Privacy notice: Personal data register for pre-primary education provided by early childhood education units and for preparatory education

Date of publication: 19 August 2024 (Updated 3 September 2025)

City of Espoo

Virpi Mattila, Director of Finnish Early Childhood Education

Barbro Högström, Director of Swedish Education and Cultural Services

Email: firstname.lastname@espoo.fi

Tel. +358 9 81621 (switchboard)

System specialists Sari Kuittinen and Sirpa Koljonen

Email: evakatuki@espoo.fi

Tel. +358 9 81621 (switchboard)

Helena Niemi, Data Protection Officer of the City of Espoo

Address: P.O. Box 12, 02070 City of Espoo

Tel. +358 9 81621 (switchboard)

Email: tietosuoja@espoo.fi

The personal data in the register is processed for the purposes of providing pre-primary education and preparatory education and taking care of tasks related to the pupil relationship. (Act on Primary and Lower Secondary Education, sections 4, 5 and 26a)

The City of Espoo provides its own pre-primary education services or purchases them from private service providers as an outsourced service. Preparatory education provided in connection with pre-primary education is only offered in Finnish-speaking municipal pre-primary education units.

Personal data stored in the register may also be processed when it is necessary for the purposes of testing the information systems, for example when a new information system is introduced.

The register is used for compiling statistics for the City of Espoo. When statistics are compiled, the data is processed anonymously.

Article 6(1)(c) of the General Data Protection Regulation of the European Union: processing is necessary for compliance with a legal obligation to which the controller is subject.

Special categories of personal data: Special categories of personal data to be processed may include information related to health or ethnic origin. According to section 6 of the Data Protection Act, Article 9(1) of the General Data Protection Regulation does not apply to any processing of data that is provided by law or that derives directly from a statutory duty set out for the data controller by law.

Key legislation:

• General Data Protection Regulation of the European Union (2016/679)
• Data Protection Act (1050/2018)
• Act on Primary and Lower Secondary Education (628/1998)
• Act on Early Childhood Education and Care (540/2018)

The processing of personal identity codes is based on section 29, subsection 1 of the Data Protection Act. The identification of the data subject and their personal data is important for the performance of a statutory duty.

Applying for pre-primary education

Applications for all forms of pre-primary education provided by the City of Espoo are submitted through the early childhood education information system eVaka, and the following information is stored in the system:

• Child’s name, personal identity code, contact information and mother tongue
• Guardians’ names, personal identity codes, contact information, mother tongue and custody information
• Application for pre-primary education
• Information on the child’s need for preparatory education
• Information on early childhood education connected to pre-primary education or preparatory education and the hours of early childhood education
• The guardian may also choose to provide information on the child’s sibling (if using the sibling principle), need for support, allergies, special dietary needs, and other additional information.

Pre-primary education decision

• Decision on pre-primary education and the pre-primary education unit or decision on preparatory education and place in pre-primary education
• Information on accepting, rejecting or terminating a place in pre-primary education and connected early childhood education
• Information on accepting, rejecting or terminating a place in preparatory education and connected early childhood education
• Child’s pre-primary education plan (LEOPS), including the plan for the implementation of child-specific support in pre-primary education   
• Individualised educational plan (IEP, or HOJKS in Finnish); no longer used after 31 July 2026
• Support measures for the child
• Administrative decisions and documents related to the provision of support in pre-primary education
• Child’s special dietary needs, allergies or medication
• Child’s picture
• Pedagogic documentation
• Transport-related information (excluding transport decisions)
• Information on the child’s attendance and absences
• Names and telephone numbers of other persons authorised to pick up the child
• Other information and forms relevant to the provision of pre-primary education, such as ‘Permission to store and publish media works’

Information related to provision of pre-primary education

For children attending municipal pre-primary education, information is stored in the eVaka information system.

Outsourced and service voucher day care centres enter information on children’s support needs and absences into eVaka.

Case management system for immigration affairs (UMA)

• Nationality of the child and the guardian, grounds for and validity period of the residence permit for the purpose of applying for reimbursement of special costs related to the pre-primary education and connected early childhood education of a child with refugee status

Population Information System

• When performing certain checks, designated persons can check clients’ information from the Population Information System.

• Child’s guardians
• Pre-primary education staff
• Other employees in the multidisciplinary cooperation network
• When filling in the application, the applicant’s and their children’s names, personal identity codes and addresses are retrieved from the Population Information System. Changes in information retrieved from the Population Information System are updated once a day.
• Early childhood education services, a previous provider of pre-primary education or a previous pre-primary education unit in the same municipality may disclose public information that is needed for the provision of pre-primary education for the child (Act on the Openness of Government Activities, section 16, subsection 3).
• The provider of early childhood education may disclose confidential information that is necessary for the provision of pre-primary education (Act on Primary and Lower Secondary Education, section 41, subsection 4; Act on Early Childhood Education and Care, section 41, subsection 3).
• A previous provider of pre-primary education or a previous pre-primary education unit in the same municipality may disclose confidential information that is necessary for the provision of pre-primary education (Act on Primary and Lower Secondary Education, section 40, subsections 2 and 4).
• In addition, health care and social welfare authorities, other providers of early childhood education, health care and social welfare services, and health care and social welfare professionals may, notwithstanding provisions on confidentiality, disclose information that is needed for the provision of education for the child (Act on Primary and Lower Secondary Education, section 41, subsection 4).
• Case management system for immigration affairs (UMA) maintained by the Finnish Immigration Service (Migri)

Data and documents are disclosed to the person requesting them in accordance with the Act on the Openness of Government Activities. Information and documents are public unless specifically defined as confidential under law.

The pre-primary education unit may disclose information necessary for the provision of basic education to the provider of basic education. (Act on Early Childhood Education and Care, section 41, subsection 3; Act on Primary and Lower Secondary Education, section 40, subsection 4 and section 41, subsection 4)

The national centralised integration service for study rights and study records (KOSKI) collects information on each learner’s education from completed study units to degrees and qualifications (Act on the National Registers of Education Records, Qualifications and Degrees, 884/2017).

The City of Espoo may use operational or technical service providers to provide the service. The service providers process personal data on behalf of the City of Espoo and according to its instructions, to the extent that is necessary to enable service provision.

Service providers (processors) that process data through eVaka (early childhood education information system) on behalf of the City of Espoo: There is a contractual relationship between the City of Espoo and Digia (framework agreement on the development and maintenance of the City of Espoo’s digital services), which means that agreements have been concluded on the matter. Amazon is Digia’s sub-processor. The Digital and Population Data Services Agency is the provider of the Population Information System.

Case management system for immigration affairs (UMA)

To retrieve the data, the personal identity code or name of the guardian or child is entered into the UMA system.

As the data controller, the city uses personal data processors (service providers). The early childhood education information system uses a cloud service provided by Amazon. Processors may transfer data from the register outside the European Union or the European Economic Area only if the transfer meets the applicable statutory requirements and if the transfer and appropriate protection measures have been agreed upon between the controller and the processor as required by data protection legislation.

The storage location of Amazon’s cloud service is within the EU. If they operate and develop services from outside Europe, data is considered to be transferred outside the EU. For example, if an administrator connects remotely from the United States to a European data centre to resolve an issue. In these situations, safeguards are established to maintain the high level of data protection required by European legislation even after the personal data has been transferred. These safeguards include an adequacy decision by the European Commission and a commitment to the required safeguards, such as the EU-US Data Privacy Framework, by the recipient of personal data. Required safeguards may also include the use of standard contractual clauses adopted by the European Commission as part of agreements concluded with personal data processors, in addition to which the processors are required to observe appropriate technical and administrative safeguards.

Data is stored and destroyed in line with the City of Espoo’s records management plan and the applicable provisions and regulations issued by the National Archives of Finland.

For children attending municipal pre-primary education, data is, as a rule, stored in the system until ten (10) years have passed since the end of the calendar year during which the child’s pre-primary education and early childhood education ended.  The plan for the implementation of child-specific support in pre-primary education is stored for ten (10) years after the end of compulsory education. After the storage period, the data is deleted from the electronic system either automatically or by the administrator. Digitally produced documents that are stored permanently (e.g. the child’s pre-primary education plan, which includes the child’s early childhood education plan) are transferred to the City of Espoo’s electronic archiving system Särmä.

The child’s early childhood education plan is a permanently stored document. In Espoo, it is included in the child’s pre-primary education plan and the individualised educational plan (IEP, or HOJKS in Finnish).

Administrative decisions on support in pre-primary education are stored for 10 years after the end of compulsory education. Other physical materials are destroyed at the end of the storage period.

For children attending pre-primary education at outsourced and service voucher day care centres, the City of Espoo’s records management plan and the applicable provisions and regulations issued by the National Archives of Finland are followed. Permanently stored documents are delivered to the Records Management Unit of the Growth and Learning Sector.

For children attending pre-primary education at day care centres receiving private day care allowance, pre-primary education applications and decisions are stored in the system.

Data protection legislation guarantees various rights for the data subject in relation to the processing of personal data. Requests concerning the data subject’s rights can be submitted to the city’s Data Protection Officer or the contact person of the register using the above-mentioned contact details.

If necessary, the controller may ask the data subject to provide additional information to fulfil the request.

The controller must respond to a request concerning the data subject’s rights without undue delay and no later than one month after receiving the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.

If the data controller does not take action on the request of the data subject, the data controller must inform the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Requests from the data subject and any resulting actions are, as a rule, free of charge. However, where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.

The data subject shall have the right to obtain from the controller confirmation as to whether personal data concerning him or her is being processed as well as the right to access the data and to obtain a copy of the data. However, the provision of data shall not adversely affect the rights or freedoms of others.

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. In addition, taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed.

Under certain conditions, the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her. For example, if the processing of personal data is based on consent and the data subject withdraws his or her consent and there is no other legal ground for the processing, the data subject shall have the right to have his or her data erased. However, the data subject shall not have the right to erasure if the processing of data is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The data subject shall have the right to request the restriction of processing in certain situations. For example, if the accuracy of the personal data is contested by the data subject, processing is restricted for a period enabling the controller to verify the accuracy of the personal data. The right also applies if the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her, which is processed for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In such a situation, the controller may only continue processing the personal data if the controller demonstrates compelling legitimate grounds for the processing. Processing may also continue if it is necessary for the establishment, exercise or defence of legal claims.

The data subject shall have the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to him or her infringes data protection legislation. The data subject can lodge a complaint with the Office of the Data Protection Ombudsman: www.tietosuoja.fi(external link, opens in a new window)

Change history:

3 September 2025

Section 5       Provision of preparatory education added

Section 7       Information related to provision of pre-primary education specified

Section 9       Disclosure of necessary information by the pre-primary education unit to the provider of basic education specified

Section 11     Data storage periods specified