Privacy policy: Case-specific register for contact tracing

The County Board of the Western Uusimaa Wellbeing Services County

Chief Physician of the Infectious Diseases Unit

Chief Physician of the Infectious Diseases Unit

Western Uusimaa Wellbeing Services County

P.O. Box 33, 02033 Western Uusimaa Wellbeing Services County

Switchboard’s phone number: 029 151 2000

Purposes of processing

The purpose of processing is the tracing of generally hazardous or monitored communicable diseases or other communicable diseases and the tracking of carriers of microbes and persons justifiably suspected of having been exposed.

Under section 9 of the Communicable Diseases Act, the wellbeing services counties and the HUS Group are responsible for organising the control of communicable diseases within their area, as laid down in the Act on Organising Healthcare and Social Welfare Services, the Health Care Act (1326/2010) and in this Act. The wellbeing services counties and the HUS Group must have all the competence, capacity and preparedness necessary to take responsibility for the control of communicable diseases and all related tasks within the services for which they are responsible.

Under the Communicable Diseases Act, the actions to control communicable diseases encompass the prevention, early identification and tracking of communicable diseases, the measures required for investigating or controlling the epidemic, and the examination, treatment and medical rehabilitation of persons who have a communicable disease or are suspected of having a communicable disease, as well as the prevention of healthcare-associated infections.

The data of the register are also used for planning the tracing and tracking of the communicable disease, the development of a pandemic response and for research purposes.

Legal grounds for processing

Article 6(1)(c) of the General Data Protection Regulation of the European Union: legal obligation of the controller. Communicable Diseases Act, section 39.

Data pertaining to health or social care constitutes a special category of personal data. Its processing is permitted on the grounds of Article 9(2)(h) of the General Data Protection Regulation (GDPR) of the European Union, under which processing is necessary for the provision of health or social care.

Key legislation

• General Data Protection Regulation of the European Union (679/2016)
• Data Protection Act (1050/2018)
• Communicable Diseases Act (1227/2016)
• Health Care Act (1326/2010)
• Act on the Status and Rights of Patients (785/1992)
• Act on the Processing of Client Data in Healthcare and Social Welfare (703/2023)
• Act on Healthcare Professionals (559/1994)
• Archives Act (831/1994)
• Act on the Openness of Government Activities (621/1999)
• Administrative Procedure Act (434/2003)

The register contains data concerning communicable diseases or microbe findings, the means, time and location of the transmission and the provided care to the extent necessary for the prevention of communicable diseases or the investigation of communicable disease epidemics and for controlling their spreading. The infected or exposed person’s name, personal identity code, contact details and municipality of residence or municipality of temporary residence constitute personally identifiable information.

Data pertaining to infection and exposure: information on the contact, time when the symptoms started, symptoms, infectious period, source of infection.

Information on the exposure situation, including the name and contact details of the exposed persons; for mass exposures, the name and contact details of the contact person.

The exposed person’s name, personal identity code, contact details and municipality of residence or municipality of temporary residence constitute personally identifiable information. Exposure time, symptoms and screening examinations.

Mention of decisions made pursuant to sections 57, 60 and 63 of the Communicable Diseases Act.

Physicians must notify the Finnish Institute for Health and Welfare of suspected or diagnosed cases of generally hazardous or monitored communicable diseases. Personal data are disclosed to the entitled authorities based on legislation or specific data requests in compliance with the law and the data protection guidelines of the Social Services and Health Care Division. Data is not transferred from the register to countries outside the EU or the EEA.

Data collected in accordance with the Communicable Diseases Act are destroyed upon completion of the investigation of the epidemic or the tracing of transmissions, provided that the preservation of the data is not essential for controlling the communicable disease.

The data of the register are acquired and maintained based on information received from the infected or exposed persons or their representatives and based on data generated in the care units. The personal and address data of infected or exposed persons residing in the Western Uusimaa Wellbeing Services County are extracted from the population register, and other necessary basic data are saved in the information systems when the care relationship begins.