Data permit authority for the social and health care sector Findata will start operating in early 2020. Findata issues permits for the secondary use of health and social data when data is compiled from various controllers or sourced from private service providers.
Secondary use means that client and register data of social welfare and health care activities is used for purposes other than the primary purpose for which it was originally stored.
Primary purposes relate to, for example, treatment provided to a patient or the processing of benefits. The secondary use of data includes research, the compilation of statistics and innovation activities, among others.
The operation of Findata is based on the Act on the Secondary Use of Health and Social Data (552/2019) which entered into force in May 2019.
Finland’s internationally unique register data resources
Finland’s social welfare and health care data resources are particularly extensive and of exceptionally high quality, and they have been utilised for research and statistical purposes for decades. The task of Findata is to facilitate the utilisation of the data resources in, for example, the development of social welfare and health care services and more effective medicines and treatments.
“Previously researchers, for example, have had to submit separate permit applications to each controller. This has resulted in overlapping administrative work and wasted time. In addition, the practices for data disclosure have varied. In future, the processing of social welfare and health care permits are centralised in accordance with the one-stop-shop principle,” explains Johanna Seppänen, Director of Findata.
For example, in medical research, data is often required from various health care operating units, the registers of the Finnish Institute for Health and Welfare (THL) and Social Insurance Institution of Finland (Kela), the Population Register Centre, the Finnish Centre for Pensions and Statistics Finland.
“We engage in close collaboration with various controllers. We compile data and provide online tools for permit application and data resource utilisation for those who need them”, Seppänen states.
Companies, too, may utilise the data resources as part of development and innovation activities, provided that certain conditions are met.
“It is possible to receive statistical data for development and innovation activities if they contribute to the health and well-being of citizens or improve social welfare and health care services.”
Like now, health and social data may not be used for marketing or for the definition of individual commercial services in the future.
Improved data security
The centralised permit procedure also improves data security. Secure, closed user environments have been built for the operation of Findata. When the data is compiled in a centralised manner, its use is more protected and easier to monitor.
“We only disclose data to the extent necessary and always ensure maximum privacy protection. We do not disclose personal data as such at all. We ensure the anonymity of statistical data, and never transfer personal data outside the remote access environment. Instead, we provide our clients with a secure access to the data which they are authorised to examine,” Seppänen specifies.
In addition, the information systems used by Findata maintain a log on various activities. The log shows, for example, who has processed the data, how, and when.
“Naturally, our operation is also monitored, developed and reviewed on a regular basis as defined by law,” Seppänen adds.
Gradual start of operations
At first, Findata’s task is to receive and process data requests concerning anonymous statistical data for the purposes laid down in the Act on the Secondary Use of Health and Social Data. In addition, Findata provides advisory services to future clients and controllers.
Findata’s operation expands in the spring as the authority starts to accept data permit applications concerning the use of personal data as of 1 April 2020. As the term suggests, personal data contains data on the level of individual persons, but any direct identifiers have been removed, meaning that the data is either pseudonymised or anonymised.
“Data permits are applied for personal data as before, but the service will be provided on a one-stop-shop basis. The permits are issued for analysing data in a closed environment for a predetermined period of time, after which the data is erased,” Seppänen explains.
Findata will start to issue permits for data in the Kanta Services in 2021.
