Inform data subjects about processing (templates)

In scientific research, the processing of personal data is based on a task carried out in the public interest (and to consent to participate). 

Further information on the concept of scientific research is provided in the FAQs.

What is scientific research?

Submit the final version of the privacy notice and research notification to the University of Jyväskylä (JYU) Registry Office (kirjaamo@jyu.fi) if JYU is the controller or joint data controller. The JYU Registry retains the forms of the studies for 15 years. The retention is based on the University's legal obligation to monitor the processing of personal data. If a student is a data controller she/he does not submit forms to the Registry Office.

Informing research participants 

Note! Please ensure that the research notification and the privacy notice are in accordance with the research design/plan and are correct in content. Do not submit incomplete forms for proofreading e.g., to Ethical committees.

1. A research notification is a brief description of the study for the research participant. 
2. A privacy noticeis a description of the processing of personal data required by law and provided to the research participant. 
3. Ethical consent forms to participate Appendix 7. Consent form for research subjects (the informed consent process 2/2) | University of Jyväskylä (jyu.fi)
4. You can use the simplified template on some occasions to inform e.g., children or the elderly. It includes notification, privacy notice and consent to participate.

If the privacy notice cannot be provided to the participant because it is impossible or unreasonably difficult, it will be published online. There are no exceptions to informing the participants if the personal data are collected from him/her (in which case it cannot be impossible or unreasonably difficult to provide the information).

Note! If, at the end of the study, you intend to archive the data in a repository such as the Finnish Social Data Archive check the archiving instructions of the archiving body.When the plan is to archive the data at the Finnish Social Science Data Archive (FSD) read their instruction Informing Research Participants about the Processing of Their Personal Data - Finnish Social Science Data Archive (FSD) (tuni.fi) - Informing research participants about archiving

In scientific research, the consent of the data subject should not be used as a legal basis for processing personal data (legal basis is public interest). However, an ethical informed consent is required from the research subject.

If you are seeking an opinion from a hospital district, see the guidelines and forms Alueellinen lääketieteellinen tutkimuseettinen toimikunta | www.sairaalanova.fi

When the processing of personal data is for another purpose than scientific research e.g., a survey, interview, opinion poll, etc., as part of a course or a thesis that does not meet the criteria for scientific research, you can use the forms below to inform people.

Bachelor theses are in principle not scientific research. Your supervisor may consider your master's thesis to be scientific research. If the supervisor states that the research plan for the thesis meets the criteria for scientific research, the legal basis for the study may be the public interest. In this case, please use the model forms for scientific research found at the top of this page. 

You must provide the participant with a notification, a privacy notice, and consent form.

Templates which you can use to inform the data subject

• Notification (the content should be adapted to suit the situation, e.g. replace the term research with the term course work, interview or thesis, etc.)
• Privacy notice
• Consent to personal data processing and participation

Legal basis for data processing

Consent 

For consent to be valid, it must be a

• informed,
• freely given, and
• unambiguous indication of the data subject's wishes.

Learn requirements for consent

Controller's legitimate interests

If personal data is not collected from the data subject the processing of personal data can sometimes be justified due to the legitimate interests of the controller.  The use of legitimate interests requires that you do a balancing test. 

More information about legitimate interests and balancing test

Special categories of data

As a rule, the processing of personal data belonging to special categories is prohibited.

Such data reveals the person’s

• racial or ethnic origin
• political opinions
• religion or philosophical beliefs
• trade union membership
• data concerning health
• sexual orientation or activity and
• genetic and biometric data for identifying the person.

You should avoid the processing of special categories. If it is not possible the legal basis for the processing of special categories of personal data for opinion polls, etc. is the explicit consent of the data subject. The difference with consent as a general ground for processing is that consent needs to be explicit in addition to the general conditions for processing personal data. 

In the case of a monitoring or other task based on its obligations imposed on the university, such as section 87 of the Universities Act to evaluate education, research and their effectiveness, section 4 of the Data Protection Act may be used as a legal basis for processing, to the extent that personal data must be processed. In accordance with section 4(2) processing is necessary and proportionate for the performance of a task carried out by a public authority in the public interest or section 4(3) if the primary purpose is the production of statistical data (processing is necessary and proportionate for statistical purposes in relation to the public interest objective pursued). Article 4(2) does not allow the processing of special categories of personal data.

For surveys and enquiries carried out by the university, it must always be assessed separately whether a separate privacy notice is required or whether all the necessary data are included in existing notices. Please note that the privacy notice must be provided to the data subject before he/she is asked to provide his/her data. If the survey is outsourced to a processor, this should be explicitly mentioned to data subjects.

For advice: tietosuoja@jyu.fi

Please attach the following information to your request for advice: 

• Whether any of the existing privacy notices would be applicable The University of Jyväskylä processes personal data as part of its operations | University of Jyväskylä (jyu.fi)
• Does the processing involve external parties such as companies?
• Categories of personal data (basic personal data, special categories of personal data)
• Why personal data are handled
• Will the data be disclosed to third parties
• Retention period of personal data
   

A description of the university's permanent processing activities is available online: The University of Jyväskylä processes personal data as part of its operations | University of Jyväskylä (jyu.fi)

This information is provided to the data subject when the data is collected. Linking must be made to the explicit privacy notice to which the processing relates, the link may not be limited to the summary page of all privacy notices.

If no suitable notice is found, sometimes it may be necessary to create a separate privacy notice, template. This template is not suitable for scientific research but is used in administration.  

Submit the final version of the privacy notice and the information sheet to the participant and to the University Registry Office (kirjaamo@jyu.fi) if the University is the controller, joint controller or processor. The University of Jyväskylä Registry retains the forms of the studies (notification, privacy notice, simplified notification) for 15 years. The retention is based on the University's legal obligation to monitor the processing of personal data. 

If you use the templates of other organisations (joint project), submit the finished versions to the University of Jyväskylä Registry.