This is how your personal data is processed in the processing of complaints
Personal data refers to any information that can be directly or indirectly linked to a natural person.
On this page, we will outline the instructions we follow, our methods for processing and storing your data, and what rights you have. These guidelines will never limit the rights granted to you by the General Data Protection Regulation or any other legally valid decision.
This is how we process your personal data in the processing of complaints
A complaint is a report submitted to a supervisory authority, such as a regional state administrative agency, concerning a suspected erroneous action or negligence. The processing of your personal data is based on Article 6 (1)(c) of the EU General Data Protection Regulation (EU 2016/679), i.e. processing required compliance with the legal obligation of the controller. The competence of the Regional State Administrative Agencies in the processing of complaints is based on, for example, Chapter 8 a of the Administrative Procedure Act and special legislation of the sectors, such as the Social Welfare Act, the Act on the Status and Rights of Patients or the Health Protection Act. More detailed list of laws is in section 7 of the privacy statement.
The right to access and process data is granted based on tasks. For example, confidential information is generally not processed at all unless the tasks require it. Confidential information is not discussed with outsiders. All processing of personal data and all participants in the processing are subject to the obligation of confidentiality and non-disclosure. The Regional State Administrative Agencies process special personal data, such as health data, in the processing of complaints.
The Regional State Administrative Agencies handle complaints in the following sectors
- Education
- Rescue services
- Reindeer husbandry
- Accessibility
- Social care
- Health care
- Municipal trial on promoting employment
- Early education
- Environmental health
- Reporting local authority misconduct
In the processing of complaints by Regional State Administrative Agencies, personal data is processed in the following situations, among others:
- The complaint is transferred between authorities if necessary
- In order to investigate a complaint, the Regional State Administrative Agency may request statements and reports from the subject of the complaint
- The Regional State Administrative Agency may request expert opinions to investigate the matter
- The Regional State Administrative Agency's decision on the complaint is notified to the party concerned, taking into account the provisions on confidentiality
- The complaint decision is archived in the case management system
When your complaint is submitted to the Regional State Administrative Agency for investigation, your name will be known to the subject of the complaint. Complaints are permanently kept documents.
How we secure your personal data
Your personal data is protected from unauthorised viewing, editing and destruction. The protection is based on user authorisation management, the technical protection of databases and servers, the physical protection of facilities, access control, the protection of data communication and the backup of data. The right to access and process data is granted based on tasks. The processors of complainants have the right of access to the complaints in their unit. More extensive access rights have been granted to complaint coordinators or officials in a similar supervisory position.
Purpose of processing your personal data
The case management system shall be used for registering cases and documents, preparing cases, making decisions, communications, implementation and processing phase supervision (Article 6 of the EU General Data Protection Regulation (EU) 2016/679). Registering enables the monitoring of cases and the recording of new documents. The system can be used to produce statistics and reports on processed cases. The system also functions as an electronic archive for documents. The system includes a record/case register, document management, a customer register and any integrations to other systems.
Regular disclosures of data
Personal data are not regularly disclosed to third parties. Public personal data included in the case management system is given for viewing for justified reasons. Data included in the register shall be disclosed in accordance with sections 13 and 16(3) of the Act on the Openness of Government Activities (621/1999). Confidential data shall only be disclosed with the consent of the data subject, upon request by the data subject in accordance with the Act on the Openness of Government Activities, or based on legal rights.
Some or all of the following data may be processed:
- last name
- first name
- personal identity code
- postal address
- postal code
- city
- municipality of residence
- telephone number
- e-mail address
- information and documents relevant to each case, such as
- case number,
- information about the procedural steps taken,
- information about any decisions made,
- details about any relevant projects,
- payment history, and
- any other documents submitted, which can also include sensitive information (such as information about a person’s health in the case of medical malpractice complaints).
We therefore ask you to only send us information that we actually need. The documents are kept for as long as specified in the Regional State Administrative Agency's information management plan. For information management plans, contact the registry.
The easiest way to ensure that you are sending us the right information is to use our online customer service portal or forms. If you are unsure as to what information we need, ask us. Contacting your nearest Regional State Administrative Agency.
Data sources for your personal data
The information on your complaint can be processed through the following channels:
- electronic form
- secure message
- telephone
- post
- other situations in which the customer discloses their data.
Instead of storing the complainant's personal data on the electronic form, the information is sent to the receiving case management system. During the submission of the form, the personal data is structured data that is transmitted to the receiving system. To check for errors, the data is stored in the log for a short period of time and is automatically deleted. Personal data is transferred to the case management system of the Regional State Administrative Agency.
The electronic form for complaints uses Suomi.fi identification and Suomi.fi Messages service for notification of complaints if the customer has approved the use of the service. For more information, see the Suomi.fi service's privacy statement.
The Regional State Administrative Agency uses the Deltagon Sec@GW security messaging service for the confidential sending of e-mail messages between both internal and external persons. The identification of the recipient in a sufficiently secure manner is determined on a case-by-case basis based on the value of the information and the risk assessment and taking into account the legal principles of administration.
Decisions on complaints that are not sent to the customer in the Suomi.fi Messages service are sent by post or e-mail as a security messaging service with the suffix .sec.
When investigating complaints, the Regional State Administrative Agency uses the following sources of information
- Patient data
- Social welfare client information
- Statements and reports by the subjects of complaints
- Expert opinions
We also receive information from services that provide public contact information.
You have the right to know which of your personal data we are processing and to request a copy. You have the right to receive information about whether we process your personal data in our activities. If we do not process your personal data, you have the right to be informed about this as well. You also have the right to rectify incorrect information about you, supplement your personal data, and ask us to delete your personal data or limit its use. You also have the right to receive personal data concerning you in a machine-readable format and to transfer the data to another party responsible for processing the data.
If you believe that your personal data has been processed in a manner that is violated to the law, you can file a complaint or complain to the Office of the Data Protection Ombudsman about the processing of your data. However, we recommend that you first contact the Regional State Administrative Agencies' Data Protection Officer (see contact details below).
Contact information for the Data Protection Officer and further information on data protection
Office of the Data Protection Ombudsman
Data controller
Each Regional State Administrative Agency is competent to carry out its tasks in a certain geographical area in Finland, unless the national management of a matter has been centralised to a specific Regional State Administrative Agency. Therefore, one of the six Regional State Administrative Agencies will usually act as the controller for the processing of personal data in accordance with this notification, depending on where in Finland you live and which Regional State Administrative Agency has processed your matter.
In accordance with this notification the controllers are the Regional State Administrative Agencies; their national domains and contact information are the following:
Area of jurisdiction: regions of Uusimaa, Kanta-Häme, Päijät-Häme, Kymenlaakso, South Karelia, Southwest Finland and Satakunta
Visiting address: Wähäjärvenkatu 6, Hämeenlinna
Postal address: P.O. Box 1, 13035 AVI, Finland
Telephone: +358 295 016 000
Registry: kirjaamo.etela(at)avi.fi
Area of jurisdiction: regions of South Savo, North Savo and North Karelia
Visiting address: Raatihuoneenkatu 5, Mikkeli
Postal address: P.O. Box 2, 13035 AVI, Finland
Telephone: +358 295 016 000
Registry: kirjaamo.ita(at)avi.fi
Area of jurisdiction: region of Lapland
Visiting address: Valtakatu 2, Rovaniemi
Postal address: P.O. Box 3, 13035 AVI, Finland
Telephone: +358 295 016 000
Registry: kirjaamo.lappi(at)avi.fi
Area of jurisdiction: regions of Southwest Finland and Satakunta
Visiting address: Itsenäisyydenaukio 2, Turku
Postal address: P.O. Box 4, 13035 AVI, Finland
Telephone: +358 295 016 000
Registry: kirjaamo.lounais(at)avi.fi
Area of jurisdiction: regions of Pirkanmaa, Central Finland, South Ostrobothnia, Ostrobothnia and Central Ostrobothnia
Visiting address: Wolffintie 35, Vaasa
Postal address: P.O. Box 5, 13035 AVI, Finland
Telephone: +358 295 016 000
Registry: kirjaamo.lansi(at)avi.fi
Area of Jurisdiction: regions of North Ostrobothnia, Kainuu and Lapland
Visiting address: Linnankatu 3, Oulu
Postal address: P.O. Box 6, 13035 AVI, Finland
Telephone: +358 295 016 000
Registry: kirjaamo.pohjois(at)avi.fi
Contact information
Data Protection Officer
tel. +358 295 018 015
[email protected]
You can contact the Regional State Administrative Agencies' Data Protection Officer if you need more information on the processing of personal data by Regional State Administrative Agencies. Contact the Regional State Administrative Agency's registry office, if you have any questions concerning the exercising of your rights in matters related to the processing of your personal data. The contact details for the registry office can be found below. If your matter concerns the processing of your personal data by an organisation other than the Regional State Administrative Agency, you must first contact the relevant organisation or its data protection officer.
Queries relating to exercising your rights as a data subject should be addressed to the registry of the Regional State Administrative Agency for Southern Finland:
Regional State Administrative Agency for Southern Finland
Wähäjärvenkatu 6, Hämeenlinna
PO Box 1, 13035 AVI
tel. +358 295 016 000
[email protected]