Privacy notice: Processing of personal data, student welfare register

Date of publication: 12 August 2024 (Updated: 11 June 2025 )

City of Espoo, Growth and Learning Committee and Committee for Swedish Education and Culture

Early childhood education: Virpi Mattila, Director of Early Childhood Education

Upper secondary education: Tapio Erma, Director of Upper Secondary Education

Basic education: Juha Nurmi, Director of Basic Education

Email: firstname.lastname@espoo.fi

Tel. +358 9 81621 (switchboard)

Principals / unit directors are responsible for tasks related to the register with regard to the school / early childhood education unit that they manage. The data subject can contact the principal / unit director to receive more detailed information about the register or their rights.

Email: firstname.lastname@espoo.fi

Tel. +358 9 81621 (switchboard)

Helena Niemi, Data Protection Officer of the City of Espoo

Address: P.O. Box 12, 02070 City of Espoo

Tel. +358 9 81621 (switchboard)

Email: tietosuoja@espoo.fi

According to section 21 of the Student Welfare Act, the education provider must maintain, as a data controller, a register of multi-professional individual student welfare services (student welfare register). The register contains student welfare reports drawn up in connection with an educational institution’s multi-professional individual student welfare services as well as the expressions of will by a student or their legal representative.

Article 6(1)(c) of the General Data Protection Regulation of the European Union: processing is necessary for compliance with a legal obligation to which the controller is subject.

A multi-professional team of student welfare experts is put together, if necessary, to support an individual student. They will assess the student’s need for support and take care of the organisation of the necessary services. 

The group’s responsible person enters in the student welfare report any information necessary for the organisation and provision of individual student welfare services. This report is written on a printed form, accompanied by a completed consent form. Entries can also be made by the other members of the group, notwithstanding any obligations of confidentiality. Typically, information is entered in a student welfare report by the person who convenes the group of experts. 

A student welfare report is drawn up in a continuous form and in chronological order and includes the following information concerning an individual student:

1) name, personal identity code, municipality of residence and contact information and, for a minor or an otherwise incompetent student, the name and contact information of a guardian or other legal representative;

2) subject matter and the person who started the process;

3) measures taken when assessing the student’s situation;

4) information on the handling of the matter at the student welfare group’s meeting, the persons participating in the meeting and their positions, the decisions made at the meeting, the plan for implementing the decisions, and the parties responsible for implementation and monitoring;

5) measures taken;

6) the date of the entering of information, and the person who made the entry and their occupational or professional position.

If information in a student welfare report is disclosed to a third party, the document must also indicate what information has been disclosed, to whom and on what basis.

Data is obtained from the pupils/students and their guardians or other legal representatives.

Notwithstanding the obligation of confidentiality, those participating in the organisation and provision of a student’s individual student welfare services have the right to obtain from each other and disclose to each other and to an authority responsible for student welfare such information that is necessary for the organisation and provision of individual student welfare services (Student Welfare Act, section 23, subsection 2).

If a student transfers to another educational institution, the previous education provider has to request the consent of the student or, if the student does not have the ability to understand the significance of the consent, of their guardian or other legal representative for transferring to the new education provider such confidential information from the student welfare client register that is necessary for the continuity of student welfare services (Student Welfare Act, section 23, subsection 3).

Those participating in pupil welfare work have the right to obtain from one another information necessary for the appropriate arrangement of instruction for the pupil (Basic Education Act, section 40, subsection 2).

Notwithstanding secrecy provisions, the holder of information shall have the right to provide information on a student’s state of health and functional capacity necessary for the performance of the recipient’s duties to a person responsible for student healthcare for the purpose of ensuring the student’s health and safety and to guide the student to support services where necessary (Act on General Upper Secondary Education, section 58, subsection 1, paragraph 3).

Based on the specific written consent of the data subject or the pupil’s guardian or other legal representative, data may also be obtained from other parties. Data may be obtained if there is a specific provision on such access or on the right of such access in an act (Act on the Openness of Government Activities, section 26).

Data and documents are disclosed to the person requesting them in accordance with the Act on the Openness of Government Activities. Information and documents are public unless specifically defined as confidential under law.

The data in the student welfare register is confidential. It may be disclosed with the written specific consent of the person in question or, if they do not have the ability to understand the significance of the consent, of their legal representative or on the basis of a provision that authorises its disclosure (Student Welfare Act, section 22).

Notwithstanding the obligation of confidentiality, those participating in the organisation and provision of a student’s individual student welfare services have the right to obtain from each other and disclose to each other and to an authority responsible for student welfare such information that is necessary for the organisation and provision of individual student welfare services (Student Welfare Act, section 23, subsection 2).

If a student transfers to another educational institution, the previous education provider has to request the consent of the student or, if the student does not have the ability to understand the significance of the consent, of their guardian or other legal representative for transferring to the new education provider such confidential information from the student welfare client register that is necessary for the continuity of student welfare services (Student Welfare Act, section 23, subsection 3).

Those participating in pupil welfare work have the right to disclose to one another and to the pupil’s teacher, principal and the authority responsible for education operations under the Basic Education Act information necessary for the appropriate arrangement of instruction for the pupil (Basic Education Act section 40, subsection 2).

Notwithstanding secrecy provisions, the holder of information shall have the right to provide information on a student’s state of health and functional capacity necessary for the performance of the recipient’s duties to the principal of an educational institution and those responsible for the security of the educational institution for the purpose of ensuring the safety to pursue studies as well as to a person responsible for guidance for studies for the purpose of guiding the student to other studies or support services (Act on General Upper Secondary Education, section 58, subsection 1, paragraphs 1 and 2).

The provider of education for students pursuing a vocational upper secondary qualification or attending preparatory education has the right to obtain information in certain situations, and it cooperates with the authorities and other parties that provide and organise student welfare services (Act on Vocational Education and Training, sections 40 and 99).

Based on the specific written consent of the data subject or the pupil’s guardian or other legal representative, data may also be disclosed to other parties. Data may be disclosed if there is a specific provision on such access or on the right of such access in an act (Act on the Openness of Government Activities, section 26).

School social workers record student welfare information in the social welfare client information system, while psychologists and school nurses use the health care patient information system.

Data will not be transferred.

Data is stored and destroyed in line with the City of Espoo’s records management plan and the applicable provisions and regulations issued by the National Archives of Finland. 

Data protection legislation guarantees various rights for the data subject in relation to the processing of personal data. Requests concerning the data subject’s rights can be submitted to the city’s Data Protection Officer or the contact person of the register using the above-mentioned contact details.

If necessary, the controller may ask the data subject to provide additional information to fulfil the request.

The controller must respond to a request concerning the data subject’s rights without undue delay and no later than one month after receiving the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.

If the data controller does not take action on the request of the data subject, the data controller must inform the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Requests from the data subject and any resulting actions are, as a rule, free of charge. However, where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.

The data subject shall have the right to obtain from the controller confirmation as to whether personal data concerning him or her is being processed as well as the right to access the data and to obtain a copy of the data. However, the provision of data shall not adversely affect the rights or freedoms of others.

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. In addition, taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed.

Under certain conditions, the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her. For example, if the processing of personal data is based on consent and the data subject withdraws his or her consent and there is no other legal ground for the processing, the data subject shall have the right to have his or her data erased. However, the data subject shall not have the right to erasure if the processing of data is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The data subject shall have the right to request the restriction of processing in certain situations. For example, if the accuracy of the personal data is contested by the data subject, processing is restricted for a period enabling the controller to verify the accuracy of the personal data. The right also applies if the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her, which is processed for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In such a situation, the controller may only continue processing the personal data if the controller demonstrates compelling legitimate grounds for the processing. Processing may also continue if it is necessary for the establishment, exercise or defence of legal claims.

The data subject shall have the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to him or her infringes data protection legislation. The data subject can lodge a complaint with the Office of the Data Protection Ombudsman: www.tietosuoja.fi(external link, opens in a new window).

Change history: 

11.06.2025 Last paragraph in point 9.