Rights under the Data Protection Regulation, request for access and rectification of personal data
This instruction page is a subpage of Right of access and other client´s rights in the services of the Western Uusimaa Wellbeing Services County | Western Uusimaa Wellbeing Services County (luvn.fi), refer to this page for general instructions, authorisation instructions and Data Protection Officer’s contact information.
This page contains information on a client’s rights under the General Data Protection Regulation. The most commonly used rights are the request to review personal data and to rectify personal data.
How to exercise your rights in accordance with the GDPR
Request for access
If you want to inspect your personal data, you can submit an request for access to your personal data to the Western Uusimaa Wellbeing Services County.
Kela’s My Kanta Pages at My Kanta – Citizens– Kanta.fi(external link) allows you to see information about patient appointments and medication provided by both public and private healthcare services.
You can submit a data review request to the Wellbeing Services County electronically, in which case strong authentication is required, or you can visit the Registry Office in person and submit the request using a paper form, in which case your identity will be verified.
On this page, you can find separate forms based on the service to which you direct your data review request. If you are unsure about which form to use, you can use any form, as long as you clearly write down which service the data request concerns.
Forms for request to access to personal data under the Data Protection Regulation, by service area:
You can also visit the office to submit the request in person. In that case, please bring your ID with you. All data requests to the Wellbeing Services County can be submitted via the Registry Office.
Requests at the office are made using the following forms:
Downloadable files
- Download file: Services for the elderly, request for access to data in line with the GDPR.pdf.
- Download file: Disability Services, request for access to data in line with the GDPR.pdf.
- Download file: Services for children, young people, families, request for access to data in line with the GDPR.PDF.
- Download file: Joint healthcare and social welfare services, request for access to data in line with the GDPR.PDF.
- Download file: Employee information, request for access to data in line with the GDPR.PDF.
Demand for rectification of personal data
You also have the right to demand for the correction of inaccurate personal data and the completion of incomplete data.
You can submit a data rectification demand to the Wellbeing Services County electronically, in which case strong identification is required, or you can visit the Registry Office in person and submit the demand using a paper form, in which case your identity will also be verified.
On this page, you can find separate forms based on the service to which you direct your demand. If you are unsure about which form to use, you can use any form, as long as you clearly write down which service the data request concerns.
Forms for demands for rectification of personal data under the Data Protection Regulation, by service area:
You can also visit the office to submit a demand for rectification in person. In that case, please bring your ID with you. All demands for rectification addressed to the Wellbeing Services County can be submitted via the Registry Office.
Demands at the office are made using the following forms:
Downloadable files
- Download file: Services for the elderly, demand for rectification in line with the GDPR.pdf.
- Download file: Disability Services, demand for rectification in line with the GDPR.pdf.
- Download file: Services for children, young people and families, demand for rectification in line with the GDPR.pdf.
- Download file: Joint health and social services, demand for rectification in line with the GDPR.pdf.
- Download file: Employee information, demand for rectification in line with the GDPR.pdf.
EU’s General Data Protection Regulation
Data protection refers to protecting personal data. The objective of the EU’s General Data Protection Regulation is to improve the protection of personal data, increase the transparency of processing personal data and give data subjects, i.e. the clients of the Western Uusimaa Wellbeing Services County, more tools for managing the processing of their personal data. Furthermore, the GDPR aims to provide an answer to data protection questions brought on by digitalisation and globalisation. The national Data Protection Act complements and specifies the regulations set by the GDPR.
Your rights and exercising them
As a data subject, you have rights related to your personal data and their processing in the Western Uusimaa Wellbeing Services County. For example, you have the right to know whether the Wellbeing Services County processes your data and what type of data is being processed as well as the right to request access to your personal data. You also have the right to ask incorrect personal data to be rectified.
The processing of personal data in the Wellbeing Services County is mostly based on realising its legal obligations, performing an assignment related to the public interest or exercising public power. Thus, the Wellbeing Services County does not need a separate consent for processing your personal data. However, in certain services, the processing of personal data is based on consent you have given to the Wellbeing Services County, which means that you have the right to withdraw your consent at any time.
The rights can be exercised in different ways, depending on the grounds for the processing of personal data.
Right to gain access to data, right to inspect data
A person has the right to know whether their personal data is being processed and what kind of personal data has been saved.
The Wellbeing Services County will provide the data without undue delay, at the latest within one month after receiving the request. The deadline can be postponed by a maximum of two months if the request in question is exceptionally extensive and complex. If the deadline is postponed, the Wellbeing Services County will inform the person requesting the data of this within one month of receiving the request, stating also the grounds for the delay.
One has the right to receive their personal data free of charge. If the requests are clearly unfounded or unreasonable and especially if they are made repeatedly, the Wellbeing Services County can charge a reasonable fee for the task or refuse to perform it. In such cases, the Wellbeing Services County shall prove the apparent lack of grounds or the unreasonableness of the request.
The right to inspect data is not unlimited. For example, a data subject does not have the right to inspect personal data collected of them if receiving this information could endanger national security, defence or public order and safety or hinder the prevention or solving of crimes. Furthermore, this right does not apply if disclosing the information could cause a serious risk to the data subject’s health or care, their rights or the rights of another person.
If the Wellbeing Services County will not disclose the data based on the request received, it shall without delay, at the latest within one month after receiving the request, report the reasons for this decision and offer the option to appeal to a supervisory authority and utilise other methods of legal protection.
(GDPR: article 12, article 15, and Data Protection Act: section 34)
Right to rectify data
A person has the right to ask the Wellbeing Services County to rectify any inaccurate and incorrect personal data related to them without undue delay. Additionally, they have the right to have incomplete personal data completed. Potentially incomplete data is resolved by considering the purpose of processing the registered personal data.
If the Wellbeing Services County does not accept the person’s appeal to rectify their data, it will provide a written statement that discloses the reasons for why the claim was not accepted. In the same connection, the client will be informed of the option of submitting an appeal in the matter to the supervisory authority and using other methods of legal protection.
(GDPR: article 12, article 16).
Right to erasure, right to be forgotten
In certain special circumstances, such as when a person’s data has been processed based on their consent and they want to withdraw their consent, the person has the right to have their data erased, i.e. the right to be forgotten.
If the Wellbeing Services County does not accept the person’s appeal to erase their data, it will provide a written statement that discloses the reasons for why the claim was not accepted. In the same connection, the client will be informed of the option of submitting an appeal in the matter to the supervisory authority and using other methods of legal protection.
The right to have data erased does not apply if the processing is based on fulfilling the legal obligations of the Wellbeing Services County or is related to performing a duty pertaining to public interest or exercising the public power of the Wellbeing Services County.
(GDPR: article 17).
Right to restrict the use of data
In some circumstances, a person may have a right to request that the processing of their data be restricted until their data has been appropriately inspected, rectified or completed. Such circumstances occur when a person denies the accuracy of their personal data, for example. In such cases, the data’s processing will be restricted until the Wellbeing Services County has reviewed their validity.
(GDPR: article 18).
Right to data portability
A person has the right to transfer their data from one controller to another if they have disclosed their personal data to their controller and if their processing is based on consent or an agreement and the processing is done automatically.
(GDPR: article 20).
Right to object
The data subject shall have the right to object, on grounds relating to their particular special circumstances, at any time to the processing of personal data concerning them which is based on the performance of a task carried out in the public interest or in the exercise of official authority vested in the Wellbeing Services County. In this case, data can be processed further only if there is compelling legitimate grounds for the processing which can be demonstrated by the Wellbeing Services County. The processing can also be continued if it is necessary for the establishment, exercise or defence of legal claims.
(GDPR: article 21).
Right to contest an automated individual decision
A person shall have the right not to be subject to a decision based on automated processing, if the decision produces legal effects concerning them or similarly significantly affects them. An automated decision-making refers to a process where there is no human involvement, but instead the decision is made automatically solely based on personal data.
(GDPR: article 22).
Right to lodge a complaint with an authority
A person shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement if they consider that the processing of personal data relating to them infringes the EU’s General Data Protection Act. In Finland, this supervisory authority is the Data Protection Ombudsman. In addition to this, the person has the right to utilise other administrative appeal methods and methods of legal protection.
(GDPR: article 77).
The Western Uusimaa Wellbeing Services County has used a similar instructional page by the City of Helsinki as a template for this page.