Processing of personal data, media bank

Date of publication of the Privacy Statement: 8/3/2021

1. Data controller

City of Espoo

P.O. Box 1, 02070 CITY OF ESPOO

tel. +358 9 81621

2. Person responsible for the data file

City of Espoo Communications Director

3. Data file contact person

Minna Konttinen, Graphic Designer, Corporate Group Administration, Communications

minna.k.konttinen@espoo.fi, tel. +358 46 8773676

4. Data protection officer

City of Espoo Data Protection Officer

Address: P.O. Box 12, 02070 City of Espoo

Tel. +358 9 81621 (exchange)

E-mail: tietosuoja@espoo.fi

5. For what purpose is personal data processed?

Information from the media bank users is only collected for the management of user identifiers.

The names and contact information in connection with the images and videos are used in order to communicate with the person appearing in the image or video, if necessary.

The data subject has given consent to the processing of their personal data for one or more specific purposes. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

We use the photos of persons in the media bank for journalistic purposes to communicate the services and activities of the City of Espoo (e.g. the city’s electronic communications channels, city magazines, brochures and other communications materials on the city’s services). The images are generally reserved for the use of the City of Espoo’s communications only. We do not sell, rent, transfer, or disclose photos of an identifiable person to third parties unless the person in the photo has consented to this. We follow good practices in the processing of photos of identified persons and ensure that they are not used improperly. We pay special attention to the personal protection of children and young people as well as social and health care clients.

6. On what grounds is personal data processed?

• Article 6(1)(a) of the EU General Data Protection Regulation: The data subject has given consent to the processing of their personal data for one or more specific purposes.
• The EU General Data Protection Regulation, Article 6(1c): processing is necessary for compliance with a legal obligation to which the controller is subject.
• The EU General Data Protection Regulation, Article 6(1e): processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. What data is processed?

The media bank contains the following information about the users of the system: name, work unit or organisation name, e-mail address, ID creation date and last login date.

For persons identifiable in the photos or videos in the media bank, the persons’ names and other possible identification information, such as titles, are collected in the image file information.

PUBLIC ACCESS TO INFORMATION AND CONFIDENTIALITY:

Does not contain confidential information.

8. What are the sources of data?

Users provide the requested information (name, e-mail address, work unit/organisation) when they register for the service.

Information related to the data contained in the media bank is collected at the time of the shooting with an oral or written consent. For persons identifiable in the photos and videos, the names and other possible identification information, such as titles, are collected. The information is collected so that we can, if necessary, contact the person in the photo and ask for their consent if the photo is to be used for a different purpose than that originally agreed.

Media bank users import files to the media bank and, at the same time, manually enter personal data related to photos or videos.

9. Is data disclosed or transferred outside the city?

The data will not be disclosed outside the data file.

10. Is data transferred outside the EU/EEA?

The data will not be transferred. The data is stored on Grano’s server in Finland.

11. How long will data be stored?

Twice a year, user identifiers that have been unused for more than a year are removed from the system.

The data of persons in photos will be removed from the view of users when the photo is archived from the media bank. However, the file will still be visible to two employees with admin privileges in the system.

12. How is data protected?

The system administrator (2 persons) exports the data of the media bank users from the system as an Excel file twice a year in order to delete old user identifiers. The person deleting the identifiers keeps the file in their personal OneDrive folder for the duration of the deletion. After this, the file is deleted.

The media bank’s EMMI system is provided to the City of Espoo by Grano Oy. The system operates on Grano’s servers in Finland. The server connection is protected by a firewall, and the users’ passwords are encrypted on the database server with restricted access on Grano’s intranet.

13. The data subject’s rights

More detailed instructions on how to submit data requests in accordance with the GDPR: https://www.espoo.fi/fi/espoon-kaupunki/tietosuoja#section-7317

We follow good practices in the processing of photos of identified persons and ensure that they are not used improperly. We pay special attention to the personal protection of children and young people as well as social and health care clients.

The photos and videos of persons in the media bank will be used for journalistic purposes to communicate the services and activities of the City of Espoo (e.g. the city’s electronic communications channels, city magazines, brochures and other communications materials on the city’s services). Therefore, persons appearing in the photos or videos cannot check where their photos have been used.

The photos and videos of persons in the media bank will be used for journalistic purposes to communicate the services and activities of the City of Espoo (e.g. the city’s electronic communications channels, city magazines, brochures and other communications materials on the city’s services). Therefore, persons appearing in the photos or videos cannot request rectification of their data.

The photos and videos of persons in the media bank will be used for journalistic purposes to communicate the services and activities of the City of Espoo (e.g. the city’s electronic communications channels, city magazines, brochures and other communications materials on the city’s services). Therefore, persons appearing in the photos or videos cannot request the deletion of files where they can be identified.

If the data collected about you is inaccurate, you may require that the processing of your customer data be restricted until the accuracy of the data has been verified.

The photos and videos of persons in the media bank will be used for journalistic purposes to communicate the services and activities of the City of Espoo (e.g. the city’s electronic communications channels, city magazines, brochures and other communications materials on the city’s services). Therefore, persons appearing in the photos or videos cannot lodge a complaint.