Privacy notice: Personal data register for Espoo’s outreach library service

Date of publication: 17 September 2020

City of Espoo

firstname.lastname@espoo.fi

Oili Sivula, Library Services Manager

Katariina Lauronen, Library Services Manager

P.O. Box 3605, 02070 CITY OF ESPOO

Tel. +358 9 81621 (switchboard)

tietosuoja@espoo.fi

The outreach library service is the provider of the Taika home library.

The purpose of the register is to enable people with reduced mobility to borrow books, so that books are delivered to their homes on a monthly basis and collected later. For this purpose, the home library staff have the right, with the customer’s written consent, to check their information in the library customer information system (e.g. address and contact person’s information if the customer cannot be reached) and to collect certain personal data concerning the customer (e.g. topics they are interested in, what kind of materials they want).

Article 6(1)(a) and Article 6(1)(c) of the General Data Protection Regulation of the European Union: The data subject has given consent to the processing of his or her personal data for one or more specific purposes, and processing is necessary for compliance with a legal obligation to which the controller is subject.

• The electronic register content consists of the library’s customer register and digital workspace. The digital workspace (Microsoft SharePoint Online) contains the following information:
  • last name
  • first names
  • date of birth
  • telephone number
  • email address
  • responsible person
  • checklist
  • library card number
  • PIN code
  • functional capacity
  • additional information
  • The manual register content consists of customers’ written consent forms (A4 paper form).
• Form content:
  • name
  • date of birth
  • address
  • telephone number
  • email address
  • contact person if the customer cannot be reached (name, telephone number, email address)
  • customer’s signature

PUBLIC ACCESS TO AND CONFIDENTIALITY OF DATA:

For the most part, the data is not confidential according to the law. Confidentiality is regulated by the Act on the Openness of Government Activities (621/1999). According to section 24 of the Act, documents are confidential if they, for example, contain information on a secret telephone number given by a person.

The main sources of data are the library information system Sierra and the customers themselves.

As a rule, personal data will not be disclosed.

Any transfer or disclosure of data must be based on legislation or an order given by an authority.

Espoo’s service providers are Innovative Interfaces Incorporated (Sierra library system) and Microsoft (digital workspace SharePoint).

Data may be transferred outside the European Union or the European Economic Area.

Microsoft workspaces are stored within the EU. Microsoft operates and develops Office 365 services from locations outside Europe, and data is considered to be transferred outside the EU if, for example, an administrator establishes a remote connection from the United States to a data centre in Europe, for example to solve a technical problem. In these circumstances, standard contractual clauses of the European Union apply.

Data is stored and destroyed in line with Espoo’s records management plan and the applicable provisions and regulations issued by the National Archives of Finland.

Personal data is processed in a manner that ensures appropriate security of the personal data, including protection (General Data Protection Regulation, Article 5(1)(f)). Data processing is regulated, for example, based on the principles of purpose limitation, necessity and accuracy.

Each employee can only process the data they need to conduct their work.

The protection of confidential and sensitive data is given particular consideration in tasks such as descriptions of work processes and the granting of access rights. Provisions on the confidentiality of data are laid down in section 24 of the Act on the Openness of Government Activities.

A. Electronic maintenance systems:

Personal data is protected through access rights determined on the basis of the unit employees’ duties. Access rights are restricted in accordance with duties and are based on user roles, which have access to duty-specific views and functions. Read, write, save and delete rights are defined separately for each access rights group. All users of the network accept an end user license agreement that includes a confidentiality commitment. The server hardware is located in a protected, supervised space in the service provider’s data centre. Electronically processed data is transmitted encrypted on the open Internet. The data in the register is backed up automatically at regular intervals.

B. Manual materials:

Manual materials are stored in locked work premises and locked cabinets.

Further instructions on submitting information requests referred to in the General Data Protection Regulation: Data protection, Rights of the data subject

You have the right to obtain from the data controller a copy of the personal data that is subject to processing. The data controller must provide the data without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.

If the data controller does not take action on the request of the data subject, the data controller must inform the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Requests from the data subject and any resulting actions are free of charge. However, where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the data controller may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.

You have the right to have inaccurate, incomplete, outdated or unnecessary personal data that we store either rectified or completed by us.

You have the right to have the data controller erase your personal data without undue delay under certain conditions. The data subject does not have the right to erasure if the processing of data is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In these cases, the data will only be erased after the statutory time limit.

If the data concerning you is inaccurate, you have the right to request that its processing be restricted until its accuracy has been verified.

You have the right to lodge a complaint with a supervisory authority if you feel that the processing of your personal data is in infringement of data protection legislation. You can lodge a complaint with the Office of the Data Protection Ombudsman: www.tietosuoja.fi(external link, opens in a new window)