Privacy

Published 28 November 2022

Ministry of Education and Culture’s Privacy Notice to Data Subjects

Personal data to be processed in the Research Information Hub

General

This privacy notice contains the information for the data subject (natural person) that is required under Articles 13 and 14 of the EU’s General Data Protection Regulation (EU) 679/2016.

Controller and controller’s contact details

Ministry of Education and Culture
Visiting address of the Registry: Ritarikatu 2 b, Helsinki, Finland
Postal address: P.O. Box 29, FI-00023 GOVERNMENT, FINLAND
E-mail address: kirjaamo.okm@gov.fi  
Tel. +358 295 16001 (exchange)

Data protection officer’s contact details

Data Protection Officer of the Ministry of Education and Culture
E-mail address: okmtietosuojavastaava@gov.fi
Postal address: Ministry of Education and Culture, P.O. Box 29,
FI-00023 GOVERNMENT, FINLAND

Purposes for the processing of personal data

The purposes of personal data are:

• Publishing information in the Research Information Hub.
• Editing and combining the information contained in the Research Information Hub to improve its quality and usability.
• Transmitting information contained in the Research Information Hub to research actors.
• Researcher information, information about research activities and merits are published only after researcher’s consent.
• Management of login details of users of the service's websites www.tiedejatutkimus.fi, www.forskning.fi, and www.research.fi, user statistics, and management of cookies needed to use the service.
• Keeping statistics, performing analytics and management related to the use and development of the service.

Basis for the processing of personal data

The processing of personal data is based on the legal obligation to which the controller is subject (Article 6 (1) (c) of the EU General Data Protection Regulation). The related laws and regulations are among others:

• Government Rules of Procedure (262/2003) 11 § and 18 §
• Government Decree on the Ministry of Education and Culture (310/2010) 1 §
• The Research Information Hub Act (1238/2021)
• Universities Act (558/2009)
• Universities of Applied Sciences Act (932/2014).

Categories of data subjects and personal data to be processed

• Information on publications, research data, funding decisions, research infrastructures and scientific news submitted to the Research Information Hub as well as the researcher's first and last name, ORCID identifier and organization mentioned therein.
• IT management details, such as equipment details related to services provided, including technical identifiers, usernames, location, contact details, communication details and metadata, and technical events related to services provided, including system and application log data.

Sources of the personal data

The data to the Research Information Hub is disclosed from numerous systems. The catalogue of organisations disclosing data to the Research Information Hub is maintained at: https://wiki.eduuni.fi/x/JROpC. In addition, the Ministry of Education and Culture transfers data from external sources to the Research Information Hub (for example: The CORDIS database maintained by the EU). The source of personal data is specified on the websites of the Research Information Hub for each data item.

Each organisation storing data in the Research Information Hub is responsible for the accuracy of the data it submits.

Processors

The processors of personal data are CSC - IT Center for Science Ltd and its subcontractors, who implement the development, maintenance and storage of the service on the basis of an agreement made with the Ministry of Education and Culture.
In addition, metadata

• and abstracts on publications and other research outputs,
• on research data,
• on research infrastructures,
• on research actors,
• on funding decisions and research projects,

may be disclosed in accordance with current legislation to the research actors. Researcher information, information about research activities and merits are disclosed to third parties only after researcher’s consent.

Transferring personal data outside the EU or the EEA or to international organizations

The metadata mentioned in paragraph Processors may be disclosed to international organizations or actors in the field, both within and outside the EU/EEA, in accordance with current legislation. Other personal data is not disclosed outside the EU or the EEA.

Personal data retention periods

Personal data related to the data in the Research Information Hub will be stored for the time being in accordance with section 21 (1, 2) of the Information Management Act, unless otherwise stipulated in legislation on archiving or other statutes.
The data retention period for publications, research data and other data that involve authors is based on subsections 1 and 2. Subsection 1 deals with other information. Information based on consent is retained for as long as the consent remains valid.

Data subject rights

Right of inspection

Data subjects have the right to inspect personal data concerning themselves in the Research Information Hub. In addition to requesting data protection, they may inspect the Research Information Hub's website www.tiedejatutkimus.fi, www.forskning.fi, and www.research.fi.

Right to rectification

Data subjects have the right to request rectification of their personal data stored in the Research Information Hub.

Right to restriction of processing

In certain situations, data subjects have the right to demand that the processing of personal data be restricted in the Research Information Hub. For example, in cases where they are needed for a legal claim.

Right of appeal

Data subjects have the right to file a complaint with the Data Protection Ombudsman if they believe that the processing of their personal data is not lawful. You can contact the Data Protection Ombudsman at: https://tietosuoja.fi/en/contact-information.
Data subjects have the right to be informed by the controller of whether or not their personal data are processed.

Automatic decision making and profiling

The personal data will not be used for automated decision-making or profiling that would have an effect on the data subjects’ rights or freedoms.

Protection of personal data

In its capacity as the controller, the Ministry of Education and Culture has taken the necessary technical and organizational measures to ensure that the data are secure and requires this of the processors of personal data, too.