Data can be supplied depending on its intended use in a form where it is impossible for the recipient to identify the data subject or a form in which the individual can be identified. The premise of this Act is that data, which contains identifiers, will only be supplied in exceptional circumstance and its disclosure to third parties will be prevented.
A data permit can be granted for scientific research, teaching and the planning and reporting duties of authorities. A permit is only granted it is evident that supplying the data in question will not violate the interests for the protection of which the duty to secrecy has been laid down. Additionally, the permit will stipulate the measures necessary for the protection of an individual’s privacy. A permit is always granted for a fixed period of time.
Even when it is important that different pieces of data concerning one person are collated, for example using their personal identity code the data is, as a rule, supplied to the recipient in anonymised or pseudonymised form. Pseudonymised means that before the collation of data, the personal data that can be connected to a certain person are replaced with, for example number codes or it is changed to a form from which the person can no longer be identified without additional data.
The data recipient duty to maintain the secrecy of the data pursuant to the Act and data permit conditions. If the recipient of a data permit violates data permit conditions, the data permit can be cancelled and the person who has disclosed data can be sentenced under the Criminal Code of Finland for a secrecy offence or secrecy violation.
The data permit authority for the health and social sector will keep the additional data that enable identification in its possession separately from the other data. The permit authority ensures that it is the only party that has the technological and administrative ability to later link up supplied data to register data and only in situations permitted by law.
If information is requested in a format where the data subject cannot be identified even indirectly, the data permit authority has the right under its responsibilities as an authority without a separate data permit to combine, collate and supply information to the recipient as aggregate data from which the individual cannot be identified.