Joint controller
Social Insurance Institution of Finland
Nordenskiöldinkatu 12, 00250 Helsinki
P.O. Box 450, 00056
tel. 020 634 11
Person responsible for register issues or contact person
Client inquiries about the data file of the system for issuing declarations of intent can be addressed to Kanta Services customer support at asiakaspalvelu@kanta.fi.
In matters concerning the rights of a data subject, please email enquiries to the Kanta Services’ Data Protection Officer at tietosuoja@kanta.fi.
Name of the register
System for issuing declarations of intent
Purpose of processing personal data / purpose of use of the register
The system for issuing declarations of intent is a national information system service that maintains the declarations of intention related to the processing of information about the Kanta Services, consent to data sharing, denials of consent to data sharing, consent in patient data summaries and documents on the denial of consent to contact regarding findings in research data, as well as other declarations of intent related to social welfare and healthcare services and the processing of client data.
Each healthcare or social welfare service provider and the Social Insurance Institution of Finland (hereinafter Kela) are joint controllers of the system for issuing declarations of intent.
Kela is responsible for the usability of the Kanta Services and the data stored therein. Kela is responsible for storing the data recorded in Kanta, and in connection is responsible for the integrity, destruction and non-repudiation of the data stored in Kanta. In addition, Kela is responsible for ensuring the destruction of data after the end of the retention period (Act on the Processing of Client Data in Healthcare and Social Welfare 703/2023, sections 23, 66 and 72). Service providers storing documents in the system for issuing declarations of intent are responsible for the accuracy of data entered and for other controller obligations.
Kela acts as the contact point referred to in Article 26(1) of the General Data Protection Regulation. As the contact point, Kela is responsible for fulfilling and implementing the data controller’s obligation to inform as stipulated in data protection legislation with regard to the system for issuing declarations of intent. In addition, Kela acts as the primary contact point for requests concerning the rights of data subjects and is responsible for disclosing the data stored in the system for issuing declarations of intent.
Legislation concerning joint controllership and the procedures to be complied with in joint controllership are addressed in the document relating to it.
With the help of documents stored in the system for issuing declarations of intent, the data subject has the right to influence the disclosure of their client data. With the help of documents related to the management of data sharing to be recorded in the system for issuing declarations of intent, social welfare and health care service providers can implement the data subject’s intent regarding the disclosure of their data. In addition, health care and social welfare service providers can utilise other documents stored in the system for issuing declarations of intent in organising and implementing the service.
The data about the provision of information about the Kanta Services and declarations of intent stored in the system for issuing declarations of intent may, under the conditions laid down by law, be utilised in scientific research, reporting, and in the compilation of statistics.
The documents on the provision of information about the Kanta Services and the latest versions of the documents regarding declarations of intent stored in the system for issuing declarations of intent are stored for 12 years after the client’s death. Previous versions of documents of declarations of intent are stored for 12 years after the latest version was drawn up.
If the date of death is not known, the data shall be retained for 120 years from the client’s birth date. After that, the data will be destroyed.
Data content of the register
The following data is entered in the system for issuing declarations of intent:
- information about the fact that a client has been informed of the nationwide information system services (Kanta Services)
- client’s declarations of intent concerning the disclosure of their data as well as their denials of consent (consent to data sharing, denials of consent to data sharing and consent for patient data summaries)
- denial of consent to contact based on clinical findings and the withdrawal of such consent
- the client’s living will and their opinion on organ donation.
Regular data sources
Healthcare and social welfare service providers that have joined the Kanta Services enter the client’s data on declarations of intent in the system for issuing declarations of intent.
The client can also enter declarations of intent in MyKanta, from where they are saved in the system for issuing declarations of intent.
Regular disclosure of data and transfer of data outside the EU or the European Economic Area
Healthcare or social welfare service providers use the data in the system for issuing declarations of intent or viewed via the system when implementing and arranging the client’s health or medical care.
Based on the consent given by the data subject regarding patient data summaries, the information in the patient data summaries may be disclosed within the EU.
The data is not transferred outside the EU or the European Economic Area.
Principles of protecting the register
The data stored in the system for issuing declarations of intent are confidential information concerning a person’s social welfare and health care.
Organisational protection principles
Healthcare and social welfare service providers and Kela monitor and supervise the lawfulness of data processing for their own part. Each party has an information security plan to ensure data protection and information security. Kela and every healthcare and social welfare service provider have appointed a data protection officer.
Kela and the responsible manager of the healthcare and social welfare service provider shall issue written instructions on the processing of data in the system for issuing declarations of intent and ensure sufficient expertise and competence among the personnel when processing a client's data.
Kela and the healthcare and social welfare service provider shall on their own initiative take necessary measures if data entered in the system for issuing declarations of intent has been unlawfully accessed, used or shared.
In order to implement monitoring and supervision, healthcare and social welfare service providers using the system for issuing declarations of intent have the right to obtain log data from Kela with regard to the viewing and handling of data in the system for issuing declarations of intent by staff members of the service provider in question.
Principles of technical protection
Browsing, recording and other processing of data in the system for issuing declarations of intent and accessible via the system require strong authentication that identifies the processor, as well as access rights management related to the system by both the healthcare service provider and Kela.
The Digital and Population Data Services Agency is responsible for the identification and certification services in the Kanta Services.
The healthcare and social welfare service provider and Kela are responsible for the management of access rights for their own part.
Log data is recorded in the log of the system for issuing declarations of intent on all browsing and processing of data in the system for issuing declarations of intent.
Principles of physical protection
The data entered in the system for issuing declarations of intent is technically protected to prevent editing and deleting.
Kela’s IT areas and the physical location of data are in Finland. Kela’s technical administrators have limited access to the IT areas when the management of their duties requires such access.
The right of access to personal data
The client has the right to access their personal data entered in the system for issuing declarations of intent. The client can browse and update their declarations in intent saved in the system for issuing declarations of intent via MyKanta.
The client can contact Kela to request information stored in the system for issuing declarations of intent. A request for access to data should be directed to Kela (Registry, P.O. Box 450, FI-00056 Kela).
If necessary, the client can request their information by using the form for requesting access to data, which is available from service providers that have joined the Kanta Services, Kela’s offices and the kanta.fi website. A request for data may also be made by contacting Kela’s Registry by phone or email (kirjaamo@kela.fi)
As a rule, the respond to the subject access request is provided free of charge.
Right to demand rectification of incorrect data
The client has the right to request rectification of incorrect data entered in the system for issuing declarations of intent. If the client or their legal representative requests rectification of an error and the incorrect data is based on an entry made by the healthcare or social welfare service provider, the request for rectification must be addressed to the service provider that made the incorrect entry.
The client themselves can also amend or correct part of the data entered in the system for issuing declarations of intent in MyKanta.
In its role of joint controller, Kela acts as the contact point for data subjects. Therefore, the request for rectification can be delivered in writing to Kela (Registry, P.O. Box 450, 00056 Kela.) If necessary, Kela will address the delivered request for rectification to the service provider whose entry is subject to the request for rectification.
If the client’s request to correct the data is not accepted, client is entitled to lodge a complaint with a competent regulatory authority.
Right to lodge a complaint with a supervisory authority
If the client deems that the processing of their personal data breaches the applicable data protection regulations, the client is entitled to lodge a complaint with a competent regulatory authority in accordance with Article 77 of the General Data Protection Regulation and section 21 of the Data Protection Act. In Finland, the regulatory authority is the Data Protection Ombudsman.
Other rights related to the processing of personal data
In MyKanta, the client can view data entered in the system for issuing declarations of intent and see which service provider the data has been shared with. The client has the right to request log data on who has handled or shared their personal data entered in the system for issuing declarations of intent. The log data request concerning data entered in the system for issuing declarations of intent is addressed to the healthcare and social welfare service provider that has entered the declaration of intent in question.
The client can contact Kela to request log data for the system for issuing declarations of intent. A request for log data should be directed to Kela (Registry, P.O. Box 450, FI-00056 Kela). If the client wishes to receive information about the use of the data stored in the system for issuing declarations of intent, such requests must be addressed to the social welfare and health care service provider.
If necessary, the client can request their information by using the form for requesting log data, which is available from service providers that have joined the Kanta Services, Kela’s offices and the kanta.fi website. The request can also be made by telephone or email to Kela’s Registry (kirjaamo@kela.fi).
As a rule, the respond to the log data request is provided free of charge.
There is no right to obtain log data that is older than two years unless there is a valid reason for it. The client must not use or share the log data, which they have received, for any purpose other than for clarifying and implementing their rights concerning the handling of their own client data.
If the client considers on the basis of the log data that their data has been processed without a valid reason, they can request the service provider in question for an explanation on the matter.
The client has the right to receive the same data again if there is a valid reason for it in order to fulfil the client’s interests and rights. Kela may charge a fee corresponding to the costs of providing the information with regard to data that is provided a second time.
The system for issuing declarations of intent is a statutory service implemented and maintained by Kela (Client Data Act, Act on Electronic Prescriptions). The retention periods of data entered in the service are provided for in legislation and the processing of data entered in the service is based on the rule of law. For these reasons, the data subject’s right to erasure pursuant to Article 17 of the EU General Data Protection Regulation or the data subject’s right to data portability pursuant to Article 20 of the EU General Data Protection Regulation do not apply to the system for issuing declarations of intent.