Data protection

VATT Institute for Economic Research Privacy Statement

Data protection officer

The data protection officer of the VATT Institute for Economic Research can be contacted at
[email protected]

Controller

VATT Institute for Economic Research, POB 1279, 00101 Helsinki
Registry: [email protected]

Data protection in research activity

The VATT Institute for Economic Research is a research institution that conducts research and analysis to serve economic policy making. Under Section 4 of the Act on the VATT Institute for Economic Research, VATT is entitled to receive from authorities the information necessary for carrying out its tasks. VATT receives research material from different official sources, such as the Finnish Tax Administration, the Social Insurance Institution of Finland and Statistics Finland, and from various public sources. The material mainly contains information relating to social security, income distribution, taxation and business activities. Data processing is based on a research plan and there is a person responsible for the research.

The research work complies with the guidelines on research ethics of the Finnish National Board on Research Integrity. Data are protected appropriately. Material is not disclosed. VATT retains research material within the retention periods specified in research permits and legislation

Information on website – processing of personal data

VATT is committed to protecting the privacy and personal data of visitors to its website in accordance with the General Data Protection Regulation (GDPR). We do not collect data from which individual users could be identified.

Cookies (vatt.fi)

VATT’s website is part of the government’s shared publishing platform service (YJA). The YJA’s cookies do not collect data on users; they are used in order to offer users a smoother user experience.

We use web analytics on the website. General statistical data are collected on use of the website which are used to improve our online services. The web analytics service we use is Snoobi. Via Snoobi we monitor the following data:

• number of visits
• most frequently downloaded content
• distribution of visitor traffic between Finland and other countries
• means of access
• times of visits and time spent on site
• IP address
• web browser and operating system.

It is possible to send us feedback via VATT’s network service. We only store contact details that users specifically provide themselves until we have responded to the user’s feedback. When the feedback has been responded to, the contact details are deleted.

You are entitled to find out what data we store on you. You can also check the data that we collect on you and if necessary update it.

To find out what personal data has been stored in the services, send an information request to VATT's registry.

Registry email address:
kirjaamo(at)vatt.fi

Social extensions

VATT's website contains links and connections to third-party website and so-called social extensions (e.g. Twitter). Plugins on the site maintained by third parties upload from those services' own servers. The site does not transmit data on its users via social extensions.

Services offered by third parties or applications provided by third parties on the site are governed by the terms and conditions of use etc. of the third party. Social media services therefore determine themselves what data they provide to their users and over what time period.

Data protection of newsletter subscribers

1. Controller
   VATT Institute for Economic Research
   Business ID: 0809880-7
   Postal address: Economicum, Arkadiankatu 7
   POB 1279, 00101 Helsinki
    
2. Person responsible for register
   Communications Officer
   Tel. 0295 519 500, [email protected]
    
3. Name of register
   VATT stakeholder register
    
4. Purpose of VATT register
   The purpose of the stakeholder register is to communicate with VATT's stakeholders. We use the register to send electronic newsletters and invitations.
   
   Subscribers receive information on our new research or our upcoming events sent to the email address they provide. The register is based on subscriptions made via the uutiskirje.vatt.fi site. We use the register to develop VATT's communications and stakeholder relations. We use the register to target our communications by subject at various stakeholder groups, and to analyse the reach of announcements, news items and events. This information helps us to develop VATT's website and our communications in social media channels.
    
5. Data content of register and prescribed data sources
   We collect and process the following data:
   - Work email address / email address
   - Classification data given by the persons themselves on research themes they are interested in
    
6. Operating systems using the register
   Postiviidakko system of Koodiviidakko Oy
    
7. Prescribed data sources, disclosures
   Data are added to the register based on subscriptions placed. We do not disclose personal data.
    
8. Transfer of data outside the EU or the European Economic Area
   Our data are not transferred outside the EU or the European Economic Area.
    
9. Retention period of personal data
   We do not retain data longer than necessary for their intended purpose. Persons can leave VATT's stakeholder register at any time by following the link at the bottom of the newsletter, or at uutiskirje.vatt.fi. We regularly update personal data by removing inoperative email addresses from the register.
    
10. Register protection principles
    We retain personal data in electronic form on the server of our service provider. This is protected by agreements between us (VATT) and the service provider that comply with general practices. We have restricted access to personal data using logins, passwords and access rights. Data is not disclosed to outside parties.
     
11. Right of inspection
    Everybody is entitled to inspect the data stored on them in our stakeholder register in accordance with the General Data Protection Regulation (GDPR). Inspection requests should be sent to VATT's communications department at: [email protected] or: VATT Communications, POB 1279, 00101 Helsinki
     
12. Right to require data to be corrected or removed
    Registered persons are entitled to request that we rectify erroneous, unnecessary, outdated or inaccurate personal data on them. Send your request for rectification under the General Data Protection Regulation (GDPR), specifying the error in the personal register, to VATT's communications department at: [email protected] or: VATT Communications, POB 1279, 00101 Helsinki
     
13. Other rights related to processing of personal data
    Registered persons are entitled to restrict the processing of data concerning them or to have them erased. Persons can leave VATT's stakeholder register at any time by following the link at the bottom of the newsletter, or at uutiskirje.vatt.fi
     
14. Updating of privacy statement
    Updates may be made to this privacy statement, for example if our procedures or systems change, or if data protection recommendations change.

Events organised by VATT

We invite persons to events organised by VATT among others from the civil service, financiers, other stakeholders and partners and the media.

For our principal annual stakeholder event (VATT Day) we assemble a list of invited guests from public sources. The list of invited guests is assembled based on the theme of the event concerned, and the list is used for this event only.

Privacy Statement of VATT Institute's Whistleblowing Reporting Channel

Date created: 15 June 2023

1 Controller

VATT Institute for Economic Research
address: Arkadiankatu 7, 00100 Helsinki, Finland
tel: + 358 295 519400
Email: [email protected]

Data Protection Officer
Outi Örn
Email: [email protected]

2 Purpose and legal basis for the processing of personal data

The maintenance of the Whistleblowing channel is based on the Directive of the European Parliament and of the Council on the protection of persons who report breaches of Union law (EU 2019/1937) and on the national legislation implementing the protection of whistleblowers (Act on the Protection of Persons Reporting Infringements of European Union and National Law, 1171/2022, hereinafter the “Whistleblower Act”).

A report can be submitted by a person who, in connection with their work, detects or suspects activities contrary to the public interest. Those eligible to submit reports include VATT’s current employees, former employees and various stakeholders, such as visiting researchers, temporary workers, service providers, etc.

The purpose of the whistleblowing channel is to ensure VATT’s compliance with the EU legislation and national legislation referred to in section 2 of the Whistleblower Act.

The personal data contained in the reports to the whistleblowing channel and the personal data revealed in the investigation of reports are used to investigate and prevent possible misconduct.

The processing of personal data is based on VATT’s statutory obligation, as specified in the Whistleblower Act.

3 Data content of the register

The register may be used to process the personal data of the person who submitted the report, the subject of the report, the processors of the report, and the experts necessary for processing the matter.

The report can be submitted anonymously or under one’s own name. Regardless of this choice, every report will always be processed in a confidential manner, and the identity of the person who submitted the report will only be disclosed to the persons appointed to the processing of the report and the persons invited to investigate the matter as experts.

The person submitting the report may decide whether to submit the report with or without their contact details. If the report is submitted anonymously, it will display the response time. The system creates a password that allows the report’s author to track the processing of their report. The processors of the report will see a case number that cannot be linked to any individuals, unless the person decided to provide their contact details to the processors. The reporter’s browser, browser version, and IP address are recorded in the system’s log data.

4 Regular disclosure of data

The personal data contained in the register will not be disclosed to third parties, unless the matter must be transferred to an official investigation for the purpose of carrying out an investigation related to misconduct or violations of legislation, or if the report contains information on the basis of which there is reason to suspect that an offence has been committed. In situations where the reporter’s identity is known to the team processing the report, any information concerning the reporter’s identity will not, as a rule, be disclosed to third parties without the reporter’s express consent. However, the identity of the person submitting the report may be disclosed if the disclosure of the information is necessary for the processing of a report referred to in the Whistleblower Act in an external whistleblowing channel, for reporting an offence to the police, for pre-trial investigations carried out by the police, or for court proceedings. In such cases, VATT must inform the reporter of the disclosure of their identity in advance, unless the provision of such information could endanger any relevant pre-trial investigations or trials.

The data is stored in the information system of Webropol Oy, which acts as the data processor and whose system has been selected as the central government’s joint whistleblowing channel solution. Webropol employees will not have access to the reports in the channel without VATT’s express consent.

5 Transfer of personal data to a third country or international organisation

No data is transferred outside the EU or the EEA or to international organisations.

6 Retention periods for data groups

The information received through the whistleblowing channel will be deleted five years after the arrival of the report, unless it is necessary to retain it for the purpose of fulfilling the rights or obligations laid down in the Whistleblower Act or in other acts, or for the preparation, presentation or defence of a legal claim. Any personal data that is clearly not relevant for the processing of a report will be deleted without undue delay.

The target period for providing the reporter with a response detailing the chosen measures is three months. After this, the original notification and summary report are entered into the case management system according to the deadlines specified in the archiving plan. No personal data is processed in the summary reports describing the use of the whistleblowing system.

The server of the data processor (Webropol Oy) will log the browser, browser version, and IP address of the person who submitted the report. This log data will be destroyed permanently within two weeks of the submission of the report.

7 Technical and organisational security measures

Manual materials:

If a manual dataset is added to the register or a copy is printed of it, this manual data will be stored in a locked space. All unnecessary manual material will be destroyed in a secure manner, in accordance with the decisions and regulations issued on the storage of data as well as the instructions issued by document management.

Digitally processed materials:

Access to data processed in information systems is restricted to persons specifically designated and authorised by the controller. The rights of these persons to access said data is verified regularly. The information network and terminal devices in which the register is located are protected by technical measures.

8 Data sources where no data have been obtained from the data subject

Data is collected from reports submitted to the whistleblowing channel and, in connection with the investigation of the subject of the report, from VATT’s internal data sources, such as persons potentially involved in the matter and, if necessary, using information from IT systems.

9 Rights of the data subject

9.1 data subject's right of access under article 15

The right of access of the data subject under Article 15 of the General Data Protection Regulation may be restricted with regards to personal data reported under the Whistleblower Act if this is necessary and proportionate in order to ensure the accuracy of the report or to protect the identity of the person submitting the report. If only part of the data concerning the data subject is excluded from the above-mentioned right, the data subject has the right to access any other data concerning them. The data subject has the right to be informed of the reasons for the aforementioned restriction and to request that the other information be disclosed to the Data Protection Ombudsman under section 34, subsections 3 and 4 of the Data Protection Act (1050/2018).

In the case of reports not covered by the Whistleblower Act, the data subject’s right of access to the data collected on them may also be restricted by the corresponding justifications and procedures laid down in section 34 of the Data Protection Act. Data access requests are to be addressed to VATT’s registry office at [email protected].

9.2 right to rectification under article 16 and right to erasure under article 17

The data subject has only a limited right of access to the recorded data concerning them with regard to reports covered by the Whistleblower Act and other reports of misconduct. If such other data concerning the data subject can be disclosed to the data subject without jeopardising the processing and investigation of the report, the data subject may request the rectification or erasure of said data. Requests are to be addressed to VATT’s registry office at [email protected].

9.3 right to restriction of processing under article 18

Article 18 of the General Data Protection Regulation concerning the data subject’s right to restriction of processing does not apply to the processing of personal data referred to in the Whistleblower Act.

Additionally, as a rule, the right of restriction does not apply to other reports of misconduct than those falling within the scope of the Whistleblower Act, as the processing of personal data is based on VATT’s statutory task, which precludes the right of access to data under Article 15, the right of erasure under Article 17, or the right to object to the processing of data under Article 21 of the General Data Protection Regulation. If other data concerning the data subject can be disclosed to the data subject without jeopardising the processing and investigation of the report, the data subject may request to exercise their right to restrict the processing of said data. Requests are to be addressed to VATT’s registry office at [email protected].

9.5 right to object to the processing of personal data under article 21

With regard to reports falling within the scope of the Whistleblower Act, VATT processes personal data for the purpose of carrying out a statutory task, which is why the data subject does not have the right to object to the processing of the data.

In connection with other reports of misconduct, the related data is processed in order to perform a task carried out in the public interest, and the data subject may object to the processing on the basis of their specific circumstances. In such cases, the processing of the data must be discontinued unless VATT can demonstrate that there is a significant and justified reason for the processing that overrides the interests, rights and freedoms of the data subject or is necessary to establish, present or defend a legal claim.

10. Right to file a complaint

The data subject has the right to file a complaint with the supervisory authority if they believe that their rights have been violated by the controller and the controller has not reacted to the matter. You can check the rights of data subjects at https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman

11. Other possible rights

Personal data is not used or disclosed for use outside any absolutely necessary statutory official activities. Customers can report any data protection-related risks or issues to VATT by email at [email protected].

12. Cookies

Webropol Oy only uses cookies that are mandatory for the use of the service, and they are not used for any other purpose. For more information on how cookies are used on VATT’s website, please see VATT Privace Statement above.