Privacy notice: Processing of personal data, register of pupils in pre-primary education provided by the Finnish Basic Education Unit

Date of publication: 5.8.2024 (Updated 6.8.2025)

City of Espoo

Director of Basic Education: Juha Nurmi

Email: firstname.lastname@espoo.fi

Tel. 09 816 21 (switchboard)

Principals / school directors are responsible for tasks related to the register as regards the schools that they manage. The data subject can contact a principal / school director to receive more detailed information about the register or their own rights.

Email: firstname.lastname@espoo.fi

Tel. +358 9 81621 (switchboard)

Helena Niemi, Data Protection Officer of the City of Espoo

Address: P.O. Box 12, 02070 City of Espoo

Tel. +358 9 81621 (switchboard)

Email: tietosuoja@espoo.fi

Purposes of processing

Personal data stored in the register of pupils in pre-primary education provided by the Finnish Basic Education Unit is processed for the purposes of organising pre-primary education and taking care of tasks that arise from the pre-primary education provider’s relationship with the pupil (Basic Education Act, sections 4 and 26a). Personal data is also processed anonymously to compile statistics and to provide statutory information on schools’ pupil numbers. 

Processing methods

Espoo’s Growth and Learning Sector uses the following city-level systems in which pre-primary pupils’ and potentially guardians’ personal data is processed: school administration system Primus and Kurre (includes Wilma, which is the browser-based user interface of Primus and Kurre).

The purposes for which personal data related to the organisation of teaching is processed in the aforementioned systems are specified in greater detail below.

Personal data may also be processed in school-specific applications used in teaching. The data subject can contact the principal / school director to receive more detailed information about the register or their own rights.

For the purpose of organising pre-primary education, personal data may also need to be processed outside of the aforementioned systems, e.g. to support assessments conducted by teachers, prepare school transport decisions, organise school lunch (special diets), organise school trips or camps, and to produce surveys.

Personal data stored in the register may also be processed when it is necessary for the purposes of testing the information systems, for example when the pre-primary education provider introduces a new information system.

For what purposes is personal data processed in systems and electronic environments?

Primus and Kurre

• Organisation of pre-primary education (Basic Education Act, sections 4 and 26).
• Taking care of tasks that arise from the education provider’s relationship with the pupil.
• Provision of support for learning and school attendance in accordance with section 20 a of the Act on Primary and Secondary Education (assessment, plan and related documents)
• Organisation of school transport.
• Administration of user accounts for the Wilma user interface.
• School-specific statutory pupil number data is disclosed for government data collection purposes based on data in Primus (Act on the Financing of Educational and Cultural Provision, Act on Central Government Transfers to Local Government for Basic Public Services).
• Data in Primus is used to compile statistics for the City of Espoo. When statistics are compiled, the personal data is processed anonymously.

Wilma (browser-based interface of the Primus and Kurre school administration system)

Wilma can be used to carry out absence recording, registration of new pupils, cooperation between schools and homes, communication (communication with and notifications to guardians and guardians’ messages to schools), as well as surveys and their feedback. In addition, Wilma is used to provide notes and feedback concerning the pupil’s school attendance and performance (steering/corrective feedback, follow-up feedback, positive feedback). School place decisions are delivered through Wilma if the guardian has provided their consent for this.

Article 6, paragraph 1, point c of the EU’s General Data Protection Regulation: processing is necessary for compliance with a legal obligation to which the controller is subject, i.e. for the purpose of organising pre-primary education in accordance with the Basic Education Act.

Special categories of personal data: Special categories of personal data to be processed may include information related to health or ethnic origin. According to section 6 of the Data Protection Act, Article 9(1) of the General Data Protection Regulation does not apply to any processing of data that is provided by law or that derives directly from a statutory duty set out for the data controller by law.

Key legislation:

• General Data Protection Regulation of the European Union (2016/679)
• Data Protection Act (1050/2018)
• Basic Education Act (628/1998), sections 4 and 26a, organisation of pre-primary education

The processing of personal identity codes is based on section 29, subsection 1 of the Data Protection Act. The identification of the data subject and their personal data is important for the performance of a statutory duty.

Data content of the Primus, Kurre, and Wilma systems:

• the pupil’s name, personal identity code, contact information and photograph

• the guardians’ name and contact information and Wilma user account

• decisions concerning the pupil

• the pupil’s school history

• the pupil’s immigration-related information

• information related to school transport

• information concerning the pupil’s absences

• other information related to teaching and the organisation of teaching

Personal data processed outside of the systems and electronic environments

This personal data may include, for example, the pupil’s identifying and contact information, information related to assessment, and health information (related to school transport and school lunches).

The basic information of pupils starting pre-primary education is transferred to the Primus school administration system from the Trimble Locus population information system maintained by the City of Espoo. The pupil information is not updated regularly; instead, changes are recorded based on guardians’ notifications. Regular updates start from the 1st grade onwards.

Guardians supplement and update the information using a pupil registration form or in Wilma.

The majority of the information stored in the register consists of information related to the pupil’s education, created in the organisation of education.

Obtaining information from a day care provider or another pre-primary education unit

• Information collected for organising day care may only be disclosed to the school with the written consent of the guardian or on the basis of a provision that authorises its disclosure

(Basic Education Act, section 41, subsection 4)

• If a pupil transfers from one pre-primary education unit to another in the same municipality, confidential information can only be transferred to the new school / pre-primary education unit if it is necessary for the proper organisation of instruction (Basic Education Act, section 40, subsection 2).

• Notwithstanding provisions on confidentiality, if a pupil transfers to education or activities organised by another education provider, the former education provider must without delay forward information necessary for arranging instruction for the pupil to the new education provider. The information may also be provided at the request of the new education provider. (Basic Education Act, section 40, subsection 4)

Pedagogic documents

Pedagogic documents are prepared with the help of the Wilma interface as part of multidisciplinary cooperation in accordance with the Basic Education Act.

Data and documents are disclosed to the person requesting them in accordance with the Act on the Openness of Government Activities. Information and documents are public unless specifically defined as confidential under law.

The data is confidential in accordance with section 24 of the Act on the Openness of Government Activities and section 40 of the Basic Education Act.

Transfer of data to basic education or change of pre-primary education unit

• Public information can be transferred from pre-primary education to basic education based on section 16, subsection 3 of the Act on the Openness of Government Activities.

• If a pupil transfers from one pre-primary education unit to another in the same municipality, confidential information can only be transferred to the new school if it is necessary for the proper organisation of instruction (Basic Education Act, section 40, subsection 2).

• Notwithstanding provisions on confidentiality, if a pupil transfers to education or activities organised by another education provider, the former education provider must without delay forward information necessary for arranging instruction for the pupil to the new education provider. The information may also be provided at the request of the new education provider. (Basic Education Act, section 40, subsection 4)

Transfer of data to other systems

• Possibility to transfer pupils’ subject and course selection data to Kurre work plan software for the purpose of preparing work plans.
• Transfer of pupils’ address information to the ReittiGIS application for the purpose of processing pupil placement and school transport matters.
• Data provided to Statistics Finland under the Statistics Act.

Based on the specific written consent of the data subject’s / underage pupil’s guardian or other legal representative, data may also be transferred to other parties. Data may be disclosed if there is a specific provision on such access or on the right of such access in an Act. (Act on the Openness of Government Activities, section 26)

The disclosure of public information from a personal data register controlled by an authority is based on section 16, subsection 3 of the Act on the Openness of Government Activities. According to this provision, the party requesting access must have the right to record and use such data. Personal data can only be disclosed following a detailed request for data (Act on the Openness of Government Activities, section 13, subsection 2).

Pedagogic documents

• The documents contain confidential information.

• If a pupil transfers from one comprehensive school to another in the same municipality, confidential information can only be transferred to the new school if it is necessary for the proper organisation of instruction (Basic Education Act, section 40, subsection 2).

• Notwithstanding provisions on confidentiality, if a pupil transfers to education, activities or training organised by another education provider in accordance with the Basic Education Act, the former education provider must without delay forward information necessary for arranging instruction or training for the pupil to the new education provider. The information may also be provided at the request of the new education or training provider. (Basic Education Act, section 40, subsection 4)

• Those participating in pupil welfare work have the right to disclose to one another and to the pupil’s teacher, principal and the authority responsible for education operations under the Basic Education Act information necessary for the appropriate arrangement of instruction for the pupil (Basic Education Act section 40, subsection 2).

Transfer of data to service providers

The City of Espoo may use operational or technical service providers to organise the service. The service providers process personal data on behalf of the City of Espoo and according to its instructions, to the extent that is necessary to enable service provision.

As a service provider, Visma processes information in the Primus, Kurre, Wilma school administration system on behalf of the City of Espoo. Webropol is the service provider of the City of Espoo’s survey system. Microsoft is the service provider of the City of Espoo’s M365 product family.

The agreements take account of the General Data Protection Regulation of the EU and the related descriptions of processing activities.

Personal data is mainly processed in systems and data warehouses located within the European Union (EU) and the European Economic Area (EEA). Some of the processors of personal data or the services they provide are located outside the EU/EEA, and in these cases personal data is also transferred outside the area. The data in the systems is transferred outside the EU/EEA, for example, in situations where the IT system or cloud service used for the processing of personal data is located on a server outside the EU/EEA, such as a server of a service provider based in the US.

In situations where personal data is transferred outside the EU/EEA, safeguards are established to maintain the high level of data protection required by European legislation even after the personal data has been transferred. These safeguards include an adequacy decision by the European Commission and a commitment to the required safeguards, such as the EU-US Data Privacy Framework, by the recipient of personal data. Required safeguards may also include the use of standard contractual clauses adopted by the European Commission as part of agreements concluded with personal data processors, in addition to which the processors are required to observe appropriate technical and administrative safeguards.

Primus, Kurre and Wilma

Data is not transferred outside the EU or the EEA.

Webropol

Data is not transferred outside the EU or the EEA.

Microsoft

The data in the systems is transferred outside the EU or the EEA. Microsoft Corporation is a US company involved in the EU-US Data Privacy Framework.

Data is stored and destroyed in line with the City of Espoo’s records management plan and the applicable provisions and regulations issued by the National Archives of Finland.

Personal data is stored in the pupil register for one (1) year from the end of the use of the service. Statutory obligations regarding the storage of data are taken into account in the deletion of the data. The information and documents in electronic environments are stored and archived in the online services in accordance with the Growth and Learning Sector’s records management plan for one (1) year after the end of compulsory education.

Data protection legislation guarantees various rights for the data subject in relation to the processing of personal data. Requests concerning the data subject’s rights can be submitted to the city’s Data Protection Officer or the contact person of the register using the above-mentioned contact details.

If necessary, the controller may ask the data subject to provide additional information to fulfil the request.

The controller must respond to a request concerning the data subject’s rights without undue delay and no later than one month after receiving the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.

If the data controller does not take action on the request of the data subject, the data controller must inform the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Requests from the data subject and any resulting actions are, as a rule, free of charge. However, where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.

The data subject shall have the right to obtain from the controller confirmation as to whether personal data concerning him or her is being processed as well as the right to access the data and to obtain a copy of the data. However, the provision of data shall not adversely affect the rights or freedoms of others.

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. In addition, taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed.

Under certain conditions, the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her. For example, if the processing of personal data is based on consent and the data subject withdraws his or her consent and there is no other legal ground for the processing, the data subject shall have the right to have his or her data erased. However, the data subject shall not have the right to erasure if the processing of data is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The data subject shall have the right to request the restriction of processing in certain situations. For example, if the accuracy of the personal data is contested by the data subject, processing is restricted for a period enabling the controller to verify the accuracy of the personal data. The right also applies if the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her, which is processed for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In such a situation, the controller may only continue processing the personal data if the controller demonstrates compelling legitimate grounds for the processing. Processing may also continue if it is necessary for the establishment, exercise or defence of legal claims.

The data subject shall have the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to him or her infringes data protection legislation. The data subject can lodge a complaint with the Office of the Data Protection Ombudsman: www.tietosuoja.fi(external link, opens in a new window)

Change history: 

6 August 2025 The reform of support for learning, which entered into force on 1 August 2025, has been taken into account.