The General Data Protection Regulation requires the free movement of data in the EU. However, the Act has been drawn up in a manner that that specifies that data will, as a rule, be processed in a centralised secure user environment maintained by the health and social sector’s data permit authority, which can only be accessed by those with access rights. A permit recipient can be located elsewhere than in Finland, but the data will remain in Finland. A secure user environment is the key technological method also for ensuring the protection of personal data.
Data could only be supplied to another secure user environment specified by the permit recipient in exceptional circumstances. Even then, the data could only be used for the purpose for which it has been supplied to the permit holder. The EU’s General Data Protection Regulation determines the conditions according to which data can be supplied to parties outside the EU.