This page contains information on:

  • What services does Findata offer and to whom
  • Who is responsible for processing the application and granting permits
  • Examples of the jurisdictions of data controllers, e.g. to whom the application should be sent

What services does Findata offer and to whom?

Findata offers services

  • for those needing data (customers) and
  • for those controlling data (controllers)

All Findata services relate to the secondary use of health and social data.

Findata can assist you in situations where

  • data from several different controllers is being combined,
  • the register data originates from private social welfare and health care service providers

or

  • the data is stored in Kanta services. Findata will process applications related to medical record data in the Kanta services from the beginning of 2021, applications related to e-prescription data can be processed already now.

We provide advice and guidance by email at info@findata.fi and by telephone +358 (0) 29 524 6500. Our telephone service is open weekdays 9am – 11am and 12pm – 4pm.

If you need health and social data for secondary use, click Services for customers.

If you are a controller of health and social data, click Services for controllers.

Back to top

Who is responsible for processing the application and granting permits?

Findata’s jurisdiction with regard to information permits and decisions is based on section 44 of the Act on Secondary Use of Health and Social Data. Below on this page you can find a table of case studies detailing the jurisdictions of Findata and other controllers of data at a practical level. You can go to the table from this link.

The cases and jurisdictions set out in the table apply in each situation where the data of any of the controllers have not yet been authorized. If some of the data already has a valid authorization, it is considered how many data controllers still need to be authorized. In a situation where the data of only one public controller is no longer subject to authorization, that controller shall grant the authorization.

The Act on Secondary Use does not apply to clinical trials notified to Finnish Medicine Agency Fimea, so they are not under the jurisdiction of Findata.

The definitions of interventional clinical trials and non-interventional trials can be revised, for example, from Fimea’s Administrative Regulation 8/2019 (opens in a new window). If necessary, Fimea will provide advice on whether the study should be considered a clinical trial.

Findata is responsible for processing and deciding on the application when the application for a data permit or a data request concerns:

  • data from several different public controllers is combined  (* see exceptions under Delegated authorizations)
  • data from one or more private social or health care providers, or
  • data that is stored in Kanta services. Findata will process applications related to medical record data in the Kanta services from the beginning of 2021, applications related to e-prescription data can be processed already now.

In addition, according to the Act on Secondary Use, public social and health care data controllers are divided into two different groups. Below are more detailed breakdowns of these groups and differences in terms of jurisdictions.

Public controllers: Group A

  • Regional State Administrative Agencies (AVI)
  • Public health and social care service providers (e.g. hospital districts and municipalities)
  • Social Insurance Institution (Kela)
  • Finnish Medicine Agency Fimea
  • National Supervisory Authority for Welfare and Health Valvira
  • Ministry for Social Affairs and Health
  • Finnish Institute for Health and Welfare (excluding data collected by it as a statistical authority for statistical purposes)
  • Finnish Institute of Occupational Health

Where the data permit application or a data request concerns the data of at least two controllers in this group, Findata is the competent authority.

This is the case despite or regardless of the fact that another controller of data could be considered to already have “internal” material or “own” material. For example, if a hospital district needs Kela’s data in addition to its own data for its research, it is a matter of combining the data of two controllers. In this case, Findata is the competent authority.

Public controllers: Group B

  • Digital and Population Information Agency (DVV): Name, personal identity number, family relations, address, building information. If other data is required, DVV is responsible for the processing and permit.
  • Finnish Center for Pensions (ETK): Information on persons’ employment and earnings, benefits granted and their criteria, including diagnoses of disability pensions. If other data is required, ETK is responsible for the processing and permit.
  • Statistics Finland: Data to determine the cause of death. If other data is required, Statistics Finland is responsible for the processing and permit.

Findata is responsible for granting the data permit of ETK, DVV and Statistics Finland on the above-mentioned data, if they are combined

  • to data of one or more Group A public controllers
  • to data from one or more private health or social care providers, or
  • to data stored in Kanta services (as of 2021).

Transferred jurisdictions

The above-mentioned Group A public controllers may authorize Findata to provide services other than advisory and data description services provided by them stated in the Act on Secondary Use. In this case, we also process, on behalf of the controller, data permit applications and data requests that only concern the data contents of the controller’s own registers.

Group B controllers cannot authorize their jurisdiction to Findata.

Currently, the following controllers have delegated authorization to Findata:

  • Finnish Institute for Health and Welfare THL, with the exception of its internal permit management, the data it collects as a statistical authority and the permit management of the release of samples and data transferred to THL’s biobank
  • City of Rauma’s social and health care
  • City of Pori’s Basic Security Center

Examples of the jurisdictions of data controllers, e.g. to whom the application should be sent

In the table below you will find imaginary examples of cases where data is retrieved from different controllers. The table indicates which controller or controllers are competent to process the application and make a decision, e.g. to which controller or licensing authority the application should be addressed.

The cases and jurisdictions presented in this table apply in each situation where the data of any of the controllers has not yet been granted a permit. If some of the data already has a valid permit, the number of data controllers still to be authorized will be examined. In a situation where the data of only one public controller is no longer subject to a permit, that controller shall grant the permit.

See also: Processing of amendment applications

The table is under construction

Whose data is being requested Findata grants the permit Controller of data grants the permit Further information
General situations
HD (hospital district) X The application concerns only one public controller, soHD is responsible for processing and decision.
HD + Statistics Finland (cause of death) X The application concerns one public controller and Statistics Finland’s cause of death data, so Findata is responsible for the processing and permit.
HD + DVV + Statistics Finland (cause of death) X The application concerns one Group A public controller and a Group B public controller, so Findata is responsible for the processing and permit.
SHP + DVV + Statistics Finland (cause of death) + ETK X
SHP + Kela X Several public controllers of Group A (mentioned in section 6, paragraphs 1 to 8 of the Act on Secondary use), so Findata is responsible for processing and permit.
SHP + Kela + DVV X
SHP + SHP2 + Statistics Finland (cause of death) + DVV X
DVV X The application only concerns DVV’s data, so DVV is responsible for processing and permit.
DVV + Statistics Finland (cause of death) X The application only concerns the data of the Group B public controllers, so each controller is responsible for the processing and permit.
DVV + Statistics Finland (cause of death) + ETK X The application only concerns the data of the Group B public controllers, so each controller is responsible for the processing and permit.
THL X THL has transferred the jurisdiction to Findata.
THL + Statistics Finland (cause of death) X
THL + Statistics Finland (cause of death) + DVV X
Kela + THL X
Kela + THL + DVV X
Kela + THL + DVV + ETK X
THL + City of Pori’s Basic Security Center X City of Pori’s Basic Security Center has transferred the jurisdiction to Findata.
THL + City of Rauma’s social and health care + DVV X City of Rauma’s social and health care has transferred the jurisdiction to Findata.
Requesting data from private health or social care providers
“Private Ltd.” X Findata is responsible for processing and permit whenever an application
concerns the data of a private health and social care service provider.
“Private Ltd.” + Kela X
“Private Ltd.” + DVV X
“Private Ltd.” + Kela + DVV X
“Private Ltd.” + Kela + DVV + Statistics Finland (cause of death) X
“Private Ltd.” + Kela + SHP X
“Private Ltd.” + Kela + SHP + DVV X
“Private Ltd.” + Kela + SHP + DVV + Statistics Finland (cause of death) X
“Private1 Ltd.” + “Private2 Ltd.” X
“Private1 Ltd.” + “Private2 Ltd.” + Kela X
“Private1 Ltd.” + “Private2 Ltd.” + Kela + DVV X
“Private1 Ltd.” + “Private2 Ltd.” + Kela + DVV + ETK X
“Private1 Ltd.” + “Private2 Ltd.” + Kela + HD X
“Private1 Ltd.” + “Private2 Ltd.” + Kela + HD + ETK X
Requesting also other data from THL or Statistics Finland
HD + Statistics Finland (soc.econ.  data) X This is not Statistics Finland’s cause of death data, so both controllers are responsible for processing and decision.
HD + Statistics Finland (cause of death + soc.econ.  data) X X Findata is responsible for processing and deciding on the HD and Statistics Finland’s cause of death data, Statistics Finland is responsible for the soc.econ. data.
HD + Kela + Statistics Finland (cause of death + soc.econ.  data) X X Findata is responsible for processing and deciding on the HD, Kela and  Statistics Finland’s cause of death data, Statistics Finland is responsible for the soc.econ. data.
THL Hilmo + THL (as a statistical authority) X X Findata is responsible for processing and deciding on the THL Hilmo data THL is responsible for it’s other data as a statistical authority.
Kela + THL Hilmo + THL (as a statistical authority) X X  

Findata is responsible for processing and deciding on the Kela and THL Hilmo data, THL is responsible for it’s other data as a statistical authority.

DVV + THL Hilmo + THL (as a statistical authority) X X Findata is responsible for processing and deciding on the DVV and THL Hilmo data, THL is responsible for it’s other data as a statistical authority.
Kela + THL Hilmo + DVV + THL (as a statistical authority) X X Findata is responsible for processing and deciding on the Kela + THL Hilmo + DVV data, THL is responsible for it’s other data as a statistical authority.
“Private Ltd.”+ Statistics Finland (cause of death + soc.econ.  data) X X Findata is responsible for processing and deciding on the “Private Ltd. +  Statistics Finland’s cause of death data, Statistics Finland is responsible for the soc.econ. data.
“Private1 Ltd.” + HD + Statistics Finland (cause of death + soc.econ.  data) X X Findata is responsible for processing and deciding on the “Private Ltd. +  HD + Statistics Finland’s cause of death data, Statistics Finland is responsible for the soc.econ. data.
“Private1 Ltd.” + DVV + Statistics Finland (cause of death + soc.econ.  data) X X Findata is responsible for processing and deciding on the “Private Ltd. +  DVV + Statistics Finland’s cause of death data, Statistics Finland is responsible for the soc.econ. data.
Special situations
Kela’s prescription center (e-prescriptions) X Findata is responsible for handling and deciding.
Kela’s prescription center (e-prescriptions) + Kela’s reimbursed drug purchases X Findata is responsible for handling and deciding.

Back to top