Privacy notice: Processing of personal data, register for guidance and supervision of compulsory education (Espoo as the municipality of residence)

Date of publication: 29.8.2024

City of Espoo

Jaakko Turpeinen, Education Services Manager

Email: firstname.lastname@espoo.fi

Tel. 09 816 21 (switchboard)

Katrina Nylund, Planning Officer

Email: oppivelvollisuus.asuinkunta@espoo.fi

Tel. +358 9 81621 (switchboard)

Data Protection Officer of the City of Espoo

Address: P.O. Box 12, 02070 City of Espoo

Tel. +358 9 81621 (switchboard)

Email: tietosuoja@espoo.fi

The personal data in the register is processed so that the municipality of residence can guide and supervise the progress of compulsory education of a person of compulsory education age if said person does not participate in education provided in accordance with the Basic Education Act, the Act on General Upper Secondary Education, or the Act on Vocational Education and Training.

The municipality of residence is also responsible for guiding and supervising under 18-year-olds of upper secondary education age who do not participate in education and whose guidance has not been assigned to another party.

Personal data is also processed for the purpose of compiling statistics for the City of Espoo. When statistics are compiled, the data is processed anonymously.

The processing of personal data is necessary for compliance with a legal obligation to which the controller is subject. (Article 6(1)(c) of the General Data Protection Regulation)

Municipalities have a statutory obligation to monitor the participation in education of persons of compulsory education age. Municipalities also have a statutory obligation to make decisions, when necessary, as specified in the Act on Compulsory Education (1214/2020), regarding the assignment of a study place or the suspension of compulsory education.

According to section 6, subsection 1, paragraph 2 of the Data Protection Act, Article 9(1) of the General Data Protection Regulation does not apply to any processing of data that is provided by law or that derives directly from a statutory duty set out for the data controller by law.

The processing of personal identity codes is based on section 29, subsection 1 of the Data Protection Act. The identification of the data subject and their personal data is important for the performance of a statutory duty.   

Key legislation:

• General Data Protection Regulation of the European Union (2016/679)
• Data Protection Act (1050/2018)
• Act on Compulsory Education (1214/2020)
• Basic Education Act (628/1998)
• Act on General Upper Secondary Education (714/2018)
• Act on Vocational Education and Training (531/2017)

The identifying and contact information of persons of compulsory education age and their guardians is processed in the register. If the young person has other people in their support network, their contact information may also be processed.

The following information needed in the processing of the matter is collected on persons of compulsory education age: name, personal identity code, telephone number, mother tongue, school, educational level, information about starting and ending education, information about any need for support, municipality of residence and municipality to which the person has moved, contact requests and responses, child welfare notifications, and information necessary for guiding the person towards educational opportunities or assigning them a place in an educational institution. The following information needed in the processing of the matter is collected on guardians: name, telephone number, address and, if necessary, service language.

If a guardian applies for suspension of the young person’s compulsory education from their municipality of residence or if the person is assigned a study place, these decisions are processed in Espoo’s decision-making system (Dynasty). The data in this register is used in the decision-making process.

Link to the privacy notice of Espoo’s Dynasty decision-making system:

Tietosuojaseloste Päätöksentekojärjestelmä Dynasty 10 | Espoon kaupunki (in Finnish)

Data is obtained from the Valpas Monitoring and Tracking Service for Compulsory Education maintained by the Finnish National Agency for Education, the population information system of the Digital and Population Data Services Agency, and Espoo’s Primus school administration system. Data can also be obtained from different education providers and from TE services (employment services).

In addition, information may be obtained from the young person, their guardians or, with the permission of the guardians, from other members of the young person’s network.

Data and documents are disclosed to the person requesting them in accordance with the Act on the Openness of Government Activities. Information and documents are public unless specifically defined as confidential under law.

The data stored in this register is confidential.

Personal data in the register may be disclosed in response to official requests, such as those from Kela, child protection authorities, or an education provider. Data may also be transferred to another municipality, for example, if the data subject moves to another municipality.

Personal data will not be transferred outside the EU or the EEA.

Data is stored and destroyed in line with the City of Espoo’s records management plan and the applicable provisions and regulations issued by the National Archives of Finland.

The information is stored for the duration of compulsory education plus the period of free education related to compulsory education.

Data protection legislation guarantees various rights for the data subject in relation to the processing of personal data. Requests concerning the data subject’s rights can be submitted to the city’s Data Protection Officer or the contact person of the register using the above-mentioned contact details.

If necessary, the controller may ask the data subject to provide additional information to fulfil the request.

The controller must respond to a request concerning the data subject’s rights without undue delay and no later than one month after receiving the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.

If the data controller does not take action on the request of the data subject, the data controller must inform the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Requests from the data subject and any resulting actions are, as a rule, free of charge. However, where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.

The data subject shall have the right to obtain from the controller confirmation as to whether personal data concerning him or her is being processed as well as the right to access the data and to obtain a copy of the data. However, the provision of data shall not adversely affect the rights or freedoms of others.

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. In addition, taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed.

Under certain conditions, the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her. For example, if the processing of personal data is based on consent and the data subject withdraws his or her consent and there is no other legal ground for the processing, the data subject shall have the right to have his or her data erased. However, the data subject shall not have the right to erasure if the processing of data is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The data subject shall have the right to request the restriction of processing in certain situations. For example, if the accuracy of the personal data is contested by the data subject, processing is restricted for a period enabling the controller to verify the accuracy of the personal data. The right also applies if the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her, which is processed for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In such a situation, the controller may only continue processing the personal data if the controller demonstrates compelling legitimate grounds for the processing. Processing may also continue if it is necessary for the establishment, exercise or defence of legal claims.

The data subject shall have the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to him or her infringes data protection legislation. The data subject can lodge a complaint with the Office of the Data Protection Ombudsman: www.tietosuoja.fi(external link, opens in a new window)

Change history: -