DATA PROTECTION STATEMENT
Articles 13 and 14 of the EU General Data Protection
Regulation Informing a data subject
Draw up on May 22, 2018

Data Protection Statement for Prospective Students

1 Controller

University of the Arts Helsinki
P.O. Box 1, FI-00097 UNIARTS
tel. +358 294 47 2000 (exchange)

2 Entity and person in charge of processing personal data

Sanna Kotajärvi-Söderholm, Senior Head of Academic Affairs, hakijapalvelut@uniarts.fi

3 Contact persons for handling personal data

Contact: hakijapalvelut@uniarts.fi tel. +358 294 47 2000 (exchange)
Hanna Hakala, Coordinator, Studyinfo
Lotte-Maria Maasalo, Coordinator, admissions into the Academy of Fine Arts
Lotta Palin, Coordinator, admissions into the Sibelius Academy
Hannele Ylönen, Student Advisor, admissions into the Theatre Academy
Ulla Tissari, Coordinator, international exchanges of the Academy of Fine Arts
Leena Veijonsuo, Expert, international exchanges of the Sibelius Academy
Jaakko Hannula, Coordinator, international exchanges of the Theatre Academy
Sanna Takala, Education Manager, adult and further education

4 Data protection officer

Data expert Antti Orava works as data protection officer at the University of the Arts Helsinki.
E-mail address: tietosuoja@uniarts.fi
Telephone: +358 294 47 3568
Postal address: P.O. Box 1, FI-00097 UNIARTS

5 Name of register

Studyinfo
The Studyinfo register acts as the national register of student admissions in degreeoriented education. Maintained by the Finnish National Agency for Education, the Studyinfo register is in charge of gathering the data in the student admission register, implementing application systems on a national level, and with providing general information, directions, and advice on applications and admissions. The universities and institutes of higher education (polytechnics) participate in register maintenance as required by the Act 884/2017 by maintaining their own respective sub-registers and by complementing the Studyinfo data with data required for their own admissions.
For those applying for a fixed-term study right, the University gathers personal data on the applicants based on types of study right. Data are available in several systems and databases:
- in the Joopas system regarding the Flexible Study Right (JOO) and the admission process.
- Data on international exchange students are available e.g. in the DreamApply EASY application programme and in the academies’ databases on students coming and going.
- Data on students applying for education in the Junior Academy of the Sibelius Academy are gathered in Surveypal.
- Adult education: data on those applying for the open university, for professional specializations, and for further education are available in the Lyyti system.

6 What are the purpose and the legal basis for processing personal data?

The purpose for processing personal data is to enable selecting students, granting study rights, and carrying out the official duties of the University.
The Studyinfo student admission register is under the responsibility of the Finnish National Agency for Education and is used:
1) for obtaining information on studies and student admissions;
2) for organizing and following up on application processes and admissions as well as for organizing the acceptance of degree places;
3) for providing universities, institutes of higher education, organizers of professional and college education, and providers of education complementing the basic education with information required for student selections, for developing admissions, and for organizing studies;
4) for informing non-admitted applicants about possibilities for education;
5) for producing information about the applicants and admitted students in order to perform follow-ups and evaluations of the education system, and
6) for other activities necessary in student admissions.
In practice, personal data are processed when selecting students for the studies leading to the lower and higher university degrees as referred to in the Universities Act e.g. in verifying eligibility, in arranging entrance examinations, in makingadmission decisions, in informing about studies and admission decisions, in establishing statistics, and in developing and researching admissions. The register of student admissions is also used to monitor the restrictions related to the reception of degree places and in admissions for doctoral education.
Processing personal data is based on the Act on national study and degree registers (884/2017) and on fulfilling the law-based obligations of the University.
Processing personal data is also based on the consent given by the applicant for the use of his or her personal data and contact information for the purposes of marketing the Open University of the University of the Arts Helsinki as well as beyond the University for the purposes of marketing study-related education. The personal data of those applying for a fixed-term right to study separate subjects are processed in order to grant a study right (decision and acceptance of a degree place).

7 What data do we process?

When applications are made for degree-based studies, we process the following data in connection with the student admission register maintained by the Finnish National Agency for Education:
1) the applicant’s name, national learner number, and social security number or other corresponding person-specific data, nationality, gender, and mother tongue as well as the necessary contact information;
2) information about the applicant’s previous education and degrees;
3) information about applying for an admission and bout grounds for admission on each applicant;
4) information about the result of admission, about accepting a degree place, and about enrolment in an educational institution; and
5) the applicant’s consent or refusal to the use of his or her name and contact information for purposes of education-related communication and marketing.
Health data liable to have an influence on the choice of a profession as stated by the applicant and data on work experience and extracurricular activities can also be recorded in the student admission register. Applicants are asked to provide these data and they are stored only when necessary as regards student admissions. Other data necessary for admission and relevant in assessing an applicants’ suitability for a given education or profession or in making admissions on the basis of needs in educational policy or in a specific education can also be added to the admission register.
The academies gather documents/attachments containing personal data as part of admissions. These include e.g. artistic samples in e-form and preliminary assignments such as a CV, an essay on motivation, certificates on previous studies and linguistic abilities, a medical certificate for special arrangements, eventual recommendations, and work certificates.
For the purpose of applying and granting reliefs for students subject to tuition fees, an applicant gives grounds for applying for a relief and a plan for financing his or her studies and states his or her annual income as well as that of his or her parents and of his or her eventual spouse, other scholarships granted for the studies and eventual loans related to financing the studies, eventual other student financial aid (e.g. aid or scholarship from the country of origin), and other factors contributing to the financial situation (e.g. children to support).

Further information
• The Studyinfo student admission register: https://opintopolku.fi/wp/tietosuojaseloste/ (in Finnish)
• The Oili enrolment service: https://oili.csc.fi/privacy/ (in Finnish and in English)

Applications for admissions to conduct separate studies
For those students taking part in student exchanges, the start and end dates of the exchange period, the home university, and the exchange programme are also entered in addition to the aforementioned basic information about the applicant’s admission.
For those minors seeking to enrol in junior education, the names and contact information of their caregivers as well as study data from the institution of primary and/or secondary education that the applicant went to are gathered in addition to the basic information on the applicant’s admission.
When admission is applied for professional specializations, data on the applicant’s professional title, employment/service relationship, employer and duties during the application phase, place of work, and his or her highest degree are gathered in addition to the basic information on the applicant’s admission.

8 Where do we get information?

We mainly get information from the applicant in person. As for applications for degree-based educations, the data pertaining to the applicant, to the study programme applied for, and to the education are obtained from the Studyinfo system.
Apart from the data given by the applicant and the confidentiality regulations notwithstanding, the Finnish National Agency for Education also has, as the controller of the student admission register, the right to obtain data from the Matriculation Examination Register, from the Population Register Centre, from employment and trade authorities, from organizers of basic and complementary education, from universities, from universities of applied sciences, from organizers of professional and college education, and from joint registers created by two or more universities for the purpose of student admissions.
For those applying for junior education, personal data are also obtained from caregivers. Assessment data regarding applicants are obtained from admission boards.

9 To whom do we disclose and transfer data, and do we transfer data outside the EU or the EEA?

The Finnish National Agency for Education may, confidentiality regulations notwithstanding, disclose information in the student admission register in so far as is necessary for the recipient to carry out its duties:
1) for universities, for universities of applied sciences, for organizers of professional and general upper secondary education, for organizers of complementary education, and for joint registers of two or more universities;
2) for respective ministries and for the Central Statistical Office of Finland for giving accounts of the follow-up on the educational system;
3) for the Social Insurance Institution of Finland for carrying out the tasks set out in the Act on Financial Aid for Students (65/1994), in the Act on school transport subsidy of general and vocational upper secondary education students (48/1997), and in the Act on Rehabilitation Benefits and Rehabilitation Allowance of the Social Insurance Institution of Finland (566/2005) as well as for the Social Insurance Institution of Finland and for the employment and trade authorities in order to establish the prerequisites for obtaining an unemployment benefit in accordance with the Unemployment Security Act (1290/2002);
4) for a municipality providing student health care in accordance with the Health Care Act (1326/2010) and for other providers of student health care in accordance with the aforementioned law for carrying out this task;
5) for a municipality organizing outreach youth work in accordance with the Youth Act (1285/2016) for carrying out the task stated in the aforementioned law;
6) for the controller of the Register of Aliens provided in Section 3 of the Act on the Register of Aliens (1270/1997) for carrying out the tasks set for it in the Aliens Act (301/2004) or in the Nationality Act (359/2003).
The University will itself disclose personal data to the following parties:
• the data of those who have given their consent thereto for marketing the Open University of the University of the Arts Helsinki, for unions, and for other marketing
• For student tutoring (contact data of admitted students are disclosed to the tutor coordinator hired by the University of the Arts Student Union)
• We disclose personal data on students subject to a tuition fee to the financial services of the University for drawing up tuition fee invoices.
• In case enrolment involves payments, the applicant’s address details are forwarded to the Paytrail service for invoice settlement • Enrolment data are disclosed to the Studyinfo student admission register
• Information on exchange students is disclosed to the Finnish National Agency for Education via the VIRTA higher education achievement register.
• Data on exchange students subject to a tuition fee and on international exchange students who have given their consent thereto (name, contact details, gender, date of birth and duration of the right to study) are disclosed to the Foundation for Student Housing in the Helsinki Region.
• We do not transfer personal data beyond the EU or outside the EEA.

10 How do we protect data and how long will we keep them?

Only those of our employees who are authorized to process student information in their line of work are entitled to use the system containing personal data. Each user has a personal user ID and a password into the system. The data are gathered in databases protected with firewalls, passwords, and other technical means. The databases and their backup copies are situated in locked spaces, and the data can only be accessed by certain pre-named persons.
We keep personal data for as long as is necessary for the purpose for which they are used. The data management plan of the University is followed in data storage.
We regularly evaluate the need to preserve data in keeping with the applicable legislation. In addition, we will take such reasonable steps as are necessary to ensure that no personal information on data subjects that is incompatible with the purposes of data processing, outdated, or erroneous is kept in the register. We will rectify or erase such information without delay.
Information is kept in the student admission register maintained by the Finnish National Agency for Education for a period of five years as of the making of an admission decision. However, the data in the application register of higher education institutions are kept on a permanent basis (Act 884/2017 §).
However, data deemed necessary for the assessment and follow-up of education or valuable as research source material for other reasons are kept on a permanent basis as provided separately by the archive institution. The national learner number and the person-specific ID data based on which the learner number has been issued are also kept on a permanent basis.

11 What are your rights as a data subject?

​​​​​​Data subjects are entitled to check the data concerning them and stored in the personal data register and require erroneous, outdated, unnecessary, or unlawful data to be rectified or erased. In case a data subject has personal access to his or her data, they can modify their data himself or herself. In case processing is based on a consent, a data subject also has the right to withdraw his or her consent or to alter it.
As of May 25, 2018, data subjects have, according to the Data Protection Regulation, the right to object to processing or to request restriction of processing of data as well as to lodge a complaint with a supervisory authority on processing personal data. For specific reasons of personal nature, data subjects also have the right to object to processing activities concerning them when processing data is based on our legitimate interest. In conjunction with the request, the data subject shall specify the particular situation on the basis of which he or she objects to processing. We mayrefuse to execute an objection-related request only on the basis of grounds stated in law.
Should the data subject not be satisfied with the way the University has processed his or her personal data, he or she may demand the national data protection authority (in Finland, the Data Protection Ombudsman whose contact information is available in the web address http://www.tietosuoja.fi) to look into the matter.

12 With whom can you get in touch?

The student admission register is maintained by the Finnish National Agency for Education. Each data subject has the right to inspect the data recorded on him or her in the register (see Section 26 of the Personal Data Act). A data subject also has the right to acquaint himself or herself with and to see the information concerning him or her and, by request, to obtain the information concerning him or her in writing.
A verification request shall be delivered in writing by letter or by e-mail to the Finnish National Agency for Education. Requests sent by mail shall be delivered to the address Finnish National Agency for Education, Hakaniemenranta 6, P.O. Box 380, 00531 Helsinki. The form for requesting verification of the data in the register (in Finnish) (PDF). Verification requests regarding the Studyinfo student admission register shall be sent to the e-mail address kirjaamo@oph.fi. Use of the right of verification is free of charge once a year.
You may present your other questions on the processing of personal data as described in this statement by getting in touch with the contact person named in Point 3 who will, in case of need, forward the matter to the data protection officer. In case you feel that your rights as mentioned in Point 11 are not respected, you may get directly in touch with the University Data Protection Officer named in Point 4.