Data Protection Statement

Select degree programme

Search for degree programme

Bachelor's Programmes

Master's and Licentiate's Programmes

Doctoral Programmes

Reset

In order to carry out its educational duties, including the provision of teaching, the collection and maintenance of study and degree information, and the provision of student services, the University of Helsinki processes data concerning its students. This statement describes how your data are processed and the rights you have to your personal data.

In order to provide you services related to teaching, the University needs to process various identifying information, or personal data. This makes the University of Helsinki a controller of a data file, or the party which controls the processing of your personal data for the said purpose.

The University of Helsinki only processes data relevant to its duties.

1. Contact details of the controller of the data file and the data protection officer of the University of Helsinki

Contact details:

University of Helsinki
PO Box 3
00014 University of Helsinki
Telephone: +358 9 02941 911

Development Director Susanna Niinistö-Sivuranta at Teaching and Learning Services serves as the contact person for the controller of the data file, email registrar@helsinki.fi.

Data protection officer of the University of Helsinki

Veera Löthman, the data protection officer of the University of Helsinki, can be contacted by email at tietosuoja@helsinki.fi.

2. Why is your personal data processed, or what is the purpose of the processing?

The University of Helsinki must process your personal data for purposes including the following:

  • Student admissions
  • Organisation of teaching and decisions concerning studies
  • Student guidance
  • Course registrations
  • Restoration of completed studies, assessment and registration
  • Preparation of degree diplomas

In addition, the University can process your personal data for the following purposes:

  • Development of teaching (e.g., with feedback collected from students)
  • Scientific research or the compilation of statistics
  • Marketing communications related to studies
  • The safety of students and other members of the University community, the physical safety of the study environment and the protection of data, or
  • Other specific purposes

3. Why does the University of Helsinki have the right to process your personal data, or what is the legal basis for the processing?

The use of personal data is primarily based on legislation concerning the University of Helsinki and the organisations operating in the University community. In specific cases, the basis for processing data is consent given by the student.

Therefore, the right of the University as the controller of the data file is based on

  • A task carried out in the public interest or in the exercise of official authority vested in the controller (Point 1e, Article 6 of the General Data Protection Regulation of the EU)
  • Compliance with a legal obligation to which the controller is subject (Point 1c, Article 6 of the GDPR)
  • In certain cases, the performance of a contract or consent given by the data subject (Points 1a and 1b, Article 6 of the GDPR)

As a rule, the University has the right to process sensitive data as the controller of the data file in the following cases:

  • When necessary for reasons of substantial public interest (Point 2g, Article 9 of the GDPR)
  • In certain cases when the data subject has given explicit consent to the processing of certain personal data (Point 2a, Article 9 of the GDPR)

Relevant regulationsUniversities Act (558/2009)
Government Decree on University Degrees (794/2004)
Act on national study and degree registers (Laki valtakunnallisista opinto- ja tutkintorekistereistä) (884/2017)
EU General Data Protection Regulation (2016/679) and supplementing national regulations
Personal Data Act (523/1999) and the Data Protection Act (XXX/2018), which will supersede the former
Act on the Openness of Government Activities (621/1999)
Regulations of the University of Helsinki
Regulations on Degrees and the Protection of Students’ Rights at the University of Helsinki
Decisions by the University and the rector concerning teaching and studying at the University of Helsinki
Standing regulations of the University of Helsinki faculties

4. What kind of personal data does the University of Helsinki process?

The University of Helsinki processes personal data from which you can be identified directly or indirectly. Direct identifiers include the personal identity code and student number. We will also process your name and contact details, in addition to which the University processes other information related to your studies from which a third party may identify you by connecting the details.

The details most commonly processed in conjunction with studying and completed studies are the student’s name, student number and contact details, as well as details on the degrees pursued and the content of studies.

Here are examples of the data processed by the University of Helsinki:

  • Persons applying to study at the University (applicants), their basic details and application information
  • Basic student details (e.g., student number, personal identity code, name and contact details)
  • Students’ study rights
  • Students’ term registrations
  • Students’ completed studies, traineeships and theses/dissertations
  • Teachers and related information on teaching
  • Students’ registrations for teaching
  • Students’ student feedback details
  • Details related to students’ career and employment services and surveys
  • Membership in the Student Union and its special status associations
  • Data related to grants
  • Data related to international student exchange
  • Basic details on the staff involved in supporting students and teachers (e.g., name and work-related contact details)

Further information on the personal data processed by the University is available in the data protection statements of the systems used in processing, with the processed details itemised (see section 11).

5. What rights do you have?

Right to access and rectify personal data

You have the right to know whether the University of Helsinki is processing your personal data. Additionally, you have the right to know which personal details are being processed.

If there are inaccuracies in your personal data being processed, you have the right to request their rectification or completion.

Details on the personal data contained in various applications are available in the data protection statements of the applications (see section 12).

In many of our applications, you can view your personal data by logging in (e.g., WebOodi and Moodle). If you wish to know in even more detail which personal details are being processed, please contact registrar@helsinki.fi.

Right to withdraw consent

If the University of Helsinki is processing your personal data based on consent given by you, you have a right to withdraw any such consent. Please note that the processing of data related to studying is usually based on legislation or public interest, not on personal consent.

The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

Withdrawal of consent should be primarily submitted to the recipient of the consent.

Right to erasure

You have the right to request the erasure of your personal data on the following grounds:

  • The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • You withdraw the consent on which the processing is based, and there is no other legal grounds for the processing;
  • You object to the processing (the right to object is described below), and there are no overriding legitimate grounds for the processing;
  • The personal data have been unlawfully processed; or,
  • The personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.

The right to erasure does not apply when the processing of personal data is necessary for compliance with a legal obligation to which the University is subject or if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the University. Therefore, this right does not, in principle, apply to the personal data files controlled by the University. The storage and erasure of data is conducted in compliance with the archiving plan of the University and the data storage periods required by legislation.

The right to erasure does not apply to situations when erasing the data prevents or seriously impairs the processing for scientific research purposes.

Right to restriction of processing

You have the right to restrict the processing of your personal data under the following conditions:

  • You contest the accuracy of your personal data, in which case the processing will be restricted for a period enabling the University to verify the accuracy of the personal data.
  • The processing is unlawful, and you oppose the erasure of the personal data and request the restriction of their use instead.
  • The University no longer needs the personal data for the purposes of the processing, but you need them for the establishment, exercise or defence of legal claims.
  • You have objected to processing (see details below), pending the verification whether the legitimate grounds of the controller override those of the data subject.

Right to data portability

You have the right to receive the personal data concerning you, which you have provided to the University, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the University, where the legal grounds for the processing are based on consent or a contract, and the processing is carried out by automated means.

When exercising your right to data portability, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

This right does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Therefore, this right does not, in principle, apply to the personal data files controlled by the University.

Right to object to the processing of personal data

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you when the legal basis for processing is carrying out a task in the public interest or in the exercise of official authority vested in the University. In such case, your data can only be processed if the controller demonstrates compelling legitimate grounds for the processing.

Right to lodge a complaint with a supervisory authority

You have the right to subject the legality of the University’s activities to a review by the Data Protection Ombudsman.

Contact details:

Office of the Data Protection Ombudsman

Street address: Ratapihantie 9, 6th floor, 00520 Helsinki

Postal address: PO Box 800, 00521 Helsinki

Tel. (switchboard): 029 56 66700

Fax: 029 56 66735

Email: tietosuoja(at)om.fi

6. Where does my personal data originate?

Some required personal details come from yourself, which makes you responsible for their validity. A right to study is personal. Thus, your personal details must be valid.

Certain details have been collected from other parties, including:

  • Details concerning the acceptance of a student place are gained from a national student admissions register (Act 884/2017) maintained by the Finnish National Agency for Education and from documents submitted by the student.
  • The validity of name and contact details is verified from the Population Register Centre.

Further information on the origin of data is available in the data protection statements of the relevant systems (see section 12).

7. How long will your personal details be stored?

The storage period for personal data stored in University of Helsinki systems and data processed manually is based on legislation in force and the archiving plan of the University of Helsinki.

In observance of the legislation concerning universities (Sections 25 and 27 of act 884/2017), the University of Helsinki stores the following personal details related to teaching permanently:

  • Student numbers and personal identity codes or equivalent identifiers
  • Information on completed degrees and specialist training, as well as all completed studies and their grades
  • Information on rights to complete studies leading to a degree and specialist training, as well as information on the acceptance of a student place and registration for studies leading to a degree and for specialist training.

Information on storage periods for other data is available in the archiving plan of the University of Helsinki.

 The storage periods are based on the Archives Act (831/1994) and other relevant legislation.

8. The recipients or categories of recipients of the personal data

At the University of Helsinki, data is processed only by those employees of the University or those individuals mandated by the University or working on behalf the University who need the data in their duties. Access to the data systems is restricted by user accounts. Personal data is primarily processed by the staff of Teaching and Learning Services and the teaching staff. In addition, personal data can be processed by the following units: IT Centre, HR Services, Financial Services, as well as Communications and Community Relations.

The University of Helsinki may also use external parties to process personal data, such as businesses that provide system services and process personal data on behalf of the University of Helsinki on the basis of a mandate.

Personal data will only be disclosed outside the University of Helsinki or processed by the University in lawful situations.

The University of Helsinki discloses required student personal data to the following recipients.

  • Either through the national data warehouse for higher education or directly:

    • Finnish Student Health Service
    • Ministry of Culture and Education
    • Internationalisation Services of the Finnish National Agency for Education
    • Student admissions registers
    • Study credit, degree and qualification disclosure service of the Finnish National Agency for Education
    • Social Insurance Institution of Finland Kela
    • National Supervisory Authority for Welfare and Health Valvira
    • Statistics Finland
  • Employment authority
  • The Education Fund
  • Immigration authority
  • Student Union of the University of Helsinki
  • Student nations of the University of Helsinki
  • Monitoring surveys conducted by Aarresaari, a network of career and recruitment services

In addition, the University of Helsinki can disclose students’ personal data

  • For scientific research purposes
  • For the purpose of meeting obligations set by the Act on the Openness of Government Activities (621/1999) or other legislation
  • To other Finnish institutions of higher education for the processing of study rights and transferring completed studies, for example, in teaching cooperation
  • To international institutions of higher education also outside the EU or the European Economic Area for the implementation of dual or joint degree education or for the transfer of completed studies
  • With the student’s consent, regarding contact details outside the University, for restricted purposes supporting studying and other specific purposes

The primary source of transferred data is the academic administration system Oodi and the Mobility Online mobility system. Student data to be permanently stored and the mobility periods of student exchange will be transferred to Virta, the national data warehouse for higher education.

9. Transfer of data outside the EU or the European Economic Area

According to its data protection policy, the University will exercise particular care if personal data is to be transferred outside the EU or the European Economic Area to countries where data protection regulations do not conform to the EU’s General Data Protection Regulation.

The transfer of personal data outside the EU or the EEA must be carried out in compliance with the requirements of the GDPR.

10. Is automated profiling used in decision-making?

No automated decisions will be made based on the assessment of a person or a person’s performance. Decisions will be made in such a manner that a member of the University’s staff will monitor the results of an automated assessment, or an examination committee will decide on examination results.

11. Further information on the processing of personal data at the University of Helsinki

Students’ personal data is primarily processed by the University through various electronic applications.

The following are the most important applications employed in teaching and studying at the University:

Applicant and admissions details

  • Studyinfo
  • Aava (postgraduate study rights)
  • UHMA (international degree programmes)

Student exchange data

  • Mobility Online (international student mobility)
  • Joopas (Finnish student mobility)

Data for academic administration and teaching

  • Oodi (system used by academic administration)
  • Oili (system for registering for attendance and annual registration)
  • My Studies and Instructions for Students
  • My Teaching and course pages
  • Exam (examination system)
  • Moodle (learning environment)
  • Oodikone (study progress monitoring )
  • UniHow (feedback and support system for learning and teaching)
  • Eduweb (customer register of the Open University)

User account data

  • User account data file of the University of Helsinki

Further information on the data processed by each application and the related justification, on the parties with access to the data, as well as on the protection, security and destruction of personal data is available in the system-specific data protection statements.

Data protection statement (in Finnish only)