also be provided as a general notification.
9. How long is the data stored?
The data is stored and destroyed in accordance with the City of Vantaa’s data management plan.
The document storage periods specified in the data management plan are based on legislation, the regulations of the National Archives of Finland on documents intended for permanent storage and the recommendations of the Association of Finnish Local and Regional Authorities on documents to be stored for a fixed period. At the end of the period, the data is destroyed. The retention periods for vocational education and training documents vary, with some data retained permanently.
10. Will the data be used for profiling or automatic decision-making?
Your personal data will not be used for profiling or automated decision-making.
11. What rights does a data subject have, and how can the rights be exercised? How long does processing a case take?
The term ‘data subject’ refers to the natural person whose personal data is being processed. Depending on the basis for the processing, the registered party has the right to
- check the information processed by the application
- request the rectification of erroneous or inaccurate information
- request the erasure of personal data
- request the restriction of the data processing
- object to the processing of the data
- right to obtain the data and transfer it to another data controller, and to withdraw their consent at any time, if the processing is based on consent.
You can submit an access request via a separate form available through the vantaa.fi website and Vantaa Info desks. Should you wish to exercise other rights of a data subject or request additional information on the processing of personal data, please contact the person listed below in Section 15. The statutory requirements regarding exercising your rights will be confirmed on a case-by-case basis. Exercising your rights may require you to verify your identity.
The City of Vantaa will complete the requested measures without undue delay, but in any case no later than within a month of receiving the request. If necessary, the deadline may be postponed by a maximum of two months, based on the complexity and quantity of the requests. In the event that the deadline is postponed, the City of Vantaa will provide notification of the delay and the relevant grounds to the requesting party within one month of receiving the request.
12. Is exercising a data subject’s rights subject to a charge?
The exercise of the rights is, in principle, free of charge. However, the City of Vantaa may collect a reasonable fee corresponding to the administrative costs for fulfilling a request or refuse a request if the data subject’s requests are clearly unfounded, unreasonable or recurring. If the intention is to collect a fee for fulfilling a request, the City of Vantaa will contact the person who submitted the request before fulfilment. In the event that the City of Vantaa refuses to fulfil the requested measure, the person who submitted the request will be provided with the grounds for the refusal in writing and informed of the opportunity to refer the matter to the Data Protection Ombudsman and resort to other legal remedies.
13. How can I submit an appeal to a supervisory authority?
If you suspect that your personal details are being processed unlawfully, you can appeal to a supervisory authority in the EU member state of your permanent residence or employment or the member state where you consider the violation to have taken place. In Finland, the relevant supervisory authority is the Data Protection Ombudsman. More information and instructions on submitting an appeal are available on the website of the Office of the Data Protection Ombudsman and the office’s telephone guidance service.
Office of the Data Protection Ombudsman/www.tietosuoja.fi
Visiting address: Lintulahdenkuja 4, FI-00530 Helsinki Postal address: PO Box 800, FI-00531 Helsinki
Email: tietosuoja(at)om.fi
Telephone (exchange): +358 29 566 6700
Telephone (helpline for private individuals): +358 29 566 6777
14. Where can I request more information, and who is the controller?
More information on the processing of personal data is available from the contact person specified below. Please note that email is not a safe medium for processing personal data. As such, please do not send sensitive information, such as your personal identity code, via email.
Contact person for the register
City of Vantaa, Vantaa Vocational College Varia
Leena Saarinen, Study Administration Planner
+358 50 310 4265, leena.saarinen@vantaa.fi
The controller is the City of Vantaa’s Education and Learning Committee. Contact details of the controller and the City of Vantaa data protection officer can be found below:
Controller
City of Vantaa
Education and Learning Committee
Business ID 0124610-9
Asematie 7, FI-01300 Vantaa
Data protection officer
tietosuojavastaava@vantaa.fi
+358 40 071 3358
Registry office:
Postal address: PO Box 1100, FI-01030 City of Vantaa
Visiting address: Vantaa Info Centre Tikkurila, Dixi, Ratatie 11,
2nd floor, FI-01300 Vantaa.
Tel. (exchange): 09839 11
Fax +358 9 8392 4163, email: kirjaamo@vantaa.fi