Data protection

The National Archives processes personal data for several different purposes. The processing of personal data is necessary for the performance of the statutory tasks of the National Archives and for the performance of tasks related to public interest. The processing of personal data is also necessary when you use the archive or library services of the National Archives or when you have given your consent to the processing of your personal data in the voluntary services of the National Archives. Personal data is also processed, for example, for recruitment, personnel and financial matters.
The National Archives is always responsible for ensuring that there is a legal basis for the processing of personal data.

The National Archives may act as a data controller, joint controller or a processor of personal data for specific materials. For example, with regard to personal data contained in documents archived in the National Archives, the National Archives is the controller. In this case, the National Archives determines the purposes and means of the processing of personal data and is responsible for the lawfulness of the data processing.

We may be data processors when we process personal data on behalf of and under the instructions of another controller.

As joint controllers, we work, for example, with another authority or contractual partner. In this case, we jointly determine the purposes and means of the processing of personal data and share the controller’s responsibilities. Each controller will provide you with information about the processing of personal data by them.

The National Archives is always responsible for ensuring that data protection legislation is fully complied with. 

The National Archives has the following obligations, among others:

• Assessing the risks and impacts of processing personal data to the data subjects
• Demonstrating that it complies with the data protection laws
• Informing the data subject about the processing of personal data
• Appointing a data protection officer
• Communicating any personal data breaches.

No.

National Archives of Finland
P.O. Box 258, 00171 Helsinki, Finland

[email protected]

tel. 029 533 7000

Erika Lauri

P.O. Box 258
00171 Helsinki, Finland

[email protected]

tel. 029 533 7000

The statutory tasks of the National Archives include ensuring the archiving of public authorities' documents and data collections, promoting the research and other use of such data collections and promoting the archiving and use of significant private document collections. The documents contain personal data.

The National Archives is the controller of the personal data contained in the documents archived in the National Archives.

The basis for processing personal data contained in documents archived in the National Archives is, in principle, Section 4 (4) of the Data Protection Act, in which case it is a processing for the performance of a task carried out in the public interest pursuant to Article 6 (1) (e) of the General Data Protection Regulation.

Providing sources for research is among the main reasons for archiving. High-quality research often requires information about individuals, including sensitive information, such as personal data belonging to special categories of personal data. For example, the main objective of historical and social research is to determine the causes and mechanisms of various social phenomena of the past and present, as well as the long-term events and developments related to them. Personal data collected and preserved over a long period of time is characteristic of Finland's documentary cultural heritage.

Personal data is important for how a nation and its citizens see themselves, as it plays a major role in how society is perceived and how research can be used to assess past phenomena and events. The archiving of personal data enables, for example, the examination of research questions at the personal level, the multifaceted investigation of social phenomena and the interaction between society and the citizen, especially in a manner typical of the humanities.

Documents archived in the National Archives contain all kinds of personal data, such as direct and indirect personal data and data belonging to special categories of personal data. As a rule, the datasets contain information related to all types of personal data groups, such as name and contact information (also covered by non-disclosure for personal safety reasons), pension information, tax information, social sector information and conviction information.

The documents archived in the National Archives contain information on hundreds of thousands of people who have interacted with Finnish authorities. The datasets also contain personal data of customers, officials and actors of various public administration services, for example, trainees, employees, taxpayers, property owners, social and health care customers, suspects and convicts of crimes, and prisoners.

Temporally, data within the scope of data protection legislation ranges from the beginning of the 20th century to the present day. The amount of personal data processed is constantly increasing as data is received or digitised by the National Archives. 

Personal data is obtained from the authorities that have created the documents as part of their tasks, or from private archive creators.

Personal data contained in documents archived in the National Archives is stored permanently.

Personal data may be disclosed, for example, for scientific research in the manner provided for in the Act on the Openness of Government Activities (621/1999). Personal data may be published in the Astia service of the National Archives pursuant to the assessment of necessity and proportionality carried out in accordance with Section 4 (4) of the Data Protection Act.

The processing of personal data takes place in Finland, the EU/EEA or in third countries whose level of data protection has been deemed adequate, for example on the basis of an EU adequacy decision or another transfer basis in accordance with Chapter V of the EU’s General Data Protection Regulation. In addition, a level of data protection that meets EU requirements is ensured in data transfers.

The statutory tasks of the National Archives include receiving library material transferred from scientific and public libraries, storing it and making it available to those that require it (National Repository Library services). 

Personal data is processed for the monitoring of loans, material recovery, statistics and communication between the customer and the library.

When personal data is processed by the National Archives for the purpose of providing Repository Library services, the basis for processing personal data is, in principle, Section 4 (2) of the Data Protection Act, in which case it constitutes processing based on Article 6 (1) (e) of the General Data Protection Regulation for the performance of a task carried out in the public interest. 

The processing of personal data may also be based on an agreement between the National Archives and a private customer, in which case the processing is based on Article 6 (1) (b) of the General Data Protection Regulation.

Private customers: 

The information stored in the customer library is transferred to the National Repository Library: Name, address, personal identity code, email, phone number, borrower card number

Personal data is obtained from the data subject.  

The personal data processed does not include special categories of personal data. 

Libraries and other organisational customers:

Name, borrower card number, customer group, address, phone number, email address, when the customer was added to the register, when the data was modified, statistical group and Business ID (for invoicing)

Data is stored in the register for the duration of the customer relationship until the customer terminates the customer relationship. The customer can delete their data from the customer register when all loaned materials have been returned and any payments have been made.

The National Archives transfers the personal data that is required for invoicing to the Government Shared Services Centre for Finance and HR.  

Personal data may be disclosed in accordance with the Act on the Openness of Government Activities (621/1999). 

The processing of personal data takes place in Finland, the EU/EEA or in third countries whose level of data protection has been deemed adequate, for example on the basis of an EU adequacy decision or another transfer basis in accordance with Chapter V of the EU’s General Data Protection Regulation. In addition, a level of data protection that meets EU requirements is ensured in data transfers.

The National Archives prepares, distributes and loans accessible library material and educational material for the use of visually impaired persons and other print-disabled persons referred to in section 17a (1) of the Copyright Act (404/1961), advises on the use of materials and services, maintains and develops the library collection and other contents for print-disabled persons, and acts as an expert in library services and accessible publishing for visually impaired persons and other print-disabled persons (Accessibility Library Celia's services).

When personal data is processed by the National Archives for the purpose of providing Accessibility Library Celia’s services, the basis for processing personal data is, in principle, Section 4 (2) of the Data Protection Act, in which case it constitutes processing based on Article 6 (1) (e) of the General Data Protection Regulation for the performance of a task carried out in the public interest. 

The basis for processing special categories of personal data is Article 6 (1) (c) of the General Data Protection Regulation and Section 9 (1) (2) of the Data Protection Act.

The processing of personal data may also be based on an agreement between the National Archives and the customer, in which case the processing is based on Article 6 (1) (b) of the General Data Protection Regulation.

Customer information: first name, last name, information on the reason for the print disability, postal address, postal code, city, email address, telephone number, personal identity code, customer ID, customer group, customer relationship start time, language, username, password, loan information, terminal information, online transaction information, system logs, call information.

Customer contact details: name, phone number, email address and role.
The personal data processed includes personal data belonging to special categories of personal data. Information on the Accessibility Library Celia's private customer relationship belongs to special categories of personal data. 

Organisational customers and service partners: Name and email of the contact person, phone number. Schools registering for services will also be asked for a list of registering teachers with names and emails.

Personal data is obtained when the customer registers for the services of the Accessibility Library Celia or its service partner.

Personal data that is part of the Accessibility Library Celia's customer records is stored until the customer terminates the customer relationship. If the customer has not borrowed the Accessibility Library Celia's materials for two years, the customer relationship is considered terminated and the personal data will be deleted. In the case of a downloadable book loan, personal data is stored after the customer relationship until 5 years have passed since the last loan book was downloaded.

The National Archives transfers the personal data that is required for invoicing to the Government Shared Services Centre for Finance and HR.

Personal data may be disclosed in accordance with the Act on the Openness of Government Activities (621/1999).

The processing of personal data takes place in Finland, the EU/EEA or in third countries whose level of data protection has been deemed adequate, for example on the basis of an EU adequacy decision or another transfer basis in accordance with Chapter V of the EU’s General Data Protection Regulation. In addition, a level of data protection that meets EU requirements is ensured in data transfers.

We process your personal data in connection with the following purposes:

• implementation of archive and library services,
• invoicing of any services subject to a fee,
• processing of access permit applications,
• authentication of customer transactions,
• realisation of your rights and the obligations of the National Archives,
• development and analysis of the services of the National Archives,
• prevention and investigation of any misconduct.

In the case of the core functions of the National Archives and camera surveillance, the processing is based on Section 4 (2) of the Data Protection Act, in which case it constitutes processing for the performance of a task carried out in the public interest pursuant to Article 6 (1) (e) of the General Data Protection Regulation.

However, the processing of personal data in some voluntary services such as the Webropol tool and feedback channels may also be based on an agreement, in which case it constitutes processing based on Article 6 (1) (b) of the General Data Protection Regulation.

The personal data we process and its volume depend on the services and channels of the National Archives that you use.

As a rule, the personal data we process do not include personal data belonging to special categories of personal data, unless the data subject themselves discloses such data.

The Astia service of the National Archives

Basic customer information: The customer's first and last name, address, telephone number, e-mail address, language identifier and the home archive, which is the National Archives location selected by the customer as their place of access. The customers are responsible for ensuring that their contact information in the service is correct.

Information created on the basis of customer accounts: User ID, the date of accepting the terms of use, and information of the customer’s access permit applications, valid access permits, and any submitted requests for information or orders to access documents in the reading room or as inter-library loans.

TWeb case and document management system

Personal data related to issues initiated at the National Archives, including name, personal identity code or date of birth, the authority/company/organisation that the person represents, language identifier, telephone number, invoicing address, e-mail address, and any other identification information required for processing the matter, such as reference code, as well as information concerning the processing and the decision.

Electronic archiving service platform (SAPA)

Basic customer information for central government actors (Virtu authentication): first and last name, organisation and email address.

Basic customer information for other customers (suomi.fi authentication): first and last name, personal identity code, organisation and email address.

Information generated on the basis of the customer relationship: information on the customer's transfers and the date of acceptance of the terms of use. The service is always authenticated using either Virtu or suomi.fi authentication.

Recording camera surveillance in the facilities of National Archives

Digital visual material of people who have accessed the facilities where surveillance is used.

Other services

Karelia database 
Customer service channels
Newsletter system

Several documents created in the National Archives' official activities and the personal data contained in them are stored permanently. For some documents, the storage period is regulated by law. Documents that have not been ordered to be archived are disposed of in a secure manner after the storage period.

Access right applications and the personal data they contain are stored for 10 years.

Access right decisions and the personal data they contain are stored for 20 years.

Requests for information and the personal data they contain are stored for 10 years.

Recorded camera surveillance materials are kept for a maximum of two months unless a particular reason exists for storing the information for longer. The materials are destroyed by recording new materials over them.

The data is obtained from you when you submit an application, assignment or service request to the National Archives, use the National Archives' information systems or move in the National Archives' premises equipped with camera surveillance. When necessary, we confirm the personal data from the population information system or another official registry.

As a rule, the personal data we process do not include personal data belonging to special categories of personal data, unless you disclose such data yourself.

The National Archives transfers the personal data that is required for invoicing to the Government Shared Services Centre for Finance and HR.

Personal data may be disclosed on the basis of the Act on the Openness of Government Activities (621/1999).

The processing of personal data takes place in Finland, the EU/EEA or in third countries whose level of data protection has been deemed adequate, for example on the basis of an EU adequacy decision or another transfer basis in accordance with Chapter V of the EU’s General Data Protection Regulation. In addition, a level of data protection that meets EU requirements is ensured in data transfers.