Privacy Notice: Study Register Peppi
ÅBO AKADEMI UNIVERSITY
www.abo.fi
PRIVACY NOTICE
According to the EU General Data Protection Regulation GDPR (EU 679/2016), Art. 13-14
The notice concerns: Study Register
This data protection notice describes how Åbo Akademi University processes students’ personal data in the study register.
Data controller
Åbo Akademi University
Tuomiokirkontori 3
20500 Turku
Finland
Åbo Akademi University is controller for the personal data collected and processed in the university’s activities – in teaching, guidance, research, administration, and cooperation, internally and externally.
Responsible unit for the processing that is described in this document: Educational Services
Contact person:
Data Controller: Gurli-Maria Gardberg (gurli-maria.gardberg@abo.fi)
Data Protection Officer at Åbo Akademi University: dataskydd@abo.fi, +358 2 215 31 (switchboard).
Why do we process your personal data?
Personal data is processed to enable studies, teaching, and the other statutory duties of the university according to the Universities Act, as well as to carry out official tasks of the university.
In practice, personal data is processed for purposes including, but not limited to:
- Academic year registrations
- Course enrolments
- Assessment of study attainments and credit transfers
- Student exchanges
- Teaching and study-related decisions
- Study guidance
- Monitoring and management of possible tuition fees
- Degrees, including issuing and printing of certificates
The data in the Study Register is also needed for planning and developing teaching and university operations, as well as for targeted communication to students. Personal data may also be used for scientific research.
Statistics are compiled in accordance with the requirements of the Ministry of Education and Culture as well as internal university processes.
What is the legal basis for processing personal data?
Åbo Akademi University’s right to process personal data is based on:
- Compliance with the university’s statutory obligations
- Public interest or exercise of official authority
- Consent
The basis for processing personal data is the fulfilment of the university’s statutory obligations under the Act on National Study and Degree Registers (884/2017) and legislation concerning the data collection duties of authorities (including the Ministry of Education and Culture, Statistics Finland, the Social Insurance Institution of Finland (Kela), the Student Union, and the Finnish Student Health Service (FSHS)).
The basis for processing personal data is public interest, enabling the university to organize its operations efficiently and with high quality, and to provide students with the necessary information, tools, services, and resources, including the ability to use the university’s facilities.
The university also uses personal data for the granting of scholarships and reduced tuition fees, and to support studies.
Personal data is also processed in connection with student feedback, and based on the Universities Act, for decision-making within multi-member administrative bodies.
The basis for the processing of personal data for statistical purposes is a statutory obligation and public interest within scientific research.
The basis for processing personal data is consent when a student’s personal and contact information is disclosed to parties outside the university for purposes that support the student’s studies, for surveys and marketing, recruitment, or alumni directories.
Which personal data is processed and by whom?
Åbo Akademi University processes personal data based on which you can be identified directly or indirectly. Personal identity code and student numbers are examples of direct identifiers.
In connection with studies and study attainments, the most processed data includes the student’s name, student number, contact details, and details of degrees and studies.
Examples of personal data processed at Åbo Akademi University:
Identification details
- Basic student information (name, personal identity code, date of birth, study right number, username or other unique identifier, sex, mother tongue, communication language, language of prior education, nationality, municipality of residence)
- Contact information (university email address, private email address, phone number, postal address)
- Students may submit next-of-kin details, which are then stored in the study register
Study-related data
- Study rights and their validity
- Annual attendance and non-attendance information, resignation of the study right
- Student union membership and paid fees
- Possible additional study time granted
- Possible note regarding status as elite athlete
- Information on student exchange (programme, institution, period)
- Exemptions from language requirements
- For students paying tuition fees: details of liability to pay, residence permit validity, tuition fee reductions
- Completed degrees
- Scope of study rights
- Personal study plan (PSP) data; planned study modules and courses, assessment information, supervisors
- Course enrollment data
- Agreement database information
Study attainment data
- Course identifiers, name, scope, date of completion, assessor, grade
- Degrees and study attainments completed at Åbo Akademi University, with details such as programme, specializations/major subject, dates and scope
- Exam registrations
The following university staff may process personal data in the study register:
- Staff in Educational and Learning Support and Study Guidance, teaching staff
- ICT Services staff with authorized access
Other units with access due to bookings and reporting include: Legal Services, Strategic Management, Financial Services, Campus Development, and the Student Union.
Access rights in Peppi depend on the role assigned to each staff member.
From where do we collect personal data and how is the data processed?
We primarily receive the data from the data subject themselves. In addition, we receive personal data from the following entities and systems:
- Enrollment information is obtained from the Finnish National Agency for Education’s national application register (Act 1058/1998), the OILI service, as well as from the documents submitted by the student to the university
- Information on study results is most often provided by teachers
- Information about students at the Open University and information on study rights is transferred from the Open University’s registration system
- Åbo Akademi email addresses are transferred to the Study Register from Åbo Akademi’s user directory
- Basic data on individuals who are not students is transferred from ICT Services’ user directory
- Decisions made by Åbo Akademi’s heads of subject, governing bodies, and the Educational Services unit (such as exemptions from language studies, changes of study right, and the granting of extended study time) are entered manually
- From other Finnish higher education institutions, mainly via the Cross-Studies Service:
- Identifying information and registration data for students from other Finnish higher education institutions for individual study units at Åbo Akademi
- Registrations and study attainments completed at other Finnish higher education institutions by students of Åbo Akademi
- Information on flexible study rights is also recorded based on information collected through the University of Turku’s form for flexible studies (UTU-Forms).
- Information on exchange students is automatically transferred from SoleMove.
- Information on CHARM-EU students is received from the partner institutions cooperating with Åbo Akademi University.
- Individuals admitted to additional or standalone studies are entered manually based on information provided by the faculties.
In addition, personal data may be collected and updated for the purposes described in this privacy notice from publicly available sources and authorities or based on information received from third parties within the limits of applicable legislation. Such updates are performed either manually or through automated methods.
How long is the data stored?
Storage times are based on legislation. We store personal data for as long as necessary for the purpose of the processing. With reference to current legislation, we regularly assess the necessity of retaining the data. In addition, we take reasonable measures to ensure that no personal data incompatible with the purpose of the register is stored.
Based on the legislation governing universities (Act 884/2017, Sections 25 and 27), Åbo Akademi permanently stores the following education-related personal data:
- the student number and personal identity code, or other equivalent identification data of the individual concerned
- information on degrees completed by the individual, and any specialization education completed, as well as information on all study attainments and their grades
- information on a person’s study right in education leading to a degree and in specialization education, as well as information on the acceptance of a study place, registration for education leading to a degree, and registration for specialization education
Is personal data transferred for processing outside Åbo Akademi University?
Åbo Akademi discloses the necessary personal data from the study register to the following recipients:
- The Student Union of Åbo Akademi University (Universities Act 558/2009)
- The Student Union of Åbo Akademi University has the possibility to review the student’s registration status and the student union fee in the study register.
- Other Finnish higher education institutions via the Cross-Studies Service
- Registrations and completed studies at Åbo Akademi by students from other Finnish higher education institutions.
- Identifying information and registrations for Åbo Akademi students for individual study modules at other Finnish higher education institutions.
Personal data concerning students at Åbo Akademi, as well as information related to students and studies, is transferred via the national data warehouses for higher education institutions, VIRTA, and the KOSKI data warehouse (https://opintopolku.fi/konfo/sv/sivu/dataskyddsbeskrivning-for-koski-tjansten) to the following recipients:
- Statistics Finland (Statistics Act 280/2004, Section 15)
- The Social Insurance Institution of Finland (Kela) (Student Financial Aid Act 65/1994, Sections 41b and 43)
- The Finnish Student Health Service (FSHS) (Act on Student Health Care for Higher Education Students 695/2019)
- The National Supervisory Authority for Welfare and Health, Valvira (Act and Decree on Health Care Professionals 554/1994 and 564/1994)- Employment authorities (Unemployment Security Act 1290/2002; Act on Public Employment and Business Service 916/2012)
- The Ministry of Education and Culture
- The Finnish Immigration Service (Migri) (Act on the Processing of Personal Data in the Immigration Administration 615/2020, Section 13)
- The Finnish National Agency for Education: information on exchange studies
- The Digivision opin.fi service
In addition, Åbo Akademi may disclose students’ personal data:
- for scientific research
- to other Finnish higher education institutions for the processing of study rights and the transfer of information on study attainments in connection with, for example, educational cooperation
- to foreign higher education institutions in connection with exchange studies and double or joint degree programmes, as well as other educational cooperation such as the transfer of information on study attainments
- to Jolla (the Frank student card service): personal data of degree students and exchange students who have paid the student union fee is transferred (including personal identity code, name, attendance status code, and study right number)
Personal data is transferred from the study register to the following Åbo Akademi services:
- AtomiSign, for electronic signing of degree certificates, certificates, and transcripts of records
- HowULearn (OID, personal identity code, name, primary email address, username, field for passport number for foreign nationals)
- Power BI, primarily using anonymized VIRTA data
- The Alumni Register (CRM): manual transfer for those students who have given their consent in connection with their degree certificate request (name, date of birth, private email address, phone number, degree, organizational unit, and period of study)
- TUUDO, Tuudo’s privacy notice applies (name, OID, study right number, study rights, date of birth, phone number, email)
- Rimbert scholarship management system retrieves information required for processing scholarship applications (protected identity status, name, department, degree programme, major subject, specialization, nationality, and native language)
Is personal data transferred outside EU/EEA?
Personal data is generally not transferred outside EU/EEA. If transfers occur, appropriate safeguards are applied.
Additional information about a long-term or persistent register, system, or tool
Principles for how the data/register is protected:
Your data is processed only by employees of Åbo Akademi or by persons authorized by Åbo Akademi who have the right to process personal data and who do so on behalf of Åbo Akademi. As the data controller, Åbo Akademi has implemented the necessary technical and organizational measures and requires the same from the service providers engaged by Åbo Akademi.
Detailed information on automated decision-making:
No automated decision-making or profiling is used.
What rights do you have when Åbo Akademi University processes your personal data?
Åbo Akademi University is responsible for taking appropriate technical and organizational measures to protect personal data against unauthorized or illegal processing and against damage to or loss of personal data. Personal data must always be processed in a fair and transparent manner in accordance with applicable data protection regulations.
According to the EU General Data Protection Regulation GDPR, you have the right to
- get transparent information on how your personal data is processed and how you can exercise your rights (Art. 12)
- get access to your personal data at Åbo Akademi University and information on the processing of data (Art. 15)
- have your personal data corrected (Art. 16). Note that employees and students at Åbo Akademi University can in most cases correct their own data according to the instructions on the intranet.
- have your data erased (“the right to be forgotten”) in certain situations (Art. 17)
- restrict the processing of your personal data in certain situations (Art. 18)
- have your personal data transferred between systems in certain situations (Art. 20)
- object to the processing of your personal data in certain situations (Art. 21)
- not be subject to automated decision-making, with certain exceptions (Art. 22)
You have also the right to be informed of a personal data breach involving a high risk for your personal data (Art. 34).
When the purpose of the processing is scientific research, statistics or archival purposes, the rights may be restricted by the Data Protection Act (1050/2018). Restrictions on rights always require special protective measures.
If you have questions about your rights, you can contact the responsible contact person (see above) or the ÅAU Data Protection Officer (dataskydd@abo.fi). See also the overall information on the processing of personal data on the ÅAU website
You have the right to lodge a complaint with the data protection authority if you believe that the processing of your personal data is an infringement of the General Data Protection Regulation (GDPR).
Contact information to the data protection authority:
Office of the Data Protection Ombudsman
PL 800
00531 HELSINKI
+358 29 566 6700 (switchboard)
tietosuoja@om.fi
tietosuoja.fi