Use of data held by the police for research purposes

On this website, the term ‘research permit’ refers to written permission given by police authorities for a limited period of time to access the police’s data for a specific research purpose. All terms and conditions, restrictions and obligations that the competent authority deems necessary will be recorded in the permit. 

An application form on the Forms -page (TO 07 en - Application for research permit)

‘Personal data’ include all information that relate to an identified or identifiable natural person and on the basis of which a person or persons can be identified directly or indirectly. Personal data also include individual items of data that, when aggregated, make it possible to identify a person and information that enables a person to be identified on the basis of their personal characteristics. Examples of personal data include a person’s full name, name-based email address, customer number, any unusual job title, car registration number and, combined with other information, home town or area.

Research material is deemed to contain personal data if it can, taking into account all the means reasonably likely to be used, be used to directly or indirectly identify a person or persons.

‘Processing of personal data’ means any operation performed on personal data, such as collection, storage, use and disclosure by transmission or otherwise. All operations performed on personal data, from the planning of processing to the erasure of the data, constitute processing. The data protection principles of data protection laws must be observed whenever personal data are being processed

The processing of personal data requires a legal basis. Acceptable legal bases for processing personal data for research purposes include, among others, public interest or the data subjects’ consent.

The ‘purpose of processing’ refers to the purpose for which personal data are being processed. In the case of the processing of personal data for research purposes, the purpose is the research project identified in the research plan.

‘Controller’ means the natural or legal person that determines the purposes and means of the processing of personal data. In the case of research, the controller of the personal data within the meaning of data protection laws is usually the organisation that is carrying out the research.

It is the controller’s responsibility to ensure that the processing of personal data complies with the applicable data protection laws. In order to satisfy the accountability principle, the controller must, for example, implement and document any technical and organisational measures that are needed to protect the data.

‘Data subjects’ include the individuals whose personal data are at issue.

Protecting the rights of data subjects is one of the controller’s most important duties. Whenever personal data are being processed, it is the controller’s duty to take any steps necessary to protect the data protection rights of the data subjects and help the data subjects to exercise their rights.

As a rule, data subjects have the same rights in the context of scientific and historical research as they do under the GDPR otherwise. However, section 31 of the Finnish Data Protection Act provides a list of circumstances in which the rights of data subjects can be waived. It is up to the controller to decide, on a case-by-case basis, whether derogations are necessary and justified. The rights of data subjects cannot be derogated from purely on the basis of having the safeguards referred to in the Data Protection Act in place.

‘Special categories of personal data’ within the meaning of the GDPR refer to personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, data concerning health or data concerning a natural person’s sex life or sexual orientation as well as genetic data and biometric data for the purpose of uniquely identifying a natural person. Special categories of personal data can only be processed for research purposes if the conditions laid down in the Data Protection Act are satisfied. The Data Protection Act specifies certain safeguards that must be in place for processing to happen.

Personal data relating to criminal convictions and offences or related security measures can only be processed for research purposes if the conditions laid down in the Data Protection Act are satisfied. The Data Protection Act specifies certain safeguards that must be in place for processing to happen.

‘Records of processing activities’ are written descriptions of, for example, the purposes of the processing, the categories of data subjects and the categories of personal data, the envisaged time limits for the erasure of data and the technical and organisational security measures taken to protect the data. These records are crucial for the controller to be able to demonstrate their compliance with the accountability principle. The controller must keep records of processing activities if, for example, the personal data that are being processed contain special categories of personal data or personal data relating to criminal convictions and offences.

‘Data protection impact assessment’ is a process designed to describe the envisaged processing operations, evaluate the necessity and proportionality of the processing operations in relation to the purposes of the processing, the risks resulting from the processing and measures envisaged to address the risks. The objective of data protection impact assessment is to help identify, evaluate and manage the risks involved in the processing of personal data. 

If necessary, the controller must supply the Data Protection Ombudsman with a written data protection impact assessment report before special categories of personal data or personal data relating to criminal convictions and offences can be processed or certain rights of the data subjects waived. More information about data protection impact assessment is available on the website of the Office of the Data Protection Ombudsman.

The concept of ‘consent’ has two different meanings in the context of research. Consent as a legal basis for processing is different from a data subject’s consent to taking part in a study.