Skip to content

Joint Application 2019 to higher education: The higher education institutions will publish the admission results according to their own schedules however no later than by 28 June 2019.

Read more

Admission results in Joint application

How to confirm a a study place in joint appliction

 

Register description

GDPR 2016/679                                                                                                                  

Name of the register

Student admission register

A compilation of registers, which is comprised of the following registers:

  • Admission register for vocational, general and other upper secondary education
  • Admission register for higher education
  • Contact information register of the address service.

Data controller

Name

Opetushallitus

Address   

P.O.Box 380, 00531 Helsinki (street address Hakaniemenranta 6, 00530 Helsinki)

Other contact details:

email opetushallitus@oph.fi

phone (switch) +358 29 533 1000, fax +358 29 533 1035

kirjaamo@oph.fi

Controller’s representative

Name

Outi Kivipelto

Contact details:

phone (switch) 029 533 1000

email kirjaamo@oph.fi

DPO contact information

Name

Jyrki Tuohela

Contact details

phone +358 29 533 1000 (switch)

email tietosuoja@oph.fi

Legal basis and purpose of handling personal data

Keeping this register is based on laws 884/2017, 18 § and VnA 805/2008, 1.2 §.

Other laws steering the handling of personal data:

  • General Data Protection Regulation 2016/679 of the European Union and supplementary national legislation
  • Act on the Publicity of Official Documents (621/1999)
  • National Agency for Education Act (564/2016)
  • Vocational Education and Training Act (531/2017)
  • General Upper Secondary Schools Act (629/1998)
  • Universities Act (558/2009)
  • Universities of Applied Sciences Act (932/2014)
  • Valtioneuvoston asetus ammatillisen koulutuksen, lukiokoulutuksen ja perusopetuksen jälkeisen valmistavan koulutuksen hakumenettelystä (294/2014)
  • Valtioneuvoston asetus korkeakoulujen yhteishausta (293/2014)

Purpose of these registries:

  • Communication and reporting of studies and student admission
  • Application to studies, managing student admissions and rights to study and reporting of application to studies and student admissions
  • Delivering crucial data concerning student admission, development of admission processes and organization of studies to universities, universities of applied sciences and institutes providing vocational upper secondary education and general upper secondary education and institutes providing supplementary basic education
  • Informing about educational opportunities
  • Producing follow-up and assessment data about applicants and students
  • Other necessary actions for admission of students
  • Managing internal mailing in EDUFI by using compiled email addresses of representatives of educational institutions

Data subjects

L 884/2017, 19 §

a) Data content of admission registries

  • Data concerning the applicant (registrant)
  • The applicants name, learner ID and identity number or corresponding singular identity data, nationality, gender, first language and other necessary contact information
  • Preferred application options
  • Data concerning application to studies
  • Data concerning grounds for admission and acceptance to studies: degree, education and employment data of the applicant
  • Health status data affecting employment and professional choice (yes/no-data)
  • Data concerning leisure activities of the applicant
  • Data concerning result of admission (admission examination results and other data concerning admission i.a. points of admission)
  • Data concerning receiving the right to study and registration to the educational institute
  • The applicant’s approval or denial of publishing their admission result on the internet
  • The applicant’s approval or denial of delivering their personal data for purposes of educational marketing or communication

b) Data content of the contact information register of the address service

  • Data of the representatives of educational providers
  • Name, work email, work phone number

From which sources do the personal data originate, and if applicable, whether it came from publicly accessible sources

L 884/2017, 20 §

  • Application forms and their attachments filled out by the registrant
  • Institutes providing basic and supplementary education
  • Institutes providing vocational upper secondary education and general upper secondary education
  • Universities, universities of applied sciences and registries shared by two or more universities
  • Population Register Centre of Finland
  • Finnish Matriculation Examination Registry
  • Economic Affairs and Employment officials

Recipients

L 884/2017, 21 §

  • Institutes providing vocational upper secondary education, general upper secondary education or supplementary basic education
  • Universities, universities of applied sciences and registries shared by two or more universities
  • The ministry concerned in order to compile reports on the monitoring of the educational system
  • Statistics Finland, in order to compile educational reports and reports on the monitoring of the educational system
  • The Social Insurance Institute of Finland (KELA) for the procedure of student financial aid, school travel and rehabilitation matters
  • The municipality providing student health care and the legislative student health care provider in order to fulfill their duties
  • The municipality providing outreach youth work in order to fulfill their legal duties
  • The data controller of foreigner registry in order to handle permission matters regarding foreigners accepted into studies
  • With the permission of the registrant, EDUFI delivers personal data of students for limited purposes supporting studies (see “Other rights concerning handling personal data”)

Health status data affecting employment and professional choice as well as data on work experience and leisure activities given by the registrant can only be delivered to universities, universities of applied sciences, institutes providing vocational upper secondary education, general upper secondary education or supplementary basic education sciences and registries shared by two or more universities.

Data transfer outside EU Member States or EFTA countries that are parties to the EEA Agreement and appropriate safeguards

Data is not transferred outside EU Member States or EFTA countries that are party to the EEA agreement and appropriate safeguards. Exceptions are, however, made in the case of registrants who

  • conduct their entrance examination outside the EU or the EEA. Their data can be delivered to the organizer of the exam.
  • apply with a degree certificate attained from outside the EU or the EEA. The higher education institute can verify with the institution providing the certificate that the degree is completed accordingly.

Retention

Data in the data registry are kept for five years, starting from the decision of student admission. Data concerning receiving the right to study are kept forever. They are part of the application registries of higher education institutes. National learner ID is kept forever. (L 884/2017, 3 §).

Description of automated / manual data protection operations (article 32, §1)

The data in the EDUFI student admission register are protected by using security methods following current legislation. Personal data is protected from inappropriate access and illegitimate handling (e.g. destruction, alteration or transfer). Each official can only handle data that they need in order to fulfill their duties. Protection of confidential and sensitive data is attended to.

A Manual operations

Documents are kept in a locked space away from third parties. Documents are printed only when necessary, and printed documents are destructed after use.

B Automated operations

The data is protected by determination of usufructuary rights based on the duties of the EDUFI official, regular change of passwords and use of data transfer encryption software. Internal guide on the use of registries has been compiled. Administrative controls are used to administer and ensure the appropriateness of use. These controls secure adequate administration and use of security resources and the functionality of reporting processes.

Procedure to grant rights

The registrant has access to admission data via the My Studyinfo website. The registrant can make a request to access their own data to the data controller’s representative, when concerning other data than those accessed via My Studyinfo website.The request will be addressed to the National Agency For Education to the following address: Opetushallitus, Hakaniemenranta 6, PL 380, 00531 Helsinki. The request should include necessary information to find the data (name and identity number).

The data access request form can be found via the following link: Rekisteritietojen tarkastuslomake_register_description (in Finnish).

If the registrant has used their right to access their data in the past calendar year, the data controller can ask for a fee to cover the administrative costs of data retrieval (article 12 [5]).

Right to demand rectification of data

The registrant has the right to demand rectification of false inaccurate data by the data controller without undue delay. The registered can update their own data in the website Opintopolku.fi, while using strong identification. If this does not succeed, the registrant can update their own data by sending a written personal data notice to the National Agency for Education. Requests sent by mail should be sent to the following address: Opetushallitus, Hakaniemenranta 6, PL 380, 00531 Helsinki. The request should include necessary information to find the data (name and identity number). Rectification requests sent by email should be sent to kirjaamo@oph.fi

Other rights concerning handling personal data

The registrant has the rights defined by the data protection regulation. These include inter alia the right to deny the use of their personal data for purposes of direct marketing or other equivalent use.

The registrant has the right to complain about a personal data handling violation claim by appealing to the Data Protection Ombudsman.

The existence of automated decision-making, including profiling, referred to in Article 22 (1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject

Information contained by this register is not used for profiling. No automated decision-making is used.