Privacy statement: Decision-making system Dynasty 10

Privacy statement publication date: 29 March 2022

1. Name of filing system

Western Uusimaa wellbeing services county decision-making system. It includes the case processing system, the electronic records management classification system, the electronic meeting system, agreement management and the register of elected officials.

2. Contact information of the controller

Western Uusimaa wellbeing services county registry

P.O. BOX 33

02033 Western Uusimaa Wellbeing Services County

E-mail: kirjaamo@luvn.fi

3. Purpose and grounds for the processing of personal data

The purpose of the processing of personal data in the register is to register official correspondence, decision-making and other key issues and documents in the Western Uusimaa wellbeing services county for monitoring purposes in accordance with the wellbeing services county’s records management plan.

Matters to be decided by the council, county board, committees and governing bodies, their divisions and officials shall be stored in the register. The system will monitor the handling of matters to be prepared in the administration of the wellbeing services county and provide information on the progress, processing stages and decisions of the matters in accordance with the Act on the Openness of Government Activities and the Data Protection Act, as well as the guidelines and regulations issued on the basis of them. The system registers information on the processing of issues and documents stored in the system. This information is used in the inspection function.

LEGAL PURPOSE FOR PROCESSING DATA:

Article 6(1)(c) and (e) of the EU General Data Protection Regulation.

4. Filing system data content (description of categories of data subjects and personal data)

The filing system shall contain information on matters that are pending or have been decided on, such as the name of the person, date of birth, personal identity code, profession, address and other contact details, as well as other specific information required in the case under consideration and a description of the case and documents, as well as information on the handling and decision of the case. The data are stored either as public or confidential so that the reason for confidentiality is mentioned in the case of confidential data. The time when the document becomes public is determined by the Act on the Openness of Government Activities.

The system provides information on the decision-makers, contractual partners, and the people preparing and processing the matters: last name, first name, job title/position in the organisation. In addition to the name and function information, the user's ID and information on all matters and documents handled by the user, including reading, shall be registered.

OPENNESS AND CONFIDENTIALITY OF INFORMATION:

Some of the information is public and some confidential.

GROUNDS FOR CONFIDENTIALITY:

The Act on the Openness of Government Activities, section 24.

5. Sources of personal data 

The information in the register is obtained from the parties involved, such as the initiator, the contractual partner, the person making the statement or the person processing the matter. Dynasty users' data are obtained from the users themselves through the ActiveDirectory (AD) of the Western Uusimaa wellbeing services county.

6. Recipients or categories of recipients of personal data

Information is not regularly disclosed.

7. Transfer of data outside the EU or the EEA

The data will not be transferred outside the EU or the EEA.

8. Data retention times

The minutes of the decisions of the bodies and the personal data contained therein and the register of elected officials shall be kept permanently. The storage times for personal data in official decisions and correspondence in decision-making vary from one year to permanent storage. More detailed retention times can be found in the Western Uusimaa wellbeing services county's information management plan (TOS).

9. Filing system maintenance systems and data protection principles

Access rights to the Dynasty decision-making system and its various parts are provided through the Western Uusimaa wellbeing services county ActiveDirectory (AD). The supervisor shall grant reading and editing rights through the ID portal on the basis of the person's work tasks. In particular, the rights to confidential matters are only granted to users who need them for the performance of their duties.

The access rights group defines visibility to matters and documents. The groups have been formed on the basis of work tasks. The groups have both general groups and groups specific to spheres of authority. At the opening stage, the matter is public. The main users, archivists and registrars shall have editing rights to the matter and related documents on the basis of their work tasks. Matters relating to individuals are, by default, confidential.

The user right ends when a person stops performing the tasks for which they have been granted the user right.

The right to use the electronic meeting system shall be body-specific and granted to respective elected officials, officials and employees who need it for the performance of their duties.

The case and document management system entity is used and managed in a closed environment that complies with the wellbeing services county's data protection and security requirements.

10. Rights of the data subject

10.1 Right to inspect data

The data subject may submit a request for the right of inspection in writing or by e-mail.

A request for the right of inspection of the data entered in the register may be submitted to the following address:

Western Uusimaa wellbeing services county registry

P.O. BOX 21

FI-02771 Espoo

OR

By e-mail to: kirjaamo@luvn.fi.

As a rule, the right of inspection shall be exercised within four weeks of the submission of the request.

10.2 Right to rectify data

The data subject may request the correction of the data from the controller. If the request is not granted, the controller shall issue a written statement to the data subject including the reasons why the request was not accepted. The data subject may refer the matter to the Data Protection Ombudsman.

​​​​​​​10.3 Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to them infringes this Regulation. This right is based on the EU General Data Protection Regulation (2016/679, Article 77).

​​​​​​​10.4 Right to erasure (Data Protection Regulation, Article 17)

The data subject shall have the right to obtain from the controller the erasure of personal data concerning them without undue delay where one of the grounds in Article 17(1) of the General Data Protection Regulation applies. The right to erasure shall not apply to the extent that processing is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

​​​​​​​10.5 Right to restriction of processing (Data Protection Regulation, Article 18)

The data subject shall have the right to obtain from the controller restriction of processing where one of the grounds in points (a)–(d) in Article 18(1) of the General Data Protection Regulation applies.

​​​​​​​10.6 Right to object (Data Protection Regulation, Article 21)

The data subject shall have the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing.

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning them for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

​​​​​​​​​​​​​​10.7 Right to data portability (Data Protection Regulation, Article 20)

The data subject shall have the right to transmit data to another controller only where the processing is based on consent or on a contract and if the processing is carried out by automated means. The right of the data subject to data portability shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Where processing is based on consent, the data subject shall have the right to withdraw their consent at any time.