Processing of personal data, City of Espoo’s Nature Information System

Date of publication: 03 April 2025

City of Espoo

Director of the Environment and Building Control Department

Marika Rönnberg, Environmental Specialist

Urban Environment Sector / Environment and Building Control Department

Tel. +358 43 8252829

Email: marika.ronnberg@espoo.fi

Address: City of Espoo / Environment and Building Control Department / Environmental Protection

P.O. Box 44, 02070 CITY OF ESPOO

Data Protection Officer of the City of Espoo

Address: P.O. Box 12, 02070 City of Espoo

Tel. +358 9 81621 (switchboard)

Email: tietosuoja@espoo.fi

The personal data stored in the register is processed for the purpose of verifying the data of nature surveys, if necessary, from the party who commissioned the survey and the party who conducted the survey.

• Article 6(1)(a) of the General Data Protection Regulation of the European Union: the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
• Article 6(1)(e) of the General Data Protection Regulation of the European Union: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Users of the Nature Information System are asked to provide their name, email, phone number, and the name of their company or their sector in the city organisation.

Public access to and confidentialy of data: The data is not confidential according to law.

Grounds for confidentialy: Based on the Act on the Openness of Government Activities, in the case of confidential data.

The contact details are filled in for both city employees and consultants conducting nature surveys on a survey-by-survey basis. City employees have an employment contract with the city, while consultants conducting nature surveys conclude a commission agreement with the city.

Data is not transferred outside the city, except through publicly available nature survey reports. The disclosure of information is carried out in compliance with the agreement made during the acquisition of the material.

The geographical AWS location of Espoo’s Nature Information System is Europe, i.e. the data stored in the AWS environment is located in Ireland (Dublin) and Sweden. Amazon is a U.S.-based company and subject to U.S. law, but the data is stored in Europe, and we estimate that data is only transferred in extremely exceptional circumstances. All the services used are physically located in the EEA. However, it is possible that a subcontractor has a statutory obligation, due to the laws of their home country, to provide certain personal data to authorities in third countries. Such transfers would take place without prior agreement and without the knowledge of the data controller.

The data on the party commissioning and the party conducting the nature survey are stored among the nature survey data indefinitely.

Browsing and modification rights are restricted to authorised users of the application who require access to the data for official duties.

Further instructions on submitting information requests referred to in the General Data Protection Regulation: Clients’ right of access to personal data 

You have the right to obtain from the data controller a copy of the personal data that is subject to processing. The data controller must provide the data without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.

If the data controller does not take action on the request of the data subject, the data controller must inform the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Requests from the data subject and any resulting actions are free of charge. However, where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the data controller may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.

You have the right to have inaccurate, incomplete, outdated or unnecessary personal data that we store either rectified or completed by us.

You have the right to have the data controller erase your personal data without undue delay under certain conditions. The data subject does not have the right to erasure if the processing of data is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In these cases, the data will only be erased after the statutory time limit.

If the data concerning you is inaccurate, you have the right to request that its processing be restricted until its accuracy has been verified.

You have the right to lodge a complaint with a supervisory authority if you feel that the processing of your personal data is in infringement of data protection legislation. You can lodge a complaint with the Office of the Data Protection Ombudsman: www.tietosuoja.fi.(external link, opens in a new window)