The Regional Council of Northern Ostrobothnia is a statutory joint municipal authority that, in accordance with the Land Use and Building Act, manages the regional planning of its area and, in accordance with the Regional Development Act, is responsible for the general development of the area. The lawful performance of these tasks also requires the processing of personal data.
The processing of data is based on several laws or regulations, but often also on consent. The Regional Council of Northern Ostrobothnia acts in accordance with the general principles of the European Union. the Data Protection Regulation the General Data Protection Regulation (GPDR); and the Data Protection Act.
the Regional Council of Northern Ostrobothnia security and data protection rule approved by the Provincial Government on 23 May 2022.
Collection, processing and storage of personal data
The Regional Council of Northern Ostrobothnia collects only essential information for its operations, such as names and contact information. The processing of personal data is always related to the performance of a task. In addition, personal data is protected by various technical and administrative measures to ensure that only those persons who have the right to process the data have access to it.
In some cases, personal data may be disclosed to third parties, such as various authorities to which the Regional Council of Northern Ostrobothnia is legally obliged to disclose data or parties that carry out the processing of personal data on behalf of the Regional Council of Northern Ostrobothnia. The Regional Council of Northern Ostrobothnia ensures that only processors that meet the requirements of the General Data Protection Regulation can be complained about as contractual partners. In these cases, the Regional Council of Northern Ostrobothnia retains the responsibility of the controller. The data will not be disclosed for direct advertising, distance selling or other direct marketing or for market and opinion surveys.
Personal data is stored for the period required by various laws. The retention periods are specified in more detail in the archiving plan. The retention periods also take into account the decisions of the National Archives of Finland on documents to be retained permanently and the recommendations of the Association of Finnish Local and Regional Authorities on the retention periods of documents. In accordance with good data management practices, data is destroyed when it is no longer needed.
Requests relating to personal data
The controller must be able to confirm the identity of the data subject exercising his or her data protection rights. For this reason, requests related to personal data must be made in person at the office of the Regional Council of Northern Ostrobothnia at the following address:
Council of Oulu Region
Poratie 5 A
90140 Oulu
The request may relate to access, rectification, erasure, transfer, restriction of processing or objection to processing.
The requested information will be provided within one month of receipt of the request.
Requests related to the data must identify the person whose data is being requested (personal identification number, name, address) and the period during which the data is to be checked. In connection with inspection requests, the identity of the requester is always checked.
Data controller
Council of Oulu Region
Poratie 5 A, 90140 Oulu
Tel. 040 685 4000
kirjaamo@pohjois-pohjanmaa.fi
Data Protection Officer
The Data Protection Officer (DPO) is an in-house expert who monitors the processing of personal data and helps to comply with data protection regulations. The Data Protection Officer of the Regional Council of Northern Ostrobothnia is Markku Lipponen, Head of Information Management, markku.lipponen@pohjois-pohjanmaa.fi, tel. +358 (0)40 707 2721.
Contact details of the Data Protection Ombudsman
Office of Data Protection Commissioners
Lintulahdenkuja 4, 00530 Helsinki/ P.O. Box 800, 00531 Helsinki
Switchboard: 029 566 6700
Registry: 029 566 6768
tietosuoja@om.fi
The data subject's rights also include being informed of personal data breaches if they occur.
Notification to the Data Protection Ombudsman
Personal Data Repositories
| Repository of personal data | Purposes of processing | Legal basis for processing | Personal data retention period or criteria |
|---|---|---|---|
| The Cultural Bank of Finland's information reservoir | The register is used to store the data of service providers (service providers) and subscribers (service buyers). The online service can be used to register professional cultural and artistic operators. Any party or person in need of cultural and artistic services can register as a subscriber.The register includes name and contact information, registration codes, photograph, educational background, information on grants. | The processing is based on the data subject's consent. | Storage in accordance with the archiving plan. |
| Case Management Data Repository | The names and contact details of the parties are processed in order to maintain a register of cases in accordance with the Data Management Act and to resolve pending cases. The registration and electronic storage of matters pending and held by the Regional Council of Northern Ostrobothnia, their metadata and documents concerning the processing of matters are based on the Data Management Act. | The processing is based on the performance of a task carried out in the public interest or in the exercise of official authority. | The data retention periods vary depending on the subject matter or document processed. The retention periods are specified in the data management plan. |
| ERDF Data Repository | The names and contact details of the applicants and promoters of the projects concerned, as well as the salary data of the staff of the project promoters, are processed for the purpose of processing applications for projects financed by the ERDF Structural Fund programme, as well as for the purpose of making financing and payment decisions, and may also be used to carry out any verifications, ex-post monitoring and recoveries. | The processing is based on the performance of a task carried out in the public interest or in the exercise of official authority. | Data is stored permanently |
| ENI Data Repository | The names and contact details of the applicants and promoters of the projects concerned, as well as the salary data of the staff of the project promoters, are processed for the purpose of processing applications for projects funded by the ENI Structural Funds programme, as well as for the purpose of financing and payment decisions, and may also be used to carry out any verifications, ex-post monitoring and recoveries. | The processing is based on the performance of a task carried out in the public interest or in the exercise of official authority. | Data is stored permanently |
| Human Resources Repository | The personnel's personal and contact details, bank details, employment data and information on pay and salary payment are processed to implement the personnel and payroll administration of the Regional Council of Northern Ostrobothnia. Kuntarekry is used to map the competence of the personnel. | The processing is based on the performance of a task carried out in the public interest or in the exercise of official authority. | 50 years |
| Confidential Personal Data Repository | The personal and contact details of the trustees, as well as bank details, are processed for the purpose of carrying out the duties of trust of the Regional Council of Northern Ostrobothnia and for the purpose of paying the remuneration and compensation due to the duties of trust. | The processing is based on the performance of a task carried out in the public interest or in the exercise of official authority. | Data is stored for the duration of the position of trustee |
| Data Repository for Regional Planning | The name and contact details of the parties involved in the zoning process, as well as any property code, are processed to implement the zoning process in accordance with the Land Use and Building Act and to produce regional plan data. | The processing is based on the performance of a task carried out in the public interest or in the exercise of official authority. | Data is stored permanently |
| Travel Invoice Data Repository | Staff name, address, bank account and travel data are processed to collect the necessary travel information and to draw up travel invoices, daily allowance applications and driving logs. | The processing is based on the consent of the data subject. | 10 years |
| Encumbrance data pool | Information on the interests of the chairpersons of the provincial council and the provincial government, the members and deputy members of the provincial government, the chairpersons of the audit committee and the office-holders acting as rapporteurs for the above-mentioned bodies are processed in order to register the interests of the elected officials and office-holders of the Regional Council of Northern Ostrobothnia. | The processing is based on the performance of a task carried out in the public interest or in the exercise of official authority. | At the end of a position of trust or position subject to the reporting obligation, data concerning a person are removed from the register and the data network. |
| Financial Management Data Repository | Personnel's name, salary and job title data are processed as part of the accounts of the Regional Council of Northern Ostrobothnia, as well as the purchase and sales ledger, carried out in accordance with the Accounting Act, in order to implement payroll. | The processing is based on the performance of a task carried out in the public interest or in the exercise of official authority. | 10 years |
| Working time monitoring and access control data pool | Personnel identification data and time tracking data are processed to implement the employer's operations. | The processing is based on the consent of the data subject. | 10 years |
| Newsletter Repository | The e-mail address of those who have subscribed to the newsletter will be processed for the purpose of sending the newsletter. | The processing is based on the consent of the data subject. | The data will be stored for the duration of the publication of the newsletter or until the data subject cancels his/her subscription |
| Webropol Data Repository | Information on the names, addresses and e-mail addresses of persons who have registered for events and events is processed for the purpose of organising and informing about events and events. Depending on the nature of the surveys, background information on the respondents. | The processing is based on the consent of the data subject. | The data will be stored for the duration of the event or event or for the duration of the analysis of the results of the survey. |
| Recruitment Data Repository | Task, applicant and decision information needed for recruitment. | The processing is based on the consent of the data subject. | The data is stored in the Kuntarekry service during the recruitment process. In addition, the decision data is stored in the case management system in accordance with the information management plan. |
Data protection legislation and the preliminary ruling of the Court of Justice
EU General Data Protection Regulation 2016/679
.
