This page contains the privacy statements for registers of data relating to customer service and benefit processing.
If you have questions about the statements, please contact Kela's customer service, a Kela service point or the person mentioned in the statement. Inquiries can be sent to Kela’s appointed privacy officer by e-mail at tietosuoja(at)kela.fi.
The register is used to record and store customer and service related data on Kela’s appointment booking system. The data are processed as part of Kela’s statutory responsibilities.
1 Data controller
The Social Insurance Institution of Finland (Kela)
PL 450, 00056 Helsinki or Nordenskiöldinkatu 12, 00250 Helsinki
020 634 11, http://www.kela.fi/administration
2 Contact person for register-related matters
Sanna Manninen
Tel. 020 634 11 (exchange)
3 Name of register
Appointment booking system
4 Purpose and basis for the handling of personal data
The register is used for the booking and administration of appointments made by customers and for the storage of the customers’ personal and service related data. The processing of the data is part of Kela’s statutory benefit administration duties.
5 Data content of the register
Types of data contained in the register:
6 Regular sources of data
Data are obtained directly from the customers, from Kela’s benefit register (name and contact information) and from the Digital and Population Data Services Agency (name and personal identity code). The data are entered by the customers themselves or by a Kela staff member or collaboration partner (e.g. social services) using the online appointment booking system at kela.fi. Use of the appointment booking system requires customers and partners to verify their identity electronically (suomi.fi). When acting on behalf of another person, use of the service requires electronic authentication (suomi.fi), or the secondary user must be a legal guardian with the statutory right to act on behalf of his or her ward.
7 Regular disclosure of data
No personal data are disclosed.
8 Transfer of data outside the EU or EEA
None.
9 Retention period for personal data
Personal data are retained in the database for six months from the date for which the appointment was made and deleted thereafter. Retention of the data is part of Kela’s statutory benefit administration responsibilities. Personal data are retained for the duration needed for Kela to discharge its statutory responsibilities and to implement its benefit schemes.
10 Principles of register security
Kela exercises due care in all its operations and ensures a high level of data protection and data security.
All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.
11 Right of access to data
Under Article 15 of the EU General Data Protection Regulation (EU 2016/679), data subjects have the right to check the data on their person.
Those who wish to check their data must submit a request to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
12 Right of correction
According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data.
The request for correction must be submitted to Kela.
The request must specify the following:
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
13 Right of erasure
Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.
This right does not extend to personal data that Kela needs to carry out its statutory duties.
The request to erase personal data must be made to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
14 Right to file a complaint with a supervisory authority
According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of Kela personal data relating to him or her infringes this Regulation.
Benefit-related data are used in providing customer service and reviewing claims for benefit as part of a statutory social insurance programme.
1 Register controller
The Social Insurance Institution of Finland (Kela)
PL 450, 00056 HELSINKI or Nordenskiöldinkatu 12, 00250 HELSINKI
020 634 11
http://www.kela.fi/administration
2 Additional information and contact for register-related matters
Tel. 020 692 352
3 Name of register
Benefit register
4 Purpose and basis for the handling of personal data
Benefit-related data are used in providing customer service and reviewing claims for benefit as part of a statutory social insurance programme.
The data are also used by Kela for planning and research purposes as well as in the context of data exchange.
The handling of the data is based on the fulfilment of Kela’s statutory responsibilities. A list of the relevant statutory provisions is attached as Appendix 2.
5 Data content of the register
The benefit register contains general data on beneficiaries, benefit-related data, information about customer service and claims processing, and statistical data.
The types of data contained in the register are described in Appendix 1.
6 Regular sources of data
Data are obtained from customers personally and from government authorities and other entities, including the Population Register Centre, the Finnish Tax Administration and its Income Register Unit, authorised pension providers, insurance companies, workplace funds, social welfare and healthcare authorities, and labour authorities.
Data are also obtained from pharmacies and parties to direct reimbursement agreements (health service providers and transport operators providing services under the Health Insurance Act). Further, data are obtained from the Board of Education’s Opintopolku.fi and KOSKI data resources. Study-related data on higher education students are obtained from the VIRTA data resources administered by the Ministry of Education and Culture.
7 Regular disclosure of data
Provided the requirements set out in law are met, Kela discloses customer data electronically to such entities as the Finnish Tax Administration, the authorised pension providers, employment accident insurance providers, social welfare and healthcare authorities, and pharmacies.
8 Transfer of data outside the EU or EEA
In specific cases, data are transferred outside the EU or EEA in accordance with social security agreements. The data are transferred manually on paper forms.
9 Retention period for personal data
The retention periods for benefit-related data are based on the legislation governing the benefits and the Accounting Act. The standard retention period is 10 years from the discontinuation of the benefit, which is based on the six-year retention period specified in the Accounting Act and the additional time needed for appeal and recovery of overpayment.
Some data, such as the data on prescription medicines reimbursed at the pharmacy, are deleted after three years have elapsed from the end of the accounting year in which the reimbursement was paid. Read more about retention period for personal data.
10 Principles of register security
At Kela, data security and protection of personal data are systematically taken into account in all use and handling of information. Kela handles all personal data with data protection in mind and in the manner determined by law.
All persons at Kela who handle personal data sign a confidentiality agreement. The register data are used only by authorised persons who need them to perform their official duties.
11 Right of access to data
According to Article 15 of EU Regulation 2016/679, the data subject has the right to access personal data concerning him or her, i.e. a right to check information concerning the person himself or herself.
The request can be made by phone, by using the Message function on Kela’s e-service, by submitting a written request to Kela’s Registry, or by contacting a Kela office personally. Please note that our e-service is only available in Finnish and Swedish. The contact information can be found in section 1.
12 Right of correction
According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data concerning him or her.
In the request, they must identify the incorrect information, indicate why it is incorrect and specify how it should be amended.
The request can be made by phone, by using the Message function on Kela’s e-service, by submitting a written request to Kela’s Registry, or by contacting a Kela office personally. The contact information can be found in section 1.
13 Right of erasure
According to Article 17 of EU Regulation 2016/679, the data subject has the right to request the erasure of personal data concerning him or her.
This right does not concern personal data that Kela needs to carry out its statutory duties.
14 Right to file a complaint with a supervisory authority
According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
GENERAL INFORMATION
General information may be used in the administration of benefit schemes. General information includes the following:
BENEFIT-RELATED DATA
The benefits and the data used in connection with them are listed in the order of which customers may encounter them in their lives.
1. PREGNANCY, CHILDBIRTH, CHILDCARE
2. ILLNESS, INJURY OR FUNCTIONAL IMPAIRMENT OF CHILD/FAMILY MEMBER
3. OWN ILLNESS, INJURY OR DISABILITY
4. STUDENTS
5. UNEMPLOYMENT
6. WAR VETERANS, CONSCRIPTS
7. OLD AGE
8. HOUSING AND OTHER ECONOMIC SECURITY
9. DEATH OF A FAMILY MEMBER
10. OTHER CUSTOMER-RELATED DATA
11. STATISTICAL DATA
The data content is equivalent to that presented above in the context of each category of benefit.
12. DATA HANDLED MANUALLY
To monitor the management of benefit fraud matters and to produce regional and nationwide statistics for the Kelasto statistical database.
1 Data controller
The Social Insurance Institution of Finland (Kela)
PL 450, 00056 Helsinki or Nordenskiöldinkatu 12, 00250 Helsinki
020 634 11, www.kela.fi/administration
2 Contact person for register-related matters
Tiina Niskanen
Tel. 020 634 11 (exchange)
3 Name of register
Benefit fraud register (EVAREK)
4 Purpose and basis for the handling of personal data
Personal data are processed as part of monitoring the management of benefit fraud matters. The data are also processed for purposes of producing regional and national statistics for the Kelasto statistical database.
Closed cases are removed from the register, and the data are only used for statistical purposes. When compiled into statistics, the data are converted into a format that prevents individual persons from being recognised.
The handling of personal data is based on the fulfilment of Kela’s statutory responsibilities.
5 Data content of the register
The register contains the following identifying data:
6 Regular sources of data
Data are received from customers, Kela’s benefit systems and, as provided for by law, other public authorities, such as the Finnish Tax Administration, police, prosecutor’s officer and courts of law.
7 Regular disclosure of data
None.
8 Transfer of data outside the EU or EEA
None.
9 Retention period for personal data
Personal data are retained for fourteen (14) months starting from the data on which the case was registered as closed.
10 Principles of register security
Kela exercises due care in all its operations and ensures a high level of data protection and data security.
All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.
11 Right of access to data
According to Article 15 of EU Regulation 2016/679, data subjects have the right to access personal data concerning them, i.e., to you can check the data concerning their person.
Those who wish to check their data must submit a request to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
12 Right of correction
According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data.
The request for correction must be submitted to Kela.
The request must specify the following:
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
13 Right of erasure
Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.
This right does not concern personal data that Kela needs to carry out its statutory duties.
The request to erase personal data must be made to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
14 Right to file a complaint with a supervisory authority
According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of Kela personal data relating to him or her infringes this Regulation.
To verify on the basis of Kela’s customer data that the criteria for issuing a European Disability Card are fulfilled and to register eligible persons as such in the browser-based system of the Service Foundation for People with an Intellectual Disability.
1 Data controller
The Social Insurance Institution of Finland (Kela)
PL 450, 00056 HELSINKI or Nordenskiöldinkatu 12, 00250 HELSINKI
020 634 11
http://www.kela.fi/administration
2 Contact person for register-related matters
Viivi Pelkonen
Tel. 020 634 11 (exchange)
3 Name of register
Register on permissions to order a European Disability Card
4 Purpose and basis for the handling of personal data
To verify on the basis of Kela’s customer data that the criteria for issuing a European Disability Card are fulfilled and to register eligible persons as such in the browser-based system of the Service Foundation for People with an Intellectual Disability.
The processing of the data is based on the consent of the registered persons.
5 Information content of the register
Data used for identification
Other data needed for the permission (indication that the customer wishes to order a European Disability Card, A marking, authorisation).
6 Regular sources of data
Data are obtained from the customers or their authorised representatives on Kela’s customer service channels.
7 Regular disclosure of data
Kela may release customer data as specified by law.
8 Transfer of data outside the EU or EEA
None.
9 Retention period for personal data
The permission form and its supporting documents are retained for ten (10) years.
10 Principles of register security
At Kela, data security and protection of personal data are systematically taken into account in all use and handling of information. Kela handles all personal data with data protection in mind and in the manner determined by law.
All persons at Kela who handle personal data sign a confidentiality agreement. The register data are used only by authorised persons who need them to perform their official duties.
11 Right of access to data
According to Article 15 of EU Regulation 2016/679, the data subject has the right to access personal data concerning him or her, i.e. a right to check information concerning the person himself or herself.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
12 Right of correction
According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data concerning him or her.
In the request, they must identify the incorrect information, indicate why it is incorrect and specify how it should be amended.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
13 Right of erasure
According to Article 17 of EU Regulation 2016/679, the data subject has the right to request the erasure of personal data concerning him or her.
This right does not concern personal data that Kela needs in order to carry out its statutory duties.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
14 Right to file a complaint with a supervisory authority
According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
The personal data contained in the register are used in the Electronic Exchange of Social Security Information (EESSI) system of the EU member states. The data are used to identify persons who will be covered by the Finnish social security system.
1 Data controller
The Social Insurance Institution of Finland (Kela)
PL 450, 00056 KELA or Nordenskiöldinkatu 12, 00250 Helsinki
020 634 11 http://www.kela.fi/administration
2 Contact person for register-related matters
Mia Sundblad
Tel. 020 634 11 (exchange)
3 Name of register
Identification of natural persons in EESSI message exchange
4 Purpose and basis for the handling of personal data
The personal data contained in the register are used in the Electronic Exchange of Social Security Information (EESSI) system of the EU member states. The data are used to identify persons who will be covered by the Finnish social security system. The processing of the data is based on the fulfilment of Kela’s statutory responsibilities.
5 Data content of the register
The register contains data used to identify specific individuals and cases.
Personal identifying data:
6 Regular sources of data
Personal data are received from the data subjects, the institution which sent the EESSI message and the Digital and Population Data Services Agency.
7 Regular disclosure of data
Data are disclosed to the Digital and Population Data Services Agency and to the recipient EESSI institution in Finland.
8 Transfer of data outside the EU or EEA
None.
9 Retention period for personal data
Personal data are retained for ten years. The retention period has been set in accordance with the principles outlined in Article 5 of the EU General Data Protection Regulation.
10 Principles of register security
Kela exercises due care in all its operations and ensures a high level of data protection and data security.
All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.
11 Right of access to data
According to Article 15 of EU Regulation 2016/679, data subjects have the right to access personal data concerning them, i.e., them in can check the data concerning their person.
Those who wish to check their data must submit a request to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
12 Right of correction
According to Article 16 of EU Regulation 2016679, the data subject has the right to request the correction of inaccurate personal data.
The request for correction must be submitted to Kela.
The request must specify the following:
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
13 Right of erasure
Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.
This right does not extend to personal data that Kela needs to carry out its statutory duties.
The request to erase personal data must be made to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
14 Right to file a complaint with a supervisory authority
According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of Kela personal data relating to him or her infringes this Regulation.
Data are handled for the purpose of administering a statutory social insurance programme consisting of a variety of benefit schemes and customer service. The data are used primarily for the purpose of verifying customer service transactions.
1 Data controller
The Social Insurance Institution of Finland (Kela)
PL 450, 00056 HELSINKI or Nordenskiöldinkatu 12, 00250 HELSINKI
020 634 11
http://www.kela.fi/administration
2 Contact person for register-related matters
Esa Hämäläinen
Tel. 020 634 11 (exchange)
3 Name of register
System used to record customer phone calls, second-line support phone calls and chat conversations.
4 Purpose and basis for the handling of personal data
Data are handled for the purpose of administering a statutory social insurance programme consisting of a variety of benefit schemes and customer service. The data are used primarily for the purpose of verifying customer service transactions. The data may also be used to train Kela’s customer service personnel to enhance the quality of the service.
The data are used as part of Kela’s statutory responsibilities.
5 Information content of the register
Kela records all calls made to or routed through its nationwide customer service numbers or the helpline for government organisations. A portion of the calls made or routed through regional customer service numbers are recorded as well. Chat conversations on www.kela.fi are also recorded.
Phone calls to and chat conversations with second-line customer support are recorded.
Phone calls and chat conversations are recorded automatically. The data stored in the register consists of data provided by the customers themselves or by a customer service advisor contacted by phone for second-line support. This includes, for example:
6 Regular sources of data
In phone calls and chat conversations with customers, data are received from the customers themselves. In second-line support phone calls and chat conversations, data are received from customer service advisors.
7 Regular disclosure of data
None.
8 Transfer of data outside the EU or EEA
None.
9 Retention period for personal data
Recordings of phone calls and chat conversations are retained for one (1) year.
10 Principles of register security
Kela exercises due care in all its operations and ensures a high level of data protection and data security.
All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.
11 Right of access to data
Under Article 15 of the EU General Data Protection Regulation (EU 2016/679), data subjects have the right to access and check their personal data.
Those who wish to check their data must submit a request to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
12 Right of correction
According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data.
The request for correction must be submitted to Kela.
The request must specify the following:
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
13 Right of erasure
Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.
This right does not concern personal data that Kela needs to carry out its statutory duties.
The request to erase personal data must be made to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
14 Right to file a complaint with a supervisory authority
According to Article 77 of the General Data Protection Regulation, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that Kela, in processing personal data relating to him or her, infringes the Regulation.
The data are used as part of Kela’s statutory responsibilities.
1 Data controller
The Social Insurance Institution of Finland (Kela)
PL 450, 00056 Helsinki or Nordenskiöldinkatu 12, 00250 Helsinki
020 634 11, http://www.kela.fi/administration
2 Contact person for register-related matters
Merja Larikka (Healthcare service providers, healthcare professionals and transport service providers)
Tomi Mielonen (Rehabilitation service providers)
Auri Syrén (Providers of early childhood education)
Tel. 020 634 11 (exchange)
3 Name of register
Service provider register
4 Purpose and basis for the handling of personal data
The handling of personal data is based on the fulfilment of Kela’s statutory responsibilities.
Some of the data contained in the rehabilitation service provider register may be looked up without signing in via the rehabilitation service provider search function at www.kela.fi.
The data contained in the register are used by Kela to determine
5 Data content of the register
The register contains the following types of data:
1. For doctors,
2. For dentists,
3. For physiotherapists, nurses, nurse practitioners, midwifes, dental hygienists and medical laboratory technicians,
4. Specialist dental technician data
5. Psychologist data
6. For rehabilitation service providers,
7. Transport service provider data
8. For providers of early childhood education,
9. Contractual and confirmation data
10. Data handled manually
6 Regular sources of data
Data are obtained from the service providers, from benefit applicants and various government authorities, including the National Supervisory Authority for Welfare and Health (Valvira), the Regional State Administrative Agencies (AVI), the National Institute for Health and Welfare (THL), university medical faculties, the Digital and Population Data Services Agency (DVV), and municipal authorities.
7 Regular disclosure of data
Data on physicians and dentists are disclosed to pharmacies as required by the direct reimbursement system.
8 Transfer of data outside the EU or EEA
None.
9 Retention period for personal data
Personal data are stored for the duration needed for Kela to discharge its statutory responsibilities and to implement its benefit schemes.
10 Principles of register security
Kela exercises due care in all its operations and ensures a high level of data protection and data security.
All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.
11 Right of access to data
According to Article 15 of EU Regulation 2016/679, data subjects have the right to access personal data concerning them, i.e., to check the data concerning their person.
Those who wish to check their data must submit a request to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
12 Right of correction
According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data.
The request for correction must be submitted to Kela.
The request must specify the following:
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
13 Right of erasure
Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.
This right does not concern personal data that Kela needs to carry out its statutory duties.
The request to erase personal data must be made to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
14 Right to file a complaint with a supervisory authority
According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of Kela personal data relating to him or her infringes this Regulation.
The register is intended for use by Kela in operating the system for the electronic direct reimbursement of taxi fares covered by the Health Insurance Act and the ride sharing and dispatch service.
1 Data controller
The Social Insurance Institution of Finland (Kela)
PL 450, 00056 Helsinki or Nordenskiöldinkatu 12, 00250 Helsinki
Tel. 020 634 11, http://www.kela.fi/administration
2 Contact person for register-related matters
Anne Hauta
Taina Simonen
Merja Larikka
Tel. 020 634 11 (exchange)
3 Name of register
Privacy statement for a register of personal data related to the direct reimbursement procedure used with taxi trips reimbursable under the Health Insurance Act
4 Purpose and basis for the handling of personal data
The register is used by Kela to provide reimbursement for taxi trips using an electronic direct reimbursement procedure, which also includes a ride sharing and dispatch service. The direct reimbursement procedure and the ride sharing and dispatch services are based on the Health Insurance Act (1224/2004). Under the Act, reimbursements for travel costs can be paid to the service provider if the trip in question is reimbursable under National Health Insurance. The service provider must have an agreement with Kela, and the reimbursement is paid to the service provider in accordance with the agreement.
The data controller is Kela. The service provider and any of its subcontractors (such as a dispatch centre, payment processor or transport operator) process the personal data for and on behalf of Kela. The processing of personal data is based on the Health Insurance Act, with the exception of vouchers related to basic social assistance, where processing is based on the client’s consent. They use the personal data exclusively to produce the direct reimbursement procedure and the ride sharing and dispatch service. The use of the personal data is governed by the agreement between Kela and the service provider. Electronically transmitted data on trips qualifying for a direct reimbursement are only handled by Kela staff members who need access to the data to perform their professional duties.
5 Data content of the register
The register contains
The service provider processes all of the data described above on Kela’s behalf.
6 Regular sources of data
Data are received directly from clients.
Data are also received from transport operators and from service providers that have an agreement with Kela on ride sharing, dispatch and use of the direct electronic reimbursement procedure. Kela is authorised to obtain data from the service providers notwithstanding any confidentiality provisions or other restrictions on access to data. This authority is based on chapter 19, section 1 of the Health Insurance Act.
Address information for the clients is obtained from the Digital and Population Data Services Agency. Kela is authorised to obtain data from the Digital and Population Data Services Agency notwithstanding any confidentiality provisions or other restrictions on access to data. This authority is based on chapter 19, section 1 of the Health Insurance Act.
7 Regular disclosure of data
Under chapter 19, section 5 of the Health Insurance Act, Kela is authorised to release to the service provider, in connection with trips as defined in section 4 of the Health Insurance Act, the client’s first name and surname and any other client information essential for dispatching a ride. Such essential information can include that the client has a continuing right to use a taxi or that the client’s annual initial deductible has been reached (i.e. whether a copayment is charged for the trip or not). Under the Act, Kela is authorised to release the information notwithstanding any confidentiality provisions or other restrictions on access to information. Kela may, with the consent of the client, disclose data to service providers on any basic social assistance vouchers granted to the client.
Kela may disclose information within the bounds of and as required by the valid legislation. Some of the information used in connection with the services is physically located outside Kela on service providers’ servers. This is due to the technical implementation of the service. Data stored on outside servers are used by electronic and other means.
8 Transfer of data outside the EU or EEA
None.
9 Retention period for personal data
Kela retains data essential to arranging and dispatching rides for six years starting from when the data expires for example because the client is no longer entitled to use a taxi. Data on a client’s basic social assistance vouchers are retained for the period of validity of the vouchers. Service providers retain accounting data for six months starting from the date of the ride. Taxi operators retain ride data transmitted to Kela for two years starting from the ride. Service providers retain data needed for ride dispatching and sharing until the data expires or until the end of the contract term. Calls to the dispatch centre are recorded, and service providers keep the recordings for 12 months, after which they must be deleted within 3 months.
10 Principles of register security
Kela exercises due care in all its operations and ensures a high level of data protection and data security.
Service providers and any subcontractors they may use undertake to comply with the confidentiality and secrecy provisions. All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.
11 Right of access to data
Under Article 15 of the EU General Data Protection Regulation (EU 2016/679), data subjects have the right to access personal data concerning them. This means that persons included in the register have the right to check data concerning themselves.
Those who wish to check their data must submit a request to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
12 Right of correction
According to Article 16 of the General Data Protection Regulation, the data subject has the right to request the correction of inaccurate personal data.
The request for correction must be submitted to Kela.
The request must specify the following:
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
13 Right of erasure
Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.
This right does not extend to personal data that Kela needs to carry out its statutory duties.
The request to erase personal data must be made to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
14 Right to withdraw consent
Under Article 7 of the General Data Protection Regulation, the data subject has the right to withdraw his or her consent at any time concerning Kela’s right to store information on the data subject’s basic social assistance vouchers.
The withdrawal of consent can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
15 Right to file a complaint with a supervisory authority
According to Article 77 of the General Data Protection Regulation, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of Kela personal data relating to him or her infringes this Regulation.
The personal data contained in the register are used by Kela to discharge its statutory responsibilities in providing access to interpreter services for persons with disabilities.
1 Data controller
The Social Insurance Institution of Finland (Kela)
PL 450, 00056 HELSINKI or Nordenskiöldinkatu 12, 00250 HELSINKI
020 634 11
http://www.kela.fi/administration
2 Contact person for register-related matters
Suvi Liuski
Tel. 020 634 11 (exchange)
3 Name of register
Register on the interpreter service for persons with disabilities
4 Purpose and basis for the handling of personal data
The personal data contained in the register are used by Kela to discharge its statutory responsibilities in providing access to interpreter services for persons with disabilities.
Data on remote interpretation services are needed to monitor and compile statistics on the use of the service and to provide equipment and an online connection for remote interpretation and to monitor their usage.
The register data are also needed to troubleshoot errors and to bill for the use of the equipment.
The processing of the personal data is based on the Act on Interpreter Services for Persons with Disabilities (133/2010) and the consent given by the clients at the time of application.Clients have the right to withdraw their consent.
The processing of data on the interpretation service provider and interpreter is based on the procurement contract signed by Kela and the service provider.
5 Data content of the register
The register contains data on persons entitled to interpreter services arranged by Kela.
The register contains data on interpretation service providers that have an agreement with Kela to provide such services. The register also contains data on the interpreters under contract with the service providers.
Types of data contained by the register:
1. Clients receiving interpreter services for persons with disabilities
2. Interpretation service providers
3. Interpreters
6 Regular sources of data
Client data stored in the register are obtained from interpreter requests made by the clients, from letters, from remote interpretation usage data, and from reports submitted by the service providers.
The service providers are selected on the basis of bids for a specified contract term. Additional services may be procured during a contract term as needed. Information about the service providers covered by the framework agreement and the interpreters in their employ is entered into the register upon the signing of the contract.
7 Regular disclosure of data
Kela may disclose client data as authorised by the prevailing legislation. Necessary data may be disclosed to the service provider in accordance with section 24 of the governing law for the purpose of providing the interpreter service requested by the client.
The service providers are subject to a confidentiality obligation.
In order to provide the remote interpretation equipment and the required online connection, as well as to troubleshoot errors, data may be released as needed to outside service providers under contract to Kela. In such cases, the release of the information requires the client’s separate written consent, which the client may withdraw.
8 Transfer of data outside the EU or EEA
None.
9 Retention period for personal data
The generally applicable retention period for client data is 10 years from the date on which the payment of a benefit ended, which is based on the 6-year retention period specified in the Accounting Act and the time required to deal with possible appeals and recoveries. Information on service providers and interpreters is retained for the duration of the contract and an additional 10 years.
10 Principles of register security
At Kela, data security and protection of personal data are systematically taken into account in all use and handling of information. Kela handles all personal data with data protection in mind and in the manner determined by law.
All persons at Kela who handle personal data sign a confidentiality agreement. The register data are used only by authorised persons who need them to perform their official duties.
11 Right of access to data
According to Article 15 of EU Regulation 2016/679, the data subject has the right to access personal data concerning him or her, i.e. a right to check information concerning the person himself or herself.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
12 Right of correction
According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data concerning him or her.
In the request, they must identify the incorrect information, indicate why it is incorrect and specify how it should be amended.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
13 Right of erasure
According to Article 17 of EU Regulation 2016/679, the data subject has the right to request the erasure of personal data concerning him or her.
This right does not concern personal data that Kela needs in order to carry out its statutory duties.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
14 Right to file a complaint with a supervisory authority
According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
Personal data are handled in the course of providing an interpreting service to and from foreign languages (for example as part of Kela’s customer service). The personal data are handled when booking an interpreter for rehabilitation and functional assessment.
1 Data controller
The Social Insurance Institution of Finland (Kela)
PL 450, 00056 KELA or Nordenskiöldinkatu 12
00250 Helsinki
020 634 11
http://www.kela.fi/administration
2 Contact person for register-related matters
Luhta Jouni, Pouttu Merja, Sola Tuomas
Tel. 020 634 11 (exchange)
3 Name of register
Interpreting service to and from foreign languages.
4 Purpose and basis for the handling of personal data
Personal data are handled in the course of providing an interpreting service to and from foreign languages (for example as part of Kela’s customer service). The personal data are handled when booking an interpreter for rehabilitation and functional assessment. They are used to provide rehabilitation and to carry out the functional assessment.
Interpretation to and from foreign languages is based on the following laws:
5 Data content of the register
The following data are stored in the register for the interpreting service to and from foreign languages:
6 Regular sources of data
The customer data stored in the register are retrieved from Kela’s Oiwa system. The interpreter data are obtained from the interpretation provider.
7 Regular disclosure of data
None. However, data may be disclosed to outside service providers contracted by Kela for the purpose of enabling them to provide needed interpretation services. In that case, the data needed to produce the service are disclosed to the providers.
8 Transfer of data outside the EU or EEA
None.
9 Retention period for personal data
Client data are generally retained for 10 years starting from the time the benefit was discontinued. This is based on the six-year retention period specified in the Accounting Act and the additional time that may be needed for appeals and the recovery of over-payments. Data on interpreters are retained for the duration of the contract period and an additional 10 years. The data are confidential.
10 Principles of register security
Kela exercises due care in all its operations and ensures a high level of data protection and data security.
All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.
11 Right of access to data
Under Article 15 of the EU General Data Protection Regulation (EU 2016/679), data subjects have the right to check the data on their person.
Those who wish to check their data must submit a request to Kela.
can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
12 Right of correction
According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data.
The request for correction must be submitted to Kela.
The request must specify the following:
can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
13 Right of erasure
Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.
This right does not extend to personal data that Kela needs to carry out its statutory duties.
The request to erase personal data must be made to Kela.
can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
14 Right to file a complaint with a supervisory authority
According to Article 77 of the General Data Protection Regulation, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of Kela personal data relating to him or her infringes this Regulation.
1 Data controller
The Social Insurance Institution of Finland (Kela)
PL 450, 00056 KELA or Nordenskiöldinkatu 12
00250 Helsinki
020 634 11
http://www.kela.fi/administration
2 Contact person for register-related matters
Marianne Eliander
Tel. 020 634 11 (exchange)
3 Name of register
Queue management system.
4 Purpose and basis for the handling of personal data
The register is used in Kela’s queue management system to process the personal identity code of customers who use the on-site terminal to register. The handling of the personal data is based on the fulfilment of Kela’s statutory responsibilities.
5 Data content of the register
Data contained by the register:
6 Regular sources of data
Data are received from the customers themselves. Customers register at the service point by scanning the barcode on their ID card, driving licence or Kela card on the queue management terminal. The terminal reads the customer’s personal identity code, which is embedded in the barcode.
7 Regular disclosure of data
No personal data are disclosed.
8 Transfer of data outside the EU or EEA
None.
9 Retention period for personal data
Personal data are retained in the queue management system database until the end of the day of visit, and are deleted overnight.
10 Principles of register security
Kela exercises due care in all its operations and ensures a high level of data protection and data security.
All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.
11 Right of access to data
Under Article 15 of the EU General Data Protection Regulation (EU 2016/679), data subjects have the right to access personal data concerning them. This means that per-sons included in the register have the right to check data concerning themselves.
Those who wish to check their data must submit a request to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA (in Swedish).
12 Right of correction
According to Article 16 of EU Regulation 2016679, the data subject has the right to re-quest the correction of inaccurate personal data.
The request for correction must be submitted to Kela.
The request must specify the following:
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA (in Swedish).
13 Right of erasure
Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.
This right does not extend to personal data that Kela needs to carry out its statutory duties.
The request to erase personal data must be made to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA (in Swedish).
14 Right to file a complaint with a supervisory authority
According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of Kela personal data relating to him or her infringes this Regulation.