Privacy notice: Processing of personal data, Espoo’s summer job vouchers
The City of Espoo pays EUR 300 to an employer who hires a young Espoo resident between 1 May and 30 September using a summer job voucher. Young people apply for a summer job voucher online. A summer job voucher is available to young Espoo residents who turn at least 15 and no more than 19 during the year in question. The value of a summer job voucher is EUR 300, and only one voucher is available per person.
Date of publication: 22 February 2022 (Updated: 27 February 2024)
1. Data controller
City of Espoo
2. Person responsible for the register
3. Contact person
4. Data Protection Officer
Data Protection Officer of the City of Espoo
Address: P.O. Box 12, 02070 City of Espoo
Tel. +358 9 81621 (switchboard)
Email address: tietosuoja@espoo.fi
5. For what purpose is personal data processed?
Personal data is processed for the purpose of granting and managing summer job vouchers and contacting people, if necessary. The aim of the summer job voucher system is to support youth employment and encourage employers to hire young people. In addition, personal data is processed for statistical and archiving purposes.
6. On what grounds is personal data processed?
Article 6(1)(e) of the General Data Protection Regulation of the European Union: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
When personal data is processed on the basis of a task carried out in the public interest or in the exercise of official authority vested in the controller, the data subject has the right to object, on grounds relating to his or her particular situation, to processing of personal data concerning him or her. See section 12. ‘Rights of the data subject’.
According to section 29 of the Data Protection Act, personal identity codes may be processed if it is necessary to uniquely identify the data subject in order to implement the rights and duties of the data subject or the controller.
7. What data is processed?
7.1 Summer job voucher application form
Young people apply for a summer job voucher themselves. In the application form, the young person must provide their personal information. They must also provide the summer job information form filled in and signed by their employer or an employment contract containing the same information.
Young person’s information:
First name
Last name
Personal identity code
Telephone number
Email address
Address
Postal code
City/town
Summer job information form or employment contract signed by the employer’s contact person (an attachment that includes the above-mentioned information as well as the contact details of the employer’s contact person and confirms that the young person has been given a summer job)
7.2 Generation of summer job vouchers in service voucher and outsourced service system
An electronic service voucher is generated for the young person in the Parasta palvelua online service, which is a system for service vouchers and outsourced services (PSOP).
The young person’s information provided in the application is compiled into an Excel spreadsheet. Digital Workforce Services Oy generates summer job vouchers in the PSOP system. The PSOP system checks the young person’s information in the Population Information System based on their personal identity code and sends them an email containing their personal summer job voucher number.
7.3 Redemption of summer job vouchers in service voucher and outsourced service system
The employer applies for reimbursement of the summer job voucher through the PSOP system. The employer’s representative can log in to the system using Suomi.fi e-identification. The summer job voucher is redeemed by using the summer job voucher number provided by the young person. A certificate of payment and the young person’s pay certificate must be uploaded into the system. The PSOP system forms a payment list report, based on which the City of Espoo can make a payment to the employer. The employer will receive an email confirmation after submitting the application and a decision after the application has been processed. Summer job vouchers must be redeemed annually by the end of November.
8. What are the sources of data?
Data is received from the young people who fill in the form and employers who redeem their summer job vouchers. The PSOP system uses the Population Information System for checking the young person’s information.
9. Will data be disclosed or transferred outside the city?
Personal data is transferred to the following service providers that process personal data on behalf of the City of Espoo:
The Webropol Survey and Reporting application processes applicants’ and employers’ data (Webropol Oy).
Data is processed in the City of Espoo’s Microsoft Office 365 service (Excel spreadsheet, email).
Digital Workforce Services Oyj provides a service that is used for generating the summer job vouchers in the service voucher and outsourced service system (PSOP).
The provider of the PSOP system, called Parasta palvelua, is Kuntien Tiera Oy.
Data and documents are disclosed to the person requesting them in accordance with the Act on the Openness of Government Activities. Information and documents are public unless specifically defined as confidential under law.
10. Will data be transferred outside the EEA?
All data included in the Webropol service is stored within the ETA and not disclosed or processed outside the ETA.
Data in the client register of the PSOP system is not transferred outside the EEA.
The data processed with services provided by Microsoft is stored within the ETA. Microsoft operates and develops Office 365 services from locations outside Europe, and data is considered to be transferred outside the EEA if, for example, an administrator establishes a remote connection from the United States to a data centre in Europe to solve a technical problem.
In situations where personal data is transferred outside the EEA, safeguards are established to maintain the high level of data protection required by European legislation even after the personal data has been transferred. These safeguards include an adequacy decision by the European Commission and a commitment to the required safeguards, such as the EU-US Data Privacy Framework, by the recipient of personal data. Required safeguards may also include the use of standard contractual clauses adopted by the European Commission as part of agreements concluded with personal data processors, in addition to which the processors are required to observe appropriate technical and administrative safeguards.
11. How long is data stored?
A young person’s data is stored for the duration of the calendar year following the year when they applied for a summer job voucher.
The summer job information form or employment contract signed by the employer’s contact person is stored for the duration of the calendar year following the year when the young person applied for a summer job voucher.
Espoo’s Financial Services stores accounting material related to summer job vouchers for 10 years (Accounting Act, chapter 2, section 10).
Data is stored and destroyed in accordance with the City of Espoo’s records management plan.
12. Rights of the data subject
Data protection legislation guarantees various rights for the data subject in relation to the processing of personal data. Requests concerning the data subject’s rights can be submitted to the city’s Data Protection Officer or the contact person using the above-mentioned contact details.
If necessary, the controller may ask the data subject to provide additional information to fulfil the request.
The controller must respond to a request concerning the data subject’s rights without undue delay and no later than one month after receiving the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.
If the controller does not take action on the request of the data subject, the controller must inform the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
Requests from the data subject and any resulting actions are, as a rule, free of charge. However, where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.
12.1 Right of access to data
The data subject shall have the right to obtain from the controller confirmation as to whether personal data concerning him or her are being processed as well as the right to access the data and to obtain a copy of the data. However, the provision of data shall not adversely affect the rights or freedoms of others.
12.2 Right to rectification
The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. In addition, taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed.
12.3 Right to erasure
Under certain conditions, the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her. For example, if the processing of personal data is based on consent and the data subject withdraws his or her consent and there is no other legal ground for the processing, the data subject shall have the right to have his or her data erased. However, the data subject shall not have the right to erasure if the processing of data is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
12.4 Right to restriction of processing
The data subject shall have the right to request the restriction of processing in certain situations. For example, if the accuracy of the personal data is contested by the data subject, processing is restricted for a period enabling the controller to verify the accuracy of the personal data. The right also applies if the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.
12.5 Right to object to processing
The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her, which is processed for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In such a situation, the controller may only continue processing the personal data if the controller demonstrates compelling legitimate grounds for the processing. Processing may also continue if it is necessary for the establishment, exercise or defence of legal claims.
12.6 Right to lodge a complaint
The data subject shall have the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to him or her infringes data protection legislation. The data subject can lodge a complaint with the Office of the Data Protection Ombudsman at www.tietosuoja.fi(external link, opens in a new window).
Change history
27 February 2024: The minimum age limit updated.
2 February 2024: The person responsible for the register, the contact person and storage periods were updated. The grounds for processing were specified so that a statutory obligation was replaced by the performance of a task carried out in the public interest or in the exercise of official authority.