Controller
Finnish Food Authority
Mustialankatu 3, 00790 Helsinki
Tel. 029 530 0400 (switchboard), kirjaamo@ruokavirasto.fi
Contact person in matters related to the register
Pirkko Tuominen
Mustialankatu 3, 00790 Helsinki
0295 205 090 / 040 021 1624, pirkko.tuominen@ruokavirasto.fi
Contact details of the Data Protection Officer
Hanna Westinen
P.O. Box 100, FI-00027 FINNISH FOOD AUTHORITY
Tel. +358 29 530 0400 (switchboard)
tietosuojavastaava@ruokavirasto.fi
Purpose and legal basis for the processing of personal data
Registration grounds: Risk assessment is a statutory activity of the Finnish Food Authority (Finnish Food Authority Act (371/2018), Section 2 (1) (5)).
Purpose of processing: Scientific risk assessment, rapid risk assessments, other research and studies related to animal disease, plant health, or food safety risks.
Data content of the material to be processed
The material on risk assessment contains information about risk assessments produced by the Finnish Food Authority, risk assessments carried out to support risk management and control, and other research and reports. The material is used in decision-making to correctly target and measure decisions, foresee potential new risks, engage in social debate nationally and internationally, and provide consumers, producers, and the industry with objective, accurate and up-to-date information about the risks in their activities.
The main categories of data: food chemical risk assessment; food microbiological risk assessment; animal disease risk assessment; and plant health risk assessment.
Regular sources of information
Registries of the Finnish Food Authority and other authorities, surveys.
Recipients to whom personal data is regularly disclosed
The Regional State Administrative Agency, the Centre for Economic Development, Transport and the Environment, and the municipality are the joint controllers of the food administration’s information pool with the Finnish Food Authority, each of which can use the data to carry out their statutory duties.
Information may be disclosed based on the Act on the Openness of Government Activities (621/1999).
Transfer of data outside the EU/EEA or to an international organisation
Data from the register will not be disclosed outside the EU/EEA area.
Retention period of personal data
The data collected in the register will be stored only as long as and to the extent necessary in relation to the original or compatible purposes for which the personal data have been collected. Personal data stored in the register are deleted when there is no longer a legal basis for their processing unless the National Archives of Finland has ordered them to be stored permanently. The retention periods are defined in the data management plan.
Principles of the protection of the register
The security of the register and the confidentiality, integrity, and availability of personal data are ensured by appropriate technical and organisational measures
Automated decision-making and profiling
Personal data are not used for automated decision-making or profiling.
Rights of the data subject
Right to review and rectify the data
A request for review must be presented in a signed document. Review requests cannot be made over the phone. Anyone requesting information under the right to review the data may also request a review in person by visiting the controller. You need to be prepared to prove your identity. When information is requested, the information necessary for searching for and supplying the information must be provided. These include, for example, name, address, and e.g. a social security number if necessary, the relevant data to be reviewed, and whether all data or data for a specific period are to be reviewed.
The form for requesting review can be found at www.ruokavirasto.fi.
An individual request for review or rectification is made by submitting the request to the controller (kirjaamo@ruokavirasto.fi) or the Data Protection Officer (tietosuojavastaava@ruokavirasto.fi).
Restrictions on the rights of the data subject with regard to the processing of personal data
The data subject does not have the right to request the deletion of their data, as the processing of data is based on legislation. The data subject therefore also has no right to object to the processing of their personal data or to have their data transferred to another system. There is also no right to restrict the processing of personal data under Article 18 of the EU General Data Protection Regulation (560/2021, Section 2.2).
In certain cases, the data subject has the right to have the processing of their personal data restricted under Article 18 of the EU General Data Protection Regulation.
Right to lodge a complaint with a supervisory authority
The data subject has the right to complain to the supervisory authority if the data subject considers that the processing of their personal data violates the applicable data protection regulations. The supervisory authority is the office of the Data Protection Ombudsman, whose contact details can be found at www.tietosuoja.fi.