Transition period for Act on Secondary Use of Health and Social Data to be extended by one year

The transition period for the Act on the Secondary Use of Health and Social Data will be extended by one year. The requirements laid down in the Act for a secure user environment would not be applied until 1 May 2022. Initially, the requirements were meant to be applied as from 1 May 2021.

The Act will enter into force on 1 September 2021.

The intention is not to apply the requirements of the Act for a secure user environment until the key operators in the sector have been able to audit their secure user environments.

However, under the Act, data may be disclosed to a permit holder for processing purposes before 1 May 2022, even if the data permit application does not specify a secure user environment for the processing of data as referred to in the Act. In this case, the disclosure of data requires a fixed-term data permit that is valid no longer than until 30 April 2022. 

In addition, the transition period will be changed so that the rights, obligations and measures laid down in the Act which are based on significant clinical findings will be applied from 1 January 2024. 

Secure user environment safeguards the protection of personal data 

A secure user environment plays a significant role in the prevention of misconduct and the implementation of cyber security. A high level of data security also gives Finland a competitive edge, because it proves that Finland sees to the protection of sensitive personal data properly. The EU General Data protection Regulation also requires sufficient safeguards for the processing of sensitive personal data.

What does the secondary use of health and social data mean?

The secondary use of health and social data means that the client and register data generated in connection with healthcare and social welfare activities are used for purposes other than the primary reason for which they were originally saved.

The secondary uses under the Act include scientific research, statistics, development and innovation activities, guidance and supervision by the authorities, planning and reporting duties of the authorities, teaching and knowledge management.

The purpose of the Act is to enable the effective and secure processing of both personal data saved in connection with healthcare and social welfare activities and personal data saved for the purpose of guidance, supervision, research and statistics in the healthcare and social welfare sector. The Act also seeks to secure the legitimate expectations, rights and freedoms of individuals in the processing of personal data.

Inquiries

Joni Komulainen, Senior Ministerial Adviser, tel. +358 295 163 453, firstname.lastname@stm.fi
Jukka Lähesmaa, Senior Specialist, tel. +358 295 163 139, firstname.lastname@stm.fi