Data protection notice

Data protection notice of the Finnish Cancer Registry

Data protection notice to inform data subjects

The Finnish Cancer Registry (hereinafter the “Cancer Registry”) is a register maintained for the purpose of carrying out the statutory duties of the Finnish Institute for Health and Welfare. The Cancer Society of Finland, which processes the personal data contained in the register on behalf of the Institute, is responsible for maintaining the register. The mass screening registries for cervical, breast and colorectal cancer form part of the Cancer Registry.

The processing of personal data contained in the Cancer Registry complies with existing data protection legislation and is performed while ensuring an appropriate level of data security. In this notice, we will explain in more detail how the Cancer Registry processes your personal data.

1. CONTROLLER AND PROCESSOR

The Finnish Institute for Health and Welfare decides on and is responsible for the processing of personal data for the purpose specified in this notice. The Institute is the controller of the Cancer Registry.

Controller’s contact details:

Finnish Institute for Health and Welfare (THL)
PO Box 30
FI-00271 Helsinki
tel. +358 295 246 000

The email address of the Institute’s data protection officer is tietosuoja@thl.fi.

As the processor, the Cancer Society of Finland maintains the Finnish Cancer Registry and processes the personal data of the Cancer Registry’s data subjects on behalf of the Finnish Institute for Health and Welfare. A steering group appointed by the Institute directs and supervises the operation and technical maintenance of the register.

Processor’s contact details:

Cancer Society of Finland

Mäkelänkatu 2
FI-00500 Helsinki
tel. +358 9 135 331

Registrar’s Office: kirjaamo@cancer.fi

Email addresses: firstname.lastname@cancer.fi

The email address of the data protection officer at the Cancer Society of Finland is tietosuojavastaava@cancer.fi.

The contact person of the Cancer Society in matters concerning the processing of personal data is:

Registry officer at Finnish Cancer Registry

Chief Medical Officer
Tomas Tanskanen
Cancer Society of Finland
Mäkelänkatu 2
FI-00500 Helsinki
tel. +358 50 320 8035

Deputies:

Senior Consultant
Nea Malila
Cancer Society of Finland
Mäkelänkatu 2
FI-00500 Helsinki
tel. +358 50 305 5730

2. PURPOSE OF PERSONAL DATA PROCESSING

We collect and process your personal data for the purpose of performing the statutory duties of the Finnish Institute for Health and Welfare. The Institute’s duties are defined in the Act on the National Institute for Health and Welfare (668/2008).

The Cancer Registry stores information necessary for its services and for analysing the occurrence, prevention, early detection, treatment and medical rehabilitation of cancer diseases.

3. LEGAL BASIS OF PERSONAL DATA PROCESSING

The processing of personal data under this notice is based on Article 6(1)(c) of the EU General Data Protection Regulation (2016/679) (processing is necessary for compliance with a legal obligation to which the controller is subject), the Act on the National Institute for Health and Welfare (668/2008) and the Government Decree on Screenings (339/2011) and amendments to it ((908/2018) and (752/2021)).

The processing of special categories of personal data referred to in Article 9(1) of the General Data Protection Regulation is based on Section 6(1)(2) of the Data Protection Act (1050/2018), the Act on the National Institute for Health and Welfare (668/2008) and the Government Decree on Screenings (339/2011) and amendments to it ((908/2018) and (752/2021)).

4. TYPES OF PERSONAL DATA PROCESSED

The Cancer Registry collects data on persons living in Finland who suffer from cancer and data on the target population of national mass screenings. The Cancer Registry records the patient’s personal data, data on the cancer type, death certificate data and data on mass screenings of cervical, breast and colorectal cancer as follows:

Cancer Registry

Clinical notification
- Personal data
  - Personal identity code
- Tumour data
  - Diagnosis
  - Pathoanatomical diagnosis and further details
  - Primary site (topography)
  - Histological type (morphology)
  - Date and method of diagnosis
  - Cancer laterality in paired organs
  - Stage
  - Treatment outcome
- Notifier’s name, identifier and organization, date and time notification was created

Pathology (laboratory) report
- Personal data
  - Personal identity code
- Tumour data
  - Primary site (topography)
  - Histological type (morphology) or cytological type (cytopathology)
  - Statement
  - Grade of differentiation (grading)
  - Stage and lymphatic spread
  - Pap test class
- Data on sample
  - Sample’s laboratory arrival date and technical completion date
  - Sample identifier, type and preliminary data
  - Information on sample collector and physician
  - Information on healthcare provider and attending physician
  - Sampling date
  - Pathologist who examined the sample
- Notifying laboratory

Treatment notification
- Personal data
  - Personal identity code
- Treatment data
  - Treatment code and further details
  - Start and end date of treatment
  - Code and date of diagnosis
- Name, identifier and organisation of notifier

Other personal data on the patient
- Gender
- Date, location and cause of death

Combinable, if necessary
- Name
- The person’s municipality of residence at the beginning of the year the cancer was detected
- Date of emigration and immigration
- The person’s socioeconomic status, main activity and education
Furthermore, information on suspected cancers and diagnoses other than cancer diagnoses based on pathologic specimen is processed.

Mass screening registries

Personal data
- Personal identity code
- Name
- Address
- Municipality of residence and home municipality

Invitation data
- Year of invitation
- Municipality of invitation
- Reason for invitation (age group, control)

Screening data
- Date of screening
- Preliminary data (risk factors, symptoms or previous findings)
- Screening results (results from mammography, smear test sample, HPV test or faecal immunochemical test)
- Information on and results of further examinations (procedures, dates)
- Final diagnosis from further examination (histology)
- The first treatment

Combinable, if necessary
- Marital status
- The person’s socioeconomic status, main activity and education
- Preferred language
- Mother tongue

5. WHAT SOURCES OF PERSONAL DATA ARE USED?

The data to be processed are obtained from healthcare organisations and pathology laboratories. The information on the cancer patients’ municipality of residence, emigration and immigration as well as the monitoring data of the Mass Screening Registry and the data of the target population of mass screenings are obtained from the population information system of the Digital and Population Data Services Agency. The data on causes of death and the information on socioeconomic status, occupation and education are obtained from Statistics Finland. The information on treatment periods, visits and further examinations related to cancer diseases are obtained from the Hilmo treatment notification system (Care Registers of Health Care) of the Finnish Institute for Health and Welfare.

6. TRANSFER OR DISCLOSURE OF PERSONAL DATA

No regular transfers of data take place to parties outside the Cancer Registry. The data in the Cancer Registry and its mass screening registries may be used in scientific research carried out by the Finnish Institute for Health and Welfare in accordance with the Act on the National Institute of Health and Welfare (668/2008), or on the basis of an authorisation granted under the Act on Secondary Use of Health and Social Data (552/2019).

7. TRANSFER AND DISCLOSURE OF DATA TO NON-EU/EEA COUNTRIES

Personal data may be transferred to non-EU/EEA countries. Any transfer of personal data shall be subject to appropriate safeguard measures in accordance with the General Data Protection Regulation.

8. PROFILING AND AUTOMATED DECISION-MAKING

There is no automated decision-making, incl. profiling, based on personal data stored at the Cancer Registry.

9. STORAGE OF PERSONAL DATA

The storage periods for the personal data kept in the registers of the Finnish Institute for Health and Welfare are determined in accordance with the Act on the National Institute for Health and Welfare (668/2008), the Archives Act (831/1994) and the Institute’s information management plan. The personal data kept in the Institute’s registers and referred to in this notice are stored until further notice based on the legislation in force and the Institute’s information management plan.

10. WHAT ARE YOU RIGHTS?

The data protection legislation guarantees you certain rights to ensure that the protection of your privacy, which is one of your fundamental rights, is realised. If you would like to exercise your rights, contact the registrar’s office at the Finnish Institute for Health and Welfare (kirjaamo@thl.fi).

Your rights may be restricted in certain situations, for example due to a statutory obligation of the Institute, or if the processing takes place for scientific research or for statistical or archiving purposes. If your rights are restricted, the Institute will take appropriate and necessary safeguard measures as required by legislation.

10.1 Right to withdraw consent

The processing of data for the Cancer Registry is not based on your consent. As no consent has been given, it cannot be withdrawn.

10.2 Right of access

You have the right to know if the Cancer Registry processes personal data concerning you. You also have the right to know which personal data related to you are processed and how. Additionally, you have the right to receive a copy of the personal data held on you, provided that giving you this copy will not adversely affect the rights and freedoms of others, and provided that the Finnish Institute for Health and Welfare does not have legal grounds for refusing to disclose the data.

10.3 Right of rectification

As a rule, you have the right to have inaccurate or incorrect data rectified. Please note that the data in the registers of the Finnish Institute for Health and Welfare are, as a rule, obtained from healthcare patient records. Any incorrect data are primarily corrected by the healthcare unit in question.

10.4 Right to erase your data

The processing of personal data at the Cancer Registry is based on the statutory task of the Finnish Institute for Health and Welfare. Therefore, as a rule, you do not have the right to erase your data from the Cancer Registry or its mass screening registries for cervical, breast and colorectal cancer.

10.5 Right to restrict processing

You may have the right to restrict the processing of your personal data in cases provided for by law. The right to restrict processing may apply, for instance, if you believe that personal data concerning you are incorrect, or that they are being processed unlawfully. In this case, we may only process your personal data with your consent, where necessary for the establishment, exercise or defence of a legal claim, or where it is in the public interest or essential to protect another person’s rights.

10.6 Right to object

The processing of personal data at the Cancer Registry is based on the statutory task of the Finnish Institute for Health and Welfare. Therefore, you do not have the right to object to the processing of your data for the Cancer Registry or its mass screening registries for cervical, breast and colorectal cancer.

10.7 Right to lodge complaint with supervisory authority

You have the right to request that the Data Protection Ombudsman assess the lawfulness of the activities of the Finnish Institute for Health and Welfare and the Cancer Society of Finland.

Contact details of Data Protection Ombudsman:
Office of the Data Protection Ombudsman
Street address: Ratapihantie 9, 6^th floor, FI-00520 Helsinki
Postal address: PO Box 800, FI-00521 Helsinki
Switchboard: +358 29 56 66700
Fax: +358 29 56 66735
Email address: tietosuoja@om.fi