Student Register Data Protection Statement

Articles 13 and 14 of the EU General Data Protection Regulation. Informing a data subject. Drawn up on May 22, 2018

1. Controller

University of the Arts Helsinki

Telephone: +358 294 47 2000 (exchange)

Postal address: P.O. Box 1, FI-00097 UNIARTS

2. Entity and person in charge of processing personal data

Sanna Kotajärvi-Söderholm, Senior Head of Academic Affairs

Pinja Metsäranta, Head of Academic Affairs, Academy of Fine Arts

Sanna Suonsyrjä, Head of Academic Affairs, Theatre Academy

Sanna Viitanen, Head of Academic Affairs, Sibelius Academy

Contact: studentregister@uniarts.fi or telephone: +358 294 47 2000 (switchboard)

3. Contact persons for handling personal data

Student Register and Data Collection for Authorities:

  • Coordinator Heli Rautioaho
  • Coordinator Tuuli Kettunen

Study Attainments and their Evaluation: 

  • Sanna Takala, Education Manager, Open Campus
  • Pinja Metsäranta, Head of Academic Affairs, Academy of Fine Arts
  • Sanna Suonsyrjä, Head of Academic Affairs, Theatre Academy
  • Susann Vainisalo, Project Manager, identification of plagiarism in theses and dissertations

International Exchanges: 

  • Ulla Tissari, Coordinator, Academy of Fine Arts
  • Leena Veijonsuo, Expert, Sibelius Academy
  • Jaakko Hannula, Coordinator, Theatre Academy
  • Contacts: opiskelijarekisteri@uniarts.fi or telephone: +358 294 47 2000 (switchboard)

Students’ Personal Data for Location Bookings:

  • Kari Karlsson, Facilities Expert

4. Data protection officer

Specialist Antti Orava works as Data Protection Officer at the University of the Arts Helsinki.

E-mail address: privacy@uniarts.fi

Telephone: +358 294 47 3568

Postal address: P.O. Box 1, FI-00097 UNIARTS

5. Name of Register

Student register

The purpose of the processing of personal data is to enable studies, teaching, and other tasks of the University in accordance with the University Act and carrying out the official duties of the University. In practice, personal data are processed i.e. when students enrol for the study year or for teaching, when recording study attainments, credits, student exchanges, and degrees, when laying down and printing out certificates, when organizing teaching and tuition, when setting up teaching-related artistic activities, when collecting student feedback, and when relaying membership data to the Student Union. 

Data in the student register are also needed for planning teaching and University activities as well as executing communications aimed at students. Personal data may be used in scientific research activities. Statistics are established in the manner obliged by the Ministry of Education and Culture. 

Processing personal data is based on fulfilling the legal obligations of the University in accordance with the Act on the student admission register, the national data repository of higher education institutions and the matriculation examination register (person-specific ID data and data on the university degrees obtained by the person, on study attainments with their grades, on study rights pertaining to degree-based education, on accepting a degree place, and on enrolment) as well as pursuant to legislation on collecting data for authorities (e.g. the Ministry of Education and Culture, the Central Statistical Office of Finland, the Social Insurance Institution of Finland, the Student Union, and the Finnish Student Health Service). 

The processing of personal data is based on public interest so that the University can arrange its activities efficiently and with high quality and provide the student with the data, equipment, services and resources needed including the possibility to use the University’s premises. The University also uses personal data when granting scholarships and tuition fee reliefs to support studies and when organizing junior education in music. Personal data are also processed in student feedback processes and in decision-making in multimember organs pursuant to the University Act i.a.

As for statistics, the processing of personal data is based on a legal obligation and on public interest from the point of view of scientific research activities.  

The processing of personal data is based on the student’s consent for disclosing his or her personal data and contact information outside the University for purposes aimed at promoting studies, for opinion surveys and for marketing, for recruiting purposes, or for a public register.

When processing personal data, we do not make use of automated decision-making and profiling as referred to in the Data Protection Regulation.

7. What data do we process?

We process the following personal data in connection with the student register:

  • Basic information about a data subject: name, date of birth, personal ID,  student number, user ID and/or other person-specific ID, password, gender, mother tongue, language of contact, nationality, and place of origin;
  • Contact information of a data subject: e-mail address, telephone number, and address data; 
  • For those minors taking part in the junior education provided by the Sibelius Academy, a study certificate from a basic comprehensive school or from an institution of secondary education as well as (for underage students) the caregiver’s name, street address, telephone number, and e-mail address are also gathered.
  • Information about studies and study rights:
    • The student’s study rights 
    • Date of inscription in the student register
    • The student’s study rights 
    • Date of inscription in the student register
    • Granter and date of granting of the study right
    • Period of validity of the study right 
    • Eventual extension for finishing the studies
    • Presence/absence data per study year and removal from records
    • For the students subject to a tuition fee, information about the payment obligation, about the validity of the permit of residence, and about the relief granted on the tuition fee.
    • The student’s organization, degree programme, eventual orientation module, and/or main instrument
    • Position of study right (primary/secondary etc.)
    • Scope of study right (e.g. right to earn a lower or higher degree, right to earn a post-graduate degree, separate studies, studies at the Open University, studies in junior education)
    • Quota of study right
    • Eventual disciplinary measures applied on the student 
    • Information about the student’s eventual exchange studies (exchange programme, target institution, and exchange period)
    • Exemption from language skill requirements
    • Information about a personal study plan: information about the student’s study right, about the study modules and periods, about the objectives and about the assessment of the plan as recorded by the student, about studies attained, and about the supervisors, as well as supervisor feedback
    • A plan for the final project  
    • The teaching and supervision given to the student (group and personal teaching): type, kind, start and end date of teaching events, teaching language, responsible teacher, and unit in charge
    • Enrolment data on courses: identification data on the teacher of the course and on the student who has enrolled, including eventual letters of motivation and eliminatory preliminary assignments
  • The student’s study attainments
    • The ID, the type (e.g. course or module), the name, and the scope of the study, date of attainment, valdator, and grade 
    • The degrees earned and the studies attained by the student at the University of the Arts Helsinki, related data on the degree programme, on the eventual orientation module/main instrument, date of completion, and scope
    • Feedback given by the student on teaching is gathered on a student-by-student basis but the information cannot be connected with any specific student.  
    • For theses and dissertations and eventual other written assignments, a system for identifying plagiarisms records the student’s name and e-mail address as well as the text that he or she has produced.
  • Permissions given by the student for disclosing information
  • Upon permission given by the data subject, the University of the Arts Helsinki may disclose students’ personal data and contact information beyond the  University for purposes of promoting studies, for opinion surveys, and for marketing and recruiting purposes.
  • Eventual other information gathered separately upon consent given by the data subject 
    • A photograph on a website and/or in the intranet (e.g. class photographs of students in the Theatre Academy)
    • Information about participants in events and eventual event-related information including dietary restrictions
    • Personal data related to artistic activities (productions), e.g. student-specific information required by the wardrobe department

8. Where do we get information?

We mainly get information from the data subjects in person. We also get personal from the following actors and systems:

  • Registration data are obtained from the national applicant register maintained by the Finnish National Agency for Education (Opetushallitus) (Act 1058/1998), from the OILI enrolment service and from the documents submitted to the University by the student.
  • Information about study attainments are most often obtained from teachers. Attainment data are also received from academic organs and from other assessment groups.
  • Information about students and study rights of the Open University are transferred from the registration system of the Open University.
  • The e-mail addresses of the University of the Arts Helsinki are imported from the user and administration register of the University.
  • Basic information about the University personnel is transferred from the staff management system. 
  • Decisions made by the University of the Arts Helsinki and by its rector, by its deans, by its organs, and by the study administration (e.g. admission decisions, exemptions from language studies, and switching study rights).
  • The data recorded in the Joopas system regarding the Flexible Study Right (JOO) are used as basic data in the student data system of the target university and in invoicing for mobility studies between universities.

Additionally, personal data may also be collected and updated from sources publicly available and from authorities or from other third parties for the purposes described in this data protection statement within the limits of applicable legislation. Such updating of data is performed manually or by automatic means.

9. To whom do we disclose and transfer data, and do we transfer data outside the EU or the EEA?

Via a technical user connection through the national data warehouse for higher education for use in the admission register (Section 6(d) of the Act 1058/1998).

  • For the Ministry of Education and Culture, whichproduces data materials from student information sourced from the national data warehouse for higher education, as required in the assessment, development and compilation of statistics and other follow-up and steering of education and research (Section 6(d) of the Act 1058/1998)
  • For the Central Statistical Office of Finland (Section 15 of Statistics Act 280/2004) as a technical record directly and via the national data warehouse for higher education
  • For the Social Insurance Institution of Finland (Kela) (Section 41 of the Act on Financial Aid for Students 65/1994) 
  • For the Student Union of the University of Arts Helsinki (University Act 558/2009) and for he enterprise Frank oy
  • For the Finnish Student Health Service in accordance with Section 14 of the Primary Health Care Act
  • For scientific research, for statistical purposes, and for a public register. The requesting party shall indicate to the controller the purpose for which the data are to be used and provide any other clarification needed to establish the prerequisites for the discosure of the data as well as information about how data protection is to be arranged. The data subject may refuse disclosing information for a public register.
  • Information about exchange studies for the Finnish National Agency for Education (target institution, exchange programme, and its time). 
  • Information via the VIRTA higher education achievement register in view of subsequent surveys for purposes of follow-up, of creating statistics, and of conducting research, and, via a technical user connection, to the University Admissions Finland consortium for processing admission applications in its member universities.
  • We disclose personal data on students subject to a tuition fee to the financial services of the University for drawing up tuition fee invoices.
  • On permission given by the data subject, the University of the Arts Helsinki may disclose students’ personal data and address information outside the University for purposes of promoting studies, for opinion surveys, and for marketing and recruitment purposes.
  • The University of the Arts Helsinki discloses personal data and address information of those students subject to a tuition fee and those international exchange students who have given their consent thereto to the Foundation for Student Housing in the Helsinki Region. 
  • The personal data in the student register may also be used as regards services aimed at students, such as university sports, if the service provider producing services for the University so requests in order to verify a student’s study right. 
  • Personal data in the student register may also be disclosed to partner universities regarding those students who take part in teaching executed together or in mobility studies between institutions of higher education.   

The University of the Arts Student Union also has the possibility to verify a student’s enrolment situation and payment of the Student Union membership fee in the study administration system. The Student Union also has the right to use those University e-mail lists that are used for Student Union communications.   

In processing personal data, we use subcontractors working for us. We have outsourced IT administration to third-party service providers administering and protecting the server on which personal data are saved. We have taken steps with our subcontractors to ensure your data protection by concluding data-processing agreements. 

We do not transfer personal data beyond the EU or outside the EEA.

10. How do we protect data and how long will we keep them?

Only those of our employees who are authorized to process student information in their line of work are entitled to use the system containing personal data. Each user has a personal user ID and a password into the system. The data are gathered in databases protected with firewalls, passwords, and other technical means. The databases and their backup copies are situated in locked spaces, and the data can only be accessed by certain pre-named persons.

We keep personal data for as long as is necessary for the purpose for which they are used. The data management plan of the University is followed in data storage. The students’ study attainments and degrees are data kept on a permanent basis.

We regularly evaluate the need to preserve data in keeping with the applicable legislation. In addition, we will take such reasonable steps as are necessary to ensure that no personal information about data subjects that is incompatible with the purposes of data processing, outdated, or erroneous is kept in the register. We will rectify or erase such information without delay.

11. What are your rights as a data subject?

Data subjects are entitled to check the data concerning them and stored in the personal data register and require erroneous, outdated, unnecessary, or unlawful data to be rectified or erased. In case a data subject has personal access to their data, they can modify their data himself or herself. In case processing is based on a consent, a data subject also has the right to withdraw his or her consent or to alter it.

As of May 25, 2018, data subjects have, according to the Data Protection Regulation, the right to object to processing or to request restriction of processing of data as well as to lodge a complaint with a supervisory authority on processing personal data.

For specific reasons of personal nature, data subjects also have the right to object to processing activities concerning them when processing data is based on our legitimate interest. In conjunction with the request, the data subject shall specify the particular situation on the basis of which he or she objects to processing. We may refuse to execute an objection-related request only on the basis of grounds stated in law.

Should the data subject not be satisfied with the way the University has processed his or her personal data, he or she may demand the national data protection authority (in Finland, the Data Protection Ombudsman whose contact information is available in the web address http://www.tietosuoja.fi/en/) to look into the matter.

A person has at all times the right to withdraw his or her consent for electronic direct marketing via the Unsubscribe feature of direct-marketing letters or by contacting the contact person of account management.

12. With whom can you get in touch?

You may present your other questions on the processing of personal data as described in this statement by getting in touch with the contact person named in Point three who will, in case of need, forward the matter to the data protection officer. Contacts via e-mail: opiskelijarekisteri@uniarts.fi.

In case you feel that your rights as mentioned in Point 11 are not respected, you may get directly in touch with the University Data Protection Officer named in Point four.