On this page, we will tell you
- what rights to your own data you have
- who is responsible for the implementation of the rights
- how you can exercise your rights in practice.
What are the rights of the data subject based on
The rights of the data subject are based on data protection legislation.
The most important data protection laws are the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act supplementing it. In addition, health and social services and pharmacies comply with specific legislation on health and social services.
Legislation defines how personal data may be processed and what rights to their own data a person has.
Key roles in the processing of personal data
The controller is the organisation or person who determines the purpose for which personal data is used and how it is processed. Health and social service providers are usually the controllers of the data generated in their operations.
Joint controller: There are two or more controllers who decide on the processing of personal data together. For example, Kela is a joint controller of the Prescription Centre’s joint register.
The processor processes the data on behalf of the controller and in accordance with the controller’s instructions.
The data subject is the person whose data is processed.
Who is responsible for the implementation of the rights of the data subject?
Information stored in Kanta Services includes certain exceptions which can limit the rights of the data subject. The exceptions arise from other legislation, such as the Act on the Processing of Client Data in Healthcare and Social Welfare, the provisions of the Prescription Act or other legislation governing Kela’s operations.
The health and social service provider or pharmacy whose operations the data was originally recorded in is responsible for the implementation of the rights of the data subject.
The health and social service provider is the controller of the data it has recorded and is responsible for the implementation of the rights of the data subject. These are:
- the right of access to your data
- the right to know who has processed your data
- the right to restrict the use of your data
- the right to demand that incorrect information is corrected.
Kanta Services implements the rights of the data subject as a joint controller to the extent that they fall within the responsibility of Kela. These are:
- the right of access to your data
- the right to know who has processed your data
- the right to demand that incorrect information is corrected.
How to exercise your rights
If you wish to check your data stored in Kanta Services or see how your data has been processed, read the instructions:
Kela acts as the primary contact point when the request concerns data included in Kela’s register management. If necessary, Kela also directs the request to the right party when acting as a joint controller.
Right to correct incorrect information
If there are errors in your patient, prescription or customer information, you have the right to request that the controller corrects them. The incorrect information is corrected by the service provider or the pharmacy where the incorrect information was recorded. Service providers and pharmacies are responsible for the accuracy of the information they record.
Right to restrict the processing of personal data
The data subject always has the right to request the restriction of the processing of their personal data within the limits of national legislation. You can request this from the service provider that has processed your data.
Right to erasure
Kela cannot delete data stored in Kanta Services before the statutory retention period has expired.
Right to lodge a complaint with the Data Protection Ombudsman
If you feel that your rights as a data subject have not been implemented, you can submit a complaint to the Data Protection Ombudsman:
Support and guidance
Kanta Services maintains privacy statements for the registers that are under the responsibility of Kela.
The privacy statements provide more detailed information on your rights and how the personal data stored in Kanta Services is processed.
Kanta Services, health and social service providers and pharmacies all have assigned data protection officers (DPOs). They provide guidance on data protection matters and monitor its implementation.
- Kanta Services Data Protection Officer (tietosuoja@kanta.fi) provides guidance and advice on the rights of the data subject regarding the data included in the Kanta Services register
- If your question concerns, for example, the processing of your patient, customer or prescription data, contact the service provider’s or pharmacy’s data protection officer.
For general questions about Kanta Services, contact Kanta Services’ customer support: asiakaspalvelu@kanta.fi .