Information on the processing of personal data in the research project entitled Re:Urbia
The research project entitled Re:Urbia involves processing of personal data. The purpose of this data protection notice is to provide information on the personal data to be processed, from where they are obtained and how they are used. Detailed information on the rights of data subjects will be provided at the end of this notice.
Your participation in the research project and provision of personal data are voluntary. If you do not wish to participate in the project or you wish to withdraw from it, you can do so without negative consequences.
1. Data Controller
University of Helsinki
Address: PO Box (Fabianinkatu 33), 00014 University of Helsinki, Finland
2. Contact person and principal investigator
Contact person in matters concerning the research project:
PO Box 4 (Yliopistonkatu 3)
00014 Helsingin yliopisto
Phone. +358415307369, +358504154865
E-mail: first name.last name(at)helsinki.fi
Principal investigator: Venla Bernelius
3. Contact details of the data protection officer
You can contact the University of Helsinki data protection officer via email at firstname.lastname@example.org.
4. Description of the research project and the purpose of processing personal data
The personal data collected will be used in a scientific research project funded by the Ministry of the environment’s suburban housing estate programme.
The research project will examine the current state and development potential of suburban housing estates. Together with the partner municipalities, the steering group and the wider cooperation network, a vision is created of what the future development of the suburban housing estates should aim at. The processing of personal data will be used for the progression of this objective and the advancment of the research project. The data will be used to analyse neighbourhoods and their surrounding areas.
5. Personal data included in the research data
The survey collects data in two ways:
1. a questionnaire and
2. a voluntary interview with respondents.
The survey data collected through the questionnaires and interviews may contain personal information (name, address, year of birth, telephone number and email address) if provided by the respondent. In addition, the respondent can answer to the questions in different question categories to their own accord.
These categories include questions about the person's living environment, the location of daily services and activities, social relations in the neighbourhood, places of social interaction in the neighbourhood, the location of the school attended by the person's children and questions about the school itself, perceptions of the neighbourhood, the person's willingness to move and also background questions.
6. Sources of personal data
Personal data will only be collected directly from the respondent, through a questionnaire sent through mail, and through interviews with willing respondents.
The respondent is under no obligation to participate in the survey itself or in any subsequent interview.
7. Sensitive personal data
Information pertaining to the respondents health which is one of the special categories of personal data (i.e., sensitive data), as defined in Article 9 of the GDPR, will be processed in this research.
The processing of sensitive personal data is based on Article 9(2)(j) of the General Data Protection Regulation (processing is necessary for scientific research purposes), as well as Section 6, Subsection 1, Paragraph 7 of the Finnish Data Protection Act.
8. Lawful basis for processing personal data
The processing of personal data is done on the basis of a task carried out in the public interest (Article 6(1) of the GDPR) and on the basis of scientific or historical research purposes.
9. Recipients of data
Research data may be released outside the research team to research assistants for storage or other processing. The data will always be pseudonymised. Where necessary, a usage and data protection agreement will be made with the individuals concerned.
Recipients known at the time of drafting the privacy notice:
KS-Konsultointi (Mailco Oy) is the questionnaire administrator of the project. They have access to the questionnaire responses and the respondents' personal data needed for personalisation, printing, mailing, processing and storage of the questionnaire responses.
Promail Ltd, as a subcontractor, will carry out the mailing of the questionnaire and process the respondents' name and address data.
10. Transfer of data to countries outside the European Economic Area
Data will not be transferred to countries outside the European Economic Area.
11. Automated decision-making
The research project involves no automated decision-making that has a significant effect on data subjects.
12. Protection of personal data
Personal data included in the research dataset will be processed and kept protected so that only those who need the data can access them.
The University of Helsinki, as the controller, has taken the necessary technical and organisational measures and requires them from the service providers it uses.
Manual data (e.g. in paper or other tangible form) is protected in locked cabinets accessible only to the principal investigator (Venla Bernelius).
Directly identifiable information will be removed at the analysis stage and kept separate from the survey data that is being analysed.
13. Duration of the processing of personal data in this research project
The personal data will be kept for the time necessary to allow the University of Helsinki to fulfil the purposes of handling this data described in this notice, after which the research data will be archived without identifieable information.
14. Processing of personal data when the research project ends
The data will be kept without any direct identification for the purpose of validating the results of this study.
The research data will also be stored for the purposes of subsequent, compatible scientific research in accordance with the requirements of the GDPR and without direct identification.
The storage of the research data is based on Article 5(1)(b) and (e) of the GDPR.
Before the data can be used for other research, the controller will ensure that the new use is compatible with the initial purpose in accordance with the requirements of the GDPR. Data subjects will receive a new data protection notice on the new use of the research data, unless the controller can no longer identify the subjects from the data.
In addition, the data subjects will not be informed of the new research if delivering this information to them is impossible or involves a disproportionate effort or renders impossible or seriously impairs the achievement of the research objectives (Article 14(5)(b) of the GDPR).
Where the data is kept and for how long: part of the research data is sent to the Finnish Social Science Data Archive (FSD) for archiving. In this case, the research data will have already been de-identified and fully anonymised.
15. Rights of data subjects and derogations from those rights
The contact person in matters related to research subjects’ rights is the person stated in section 1 of this notice.
Rights of data subjects
Under the General Data Protection Regulation, data subjects have the following rights:
- Right of access to their data
- Right to rectification of their data
- Right to the erasure of their data and to be forgotten
- Right to the restriction of processing of their data
- Right to data portability
- Right to object to the processing of their data
- Right not to be subject to automated decision-making
However, data subjects cannot exercise all their rights in all circumstances. The circumstances are affected by, for example, the legal basis for processing personal data.
Further information on the rights of data subjects in various circumstances can be found on the website of the Data Protection Ombudsman: https://tietosuoja.fi/en/what-rights-do-data-subjects-have-in-different-....
If data subjects cannot be identified
If the processing of personal data for research purposes does not require the identification of the data subject and if the controller is unable to identify the data subject, the right to access, rectify, erase and restrict the use of personal data, as well as any notification obligations and the right to data portability do not apply unless the data subject provides additional data enabling their identification (Article 11 of the GDPR).
Derogations from rights
The General Data Protection Regulation and the Finnish Data Protection Act enable derogations from certain rights of data subjects if personal data are processed for the purposes of scientific research and the rights are likely to render impossible or seriously impair the achievement of the research purposes.
The need for derogations from the rights of data subjects will always be assessed on a case-by-case basis.
Right to appeal
If you consider that the processing of your personal data has been carried out in breach of data protection laws, you have the right to appeal to the Office of the Data Protection Ombudsman.
Office of the Data Protection Ombudsman
Street address: Ratapihantie 9, 6th floor, 00520 Helsinki
Postal address: PO Box 800, 00521 Helsinki
Phone (switchboard): 029 56 66700
Fax: 029 56 66735