Data protection at Valvira

At Valvira, personal data processing is mainly based on Valvira’s statutory obligations, tasks in the public interest and the exercise of public powers. Valvira always processes personal data in accordance with the data protection principles defined in legislation.

Valvira follows the following principles for personal data processing:

• Personal data is handled lawfully, appropriately and transparently from the point of view of the data subject.
• Personal data is collected and handled only for a certain, explicit and legal purpose. Primarily, personal data can only be processed for the mentioned purposes and for as long as the processing is purposeful and necessary in view of the laws.
• Only necessary personal data is collected, which minimises the processing of personal data.
• Personal data is updated whenever necessary. Imprecise, outdated and incorrect personal data will be deleted or corrected without delay either on Valvira’s own initiative or following a request by the data subject.
• Personal data is stored in a format in which the data subject can be identified only for as long as necessary for the purpose of personal data processing. The storage period for documents containing personal data have been defined in Valvira’s information management plan.
• Personal data is processed confidentially and securely. Personal data will only be disclosed in accordance with legislation or on the basis of the data subject’s consent. The data subject has been informed through the privacy statement on how data is disclosed in accordance with regulations.

Principle of openness

Personal data will be disclosed only to those requesting it in accordance with the Act on the Openness of Government Activities. Information and documents are public unless specifically determined as confidential under law.

Realisation of a data subject’s rights

As a data subject, you have the right to

• know whether Valvira is processing your personal data
• receive copies of your personal data if Valvira is processing your personal data 
• request correction of your incorrect or outdated information
• request restriction of the processing of your personal data or oppose it under certain conditions.

When we process your information on the basis of a statutory obligation, a task in the public interest or to exercise public powers, you do not generally have the right to request the removal of your data. In some cases, we process your information with your consent. You shall then have the right to revoke your consent at any time.

The realisation of a data subject’s rights requires that we can identify you from the dataset. To ensure the protection of your privacy, we may ask you to verify your identity when exercising your rights. We will reply to you primarily within one month of your request.

Valvira’s privacy statement mentions a contact person from whom you can ask about the processing of your personal data. You can find out more about your data protection rights and instructions on how to exercise them from Valvira’s privacy policies.

Data protection monitoring at Valvira

Valvira’s activities as a data controller in accordance with data protection regulations are monitored by Valvira’s Data Protection Officer and the office of the Data Protection Ombudsman acting as the national supervisory authority of data protection. The lawfulness of Valvira’s activities as an authority is also monitored by the Parliamentary Ombudsman and Chancellor of Justice.

Valvira’s Data Protection Officer does not monitor the activities of other authorities or data controllers with regard to data protection matters. For such matters, you should contact the Data Protection Officer of the data controller in question, the data controller directly, or the authority monitoring its activities otherwise, such as the office of the Data Protection Ombudsman.

If you have any questions about your data protection rights as a data subject or how your personal data is processed at Valvira, you can contact Valvira’s Data Protection Officer.