Privacy notice, Processing of personal data, approval of municipal supplements to private day care allowance and childcarers employed by families

Date of publication: 29.7.2024

City of Espoo

Finnish Early Childhood Education:

Maija Koiso-Kanttila, Senior Planning Officer

P.O. Box 302, 02070 CITY OF ESPOO

Email address: firstname.lastname@espoo.fi

Swedish Education and Cultural Services:

Mia Reimars, Administrative Manager

P.O. Box 32, 02070 CITY OF ESPOO

Email address: firstname.lastname@espoo.fi

Tel. +358 9 81621 (switchboard)

Municipal supplements:

Minna Mustonen, Financial Coordinator

Tel. +358 9 81627401, Mon, Wed and Thu 9:00–12:00

Email: firstname.lastname@espoo.fi

Childcarers employed by families:

Sanna Malmström and Miia Mynttinen, Early Childhood Education Specialists

Email: vaka.yksityinen@espoo.fi.

Swedish Education and Cultural Services: Mia Reimars

Email: firstname.lastname@espoo.fi

Tel. +358 9 81621 (switchboard)

Helena Niemi, Data Protection Officer of the City of Espoo

Address: P.O. Box 12, 02070 City of Espoo

Tel. +358 9 81621 (switchboard)

Email: tietosuoja@espoo.fi

The register is maintained for the purpose of processing applications for sibling supplement to private day care allowance and applications for municipal supplement for arranging 20 hours of free early childhood education for 5-year-olds, and the related decision-making, processing of payment orders, and approval of payments. The child’s guardian is responsible for applying for a sibling supplement to private day care allowance. The service provider is responsible for applying for a municipal supplement for arranging 20 hours of free early childhood education for 5-year-olds. The supplements are paid to the private early childhood education service provider.

In addition, the register is maintained for the purpose of approving childcarers employed by families. After approval, the guardians apply for private day care allowance and a municipal supplement from Kela.

Article 6(1)(e) of the General Data Protection Regulation of the European Union: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The processing of personal identity codes is based on section 29, subsection 1 of the Data Protection Act. Personal identity codes may be processed if it is necessary to uniquely identify the data subject from among other data subjects and their personal data in order to implement the rights and duties of the data subject or the controller.

Key legislation:

• General Data Protection Regulation of the European Union (2016/679)
• Data Protection Act (1050/2018)
• Act on Child Home Care Allowance and Private Day Care Allowance (1128/1996)

Form for sibling supplement to private day care allowance:

• applicant’s name, date of birth, address, telephone number, email address and signature
• information on all the children in the family who attend municipal, outsourced, service voucher or private early childhood education (name, date of birth, early childhood education unit)
• name, address, contact person, email address and telephone number of the day care centre, family day care provider or group family day care centre

Copies of service providers’ care agreements:

• applicant’s personal identity code, name, address, occupation and contact persons
• child’s personal identity code, name and address

Copy of Kela’s decision on private day care allowance:

• applicant’s name, address, date of birth and children’s names

Decision on sibling supplement:

• applicant’s name and early childhood education unit
• child’s name and date of birth

Notification form:

• child’s last name, the period for which the allowance was granted and its monthly amount

Form for 20 hours of free early childhood education for 5-year-olds:

• day care centre’s / family day care provider’s / group family day care centre’s name, address, bank account number, person in charge and their email address, telephone number, signature and name in block letters
• children’s names, dates of birth, addresses

Decision on 20 hours of free early childhood education for 5-year-olds:

• service provider and unit
• children’s last names

The use of the register, the reception and processing of applications, and related decision-making are carried out locally by the contact person (use and storage on a local encrypted hard drive).

Financial monitoring takes place in the personal workstation of the register’s contact person. Personal data is processed in the Excel program.

Approval of childcarers employed by families:

• chidcarer’s name, business ID or personal identity code, address, telephone number and email address
• employer’s (guardians) name, date of birth and address
• child’s name and date of birth, early childhood education hours, care fee
• employment contract between the carer and the employer
• other information needed by the authority to perform the above-mentioned tasks

Regarding the sibling supplement:

Data is obtained from the guardian through a separate form. The guardian fills in and signs the form. The form arrives by post or email to the register’s contact person. The form is stored in an electronic register, and the physical document is stored in a locked cabinet.

Regarding 20 hours of free early childhood education for 5-year-olds:

Data is obtained from the service provider through a separate form. The service provider fills in and signs the form. The form arrives by post or email to the register’s contact person. The form is stored in an electronic register, and the physical document is stored in a locked cabinet.

Regarding childcarers employed by families:

For childcarers employed by families, information is obtained from the employment contract between the family and carer and the Kela form WH 2.

The last name and, if necessary, the first letter of the first name of a client will be disclosed to private day care service providers for the payment of municipal supplements.

Data and documents are disclosed to the person requesting them in accordance with the Act on the Openness of Government Activities. Information and documents are public unless specifically defined as confidential under law.

Microsoft is Espoo’s service provider for the spreadsheet program Excel and the email service Outlook.

Data may be transferred outside the European Union or the European Economic Area.

Microsoft workspaces are stored within the EU. Microsoft operates and develops Office 365 services from locations outside Europe, and data is considered to be transferred outside the EU if, for example, an administrator establishes a remote connection from the United States to a data centre in Europe, for example to solve a technical problem. The basis for the transfer is the European Commission’s adequacy decision on US data protection. The recipient of personal data is committed to the EU-US Data Privacy Framework. 

Data is stored and destroyed in line with the City of Espoo’s records management plan and the applicable provisions and regulations issued by the National Archives of Finland.

The decision on a sibling supplement and the decision on free early childhood education for a five-year-old child are stored for 10 years.

The employment contracts and WH 2 forms of childcarers employed by families are stored for 10 years after they expire.

Data protection legislation guarantees various rights for the data subject in relation to the processing of personal data. Requests concerning the data subject’s rights can be submitted to the city’s Data Protection Officer or the contact person of the register using the above-mentioned contact details.

If necessary, the controller may ask the data subject to provide additional information to fulfil the request.

The controller must respond to a request concerning the data subject’s rights without undue delay and no later than one month after receiving the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.

If the data controller does not take action on the request of the data subject, the data controller must inform the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Requests from the data subject and any resulting actions are, as a rule, free of charge. However, where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.

The data subject shall have the right to obtain from the controller confirmation as to whether personal data concerning him or her is being processed as well as the right to access the data and to obtain a copy of the data. However, the provision of data shall not adversely affect the rights or freedoms of others.

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. In addition, taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed.

Under certain conditions, the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her. For example, if the processing of personal data is based on consent and the data subject withdraws his or her consent and there is no other legal ground for the processing, the data subject shall have the right to have his or her data erased. However, the data subject shall not have the right to erasure if the processing of data is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The data subject shall have the right to request the restriction of processing in certain situations. For example, if the accuracy of the personal data is contested by the data subject, processing is restricted for a period enabling the controller to verify the accuracy of the personal data. The right also applies if the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her, which is processed for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In such a situation, the controller may only continue processing the personal data if the controller demonstrates compelling legitimate grounds for the processing. Processing may also continue if it is necessary for the establishment, exercise or defence of legal claims.

The data subject shall have the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to him or her infringes data protection legislation. The data subject can lodge a complaint with the Office of the Data Protection Ombudsman: www.tietosuoja.fi(external link, opens in a new window)

Change history: -