Rights of the data subject

The General Data Protection Regulation of the European Union (GDPR) grants data subjects various rights related to the processing of their personal data. The data subject may exercise their rights in different ways depending on the grounds for processing. In city services, the processing of personal data is mainly based on compliance with a legal obligation or the exercise of official authority. If processing is based on the data subject’s consent, they have more rights. The data subject may withdraw their consent at any time and request the erasure of their data.

The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning them is being processed. If data concerning the data subject is being processed, the data subject has the right to receive a copy of the personal data being processed without undue delay, and at the latest, within one month. In cases of exceptionally large or complex data requests, the deadline may be extended to a maximum of three months, provided there are justified reasons for the extension.

The data subject can submit a request for access to personal data(external link, opens in a new window) by post to the contact person mentioned in the privacy notice, by email to tietosuoja@espoo.fi, or in person by visiting a Service Point, Espoo Info, or the Registry Office. Once the request has been processed, the data will be provided to the data subject in the agreed-upon manner.

Requests from the data subject and any resulting actions are free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the City of Espoo, as the data controller, may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.

If a data subject wishes to have their rights, they must contact the contact person mentioned in the privacy notice.

The data subject has the right to have inaccurate and incomplete personal data rectified or completed.
 

The data subject has the right to request the erasure of their personal data (‘right to be forgotten’) if:
 

• the personal data is no longer needed for the purposes for which it was collected and processed;
• the data subject withdraws consent on which the processing is based and there is no other legal ground for processing;
• the personal data has been processed unlawfully;
• a child’s personal data was collected in connection with the provision of information society services.
   

The right to erasure does not apply if the processing of personal data is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or for the exercise of official authority vested in the city.
 

The data subject has the right to request that the City of Espoo, as the data controller, restrict the processing of their personal data until the data has been checked and corrected. The data subject may request the restriction of processing if: 
 

• the data subject considers their personal data to be inaccurate;
• the processing of personal data is unlawful and the data subject opposes the erasure of the personal data and instead requests the restriction of its use;
• the City of Espoo no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims;
• the data subject objects to the processing of their personal data while it is being verified whether the City of Espoo has the right to process the data.
   

If processing has been restricted, the City of Espoo must inform the data subject before the restriction is lifted.
 

The data subject has the right to receive the personal data they have provided in a structured and machine-readable format so that it can be transferred to another controller if desired. The data subject has the right to transfer their personal data if they originally provided the data to the City of Espoo, the processing is based on consent or a contract, and the processing is carried out by automated means.

This right does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the city.

The data subject has the right to object to the processing of their personal data and request that the data not be processed. The data subject may object to the processing of their personal data on grounds relating to their specific personal situation, when the City of Espoo processes the data subject’s personal data in the public interest or in the exercise of official authority or based on a legitimate interest.

In such cases, the City of Espoo, as the data controller, must stop processing the data unless it can demonstrate compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subject. The city may also have a reason to continue processing the personal data if it is necessary for the establishment, exercise or defence of legal claims.

The data subject has the right to object to the use of personal data for direct marketing purposes without a specific reason. 
 

The data subject has the right not to be subject to a decision that is based solely on automated decision-making and produces legal effects concerning them or similarly significantly affects them. Automated decision-making means that people do not participate in the decision-making process and the decision is made entirely by automated means using personal data.
 

The data subject has the right to lodge a complaint with a supervisory authority if they feel that the processing of their personal data is in infringement of data protection legislation. The first point of contact for complaints is the Data Protection Officer of the City of Espoo. If necessary, a complaint may be lodged with the Data Protection Ombudsman.

Contact details of the Data Protection Officer

Data Protection Officer of the City of Espoo: tietosuoja@espoo.fi
Address: P.O. Box 12, 02070 City of Espoo
Tel: + 358 9 81621 (Espoo-info)

Office of the Data Protection Ombudsman: Notification to the Data Protection Ombudsman(external link, opens in a new window)

Read more about the rights of the data subject in the EU’s General Data Protection Regulation (2016/679)(external link, opens in a new window) or on the website of the Office of the Data Protection Ombudsman(external link, opens in a new window).