Privacy notice: Processing of personal data, Youth Council election and Youth Council members

Date of publication: 2 January 2024 (Updated: 15 September 2025)

City of Espoo

Tero Luukkonen, Manager of Youth Services

Email: firstname.lastname@espoo.fi

Tel. 09 816 21 (switchboard)

Tiia Ylä-Peräinen, Youth Work Coordinator

Email: firstname.lastname@espoo.fi

Tel. +358 9 81621 (switchboard)

Helena Niemi, Data Protection Officer of the City of Espoo

Address: P.O. Box 12, 02070 City of Espoo

Tel. +358 9 81621 (switchboard)

Email: tietosuoja@espoo.fi

Personal data is processed for the purpose of organising the City of Espoo’s Youth Council election, establishing the Youth Council and enabling the activities of the Youth Council.

Processing is necessary for compliance with a legal obligation to which the data controller is subject and for the performance of a task carried out in the public interest and in the exercise of official authority.

Provisions on the opportunities to be provided for young people to participate and exert an influence in youth councils are laid down in section 26 of the Local Government Act (410/2015). Furthermore, provisions on young people’s right to participate and to be heard in matters that affect them are laid down in sections 8 and 24 of the Youth Act (1285/2016).

The candidate and/or their guardian is requested to give consent for the candidate to be photographed, stand as a candidate and participate in the activities of the Youth Council.

For special categories of personal data, such as political opinions expressed in election compass responses, the processing concerns personal data that the candidate has specifically made public.

The personal data of Youth Council candidates, candidates’ guardians, elected members, persons entitled to vote, election compass users, and election officials is processed in connection with the activities. 

- Name, date of birth, address, telephone number, email, educational institution, district of residence, and consent to stand as a candidate.

- The following candidate information is processed in the online voting service: name, candidate number and district of residence.

- The following candidate information is processed in the election compass: name, candidate number, postal code, email address, year of birth, response language / mother tongue, and other information voluntarily provided by the candidate, such as election compass responses and explanations, and other information describing the candidate, such as a photo, hobbies, reasons for standing as a candidate and campaign promise. The election compass is a public website open to all.

- Information on the number of candidates.

- Name, email address and telephone number.

- The guardian signs the forms of a candidate under 18 years of age.

- Information required for the identification of the pupil and the verification of their right to vote, which may include their name, municipality of residence and age / year of birth.

- Information on whether the person has voted or not.

- Information on election compass users, such as election compass responses, results or candidate recommendations, is only stored for the time the person uses the election compass. The election compass does not include technical monitoring of users. Due to the technical implementation of the election compass, the IP address of the election compass user is processed for a limited period of time.

- Information on the number of election compass users.

- Name, school and email address.

The personal data of Youth Council members necessary for the organisation of the activities of the Youth Council is processed during the council term. This personal data includes the name, date of birth, email address and telephone number of the Youth Council member. For the payment of Youth Council members’ attendance fees, the personal identity code, home address and bank account number of the Youth Council member are also processed. The basic information form must be signed in person.

The guardian of a Youth Council member under 18 years of age is requested to give their name, email address and telephone number.

If necessary, Youth Council members and their guardians are requested to provide other information, such as permission to participate in the induction weekend. In addition, the Youth Council member or their guardian may provide any other information that they think the youth work coordinators organising the events should know. This information is processed as required by law.

Data on the candidates is obtained from the candidates themselves. The candidate’s age and municipality of residence are checked in the Population Information System.

The name, email address and telephone number of the candidate’s guardian are provided by the candidate. The consent of the guardian is requested for a young person under 18 to stand as a candidate, participate in Youth Council activities and be photographed.

The data to be verified concerning persons entitled to vote and the nomination of candidates is obtained from the Digital and Population Data Services Agency.

The responses and IP addresses of election compass users are obtained when they use the election compass. The data is only processed for the time the person uses the election compass. After using the election compass, the user’s responses, results or candidate recommendations cannot be linked to the user, not even through technical identifiers.

Data on the Youth Council members and their guardians is obtained from the members themselves.

Data on election officials is obtained from educational institutions and Youth Services. They are employees of the city.

In the Microsoft M365 service, the user identity of election officials is administered by Microsoft Azure AD, which is the city’s centralised user authorisation management and log register, Microsoft AD and Azure AD: Privacy notice 

Data and documents are disclosed to the person requesting them in accordance with the Act on the Openness of Government Activities. Information and documents are public unless specifically defined as confidential under law.

An online voting service is used in the election. Service Points use ballot papers. The candidate’s name, candidate number and district of residence are published in the online voting service.

The candidate’s name, candidate number and photo are published in the election compass if the candidate so wishes and the candidate/guardian gives their consent. The election compass is a public website open to all. After a candidate has been nominated, they can, if they so wish, submit their answers to the election compass questions.

The names of the Youth Council members and the number of votes they received in the election during said council term are published on the website of the City of Espoo’s Youth Council.

In the organisation of the Youth Council election and the activities of the Youth Council, the city uses service providers as personal data processors, who only process data within pre-established limits and for the purposes described in this privacy notice. Appropriate agreements are concluded in which the processors undertake to process personal data in a secure and confidential manner.

The processors of personal data can be divided into the following categories:

Suppliers of IT systems and server environments

To enable the storage and technical processing of personal data, the city uses technical service providers, such as Microsoft and Fujitsu. The technical service provider of the eVaali online voting and the verification of voting rights service is Arts & Minds Oy. The technical service provider of the election compass is Webscale Oy.

Translation agency

The candidates’ election compass responses are translated with the help of a translation agency. The primary contracted supplier for English and Swedish is Lingsoft Language Services.

Cooperation between cities

Information processed in the election compass is shared between the cities of Espoo, Helsinki and Vantaa.

Personal data is mainly processed in systems and data warehouses located within the European Union. Some of the processors of personal data or the services they provide are located outside the European Economic Area (EEA), and in these cases personal data is also transferred outside the area. The data in the systems is transferred outside the EEA, for example, in situations where the IT system or cloud service used for the processing of personal data is located on a server outside the EEA, such as a server of a service provider based in the US.

In situations where personal data is transferred outside the EEA, safeguards are established to maintain the high level of data protection required by European legislation even after the personal data has been transferred. These safeguards include an adequacy decision by the European Commission and a commitment to the required safeguards, such as the EU-US Data Privacy Framework, by the recipient of personal data. Required safeguards may also include the use of standard contractual clauses adopted by the European Commission as part of agreements concluded with personal data processors, in addition to which the processors are required to observe appropriate technical and administrative safeguards.

Data is stored and destroyed in line with the City of Espoo’s records management plan and the applicable provisions and regulations issued by the National Archives of Finland.

As a rule, the personal data of the candidates is stored for the duration of the Youth Council term, i.e. approximately two years. Exceptions to this include the decision of the City Board on the list of candidates for the Youth Council, which includes the name, district of residence and candidate number of the candidate, as well as any other minutes, meeting memorandums, reports, brochures and posters related to the organisation of the election. Other election marketing materials, brochures, etc. to be archived vary annually.

The written consent forms signed by guardians are stored for 2 years from the confirmation of the election results.

The candidate’s name, photograph and responses entered in the election compass are stored until the election results are confirmed and for a maximum of 2 months after the election. The election compass user’s responses, results or candidate recommendations are only stored for the time the person uses the election compass. The election compass does not include technical monitoring of users.

The data on persons entitled to vote is stored until the City Board has confirmed the election results. 

The personal data of the school’s election officials is stored for the duration of the Youth Council election but no longer than 6 months.

The personal data of members of the Youth Council is stored for a period of 2 years, unless a longer storage period is specified for a document containing personal data. For example, the City Board’s decision on the appointment of the Youth Council and the minutes of the general assemblies of the Youth Council containing the names of the members are stored for longer than 2 years.

Data protection legislation guarantees various rights for the data subject in relation to the processing of personal data. Requests concerning the data subject’s rights can be submitted to the city’s Data Protection Officer or the contact person of the register using the above-mentioned contact details.

If necessary, the controller may ask the data subject to provide additional information to fulfil the request.

The controller must respond to a request concerning the data subject’s rights without undue delay and no later than one month after receiving the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.

If the data controller does not take action on the request of the data subject, the data controller must inform the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Requests from the data subject and any resulting actions are, as a rule, free of charge. However, where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.

The data subject shall have the right to obtain from the controller confirmation as to whether personal data concerning him or her is being processed as well as the right to access the data and to obtain a copy of the data. However, the provision of data shall not adversely affect the rights or freedoms of others.

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. In addition, taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed.

Under certain conditions, the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her. For example, if the processing of personal data is based on consent and the data subject withdraws his or her consent and there is no other legal ground for the processing, the data subject shall have the right to have his or her data erased. However, the data subject shall not have the right to erasure if the processing of data is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The data subject shall have the right to request the restriction of processing in certain situations. For example, if the accuracy of the personal data is contested by the data subject, processing is restricted for a period enabling the controller to verify the accuracy of the personal data. The right also applies if the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her, which is processed for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In such a situation, the controller may only continue processing the personal data if the controller demonstrates compelling legitimate grounds for the processing. Processing may also continue if it is necessary for the establishment, exercise or defence of legal claims.

The data subject shall have the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to him or her infringes data protection legislation. The data subject can lodge a complaint with the Office of the Data Protection Ombudsman: www.tietosuoja.fi(external link, opens in a new window)

Change history: 

15.9.2025 Updated information about the voting service provider and the city's translation office.