Privacy notice Processing of personal data, register of pupils with disabilities attending morning, afternoon and holiday care provided by the Finnish Basic Education Unit

This register is managed by the Finnish Basic Education Unit of the City of Espoo, as agreed upon with the Western Uusimaa Wellbeing Services County. A framework agreement regarding the provision of these services was signed on 15 February 2023 between the client (Western Uusimaa Wellbeing Services County, Disability Services) and the provider (Growth and Learning Sector, Finnish Basic Education Unit).

Personal data is processed to organise morning, afternoon and holiday care under the Act on Disability Services and Assistance or the Act on Special Care for People with Intellectual Disabilities. The register contains information related to the client relationship recorded in the Primus school administration system.

Swedish Education and Cultural Services provides morning and afternoon care for pupils with intellectual disabilities and autism in collaboration with the Western Uusimaa Wellbeing Services County and the City of Helsinki. This register does not apply to Swedish-language education.

Information on the social services privacy policy of the Western Uusimaa Wellbeing Services County: Privacy policy: Client register of social services | Western Uusimaa Wellbeing Services County (luvn.fi)(external link, opens in a new window)

Date of publication: 24.9.2024

City of Espoo

 

Juha Nurmi, Director of Basic Education

Email: firstname.lastname@espoo.fi

Tel. 09 816 21 (switchboard)

Miia Loisa-Turunen, Education Support Manager

Email: firstname.lastname@espoo.fi

Tel. +358 9 81621 (switchboard)

Helena Niemi, Data Protection Officer of the City of Espoo

Address: P.O. Box 12, 02070 City of Espoo

Tel. +358 9 81621 (switchboard)

Email: tietosuoja@espoo.fi

The Finnish Basic Education Unit provides morning, afternoon and holiday care for pupils with intellectual disabilities and autism who are entitled to such care under the Act on Disability Services and Assistance or the Act on Special Care for People with Intellectual Disabilities.

Personal data is processed to organise morning, afternoon and holiday care under the Act on Disability Services and Assistance or the Act on Special Care for People with Intellectual Disabilities. The register contains information related to the client relationship recorded in the Primus school administration system.

A framework agreement regarding the principles and responsibilities related to the provision of care was signed on 15 February 2023 between the client (Western Uusimaa Wellbeing Services County, Disability Services) and the provider (Growth and Learning Sector, Finnish Basic Education Unit). In addition, an annual agreement is concluded on the details of care provision.

The care for children with intellectual disabilities and autism is provided by the City of Espoo’s Finnish Basic Education Unit. Care is coordinated by the Education Support Service Area under the Finnish Basic Education Unit.

The register is used for compiling statistics for the City of Espoo. When statistics are compiled, the data is processed anonymously.

Article 6(1)(c) of the General Data Protection Regulation of the European Union: processing is necessary for compliance with a legal obligation to which the controller is subject.

Special categories of personal data to be processed may include health information.  According to section 6 of the Data Protection Act, Article 9(1) of the General Data Protection Regulation does not apply to any processing of data that is provided by law or that derives directly from a statutory duty set out for the data controller by law.

The processing of personal identity codes is based on section 29, subsection 1 of the Data Protection Act. Personal identity codes may be processed if it is necessary to uniquely identify the data subject from among other data subjects and their personal data in order to implement the rights and duties of the data subject or the controller.

Key legislation:

• Social Welfare Act (1301/2014)
• Act on Disability Services and Assistance (380/1987)
• Act on Special Care for People with Intellectual Disabilities (519/1977)
• Act on the Status and Rights of Social Welfare Clients (812/2000)
• Act on the Electronic Processing of Client Data in Healthcare and Social Welfare (159/2007)
• Decree on the Openness of Government Activities and on Good Practice in Information Management (1030/1999), chapter 2
• Basic Education Act

Registration for the service. Registration for this service is completed electronically via the school administration system Primus/Wilma or using a paper form.

Information obtained in connection with registration for morning, afternoon or holiday care (Primus / paper form):

• child’s information: name, date of birth, address
• guardian’s information: name, address, telephone number, email address
• care hours, requested holiday care days and related transport needs

The decision regarding the location of morning, afternoon or holiday care will be sent to the guardian either as a paper document or through Wilma, depending on the method selected by the guardian.

The decision contains the following information:

• child’s information: name, date of birth, and address if the decision is in paper form
• granting of care and the name and telephone number of the care location
• care type: morning care / afternoon care / holiday care.

The Finnish Basic Education Unit provides each school with a school-specific list of pupils who will attend morning and afternoon care and a joint list of children and young people requiring holiday care. The lists include the following information:

Morning and afternoon care:

• child’s name
• start time of morning care and end time of afternoon care
• grade
• date of decision

Holiday care:

• care location
• child’s school
• child’s name
• start and end dates of holiday care
• care hours
• need for transport
• guardians’ names and telephone numbers

For holiday care, the Finnish Basic Education Unit sends information on the care hours and days requested by guardians to the transport logistics team, which forwards the details to transport companies.

Holiday care transport request:

• child’s school
• care location
• child’s name
• transport company (during the school year)
• start and end dates of holiday care
• care hours
• whether the child has been granted transport services

If necessary, guardians are asked to fill in a preliminary information form (paper document) for holiday care:

• child’s name
• guardians’ contact information
• possible special diet and allergies
• possible medication during the care day and instructions for administering it; if necessary, a copy of the prescription
• daily activities (dressing, toilet visits, meals)
• mobility / assistive devices
• favourite games / activities / interests
• communication
• other important information

The instructor-in-charge reports attendance data on children participating in morning and afternoon care to Disability Services every three months and at the end of each holiday care period.

Information included in the report on attendance in morning and afternoon care:

• child’s name
• personal identity code
• number of days per month the child attended morning care
• number of days per month the child attended afternoon care

Information included in the report on attendance in holiday care:

• child’s name
• personal identity code
• start date of care period
• end date of care period
• total number of care days

Guardians provide the information electronically via Wilma forms or using paper forms:

• Registration for Disability Services’ morning and afternoon care
• Registration for Disability Services’ holiday care

Basic information about the pupil and guardian and information about the pupil’s school are obtained from the Primus school administration system’s pupil register.

Disability Services decides whether the child is eligible for morning, afternoon and/or holiday care. If the decision is favourable, Disability Services sends it to the Finnish Basic Education Unit. The unit records the start and end dates indicated in the decision in the Primus support services register, which is only accessible to a limited number of Primus users.

Data and documents are disclosed to the person requesting them in accordance with the Act on the Openness of Government Activities. Information and documents are public unless specifically defined as confidential under law.

Confidential information includes information on health, social welfare, special support, pupil welfare, private life and wealth.

The data stored in this register is confidential on the basis of section 40 of the Basic Education Act and sections 14–15 of the Act on the Status and Rights of Social Welfare Clients.

Confidential information may only be disclosed with the express consent of the data subject or the guardian of a minor or if there is a specific provision on the collection of information or the right of access. (Act on the Openness of Government Activities, chapter 7)

The City of Espoo may use operational or technical service providers to organise the service. The service providers process personal data on behalf of the City of Espoo and according to its instructions, to the extent that is necessary to enable service provision.

The service provider for the Primus/Wilma system is Visma.

The service provider for Office tools is Microsoft.

As a rule, data is not transferred outside the EU or the EEA.

Participant lists for schools are compiled in a Microsoft Excel spreadsheet.

Personal data is mainly processed in systems and data warehouses located within the European Union. Some of the processors of personal data or the services they provide are located outside the European Economic Area (EEA), and in these cases personal data is also transferred outside the area. The data in the systems is transferred outside the EEA, for example in situations where the IT system or cloud service used for the processing of personal data is located on a server outside the EEA, such as a server of a service provider based in the US.

In situations where personal data is transferred outside the EEA, safeguards are established to maintain the high level of data protection required by European legislation even after the personal data has been transferred. These safeguards include an adequacy decision by the European Commission and a commitment to the required safeguards, such as the EU-US Data Privacy Framework, by the recipient of personal data. Required safeguards may also include the use of standard contractual clauses adopted by the European Commission as part of agreements concluded with personal data processors, in addition to which the processors are required to observe appropriate technical and administrative safeguards.

Data is stored and destroyed in line with the City of Espoo’s records management plan and the applicable provisions and regulations issued by the National Archives of Finland.

Decisions on morning, afternoon and holiday care are stored in pupil-specific document archives in Primus. The information remains in Primus for at least the duration of the pupil’s compulsory education. Decisions are printed out and stored in the archives of the Growth and Learning Sector for ten (10) years.

Data protection legislation guarantees various rights for the data subject in relation to the processing of personal data. Requests concerning the data subject’s rights can be submitted to the city’s Data Protection Officer or the contact person of the register using the above-mentioned contact details.

If necessary, the controller may ask the data subject to provide additional information to fulfil the request.

The controller must respond to a request concerning the data subject’s rights without undue delay and no later than one month after receiving the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.

If the data controller does not take action on the request of the data subject, the data controller must inform the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Requests from the data subject and any resulting actions are, as a rule, free of charge. However, where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.

The data subject shall have the right to obtain from the controller confirmation as to whether personal data concerning him or her is being processed as well as the right to access the data and to obtain a copy of the data. However, the provision of data shall not adversely affect the rights or freedoms of others.

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. In addition, taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed.

Under certain conditions, the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her. For example, if the processing of personal data is based on consent and the data subject withdraws his or her consent and there is no other legal ground for the processing, the data subject shall have the right to have his or her data erased. However, the data subject shall not have the right to erasure if the processing of data is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The data subject shall have the right to request the restriction of processing in certain situations. For example, if the accuracy of the personal data is contested by the data subject, processing is restricted for a period enabling the controller to verify the accuracy of the personal data. The right also applies if the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her, which is processed for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In such a situation, the controller may only continue processing the personal data if the controller demonstrates compelling legitimate grounds for the processing. Processing may also continue if it is necessary for the establishment, exercise or defence of legal claims.

The data subject shall have the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to him or her infringes data protection legislation. The data subject can lodge a complaint with the Office of the Data Protection Ombudsman: www.tietosuoja.fi(external link, opens in a new window)

Change history: -