Privacy statement for students
Controller
Laurea University of Applied Sciences Ltd, Ratatie 22, 01300 Vantaa, Finland
- Controller’s contact person: President, Managing Director Jouni Koski, jouni.koski@laurea.fi
- Person in charge of the register: Development Manager Päivi Aho, paivi.aho@laurea.fi
- Contact details of the data protection officer: Marjo Valjakka, marjo.valjakka@laurea.fi
The person in charge of register matters acts as the main user of the student and study-related information system and provides more detailed information about the register to data subjects. For instance, data subjects may send rectification and access requests to the person in charge.
In Laurea units, the student affairs officers are in charge of register-related matters. They can be reached at the following telephone numbers and email addresses:
|
Leppävaara campus |
Telephone: +358 (0)9 8868 7400 |
leppavaara.info(at)laurea.fi |
|
Lohja campus |
Telephone: +358 (0)9 8868 7800 |
lohja.info(at)laurea.fi |
|
Otaniemi campus |
Telephone: +358 (0)9 8868 7500 |
otaniemi.info(at)laurea.fi |
|
Tikkurila campus |
Telephone: +358 (0)9 8868 7300 |
tikkurila.info(at)laurea.fi |
|
Porvoo campus |
Telephone: +358 (0)9 8868 7600 |
porvoo.info(at)laurea.fi |
|
Hyvinkää campus |
Telephone: +358 (0)9 8868 7700 |
hyvinkaa.info(at)laurea.fi |
What are the purpose and legals basis for the processing of personal data?
We also process data in Laurea's user management system in order to implement a secure lifecycle and access management by enabling
- to Laurea’s user management system
- for the creation of web and email credentials
- 'to enable centralised electronic identification in the information systems of Laurea University of Applied Sciences
- for the compilation of email lists, so that the recipient cannot see who the other recipients are
- to send emergency messages
- to Laurea’s intranet system for the creation of access rights and for student communication
- to enable identification in network connections between higher education institutions (HAKA login)
The following legislation also applies to universities of applied sciences:
- Government Decree on Universities of Applied Sciences (1129/2014)
- Act on national study and degree registers (884/2017)
- Administrative Procedure Act (434/2003)
- Administrative Judicial Procedure Act (586/1996)
- Act on the Openness of Government Activities (621/1999)
- Decree on the Openness of Government Activities and on Good Practice in Information Management (1030/1999)
- Statistics Act (280/2004)
- Act on Financial Aid for Students (65/1994)
- Unemployment Security Act (1290/2002)
- Government Decree on financial aid for students (869/2017)
- The EU’s General Data Protection Regulation (2016/679)
- Data Protection Act (1050/2018)
What personal data categories Laurea processes?
Laurea University of Applied Sciences only processes data that are necessary with respect to performing Laurea’s education administration task and for the the planning, implementation, monitoring and assessment of Laurea’s operations. These data include:
1. Applicant information
Applicant data imported from the OILI system (confluence.csc.fi/display/OILI/Rekisteriseloste)
- first names, name normally used, last name, personal identification number
- learner ID
- contact details (street address, postal code, city/town, email address, telephone number)
- native language and language of communication
- nationality
- basic education
- information related to the degree programme
- enrolment and payment information
- information related to the permission to publish the results of the application process
2. Other student information
- date of birth, gender
- place of residence, place of domicile
- language of school education
- permissions to disclose information
- additional information of student
3. Study information
- student ID
- degree programme, form of education, specialisation option
- degree, title, field of study, classification of education
- required scope of studies
- full-time status of student
- duration of study entitlement, maximum number of semesters present and absent
- unit
- admission group, other groups
- instructors
- qualifications
- study entitlement specifiers
- certificate details, personal certificate details
- additional study entitlement information, transfer student information
- subject to tuition fee
4. Attendance information
- semester-specific semester registration information
- semesters of attendance and absence used
- information on the extension and restoration of study entitlement
- information on the completion of studies
- graduation information
5. Information on the student’s personal study plan
- required credits, credits earned, credits to be earned
- curriculum used as the basis for the study plan
- studies chosen on the study plan
- scheduling of studies across semesters
- study registrations
- performance
- study plan comments, assignments
- communication between student and instructor
- transcript of records
- willingness to graduate, confirmation of graduation information
6. Study attainment information
- title, credits, grade, completion date and evaluator of the studies completed; person making the entry
- method of study, language, place, municipality, project, RDI credits and virtual credits
- recognition of prior learning, exemptions
- thesis title, grade, date and supervisor
7. International mobility information
- start and end dates of mobility period
- country of mobility period
- mobility programme
- direction of mobility
- type of mobility
What are the grounds for the retention time?
The retention periods are determined in accordance with the requirements of law, the decisions of the National Archives of Finland and the filing plan of Laurea University of Applied Sciences.
The following data are permanently retained in the information systems of Laurea University of Applied Sciences:
- admission criteria
- document data related to the student admission amendment process
- study entitlement, registration, degree, study and graduation data
- attendance and absence data
- data related to the evaluation amendment process
- matters subjected to the Board of Examiners
- statements on theses as well as students’ self-assessments and grade proposals
The following data are retained for a specified period
- students’ exam results, exam answers, exercises and other similar data accumulated in digital learning environments
- student mobility and student exchange data excluding performance data
- student welfare documents (financial aid, students’ accidents, substance abuse programme and referral to treatment)
The following data are permanently retained in the registers and national data repositories maintained by the Finnish National Agency for Education
- joint application process data, data on related additional and extra application processes and direct application process data
- study entitlement, registration, graduation and performance data to be transferred to the VIRTA study data repository
What are the sources of information?
Laurea University of Applied Sciences receives student information from the following sources:
- the Opintopolku national application register maintained by the Finnish National Agency for Education
- the OILI attendance registration register maintained by the Finnish National Agency for Education
- the information provided on application forms by applicants participating in application processes outside of Opintopolku
- the Population Register Centre
- updates made by teachers
Students can themselves update their contact details and other information through the PAKKI student desk. In addition, students give Laurea specifically requested permissions to disclose information.
Statutory disclosure and transfer of data
The disclosure of data takes place through electronic data transfer connections, on individual printed documents, email lists and printed adhesive labels.
The data in a register containing student data of a higher education institution are in the public domain, as referred to in the Act on the Openness of Government Activities (621/1999), and access to them is provided upon request pursuant to the conditions laid down in sections 13 and 16 of the Act.
In the cases specified by law information on students, study entitlements, registrations for the academic year, periods of international mobility, degrees and performance is gathered in the national data repository of higher education institutions (VIRTA) for centralised storage and use. This does not constitute an actual disclosure of data, as the data remain part of the register of the higher education institution (Act 484/2013).
Information from the student and study information system is disclosed to the national data repository of higher education institutions (VIRTA), from which data are transferred to
-
- the student admission register (Opintopolku) maintained by the Finnish National Agency for Education to be used by the Opintopolku register and the joint student admission services of higher education institutions
- the national OILI service used for registration as a student and registration for the academic year
- the Ministry of Education and Culture to provide information for the support of research, assessment, development, monitoring and supervision of education and the compilation of statistics
- Statistics Finland for the compilation of statistics
- the Finnish Social Insurance Institution for the payment of financial aid, monitoring of the progress of studies and assessment of social security benefits
- the Finnish Social Insurance Institution, the labour authorities and the unemployment insurance fund to process applications for labour market support and daily unemployment benefit
- the Terhikki register of Finnish health care professionals, maintained by the National Supervisory Authority for Welfare and Health (Valvira), for the confirmation and monitoring of health care professionals’ qualifications
- the immigration and law enforcement authorities upon request for the purpose of verifying the validity of a residence permit (notification of admission, notification of attendance, certification of enrolment and transcript of records)
- information on non-EU students to the Finnish Immigration Service (Migri) for the purpose of granting residence permits based on studies
- to the employment pension institution upon specific request
- for purposes of scientific research (the party requesting data must provide the controller with a description of the intended use and other information required to determine the need for the disclosure of data; where necessary, the party requesting data must provide an account of how data protection will be arranged).
Laurea University of Applied Sciences has granted permission for the use of data transferred to VIRTA as follows:
- OILI (14 September 2014)
- permission to disclose student registration data and semester registration data through the national data repository of higher education institutions
- Valvira (17 November 2014)
- permission to disclose information on students and degrees through the national data repository of higher education institutions to Valvira for the monitoring and confirmation of the qualifications of health care professionals
- EMREX (23 October 2015)
- permission to link the EMREX National Contact Point plug-in to the national data repository of higher education institutions so that the data stored about a learner are accessible to that learner through the EMREX service
- ARVO (11 April 2016)
- permission to link the education administration’s ARVO effectiveness service to the national data repository of higher education institutions so that the data of the VIRTA higher education achievement register are accessible to the learner through the ARVO service for viewing and use
- TUUDO (9 June 2016)
- permission for Caleidon Oy, with the consent of the learner, to retrieve his or her information from the national data repository of higher education institutions for use in the TUUDO service so that the learner can access his or her data stored by Laurea University of Applied Sciences
- University of Helsinki (1 August 2018)
- permission to the University of Helsinki to link the of university’s information system to the national data repository of higher education institutions so that the study data are available for use by the application processing of the higher education institutions included in the University of Helsinki
- Follow-up queries (2 August 2016)
- permission for researchers to use the performance data stored in the national data repository for research on studies, the progress of studies and the employment of graduates
- FIONA (22 March 2017)
- permission for remote use of Statistics Finland’s FIONA research data through the national data repository of higher education institutions.
- PIVO (13 August 2019)
- Permission to transfer data via the national data warehouse of higher education institutions to Pivo Wallet Oy for the digital student card
- YTHS (6.October 2020)
- Authorisation to transfer data via the national data warehouse of higher education institutions to the Student Health Foundation (YTHS)
- CONSORTIUM FOR THE SELECTION OF STUDENTS FOR HIGHER EDUCATION (9 December 2021)
- data release licence via the national repository of higher education institutions for the development of student recruitment (research)
- DIGIVISION (14 April 2023)
- Authorisation to release data via the national repository of higher education institutions for the Digivision platform (implementation data - teaching provision)
- JOTPA (3 January 2024)
- authorisation to transfer data via the national repository for higher education institutions to the Service Centre for Continuing Learning and Employment
In addition, student data will be disclosed to
- to the register of Metropolia University of Applied Sciences and Haaga-Helia University of Applied Sciences: student, study entitlement and registration data of students taking 3AMK studies
- to Haaga-Helia’s user management system to enable centralised electronic identification in the systems of the Porvoo campus (Haaga-Helia)
- to the career and recruitment system of universities of applied sciences
- to the LAUREAMKO student union of Laurea University of Applied Sciences; information of members for the maintenance of the member register
- to Laurea Alumni for Laurea’s alumni register
Non-statutory disclosure of data
Students give their consent through the student and study information system for the use of their name and address information. Students give their consent to disclose their contact details for the following purposes:
Direct marketing:
Even if a student has given consent for direct marketing, data are never automatically disclosed and the persons in charge of the system consider each case separately.
Normally, data are not disclosed for this purpose.
Marketing of education:
For purposes that support studies, to associations and foundations, professional organisations and mainly regional authorities for the posting of information that
- is intended to promote studies, professional skills or employment
- is intended to improve the studying or working environment
- is intended to promote students’ connections to their home district
- is intended for other purposes that support studying, such as surveys, questionnaires and opinion polls.
Disclosure of graduation information:
The student may give his/her consent for the publishing of information related to his/her graduation. Normally, this information is not disclosed.
Internet:
The student’s email address may be included in the email address search engine to be introduced on Laurea’s intranet site. This means that the student’s email address can be found on Laurea’s intranet site by entering the student’s name in the search engine.
If the student has been issued an official prohibition of data processing by a Local Registry Office, he/she is entitled to request that this information be recorded in the basic register of the Student Management System. The official prohibition of data processing prohibits the disclosure of any of the student's contact information.
Laurea University of Applied Sciences adheres to the principles of good register-keeping and requires that parties requesting student information have a relevant relationship to the group whose data are requested. The user of name and address information must specify the source of the information.
Various group reports printed out from the student and study information system (address labels, participants in an implementation, student list, students included in a group, a student’s progress, implementation diary, assessments of implementations, group assessment diary, completed studies of a group and assessment sheet information) are interpreted as manual registers. For this reason, when disclosing a report printed out from the register, the disclosure is assessed as a data disclosure from a personal register.
Transfer of data outside the EU or the EEA
Student data are not transferred outside the EU or the European Economic Area. An exception to this is a situation in which a student activates a specific service, such as Google Apps for Education. In these cases, the data necessary for the use of the services are provided. In such cases, the student is specifically asked for their permission, and approval of the terms of use is required.
How do we protect the information?
When processing data in the register, particular attention is paid to not endangering students’ privacy without good reason.
Manual data
- are stored and protected so that outsiders have no access to them and the data cannot be accidentally destroyed, modified, disclosed, transferred or otherwise unlawfully processed; employees have the right to access only those student-related data that they need to perform their job
- student affairs officers are responsible for the filing of documents
- documents that include personal data are destroyed in a shredder or disposed of as data protection waste.
Electronically processed data
- The Basic Register of the Student Management System is used via the internet.
- Laurea’s data administration is responsible for the maintenance of the server equipment. The storage of the equipment is centralised in a locked space with strictly restricted access. The network and services are appropriately protected.
- Access rights are restricted user group-specifically. The visibility of data and the right to update data in the system are determined by user right roles assigned to the different user groups.
- Only those with access rights to the system can access the data. The right to access the system is determined by the person’s job or student status. The personnel are bound by the obligation of professional secrecy as specified in the employment contract.
What are your data subject rights?
You have the right to access your personal data
You have the right to check the personal data registered at Laurea via the student interface if you have enrolled as an attending student. You have the right to receive an official study certificate and a transcript of records from the Student Affair Office.
If you are studying at Laurea currently or have studied before, you can check the registered information. You can do it once a year and free of charge.
If you intend to make a request to access your personal data, you should do it either in person or in writing. If you do it in writing, the document must be signed or otherwise reliably verified. You should direct your request to the Student Affairs Office of your own Laurea unit.
The person who is in charge of register-related matters will decide whether to grant you the requested access.
Your identity will be checked before granting access to your personal data. Official identification card with a photograph can verify your identity. A request sent from Laurea’s email system can be considered adequate proof of identification.
Your right of access should be provided without delay.
You have the right to rectification of your personal data
If you are an attending student, you may correct your contact details via the student user interface or contact the Student Affairs Office and ask to make the change.
Laurea (the data controller) must erase or complete personal data in the register that is incorrect, unnecessary, incomplete or outdated regarding the purpose of the data processing. The data controller must do so without undue delay. Once the request was received, the data controller has a month to address it and not later than that.
The student affairs officers must immediately correct the error in personal data once they found it or report it to a person with access rights to rectify it instead.
You have the right to demand rectification of data.
If the controller happens to refuse your demand to rectify personal data, you will receive a certificate of refusal. You have the right to contact the Data Protection Ombudsman regarding your matter. The Data Protection Ombudsman may issue an order to Laurea to rectify the data.
You have the right to erasure of personal data
Your right to the erasure of your personal data, as stated in Article 17 of the General Data Protection Regulation does not apply to personal data processed in compliance with a legal obligation.
You have the right to erase personal data based on consent.
You have the right to restriction of processing
There are certain cases when you have the right to restrict the active processing of your personal data. For instance, this right applies to situations where you argue against the accuracy of your personal data.
Your personal data may still be stored but not in any way processed if you didn’t give the consent.
You have the right to object to automated individual decision-making
You have the right to object to the processing of personal data for purposes such as direct marketing, scientific, historical, or statistical research.
If you use your right to object, Laurea as the controller may no longer process your personal data for the purpose in question.
Your right to object does not apply to statutory data processing.
You have the right not to be subject to a decision based only on automated processing, including profiling. Profiling produces legal effects concerning you or significantly affects you. However, it does not apply if the decision is based on your explicit consent. Or it is necessary for entering into a contract between you and a data controller.
If you have questions about your rights as a data subject, you may contact the data protection officer.
You have the right to file a complaint with the data protection authority.