DATA PROTECTION STATEMENT FOR SCIENTIFIC RESEARCH

Introduction and description of the research project

Facilitating Electoral Participation from Abroad (FACE) is a research project conducted by the University of Helsinki which examines participation in elections and political engagement from abroad. Constituting the core of the project is a questionnaire survey in which Finnish citizens living abroad are asked, among other things, about their voting habits and opinions on the status of expatriate Finns in the Finnish political system.

This data protection statement pertains to the quantitative research carried out in the project. Personal data are used as research material in the project. This statement describes how personal data will be processed in the project.

The basic part of the research dataset is composed of a sample containing identifiers, ordered from the Population Register Centre, on expatriate Finns with the right to vote in the Finnish parliamentary election of spring 2019. Those included in the sample will be sent an invitation to participate in the study, requesting them to complete the questionnaire survey using an online form.

Responding to the survey is voluntary. By completing the survey, participants give their consent to participating in the study. As regards the entire research dataset (the sample obtained from the Population Register Centre and the data collected in the questionnaire survey), the legal grounds for processing personal data is a task carried out in the public interest (scientific research).

Each survey respondent is given a personal control code with which to log in to the survey form. The code is also required for examining the distortion of the respondent group in comparison to the population (for example, whether invitation letters are returned to the sender in exceptional numbers from a certain country due to invalid addresses). The code, which does not resemble the Finnish personal identity code, cannot be directly used to determine the respondent’s identity. The respondent’s name, personal identity code and postal address will not be connected with the data acquired through the questionnaire.

Respondents are asked whether they are willing to participate in a potential further study to be carried out using qualitative methods. The respondents expressing their willingness are asked to include their email address on the form so that they can be contacted regarding the further study. In the case of those respondents who include their email address on the form, the data will contain a direct identifier. These responses will be copied into a separate file to wait for the potential further study. Subsequently, the email addresses will be erased from the main file used in the currently active stage of the study, thus excluding all direct identifiers from the data processed in the current stage.

If necessary, this data protection statement can be updated during the study.

1 Name of the research project

Facilitating Electoral Participation from Abroad (FACE)

2 Controller of the data file

University of Helsinki
PO Box 4 (Yliopistonkatu 3), 00014 University of Helsinki

3 Contact person in matters concerning the study

Johanna Peltoniemi, project director, johanna.peltoniemi@helsinki.fi, +358 2941 24920

4 Data protection officer

Veera Löthman, the data protection officer of the University of Helsinki, can be contacted by email at tietosuoja@helsinki.fi and by phone on +358 2941 911 (switchboard).

5 Duration of storage of the personal data in the research dataset

The sample and the data collected in the questionnaire survey will be stored until the end of the project period of the FACE project, that is, until the end of March 2021. At the end of the project, the sample will be destroyed. The survey data will be anonymised and transferred to the Finnish Social Science Data Archive.

In the case of those respondents who provided their email address in conjunction with the survey for the purpose of participating in a potential further study, the data will be stored until the end of 2026, after which this data file will also be destroyed. A separate data protection statement will be drawn up for survey data collected in any potential further studies.

6 Purpose of and legal grounds for processing personal data

The data will be used for research in social sciences as described above. Research findings will be reported in such a manner that individual respondents cannot be identified. The data collected in the questionnaire survey will be archived in anonymised form.

The processing of personal data is based on the following grounds, as stated in Paragraph 1, Article 6 of the General Data Protection Regulation of the EU (GDPR): a task carried out in the public interest, scientific research (Paragraph 3, Section 4 of the Finnish Data Protection Act).

7 Parties carrying out the study

University of Helsinki, Faculty of Social Sciences

8 Content of the research dataset

The sample provided by the Population Register Centre contains the following details:

Name
Address
Finnish personal identity code
Native language in the Population Register (Finnish, Swedish)
Municipality at birth (if born in Finland)
Municipality of registration in Finland
Date of moving abroad
Control code (a consecutive 6-figure code).

The data gained through the questionnaire survey includes the following details:

Control code
Responses to the survey questions (e.g., concerning the respondent’s social and political participation and relationship with Finland)
Email address for those respondents who have expressed their willingness to participate in a potential further study.

The survey form includes questions about what are known as sensitive personal data (data that fall under special categories of personal data according to Article 9 of the GDPR), such as political opinions, beliefs or trade union membership.

The processing of such sensitive personal data is based on Point j, Paragraph 2, Article 9 of the GDPR (processing is necessary for scientific or historical research purposes), as well as Paragraph 7, Subsection 1, Section 6 of the Finnish Data Protection Act (Paragraph 1, Article 9 of the GDPR does not apply to the processing of data for the purposes of scientific or historical research, or for compiling statistics).

9 Regular sources of personal data

Sample (Population Register Centre) and questionnaire survey (respondents)

10 Transfer and disclosure of data, recipients

The name, address and control code data included in the sample will be transferred to a service provider outside the University (Painotalo Plus Digital, business identity code 0706518-1) for posting the survey invitations. After posting, the service provider will destroy the file.

11 Transfer of data outside EU or EEA countries

No personal data will be transferred or disclosed outside the EU or EEA.

12 Principles of protection for the research dataset

Personal data are processed in such a manner that only persons requiring them for research purposes are granted access. The data included in the research dataset are confidential. The research dataset is processed in data systems and it is protected by means of access control based on usernames and passwords. All user rights are personal.

13 Automated decision-making

No decisions or profiling by automated means will be carried out using the research data.

14 Right of access

The data subject has the right to know whether the University of Helsinki is processing their personal data. Additionally, the data subject has the right to know which personal details are being processed. The data subject can request an extract of their personal data used in the FACE project. The person making the enquiry is obliged to provide proof of identity and, thus, their right to verify the data.

15 Right to rectification

If there are inaccuracies in the personal data being processed, the data subject has the right to request their rectification or completion.

16 Other rights related to processing personal data

The data subject has the right to restrict the processing of their personal data under the following conditions:

The data subject contests the accuracy of their personal data, in which case the processing will be restricted for a period enabling the University to verify the accuracy of the personal data.
The processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead.
The University no longer needs the personal data for the purposes of the processing, but the data subject needs them for the establishment, exercise or defence of legal claims.
The data subject has objected to the processing (see below), pending verification of whether the legitimate grounds of the controller override those of the data subject.

The data subject has the right to object to the processing of their personal data if the processing is based on public interest or legitimate interests. In such cases, the University can no longer process the data subject’s personal data unless the University demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. The University can also continue processing the data subject’s personal data when necessary for the performance of a task carried out for reasons of public interest.

In certain individual cases, derogations from the rights described here may be made on the basis of the GDPR and the Finnish Data Protection Act, insofar as the rights render impossible or seriously impair the achievement of scientific or historical research purposes or statistical purposes. The need for derogations will always be assessed on a case-by-case basis.

17 Application of rights

If the processing of personal data for research purposes does not require the identification of the data subject and if the controller of the data file is unable to identify the data subject, the right to verify, rectify, erase and restrict the use of personal data, as well as any notification obligations and the right to transfer do not apply unless the data subject provides additional data enabling their identification (Article 11 of the GDPR).

18 Right to lodge a complaint

The data subject has the right to lodge a complaint with a supervisory authority concerning the processing of personal data. The applicant may submit the matter for the consideration of the Data Protection Ombudsman at the Office of the Data Protection Ombudsman, PO Box 800, 00521 Helsinki. Email: tietosuoja@om.fi.