The University of Tampere and Tampere University of Technology were merged on 1 January 2019 to create the new Tampere University. Together the new Tampere University (Tampere University Foundation sr) and Tampere University of Applied Sciences Ltd comprise the Tampere Universities community. However, each institution acts as an independent data controller that bears responsibility for ensuring that student information is processed in compliance with data protection laws.
Why do we process your personal data?
We process your personal data in order to:
- enforce and verify your right to study, manage teaching activities and provide you with academic guidance and counselling services,
- manage your academic records and degrees and compile related statistics,
- develop our teaching activities, and
- maintain a safe learning environment and safeguard data.
In addition, we may use your personal data for:
- research purposes
- study-related marketing purposes or other special purposes
The lawful bases for our processing activities include the following:
- legal obligation (Universities Act 558/2009, Universities of Applied Sciences Act 932/2014) (1, 2, 3)
- public interest or the exercise of official authority (3, 4, 5)
- contract (4)
- consent (6)
Regulations governing the processing of personal data:
- The Finnish Universities Act (558/2009) and related government decrees
- The Government Decree on University Degrees (794/2004) and subsequent amendments thereof
- The Finnish Universities of Applied Sciences Act (932/2014) and related government decrees
- Government Decree on Universities of Applied Sciences (1129/2014)
- The Act on National Study and Degree Registers (884/2017)
- The EU’s General Data Protection Regulation (2016/679) and related national regulations; the Act on the Openness of Government Activities (621/1999)
What personal data do we collect?
We process the following categories of student information:
- general information:
- personally identifiable information (name, personal identity code, student number, user account, national learner ID)
- background information (admission results, gender, nationality, language)
- contact information
- student status
- semester registration
- requirement to pay tuition fees
- information concerning the customership of paid education and related payment data
- other study-related payments (such as sports fees)
- membership of our student union
- academic records (including theses, exam answers and other assignments counted towards your degree and the awarded grades and marks)
- completed degrees
- exam and course enrolments, information about class participation (including possible special arrangements)
- video surveillance records concerning electronic examinations
- study plans and other information related to student guidance and support
- feedback that you have provided
- surveys conducted among students during their studies and in connection with graduation
- post-graduation surveys (such as career surveys)
- student exchange
- grants and scholarships awarded by the University
- decisions concerning academic dishonesty or disciplinary action
In addition, your personal data may be processed when providing the following services:
- services concerning facility management, safety and surveillance
- library services
- IT services
- HR and financial services
- continuous learning services
- alumni relations and stakeholder services
How do we collect personal data?
We collect personal data directly from you and from the following sources:
- nationwide or institution-specific application and admission systems
- international application and admission systems
- other higher education institutions in Finland and abroad (for example, in connection with student exchange programmes)
- electronic payment and registration services
- University staff
In addition, we retrieve up-to-date personal data from Finland’s population information system.
We may also process personal data that is observed or retrieved based on your use of our IT services or equipment or collected by different control and surveillance services (such as video surveillance).
How do we process your personal data?
All student information stored in our IT systems will only be processed for the purposes for which the information was originally collected. Your personal data will only be processed by our employees or partners who are authorised to process students’ personal data in connection with processes that are directly related to studies or students. The right to access and view data stored in a specific information system may only granted in the extent necessary to persons who need the data in the performance of their professional duties.
Personal data may also be used for statistical and research purposes. As a rule, personal data that is used for statistical or research purposes will be anonymised so that individual students cannot be identified. We protect all personal data against unauthorised access.
Information provided by students concerning special needs will only be used for the original specified purpose. Heightened security measures are in place to provide additional protection for this type of data (concerning, for example, any special arrangements provided to a student).
Who do we share your personal data with?
To comply with our legal obligations, we disclose student information to:
- the national higher education achievement register VIRTA, through which student information is made available to the student admissions register (Act on the National Registers of Education Records, Qualifications and Degrees 884/2017),
- the Social Insurance Institution of Finland Kela (Act on Student Financial Aid 65/1994),
- employment authorities (Unemployment Security Act 1290/2002, Act on Public Employment and Business Service 1295/2002),
- our student union (Universities Act 558/2009),
- the Finnish Student Health Service (Health Care Act 1326/2010, Government Decree 380/2009, Infectious Diseases Act 1227/2016),
- the Ministry of Education and Culture (Universities Act 558/2009, Universities of Applied Sciences Act 932/2014),
- Statistics Finland (Statistics Act 280/2004),
- Valvira, the National Supervisory Authority for Welfare and Health (Act and Decree on Health Care Professionals, Act 559/1994, Decree 564/1994).
In addition, we may disclose student information:
- for research purposes,
- to comply with obligations under the Act on the Openness of Government Activities (621/1999) or other legal obligations,
- to other higher education institutions in Finland and abroad in connection with student exchange or educational collaboration in order to confirm your student status and transfer your academic records,
- outside the EU/EEA area in connection with student exchange, the implementation of double or joint degree programmes or the transfer of academic records,
- with your consent, your contact details may be disclosed to third parties:
- for study-related purposes
- information about graduates to associations operating in their fields of study
- for survey and marketing purposes
- for recruitment purposes
In addition, your data may be processed by external service and system providers with which the University has signed a contract that covers the processing of personal data. This does not constitute disclosure of personal data as the data controller remains legally responsible for the processing of personal data. We have selected as partners only data processors who take appropriate technical and organisational security measures to ensure that all personal data are processed in compliance with the GDPR and that your rights are protected.
How long do we retain your personal data?
The retention periods of personal data and other materials stored in our information systems are based on applicable legislation and our archive management policy/data management plan.
The following data that falls in the categories of general information, right to study and academic records will be permanently retained pursuant to applicable legislation:
- Your national learner ID, personal identity number or other personal identifier.
- Information about the degrees and specialist training that you have completed, all the studies and courses that you have taken and the grades thereof.
- Information about your right to pursue education leading to a degree or specialist training; information about your acceptance of a study place; your registration for a programme leading to a degree or specialist training.
The retention periods of other personal data will be defined based on the University’s archive management policy/data management plan.
We will retain personal data that we either collect or process based on your consent (until you withdraw your consent) until further notice or for the duration of a specifically defined retention period, unless there is a lawful basis for processing this data.
Rights of data subjects
Right of access (GDPR, Article 15)
You have the right to know what personal data we process and hold about you. Many of the student information systems allow you to view the data that we have stored about you when you are logged on.
Upon request, we will provide you with a copy of your personal data without undue delay. We will respond to subject access requests within 30 days. If your request is particularly complex or extensive, this deadline may be extended by a further two months.
As s rule, we will provide you with a copy of your personal data free of charge. If you request multiple copies, we will charge a fee for the administrative costs of complying with your request. If a subject access request is manifestly unfounded, excessive or repetitively made, we may charge a fee for the administrative costs or refuse the request. In this case, we will inform the data subject of the reason for this decision.
If a subject access request is refused, the data subject will be provided with a written notice. This notice will also include instructions for appealing against the decision, such as filing a complaint with the relevant supervisory authority.
Right to rectification (Article 16)
You have the right to have any incorrect, inaccurate or incomplete personal details that we hold about you revised or supplemented without undue delay. You are also entitled to have any unnecessary personal data erased from our records.
If your request is refused, we will provide you with a written notice that sets out the reasons for the refusal. This notice will also include instructions for appealing against the decision, such as filing a complaint with the relevant supervisory authority.
Right to be forgotten (Article 17)
In certain circumstances, you have the right to have your personal data erased from our records. The right to erasure will not apply if the processing is necessary for us to comply with our legal obligations or perform tasks carried out in the exercise of official authority. The processes of storing and deleting your personal data are governed by our archive management policy and the statutory retention periods for different types of data.
Right to restrict processing (Article 18)
In certain circumstances, you have the right to request us to restrict processing your personal data until the accuracy of your data, or the lawful basis for processing your data, has been appropriately reviewed and potentially revised or supplemented.
Right to data portability (Article 20)
You have the right to obtain a copy of the personal data that you have submitted to the University in a commonly used, machine-readable format and transfer the data to another data controller. This right applies to situations where data is processed automatically on the basis of consent or contract.
This means that the right to data portability does not apply to data processing that is necessary for the performance of a task carried out in the public interest or to fulfil legal obligations imposed on the data controller. Consequently, this right does not generally apply to the University’s personal data registers.
Right to object (Article 21)
You may at any time object to the processing of your personal data for special personal reasons, if the basis for processing is a task carried out in the public interest, the exercise of official authority, or the University’s legitimate interests. After receiving such a request, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing your data.
You have an absolute right to prevent your data from being used for direct marketing purposes.
Right to lodge a complaint with a supervisory authority (Article 77)
You have the right to lodge a complaint with a supervisory authority, if you consider that the processing of your personal data violates the provisions of the GDPR (2016/679). In addition, you may follow other administrative procedures to appeal against a decision made by a supervisory authority or seek a judicial remedy.
Office of the Data Protection Ombudsman
Street address: Ratapihantie 9, 6th floor, 00520 Helsinki, Finland
Postal address: PO Box 800, FI-00521 Helsinki, Finland
Switchboard: +358 (0)29 56 66700
Fax: +358 (0)29 56 66735
Email: tietosuoja [at] om.fi
You also have the opportunity to take legal action against a data controller or a data processor if you consider that your rights have been violated through non-GDPR compliance.
Enforcing your rights under data protection laws
You can view the personal data we hold about you by logging into many of the information systems owned or maintained by Tampere Universities. Students are also able to update their personal data through our electronic services.
Students can request rectification in connection with the relevant process related to studying and teaching (if your request concerns, for example, your academic records, the rectification process is described in the Guidelines for Student Assessment).