Privacy notice – Instructions for researchers

Suomeksi

When you obtain a resource containing personal data from the Language Bank of Finland (Kielipankki) and start processing it for a new purpose, you must prepare a privacy notice regarding the purpose of processing, publish the notice openly in electronic format, and provide a link to the notice to the Language Bank.

The purpose of a privacy notice is to help data subjects understand the purposes for which their data is used. The privacy notice should be clear, concise, transparent, and easy to understand. This is good to remember also when selecting the language of the privacy notice.

The Language Bank is not responsible for the content or accuracy of the privacy notices provided by users. When processing personal data, you should always follow the data protection guidelines issued by your own organisation. Different organisations may have their own document templates for formulating privacy notices for research. Essentially, the document should be easy to read and contain the required information.

For up-to-date information on the processing of personal data in scientific research, see the website of the Data Protection Ombudsman. We also recommend that you consult the Data Management Guidelines published by the Finnish Social Science Data Archive.

Submit the public link of your privacy notice

Privacy notices submitted by users of the Language Bank of Finland

Publishing a privacy notice

How to publish a privacy notice?

• You can publish a privacy notice, for example, on the website of the research project or on a suitable cloud service to which you have access. This will also make it easy for you to update and amend your notice as necessary. As long as the link to the privacy notice, the name of the project or purpose, and the data controller remain unchanged, it is not necessary to inform the Language Bank about further updates to the notice.

How is the privacy notice information submitted to the Language Bank?

• If you intend to apply for access to restricted resource containing personal data, you must provide the title of your project and a link to the public privacy notice when you apply for access.
• If the resource containing personal data is available to you without a separate application, the title and link to the publicly available privacy notice should be submitted to the Language Bank using an electronic form.
• The Language Bank does not check the details of the privacy notices submitted by users. The controller of the research project is responsible for their own privacy notice. If necessary, please contact your home organisation for further advice.
• The Language Bank publishes the data protection notices submitted by users on a separate page.

Creating the privacy notice

Familiarise yourself with the resource-specific data protection terms and conditions

• First, make sure that your research project can comply with the resource-specific data protection terms and conditions included in the license of the required resource.
  • In case the resource-specific data protection terms and conditions are not yet specified in the license of the resource and you are not able to locate the details you need in the resource description, contact Kielipankki for further information.

What information must be included in the privacy notice?

Below is a list of the details that are in general minimally required for a privacy notice regarding scientific research. For up-to-date guidance, please check with your home organisation or directly with the Data Protection Ombudsman’s website.

When looking for relevant instructions and guidelines, please note that different organizations may sometimes use different terms for referring to a pieces of documentation corresponding to a privacy notice, e.g., privacy statement, privacy policy, (personal) data processing policy/notice/statement. (However, note that the record of processing activities or ”ROPA” is a different document, intended for internal documentation within an organization, so it cannot be utilized as a privacy notice.)

• Document creation date and last modification date
  • This is not compulsory information, but can be useful in practice.
• Name and contact details of the data controller (address, email)
  • The controller is determined by the purpose for which the personal data are processed. The role of the controller does not depend on a specific dataset.
  • The controller is always a natural or legal person. For instance, an individual research project or a university department cannot be the controller.
  • There can be one or more controllers (joint controllership).
  • The controller may be your home organisation, yourself, or both (as joint controllers). There may be more than one controller, e.g., also in a situation where the research project involves researchers from several different organisations. Policies may vary from one organisation to another. Please check with your home organisation for the situation regarding your project.
  • In case the controller is an organisation with a data protection officer, the contact details of the data protection officer should also be indicated here.
• Name of the principal investigator or contact person responsible for the project
• Purpose of processing personal data
  • State the purpose of processing in a concise, general and understandable way.
  • The purpose of the processing described in the privacy notice must be compatible with the original purpose of the processing of the data received from the Language Bank of Finland.
  • The resource-specific data protection terms and conditions of the Language Bank may contain restrictions on the purposes for which the personal data in the resource may be processed.
• Legal basis for processing personal data
  • Please state separately the legal basis for processing personal data in your project. Again, please follow the guidelines provided by your organisation.
• Description of the personal data processed
  • Provide the title and reference details of the resource(s) used for this purpose. You can find the reference instructions of the required resource, e.g., in the list of corpora available in the Language Bank or in the metadata record of the resource in question.
  • Please mention also that the data was obtained through the Language Bank. (Thus, in this case, personal data are not collected directly from the data subjects.)
  • The categories of personal data and the categories of data subjects contained in each resource made available through the Language Bank are usually described in the resource-specific data protection terms and conditions. The original description can be edited to provide an appropriate version in this section, if necessary.
  • In case sensitive personal data (so-called special categories of personal data) will also be processed, this must be indicated in addition. Please note that special attention must also be paid to the protection of the personal data in this case.
• Recipients / Disclosures of data
  • In case the data must be disclosed for processing outside the organisation acting as controller, the categories of recipients must be described. Please note, however, that the transfer of the resource and/or the personal data contained therein may be restricted or prohibited by the resource-specific data protection terms and conditions.
• Transferring data outside the EEA
  • Please note that the resource-specific data protection terms and conditions may contain restrictions on the transfer of data outside the EEA or beyond the borders of Finland.
• Protection of personal data (optional information)
  • This section is not a mandatory part of the information to data subjects. However, for practical reasons, the section regarding safeguards may be included, for example, in the university’s own privacy notice template for internal documentation purposes (’statement of processing activities’).
  • The section on the protection of personal data describes the safeguards that will be applied during the research in question. (For example, you are not supposed to describe the access management protocols or other data protection practices applied by the Language Bank to the resource in question.)
• Retention period of personal data
  • Personal data may only be stored for as long as there is a legal basis for the processing. It is advisable to give as precise an estimate as possible of how long the data will be needed for the research in question.
  • When assessing the retention period and planning your research, you should bear in mind that the material will be stored in the Language Bank, where it can be accessed again at a later time if you decide to continue the research.
• How data subjects can exercise their rights in relation to personal data
  • Information on data subjects’ rights in different situations can be found on the Data Protection Ombudsman’s website.
  • If data subjects have questions about their own personal data relating to resources made available via the Language Bank, their enquiries should be addressed to the Language Bank. If necessary, the Language Bank can then forward the questions to the data controller of the original resource.
  • General information on the processing of personal data in the Language Bank can be found in the Data Protection Statement of the Language Bank.

Submit the public link of your privacy notice

<< Privacy notices submitted by users of the Language Bank of Finland

Guidelines for processing corpora stored in the Language Bank of Finland that contain personal data

Last updated: 13.6.2024

Persistent identifier of this page: urn:nbn:fi:lb-2023042022