Privacy notice: Processing of personal data in preparatory education

Date of publication: 14 November 2023 (Updated: 6.8.2025)

Pupils who do not speak Finnish begin school in a preparatory education group. If the pupil speaks some Finnish and needs support in strengthening their Finnish skills, they can participate in preparatory education in their own class at the local school. In Finnish-language basic education, pupils are enrolled in preparatory education through Espoo’s Multicultural Education Services.

In Swedish-language basic education, preparatory education is provided as an integrated part of other education. The number of places in preparatory education varies from year to year. Pupils are referred to Swedish-language preparatory education by the decision of the Superintendent of Education.

More information on preparatory education is available on the City of Espoo website under Preparatory education | City of Espoo.

This privacy notice describes how personal data is processed in preparatory education, i.e. instruction preparing for basic education. The privacy notice concerning the basic education pupil register provides information on the electronic systems and software used in teaching, also in preparatory education. [Link to the privacy notice]

City of Espoo

Giedre Soinio, Manager of Multicultural Education Services

Outi Saloranta-Eriksson, Superintendent of Education for Swedish Education and Cultural Services

Email: firstname.lastname@espoo.fi

Tel. 09 816 21 (switchboard)

Preparatory Education Coordinator, valmistava@espoo.fi

Tel. +358 9 81621 (switchboard)

Data Protection Officer of the City of Espoo

Helena Niemi

Address: P.O. Box 12, 02070 City of Espoo

Tel. +358 9 81621 (switchboard)

Email: tietosuoja@espoo.fi

The main purpose of processing personal data is to organise preparatory education and to perform tasks related to the pupil relationship. (Basic Education Act, section 5)

Personal data is also processed to compile statistics for the City of Espoo. When statistics are compiled, the data is processed anonymously. In addition, statutory school-specific pupil number data is disclosed for government data collection purposes (Act on the Financing of Educational and Cultural Provision, Act on Central Government Transfers to Local Government for Basic Public Services).

Processing methods

Espoo’s basic education services use the following city-level systems and electronic environments in which pupils’ and potentially guardians’ personal data is processed:

• school administration system Primus and Kurre (includes Wilma, which is the browser-based user interface of Primus and Kurre)
• work environment Google Workspace for Education (including Classroom, Meet, Forms)
• work environment Microsoft M365 (including Teams, OneDrive, Forms)
• school library system Axiell Aurora
• digital learning materials Edustore
• route planning software ReittiGIS
• digital assessment tool Digilukiseula
• solutions related to the provision of ICT services (e.g. device management). 

The privacy notice concerning the basic education pupil register describes in more detail the purposes for which personal data is processed in these systems and environments. [Link to the privacy notice]

Personal data may also be processed in school-specific applications used in teaching. The data subject can contact the principal / school director to receive more detailed information about the processing of personal data related to the use of applications or about their own rights.

For the purpose of organising preparatory education, personal data may also need to be processed outside of the systems/environments, e.g. to support assessments conducted by teachers, organise school lunch (special diets), manage swimming lessons at swimming pools, organise school trips or camps, produce surveys, and to perform duties laid down in the Act on Compulsory Education, and carry out activities related to the provision of ICT services, such as device management.

Article 6, paragraph 1, point c of the EU’s General Data Protection Regulation: processing is necessary for compliance with a legal obligation to which the data controller is subject, i.e. for the purpose of organising preparatory education in accordance with the Basic Education Act and the performance of duties laid down in the Act on Compulsory Education.

Special categories of personal data: According to section 6, subsection 1, paragraph 2 of the Data Protection Act, the prohibition of processing special categories of personal data referred to in Article 9(1) of the Data Protection Regulation does not apply to any processing of data that is provided by law or that derives directly from a statutory duty set out for the data controller by law. Processing of special categories of personal data is derived from duties set out for an education provider by the Basic Education Act. Special categories of personal data, such as health information, may be processed if necessary for the organisation of teaching.

Data processed when the pupil applies for preparatory education:

• Pupil’s name, personal identity code or date of birth and gender, contact information, mother tongue
• Guardians’ names and contact information, custody information
• Application for preparatory education
• Information on the pupil’s need for preparatory education (country of birth, country of departure, date of arrival in Finland, and citizenship) and previous participation in early childhood education, preparatory education or other education
• Decision on preparatory education and the unit where preparatory education takes place
• Other relevant factors that may affect the organisation of preparatory education 

The data collected when the pupil applies for preparatory education will be transferred to the school administration system Primus. 

Systems used and personal data processed in the organisation of preparatory education

The privacy notice concerning the basic education pupil register describes in more detail what personal data is processed in systems and environments used for organising education. [Link to the privacy notice]

Data processed outside of the systems and electronic environments

This personal data may include, for example, the pupil’s identifying and contact information, information related to assessment, and health information (school transportation, school lunches, support measures, exceptional teaching arrangements, absences or suspension of compulsory education).

Applying for preparatory education

• Child’s guardians
• Pre-primary education staff
• Other employees in the multi-professional cooperation network
• When the application is processed, the applicant’s and their children’s names, personal identity codes and addresses may be retrieved from the Population Information System if necessary.
• A pupil’s previous education provider may disclose to their new education provider public information necessary for arranging instruction for the pupil (Act on the Openness of Government Activities, section 16, subsection 3).
• Notwithstanding provisions on confidentiality, if a student transfers to education activities organised by another education provider, the former education provider must without delay forward information necessary for arranging instruction for the student to the new education provider. The information must also be provided at the request of the new education provider. (Act on Compulsory Education, section 23, subsection 3)
• In order to perform the duties laid down in the Act on Compulsory Education, an education provider has the right to obtain from another education provider or municipality the necessary information related to the pupil applying to a school, being granted and accepting a place in a school and starting and suspending their studies. (Act on Compulsory Education, section 23, subsection 1)
• Notwithstanding provisions on confidentiality, an education provider has the right to obtain, from another education provider or the municipality responsible for guidance and supervision, information necessary for the performance of its educational duties laid down in the Act on Compulsory Education. Such information includes information on the pupil’s compulsory education, previous studies and suspension of studies. (Act on Compulsory Education, section 23, subsection 2)
• Notwithstanding the provisions of section 40, subsection 1 of the Basic Education Act or provisions elsewhere concerning confidentiality, those participating in pupil welfare work have the right to obtain from one another and disclose to one another and to the pupil’s teacher, principal and the authority responsible for education operations under the Basic Education Act information necessary for the appropriate arrangement of instruction for the pupil.
• If a pre-primary pupil transfers to pre-primary education under section 26a or basic education under section 26 organised by another education provider, the former education provider must, notwithstanding provisions on confidentiality, without delay forward information necessary for arranging instruction for the pupil to the new education provider. The information may also be provided at the request of the new education provider. (Basic Education Act, section 40, subsection 4)
• Notwithstanding provisions on confidentiality, the education provider has the right to obtain free of charge information necessary for arranging instruction for the pupil from early childhood education, health care and social welfare authorities, other providers of early childhood education, health care and social welfare services, and health care professionals. (Basic Education Act, section 41, subsection 4)

Data and documents are disclosed to the person requesting them in accordance with the Act on the Openness of Government Activities. Information and documents are public unless specifically defined as confidential under law.

The disclosure of public information from a personal data register controlled by an authority is based on section 16, subsection 3 of the Act on the Openness of Government Activities. According to this provision, the party requesting access must have the right to record and use such data. Personal data can only be disclosed following a detailed request for data (Act on the Openness of Government Activities, section 13, subsection 2).

Confidential information may only be disclosed with the written consent of the guardian or on the basis of a provision that authorises its disclosure.

• Notwithstanding provisions on confidentiality, if a student transfers to education activities organised by another education provider, the former education provider must without delay forward information necessary for arranging instruction for the student to the new education provider. The information must also be provided at the request of the new education provider. (Act on Compulsory Education, section 23, subsection 3)
• In order to perform the duties laid down in the Act on Compulsory Education, an education provider has the right to obtain from another education provider or municipality the necessary information related to the pupil applying to a school, being granted and accepting a place in a school and starting and suspending their studies. (Act on Compulsory Education, section 23, subsection 1)
• Notwithstanding provisions on confidentiality, an education provider has the right to obtain, from another education provider or the municipality responsible for guidance and supervision, information necessary for the performance of its educational duties laid down in the Act on Compulsory Education. Such information includes information on the pupil’s compulsory education, previous studies and suspension of studies. (Act on Compulsory Education, section 23, subsection 2)
• Notwithstanding the provisions of section 40, subsection 1 of the Basic Education Act or provisions elsewhere concerning confidentiality, those participating in pupil welfare work have the right to obtain from one another and disclose to one another and to the pupil’s teacher, principal and the authority responsible for education operations under the Basic Education Act information necessary for the appropriate arrangement of instruction for the pupil.
• If a pre-primary pupil transfers to pre-primary education under section 26a or basic education under section 26 organised by another education provider, the former education provider must, notwithstanding provisions on confidentiality, without delay forward information necessary for arranging instruction for the pupil to the new education provider. The information may also be provided at the request of the new education provider. (Basic Education Act, section 40, subsection 4)
• Notwithstanding provisions on confidentiality, the education provider has the right to obtain free of charge information necessary for arranging instruction for the pupil from early childhood education, health care and social welfare authorities, other providers of early childhood education, health care and social welfare services, and health care professionals. (Basic Education Act, section 41, subsection 4)
• The national centralised integration service for study rights and study records (KOSKI) collects information on each learner’s education from completed study units to degrees and qualifications (Act on the National Registers of Education Records, Qualifications and Degrees, 884/2017).

The City of Espoo may use operational or technical service providers to organise the service. The service providers process personal data on behalf of the City of Espoo and according to its instructions, to the extent that is necessary to enable service provision.

The privacy notice concerning the basic education pupil register describes in more detail data transfers to service providers in systems and environments used for organising education. [Link to the privacy notice]

The technical service provider of the online application form is Webropol Oy. 

Personal data is mainly processed in systems and data warehouses located within the European Union (EU) and the European Economic Area (EEA). Some of the processors of personal data or the services they provide are located outside the EU/EEA, and in these cases personal data is also transferred outside the area. The data in the systems is transferred outside the EU/EEA, for example, in situations where the IT system or cloud service used for the processing of personal data is located on a server outside the EU/EEA, such as a server of a service provider based in the US.

In situations where personal data is transferred outside the EU/EEA, safeguards are established to maintain the high level of data protection required by European legislation even after the personal data has been transferred. These safeguards include an adequacy decision by the European Commission and a commitment to the required safeguards, such as the EU-US Data Privacy Framework, by the recipient of personal data. Required safeguards may also include the use of standard contractual clauses adopted by the European Commission as part of agreements concluded with personal data processors, in addition to which the processors are required to observe appropriate technical and administrative safeguards.

All data processed in the Webropol service is stored within the EU/EEA and is not disclosed or processed outside the EU/EEA. The privacy notice concerning the basic education pupil register describes in more detail transfers of personal data outside the EU/EEA in systems and environments used for organising education. [Link to the privacy notice]

Data is stored and destroyed in line with the City of Espoo’s records management plan and the applicable provisions and regulations issued by the National Archives of Finland.

The following storage periods apply to preparatory education:

• Preparatory education applications/decisions: duration of compulsory education + 10 years
• Preparatory education study plan: duration of compulsory education + 10 years
• Preparatory education certificates: duration of compulsory education
• Completion of studies included in the basic education syllabus during preparatory education: stored permanently

Data protection legislation guarantees various rights for the data subject in relation to the processing of personal data. Requests concerning the data subject’s rights can be submitted to the city’s Data Protection Officer or the contact person of the register using the above-mentioned contact details.

If necessary, the controller may ask the data subject to provide additional information to fulfil the request.

The controller must respond to a request concerning the data subject’s rights without undue delay and no later than one month after receiving the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.

If the data controller does not take action on the request of the data subject, the data controller must inform the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Requests from the data subject and any resulting actions are, as a rule, free of charge. However, where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.

The data subject shall have the right to obtain from the controller confirmation as to whether personal data concerning him or her is being processed as well as the right to access the data and to obtain a copy of the data. However, the provision of data shall not adversely affect the rights or freedoms of others.

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. In addition, taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed.

Under certain conditions, the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her. For example, if the processing of personal data is based on consent and the data subject withdraws his or her consent and there is no other legal ground for the processing, the data subject shall have the right to have his or her data erased. However, the data subject shall not have the right to erasure if the processing of data is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The data subject shall have the right to request the restriction of processing in certain situations. For example, if the accuracy of the personal data is contested by the data subject, processing is restricted for a period enabling the controller to verify the accuracy of the personal data. The right also applies if the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her, which is processed for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In such a situation, the controller may only continue processing the personal data if the controller demonstrates compelling legitimate grounds for the processing. Processing may also continue if it is necessary for the establishment, exercise or defence of legal claims.

The data subject shall have the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to him or her infringes data protection legislation. The data subject can lodge a complaint with the Office of the Data Protection Ombudsman: www.tietosuoja.fi(external link, opens in a new window)

Change history: 

6 August 2025: Mobile device management as a processing method was changed and extended to include the provision of all ICT services. The reform of support for learning, which entered into force on 1 August 2025, has been taken into account.