Privacy notice for students

Data controller

Laurea University of Applied Sciences Ltd, Ratatie 22, 01300 Vantaa

Data controller contact person: President, CEO Jouni Koski, jouni.koski@laurea.fi
Person responsible for processing personal data: Development Manager Päivi Aho, paivi.aho@laurea.fi
Data Protection Officer: Marjo Valjakka, marjo.valjakka@laurea.fi

The person responsible for processing personal data acts as the main administrator of the student and study information system, provides more detailed information on the processing of personal data to the data subject and responds to requests related to the data subject’s rights, such as requests to inspect data and correct errors.

On Laurea’s different campuses, study services are responsible for handling students’ personal data. They can be reached at the following phone numbers and email addresses:

Campus	Phone number	Email address
Leppävaara campus	+358 9 8868 7400	leppavaara.info@laurea.fi
Lohja campus	+358 9 8868 7800	lohja.info@laurea.fi
Otaniemi campus	+358 9 8868 7500	otaniemi.info@laurea.fi
Tikkurila campus	+358 9 8868 7300	tikkurila.info@laurea.fi
Porvoo campus	+358 9 8868 7600	porvoo.info@laurea.fi
Hyvinkää campus	+358 9 8868 7700	hyvinkaa.info@laurea.fi

Why do we process personal data?

We process students’ personal data for the planning, implementation, evaluation and monitoring of our activities in accordance with the tasks assigned by the education administration. Personal data are also processed to safeguard students’ rights and interests.

We maintain study and achievement records of those studying or who have previously studied at Laurea and produce various study-related extracts, certificates and reports.

We also process data in the user management system to enable secure lifecycle and access management by providing

network and email accounts for students
centralized electronic authentication in Laurea University of Applied Sciences’ information systems and access rights to learning platform workspaces
authentication in inter-university network connections
creation of email lists
creation of access rights to Laurea’s intranet system for student communications

The use of the register and the legal basis for processing are based on the tasks prescribed in the Universities of Applied Sciences Act (L932/2014) and, in certain respects, on the public interest (e.g. provision of services) and Laurea’s legitimate interests (e.g. online exam invigilation). In other respects, separate consent is requested from students for data processing.

The university of applied sciences is also subject to the following legislation:

Government Decree on Universities of Applied Sciences (1129/2014)
Act on National Registers of Study and Degree Records (884/2017)
Administrative Procedure Act (434/2003)
Act on Administrative Judicial Procedure (586/1996)
Act on the Openness of Government Activities (621/1999)
Decree on the Openness of Government Activities and Good Information Management (1030/1999)
Statistics Act (280/2004)
Act on Financial Aid for Students (65/1994)
Unemployment Security Act (1290/2002)
Government Decree on Financial Aid for Students (869/2017)
EU General Data Protection Regulation ((EU) 2016/679)
Data Protection Act (1050/2018)
Act on the Management of Public Administration Information (906/2019)

What personal data do we process?

Laurea University of Applied Sciences processes only the personal data necessary for carrying out its tasks. These include:

1. Applicant data from OILI

first names, preferred name, surname, personal identity code
student number, learner ID
contact details (street address, postal code, city, email address, telephone number)
gender
native language and language for correspondence
nationality
prior education information
information related to the application target and education
enrolment and payment information
information related to consent for publishing student selection results

2. Other student data

Laurea email address and other contact details
data disclosure consents
additional student information

3. Study information

student number
degree programme,form of education, specialisation option
degree, degree title, field of study, education classification
required extent of studies (credits)
study intensity (full-time/part-time)
study right period, presence and absence limits
study right period
cross-institution study information
study unit
admission group, other groups
instructors
qualifications
details of study right
certificate annotations, personal certificate annotations
additional information on study right, transfer student information
subject to tuition fee

4. Attendance information

semester enrolment details per semester
used attendance and absence periods
information on extension and restoration of study entitlement
information on completion of studies
graduation information

5. Information on the student’s personal learning plan

required credits, completed credits, credits to be completed
curriculum used as basis for the study plan
studies selected in the study plan
scheduling of studies by semester
enrolments in studies
course performance
study plan comments and assignments
communication between student and advisor
transcript of records
willingness to graduate, confirmation of graduation information

6. Study attainment information

title, credits, grade, completion date and evaluator of the studies completed, person who marked completion
method of study, language, place of completion, municipality, project affiliation, RDI and virtual credits
recognition of prior learning,exemptions
thesis title, grade, completion date, supervisor

7. International mobility information

start and end dates of the mobility period
country of the mobility period
mobility programme
mobility direction
type of mobility

How long do we retain personal data?

Retention periods are determined by legal requirements, decisions of the National Archives and Laurea University of Applied Sciences’ records management plan.

The following are stored permanently in Laurea University of Applied Sciences’ information systems

selection criteria
documents related to the student admission amendment process
study entitlement, registration, degree, study and graduation data
attendance and absence data
data related to the evaluation amendment process
matters subjected to the Board of Examiners
statements given on theses, student’s self-assessments and grade proposals

The following are stored for a limited time in Laurea University of Applied Sciences’ information systems

students’ exam performances, exam answers, assignments and similar data accumulated in electronic learning environments
student mobility and student exchange data excluding performance data
student welfare documents
user management data

The following are stored permanently in the registers maintained by the Finnish National Agency for Education and in national data repositories

joint application process data, data on related additional and extra application processes and direct application process data
study entitlement, registration, graduation and performance data to be transferred to the VIRTA study data repository

Where do we obtain personal data from?

Laurea University of Applied Sciences receives student data from the following sources

The national applicant register maintained by the Finnish National Agency for Education, Studyinfo (Opintopolku)
The national semester enrolment register (OILI) maintained by the Finnish National Agency for Education
information provided on application forms by applicants in application procedures outside Opintopolku
Population Register Centre
updates made by staff into Laurea systems
information provided by the student themselves

Students can update their contact details and other information themselves via the student dashboard. In addition, students separately give consent for data disclosure to Laurea where requested.

To whom and where are personal data disclosed and transferred?

Data disclosure is generally carried out via electronic data transfer connections.

The records of the register containing the university’s student data are public documents as referred to in the Act on the Openness of Government Activities (JulkL 621/1999), which are made available for inspection upon request in accordance with sections 13 and 16 of the Act.

In cases specified by law, data from the student and study information system are transferred to the national data repository of universities (VIRTA), which compiles information on students, study rights, semester enrolments, international mobility periods, and degree and study performances for centralized storage and use. This is not a transfer of ownership of the data; the data remain part of the higher education institution’s register (L484/2013).

Data from the national data repository of universities (VIRTA) are transferred to

the student selection register (Opintopolku) maintained by the Finnish National Agency for Education for use by the student selection register and shared student selection services of higher education institutions
the national OILI service used for registration as a student and registration for the academic year
the Ministry of Education and Culture to support research, evaluation, development, statistics, monitoring and guidance of education
Statistics Finland for statistical datasets
the Social Insurance Institution (KELA) for payment of financial aid, monitoring study progress and assessing social benefits
KELA for providing data to the student health services provider (YTHS) to carry out its tasks
KELA, employment authorities and unemployment funds for handling eligibility for labour market subsidy and unemployment allowance
The Finnish Supervisory Agency for the national register of healthcare professionals (Terhikki) to verify and monitor professional qualifications in healthcare
information on students from outside the EU area to the Finnish Immigration Service (Migri) to grant residence permits based on studies
Information on the education programmes funded by the Service Centre for Continuous Learning and Employment is provided to the Service Centre for Continuous Learning and Employment.
Study attainment data and attendance information of individuals who have received adult education allowance are provided to the Employment Fund.
The Finnish Centre for Pensions uses the degree data stored in the register for the determination of pensions.

On separate request:

for scientific research (The requester must then present to the data controller the purpose of using the data and other matters necessary to determine the conditions for data disclosure. If necessary, a description of how data protection will be organized must be provided.)

Laurea University of Applied Sciences has granted the following permissions for the use of data submitted to VIRTA

OILI (14.09.2014)
- permission to disclose student enrolment and semester enrolment data via the national data repository of higher education institutions
FINNISH SUPERVISORY AGENCY (17.11.2014)
- permission to disclose student and degree data via the national data repository of higher education institutions to Finnish Supervisory Agency for monitoring and verification of healthcare professionals’ qualifications
EMREX (23.10.2015 and 5.2.2024 )
- permission to link the EMREX National Contact Point interface to the national data repository of higher education institutions so that the stored data are available to the learner via the EMREX service
- permission to connect the EMREX National Contact Point interface to the national data repository
ARVO (11.04.2016)
- permission to connect the ARVO effectiveness service of the Finnish National Agency for Education to the national data repository so that VIRTA study data are visible and usable by the learner in the ARVO service
TUUDO (09.06.2016)
- permission for Caleido Oy to, with the learner’s consent, retrieve their data from the national data repository of higher education institutions into the TUUDO service so that the learner gains access to the data Laurea has stored about them
UAF (02.08.2016)
- permission to University Admissions Finland consortium and its system to connect to the national data repository so that study records can be used by consortium universities in their application processing
FOLLOW-UP QUERIES (02.08.2016)
- permission for researchers to use study performance data stored in the national data repository for research collecting information on studies and their progression, graduates’ employment and placement in working life
FIONA (22.03.2017)
- permission for remote use of Statistics Finland’s FIONA research datasets via the national data repository
UNIVERSITY OF HELSINKI (1.8.2018)
- permission to the University of Helsinki to link the of university’s information system to the national data repository of higher education institutions so that the study data are available for use by the application processing of the higher education institutions included in the University of Helsinki
YTHS (6.10.2020)
- permission to disclose data via the national data repository to the Finnish Student Health Service (YTHS)
CONSORTIUM FOR THE SELECTION OF STUDENTS FOR HIGHER EDUCATION (9.12.2021)
- permission to disclose data via the national data repository for the development of student selection (research)
DIGIVISION TRAY (14.4.2023)
- permission to disclose data via the national data repository to Digivision Tray (implementation data – course offerings)
JOTPA (3.1.2024)
- permission to disclose data via the national data repository to the Centre for Continuous Learning and Employment Services
OPIN.FI SERVICE (16.9.2024)
- permission to disclose data to CSC for integrating the Opin.fi service produced by HigherEd Hub Finland Ltd on behalf of universities into the national data repository

In addition, student data are disclosed to

the registers of Metropolia University of Applied Sciences and Haaga-Helia University of Applied Sciences when the student completes 3AMK studies
Haaga-Helia’s user management system to enable centralized electronic authentication in the systems of the Porvoo campus (Haaga-Helia)
the universities of applied sciences’ career and recruitment system
to Laurea’s student union Laureamko for maintaining its membership register
to Laurea Alumni for Laurea’s alumni register

A student can give consent via the student and study information system for the use of their name and address information for the following purposes:

Direct marketing:

Even if the student has given consent to direct marketing, disclosure of data does not occur automatically but is considered on a case-by-case basis by system controllers. As a rule, data are not disclosed.

Education marketing:

For purposes supporting studies, to associations, foundations, professional associations and primarily regional authorities for mailing information which

is intended to promote studies, professional skills or employment in the profession
is intended to improve study or working conditions
is intended to promote the student’s connections to their home region
for other purposes supporting studies, such as research, surveys or opinion polls.

Publication of graduation information:

A student may give consent to publish their graduation information. As a rule, data are not disclosed.

Internet:

The student’s email address may be included in the email address search tool on the university of applied sciences’ intranet. In this case, the student’s email address can be found on Laurea University of Applied Sciences’ internal pages when one knows the student’s name.

If the student has an official protection order from the registry office, this information can be recorded in the Student Administration’s Basic Register at the student’s request. A protection order means that the student’s contact details are not disclosed.

Laurea University of Applied Sciences follows good registry practices and requires that the applicant for data disclosure has a legitimate connection to the target group whose data are requested. The user of name and address data must indicate the source of the data.

Various group reports printed from the student and study information system are interpreted as manual registers. For this reason, the disclosure of a report printed from the register is assessed as a disclosure from a personal data register.

Transfer of data outside the EU or EEA

Normally, Student data are not transferred outside the EU or the European Economic Area.

An exception is where the student activates a separate service themselves, for example Google Apps for Education or Microsoft Office365; in such cases, the necessary data are provided to those services. In such exceptional cases, separate consent is requested from the student and acceptance of the terms of use is required.

How do we protect personal data?

In processing the data, care is taken not to unjustifiably jeopardize students’ privacy.

Manual data

They are stored and protected so that outsiders cannot see them and so that they cannot be accidentally destroyed, altered, disclosed, transferred or otherwise unlawfully processed. Employees are only entitled to view those student-related data that they need in their duties.
Study services are responsible for archiving documents to be archived
Documents containing personal data are destroyed by shredding or as data protection waste.

Electronically processed data

Responsibility for server maintenance lies with Laurea’s IT department. The devices are centralized in locked premises with strictly limited access. The network and servers are appropriately secured.
Access rights are restricted by user groups. Data visibility and update rights in the system are determined by access roles for different user groups.
Only users with system access rights can access the data. System access is determined based on a person’s duties or student status. Staff are bound by confidentiality obligations defined in their employment contracts.

Data subject rights

Right of access

A student currently enrolled has the opportunity to check their own information through the student interface. The student has the right to obtain an official certificate of study and a transcript of records from the Study Services.

A person studying at Laurea or who has previously studied has the right to inspect the data concerning them in the register free of charge once a year. The request for inspection must be made in person or in writing (signed or otherwise reliably authenticated document). The request should be addressed to the Study Services of the student’s campus. The person responsible for register matters decides on the implementation of the inspection request. The student’s identity will be verified before the data are provided. The right of inspection is implemented without delay.

If the person requesting the data is not previously known or their identity cannot be otherwise verified, they must always prove their identity before the data (certificate of study, transcript of records, degree certificate with attachments, assessment of studies, monitoring of progress) are disclosed. Identity can be proven with an official identity document with a photograph. A request sent from a Laurea email account may be considered sufficient proof of identity.

Correction of errors

A currently enrolled student can correct their contact details via the student interface or notify the Study Services of the change.

Laurea (the data controller) must without undue delay, on their own initiative or at the request of the data subject, rectify, erase or complete any personal data in the register that is inaccurate, unnecessary, incomplete or outdated for the purposes of the processing. The person responsible for register matters must, immediately after noticing an error, correct the error or notify the person who has sufficient rights to correct it. The data subject has the right to request correction of data, and the information is corrected without undue delay. If correction is refused, a written refusal certificate is provided. The data subject has the right to bring the matter before the Data Protection Ombudsman. The Data Protection Ombudsman may order the data controller to correct the data.

Right to erasure, restriction of processing and objection to the processing of personal data and automated individual decision-making

The right to erasure under Article 17 of the GDPR does not apply to personal data based on tasks prescribed by law. The data subject has the right to delete personal data based on consent.

In certain situations, the data subject has the right to obtain restriction of the active processing of their personal data. This right exists, for example, when the data subject contests the accuracy of the personal data. The data may still be stored but not otherwise processed without the data subject’s consent.

The data subject also has the right to object to the processing of their personal data, including for direct marketing and, under certain conditions, for scientific, historical or statistical research. If the data subject exercises their right to object, the data controller shall, as a rule, no longer process the personal data for that purpose. The right to object does not apply to processing required by law.

In addition, the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. An exception may be made if the person has given explicit consent or if it is necessary for entering into or performing a contract between the data controller and the data subject.

The contact person for questions concerning data subjects’ rights is the Data Protection Officer.

The data subject has the right to lodge a complaint with the supervisory authority. In Finland, the national supervisory authority is the Office of the Data Protection Ombudsman.