Disclosure of data for research purposes

Requesting data

Disclosure of data for research purposes must always be requested by submitting the Tiedonluovutuspyyntö - tieteellinen tutkimus form (External link) (Data disclosure request – scientific research). The disclosure of data request form contains e.g. basic information on the applicant, the requested information and their purpose of use.

A research plan

A research plan must always be attached to the request. The research plan must contain:  

• the purpose of use of the data
• the person responsible for and the team in charge of the research
• research schedule, which data are required for the research (itemisation of the data to be disclosed)
• are the data going to be combined with material from other registries 
• how the data are going to be protected during the project
• what will happen to the data after the research
• how the research results are going to be published and utilised.

Personal data

If the data request concerns personal data, the research plan must specify whether the rights of the data subject, specified in Articles 15, 16, 18 and 21 of the EU’s General Data Protection Regulation (GDPR), must be deviated from. Traficom must also be provided with records of processing activities in accordance with Article 30 of the GDPR or other reports stating 

• the data controller
• implementers of the research, i.e. persons with the right to process the register data during the research
• the purpose of use of the data
• the legal basis for the processing
• the principles of register protection
• whether data is transferred outside the EU or EEA and 
• the storage and destruction of the data. 

Special categories of personal data

If the research processes special categories of personal data, such as

• racial or ethnic origin
• political opinions
• religion or philosophical beliefs
• trade union membership
• data concerning health
• sexual orientation or activity and
• genetic and biometric data for identifying the person,

a data protection impact assessment in accordance with Article 30 of the GDPR must also be drafted. The data protection impact assessment must be submitted in writing to the Data Protection Ombudsman prior to starting processing, and to Traficom upon request. 

The cover note for a questionnaire survey

If the research is a questionnaire survey, the researcher must also provide Traficom with the questionnaire and the cover note sent to the research subjects, in addition to the data request.

The cover note must state 

• the person providing further information on the research
• the organisation serving as the research register controller 
• who the cooperation partners of the research are and what their roles are
• name of the researcher
• whether the research is a cross-sectional study or a follow-up study and
• whether information on the personal data level is disclosed to anyone
• source of addresses
• the voluntary nature of responding to the survey
• what will happen to the data after the research 
• the retention time and manner of destruction of the data.