Student Register Data Protection Notice

Published 3.2.2020 | Updated 22.10.2024

EU General Data Protection Regulation, Articles 13 and 14. Informing the data subject.

Date of draft: 22.5.2018, Updated: 22.10.2024.

1. Data controller

University of the Arts Helsinki

Postal address: P.O. Box 1, FI-00097 Uniarts Helsinki

Telephone: +358 294 47 2000 (switchboard)

2. Entity and person in charge of processing personal data

Milla Vaisto-Oinonen, Senior Head of Academic Affairs

Pinja Metsäranta, Head of Academic Affairs, Academy of Fine Arts
Susanna Ketola, Head of Academic Affairs, Sibelius Academy
Sanna Suonsyrjä, Head of Academic Affairs, Theatre Academy

Contact: opiskelijarekisteri@uniarts.fi or telephone: +358 294 47 2000 (switchboard)

3. Contact persons for the processing of personal data

Student Register and Data Collection for Authorities:

Development Manager Lotta Lassila
Specialist Heli Rautioaho

Study Attainments and their Evaluation:

Mari Karjalainen, Senior Advisor, Open Campus
Pinja Metsäranta, Head of Academic Affairs, Academy of Fine Arts
Susanna Ketola, Head of Academic Affairs, Sibelius Academy
Sanna Suonsyrjä, Head of Academic Affairs, Theatre Academy

International Exchanges:

Ulla Tissari, Coordinator, Academy of Fine Arts
Leena Veijonsuo, Specialist, Sibelius Academy
Jyri Äärilä, Coordinator, Theatre Academy

Contacts: opiskelijarekisteri@uniarts.fi or telephone: +358 294 47 2000 (switchboard)

4. Data Protection Officer

Uniarts Helsinki’s Data Protection Officer is lawyer Minna Eskola.

Email Address: tietosuoja@uniarts.fi 

Phone: +358 0294 47 3940

Postal address: P.O. Box 1, FI-00097 Uniarts Helsinki

5. Name of Register

Student register

6. What is the purpose and legal basis for processing personal data?

The purpose of the processing of personal data is to enable studies, teaching, and other tasks of the University in accordance with the University Act and carrying out the official duties of the University. In practice, personal data are processed i.e. when students enrol for the study year or for teaching, when recording study attainments, credits, student exchanges, and degrees, when laying down and printing out certificates, when organizing teaching and tuition, when setting up teaching-related artistic activities, when collecting student feedback, and when relaying membership data to the Student Union. 

Data in the student register are also needed for planning teaching and University activities as well as executing communications aimed at students. Personal data may be used in scientific research activities. Statistics are established in the manner obliged by the Ministry of Education and Culture.

In many processes, the provision of personal data is a necessary prerequisite for handling the matter.  

Uniarts Helsinki’s right to process personal data is based on:

• Fulfilling the university’s statutory obligations
• Public interest
• Partial consent

 Processing personal data is based on fulfilling the legal obligations of the University in accordance with the Act on the student admission register, the national data repository of higher education institutions and the matriculation examination register (person-specific ID data and data on the university degrees obtained by the person, on study attainments with their grades, on study rights pertaining to degree-based education, on accepting a degree place, and on enrolment) as well as pursuant to legislation on collecting data for authorities (e.g. the Ministry of Education and Culture, the Central Statistical Office of Finland, the Social Insurance Institution of Finland, the Student Union, and the Finnish Student Health Service). 

The processing of personal data is based on public interest so that the University can arrange its activities efficiently and with high quality and provide the student with the data, equipment, services and resources needed including the possibility to use the University’s premises. The University also uses personal data when granting scholarships and tuition fee reliefs to support studies and when organizing junior education in music. Personal data are also processed in student feedback processes and in decision-making in multimember organs pursuant to the University Act i.a.

As for statistics, the processing of personal data is based on a legal obligation and on public interest from the point of view of scientific research activities.  

The processing of personal data is based on the student’s consent for disclosing his or her personal data and contact information outside the University for purposes aimed at promoting studies, for opinion surveys and for marketing, for recruiting purposes, or for a public register.

When processing personal data, we do not make use of automated decision-making and profiling as referred to in the Data Protection Regulation.

6. What data do we process?

We process the following personal data in connection with the student register:

• Basic information about a data subject: name, date of birth, personal ID,  student number, user ID and/or other person-specific ID, password, gender, mother tongue, language of contact, nationality, and place of origin;
• Contact information of a data subject: e-mail address, telephone number, and address data; 
• For those minors taking part in the junior education provided by the Sibelius Academy, a study certificate from a basic comprehensive school or from an institution of secondary education as well as (for underage students) the caregiver’s name, street address, telephone number, and e-mail address are also gathered.
• Information about studies and study rights:
  • The student’s study rights and their validity period
  • Right to study quota
  • Date of inscription in the student register
  • The student’s study rights 
  • Date of inscription in the student register
  • Granter and date of granting of the study right
  • Period of validity of the study right 
  • Eventual extension for finishing the studies
  • Presence/absence data per study year and removal from records
  • For the students subject to a tuition fee, information about the payment obligation, about the validity of the permit of residence, and about the relief granted on the tuition fee.
  • The student’s organization, degree programme, eventual orientation module, and/or main instrument
  • Position of study right (primary/secondary etc.)
  • Scope of study right (e.g. right to earn a lower or higher degree, right to earn a post-graduate degree, separate studies, studies at the Open University, studies in junior education)
  • Quota of study right
  • Eventual disciplinary measures applied on the student 
  • Information about the student’s eventual exchange studies (exchange programme, target institution, and exchange period)
  • Exemption from language skill requirements
  • Information about a personal study plan: information about the student’s study right, about the study modules and periods, about the objectives and about the assessment of the plan as recorded by the student, about studies attained, and about the supervisors, as well as supervisor feedback
  • A plan for the final project  
  • The teaching and supervision given to the student (group and personal teaching): type, kind, start and end date of teaching events, teaching language, responsible teacher, and unit in charge
  • Enrolment data on courses: identification data on the teacher of the course and on the student who has enrolled, including eventual letters of motivation and eliminatory preliminary assignments
• The student’s study attainments
  • The ID, the type (e.g. course or module), the name, and the scope of the study, date of attainment, valdator, and grade 
  • The degrees earned and the studies attained by the student at the University of the Arts Helsinki, related data on the degree programme, on the eventual orientation module/main instrument, date of completion, and scope
  • Feedback given by the student on teaching is gathered on a student-by-student basis but the information cannot be connected with any specific student.  
  • For theses and dissertations and eventual other written assignments, a system for identifying plagiarisms records the student’s name and e-mail address as well as the text that he or she has produced.
• Permissions given by the student for disclosing information
• Upon permission given by the data subject, the University of the Arts Helsinki may disclose students’ personal data and contact information beyond the University for purposes of promoting studies, for opinion surveys, and for marketing and recruiting purposes.
• Eventual other information gathered separately upon consent given by the data subject
  • A photograph on a website and/or in the intranet (e.g. class photographs of students in the Theatre Academy)
  • Information about participants in events and eventual event-related information including dietary restrictions
  • Personal data related to artistic activities (productions), e.g. student-specific information required by the wardrobe department
  • Information related to grants

7. Where do we get information?

We mainly get information from the data subjects in person. We also get personal from the following actors and systems:

• Registration data are obtained from the national applicant register maintained by the Finnish National Agency for Education (Opetushallitus) (Act 1058/1998), from the OILI enrolment service and from the documents submitted to the University by the student.
• Information about study attainments are most often obtained from teachers. Attainment data are also received from academic organs and from other assessment groups.
• Information about students and study rights of the Open University are transferred from the registration system of the Open University.
• The e-mail addresses of the University of the Arts Helsinki are imported from the user and administration register of the University.
• Basic information about the University personnel is transferred from the staff management system. 
• Decisions made by the rector, deans, bodies and study administration of University of the Arts Helsinki (e.g. admission decisions, exemptions from language studies, and switching study rights).
• The data recorded in the Joopas system regarding the Flexible Study Right (JOO) are used as basic data in the student data system of the target university and in invoicing for mobility studies between universities.

Additionally, personal data may also be collected and updated from sources publicly available and from authorities or from other third parties for the purposes described in this data protection statement within the limits of applicable legislation. Such updating of data is performed manually or by automatic means.

8. To whom do we disclose and transfer data, and do we transfer data outside the EU or the EEA?

Via a technical user connection through the national data warehouse for higher education for use in the admission register (Section 6(d) of the Act 1058/1998).

• For the Ministry of Education and Culture, whichproduces data materials from student information sourced from the national data warehouse for higher education, as required in the assessment, development and compilation of statistics and other follow-up and steering of education and research (Section 6(d) of the Act 1058/1998)
• For the Central Statistical Office of Finland (Section 15 of Statistics Act 280/2004) as a technical record directly and via the national data warehouse for higher education
• For the Social Insurance Institution of Finland (Kela) (Section 41 of the Act on Financial Aid for Students 65/1994) 
• For the Student Union of the University of Arts Helsinki (University Act 558/2009) and for he enterprise Frank Oy
• For the Finnish Student Health Service in accordance with Section 14 of the Primary Health Care Act
• For scientific research, for statistical purposes, and for a public register. The requesting party shall indicate to the controller the purpose for which the data are to be used and provide any other clarification needed to establish the prerequisites for the discosure of the data as well as information about how data protection is to be arranged. The data subject may refuse disclosing information for a public register.
• Information about exchange studies for the Finnish National Agency for Education (target institution, exchange programme, and its time). 
• Information via the VIRTA higher education achievement register in view of subsequent surveys for purposes of follow-up, of creating statistics, and of conducting research.
• We disclose personal data on students subject to a tuition fee to the financial services of the University for drawing up tuition fee invoices.
• On permission given by the data subject, the University of the Arts Helsinki may disclose students’ personal data and address information outside the University for purposes of promoting studies, for opinion surveys, and for marketing and recruitment purposes.
• The University of the Arts Helsinki discloses personal data and address information of those students subject to a tuition fee and those international exchange students who have given their consent thereto to the Foundation for Student Housing in the Helsinki Region. 
• The personal data in the student register may also be used as regards services aimed at students, such as university sports, if the service provider producing services for the University so requests in order to verify a student’s study right. 
• Personal data in the student register may also be disclosed to partner universities regarding those students who take part in teaching executed together or in mobility studies between institutions of higher education.   
• For The Service Center for Continuous Learning and Employment (SECLE), information about the credits of regulated education funded by SECLE.
• For Digivision’s opin.fi service attendance, right to study and study performance data, which are stored in the service with the student’s consent.   
• The University of the Arts Student Union also has the possibility to verify a student’s enrolment situation and payment of the Student Union membership fee in the study administration system. The Student Union also has the right to use those University e-mail lists that are used for Student Union communications. 
• Foreign higher education institutions, also outside the EU and EEA, for the implementation of exchange studies and double or joint degree studies or for the transfer of completion data.

We also disclose personal data directly to other Finnish higher education institutions in order to process the right to study and transfer performance data, for example in teaching cooperation

 In processing personal data, we use subcontractors working for us. We have outsourced IT administration to third-party service providers administering and protecting the server on which personal data are saved. We have taken steps with our subcontractors to ensure your data protection by concluding data-processing agreements. 

Generally, we do not transfer personal data beyond the EU or outside the EEA. In those cases where we transfer personal data outside the EU/EEA, we have taken care of the appropriate protective measures related to the transfer. We use standard contract clauses approved by the EU.

9. How do we protect the data and how long do we store the data?

Only those of our employees who are authorized to process student information in their line of work are entitled to use the system containing personal data. Each user has a personal user ID and a password into the system. The data are gathered in databases protected with firewalls, passwords, and other technical means. The databases and their backup copies are situated in locked spaces, and the data can only be accessed by certain pre-named persons.

We keep personal data for as long as is necessary for the purpose for which they are used. The data management plan of the University is followed in data storage. The students’ study attainments and degrees are data kept on a permanent basis.

We regularly evaluate the need to preserve data in keeping with the applicable legislation. In addition, we will take such reasonable steps as are necessary to ensure that no personal information about data subjects that is incompatible with the purposes of data processing, outdated, or erroneous is kept in the register. We will rectify or erase such information without delay.

10. What are your rights as a data subject?

Data subjects have the following rights:

• Right of access to your data
• Right to information on the processing of personal data
• Right to rectification of inaccurate or inaccurate personal data
• Right to erasure
  • Not applicable if the processing is based on a task carried out by law or in the public interest
• Right to restriction of processing
• Right to object to processing, i.e. to request that data not be processed
• Right to data portability
  • Applicable when processing is based on a contract or consent
  • The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal of consent
• Right to withdraw consent
  • Applicable where processing is based solely on consent
• Right to information about a high-risk personal data breach
• Right not to be subject to automated decision-making

In particular, the data subject has the right to lodge a complaint with the supervisory authority corresponding to the location of his or her permanent residence or place of work if he or she considers that the processing of personal data infringes the EU General Data Protection Regulation (EU) 2016/679. The data subject also has the right to administrative and other legal remedies.  (www.tietosuoja.fi/ilmoitus-tietosuojavaltuutetulle).

11. Who can you contact?

Questions and contacts concerning the processing of personal data described in this privacy notice can be addressed to the contact person named in section 3, who will refer the matter to the Data Protection Officer if necessary. If you consider that your rights mentioned in section 11 are not fulfilled, you can contact the university’s Data Protection Officer named in section 4 directly.