Privacy notice - AHJO

A description of the processing of personal data for scientific research purposes (privacy notice; Articles 13, 14 and 30 of Regulation (EU) 2016/679)

1. Personal data processed in AHJO – Individual and organisatory development of Academic wellbeing

The following personal data will be collected from you in this study:

- name, e-mail, questionnaire answers, fitness test results, audio recording, interview notes, photos, videos, diaries

This privacy notice has been published on the website of the study.

2. Legal grounds for the processing of personal data for research/archiving purposes

☒ Processing is necessary for scientific or historical research purposes or statistical purposes, and it is correctly proportional in relation to the goal in accordance with public interest (section 4.1(3) of the data protection act)

The study includes interviews and observations in which questions are not directly related to other areas than health, but some of these facts might come up indirectly when discussing work wellbeing, in the interviews, observations and diaries, if the subjects themselves bring them up. The data will only be processed by the appointed research team, and information concerning a specific person cannot be identified from the data.

☐ Race or ethnic origin

☐ Political opinions

☐ Religious or philosophical beliefs

☐ Membership of a trade union

☒ State of health

☐ Sexual behaviour or orientation of a natural person

The prohibition of processing special categories of personal data will be deviated from on the following grounds:

☐ Scientific or historical research purposes or statistical purposes for the public interest (section 6 of the personal data act)

Transferring personal data outside the EU/EEA

During this study, your personal data will not be transferred outside the EU/EEA.

Protection of personal data

In this study, the processing of personal data is based on a proper research plan, and a responsible person has been appointed for the study. Your personal data will only be used and disclosed for purposes of conducting historical or scientific research or for other similar purposes (statistics), and it is otherwise ensured that no data about you is disclosed to unauthorised parties.

Prevention of identifiability

☒ Direct identification data will be removed as a protective measure when generating the data (pseudonymised data, in which case persons can be later identified on the basis of a code or similar data, and new data can be merged with the data)

· Part 1 of the study includes Wellness 360 –survey (anonymous data), and already anonymised university work wellbeing survey and performance review data.

· In part 2, the collected ethnographic and autoethnographic observations will be pseudonymised by the research team for the use of the research team, and anonymised when the study is over. The pseudonymised data is only available to the research team in the analysis phase. In the reporting phase, individual information will not be highlighted, and the subjects will have the chance to comment on the any elements in the report that might be recognisable.

Personal data used in the study will be protected by means of

☒ username ☒ password ☐ registered use ☐ access control (physical facilities)

☐ other, please specify:

The researchers have completed data protection and information security training.

☒ Yes

Agreements have been signed with research assistants and/or processors/joint controllers of personal data.

☒ Yes

The processing of personal data after the study

☒ The research register will be anonymised, i.e. all identifiers will be fully removed so that no persons can be identified from the data, and no new data can be merged with the data.

The research data are offered for permanent archiving without personal data at the the JYU Open Data Repository / JYX. The open data repository may hand over the data for research, teaching and study.

Controller(s) and researchers

The controller for this study is:

University of Jyväskylä, Seminaarinkatu 15, P.O. Box 35, 40014 University of Jyväskylä. Tel.: +358 (0)14 260 1211, business ID: 0245894-7. Data protection officer of the University of Jyväskylä: tietosuoja@jyu.fi, tel.: +358 (0)40 805 3297.

Digiterveys contact information and data protection officer: MInna Tervo, Minna@digiterveys.fi, +358 50 5948 564, business ID: 2616698-1

A joint controller agreement will be signed before recruiting and informing the research subjects.

Person in charge of the study:

Taina Saarinen, 0400247970 taina.m.saarinen@jyu.fi, Finnish Institute for Educational Research, PL 35, 40014 University of Jyväskylä

Contact persons:

Taina Saarinen (JYU; phase 1 and phase 2; contact information above)

Minna Tervo (Digiterveys; Phase 1 Wellness 360 surveycontact information above)

Researchers who may process personal data in this study:

Taina Saarinen, University of Jyväskylä

Minna Tervo (Phase 1 (2020-2021), Digiterveys Oy

David Hoffman (Phase 1 2020-2021), University of Jyväskylä

Johanna Ennser-Kananen, University of Jyväskylä

Anu Salpakoski, Peurunka rehabilitation centre

Anduena Ballo, University of Jyväskylä

Marc Perkins (Phase 2 2022-2023), University of Jyväskylä

Taru Siekkinen (Phase 2 2022-2023), University of Jyväskylä

In addition, a project researcher who is in a contractual relationship with the University of Jyväskylä (University of Jyväskylä, Centre for Applied Language Studies and Finnish Institute for Educational Research) may be hired for the project. More information about these persons is available from the person in charge of the study. In phase 2, an advisory group will assist the researchers, with access only to anomymised data.

The controllers of this study are the University of Jyväskylä and Digiterveys Oy, who will sign a joint controller agreement before collecting any data. The processors data are the same organisations. Information will not be transferred to undefined parties. JYU and Digiterveys will make a data processing agreement regarding the data that will be transferred between them. The anonymised data will be archived after the study for transferral into open research use.

Rights of data subjects

Withdrawal of consent (Article 7, GDPR)

You have the right to withdraw your consent if the processing of personal data is based on consent. Withdrawing consent does not have any impact on the lawfulness of processing based on consent carried out before the withdrawal.

Right to access data (Article 15, GDPR)

You have the right to obtain information about whether your personal data is processed, and which personal data is processed. If required, you can request a copy of the personal data processed.

Right to have data rectified (Article 16, GDPR)

If there are any inaccuracies or errors in the processing of your personal data, you have the right to request your personal data to be rectified or supplemented.

Right to have data erased (Article 17, GDPR)

You have the right to request your personal data to be erased in certain situations. However, the right to have data erased does not exist if the erasure prevents the purpose of processing from being fulfilled for scientific research purposes or makes it much more difficult.

Right to the restriction of processing (Article 18, GDPR)

You have the right to restrict the processing of your personal data in certain situations, such as if you deny the accuracy of your personal data.

Right to object (Article 21, GDPR)

You have the right to object to the processing of your personal data if processing is based on public or legitimate interest. As a result, the university cannot process your personal data unless it can prove that processing is based on a significantly important and justified reason which supersedes your rights.

Derogation from the rights of data subjects

Derogation from the aforementioned rights is possible in certain individual situations on the basis of the GDPR and the Finnish data protection act, insofar as the rights prevent scientific or historical research purposes or statistical purposes being fulfilled or make it much more difficult. The need for derogation must always be assessed separately in each situation.

Profiling and automated decision making

In this study, your personal data will not be used in automated decision making. In this study, the purpose of the processing of personal data is not to assess your personal characteristics, i.e. profiling. Instead, your personal data and characteristics will be assessed from the perspective of broader scientific research.

Executing the rights of data subjects

If you have any questions about the rights of data subjects, please contact the university’s data protection officer. All requests related to the execution of rights must be sent to the registry office of the University of Jyväskylä. Registry office and archive, P.O. Box 35 (C), 40014 University of Jyväskylä, tel.: +358 (0)40 805 3472, email: kirjaamo@jyu.fi. Visiting address: Seminaarinkatu 15, Building C (Main Building, 1st floor), Room C 140.

Any data breaches or suspicions of data breaches must be reported to the University of Jyväskylä.

https://www.jyu.fi/en/university/privacy-notice/report-data-security-breach

You have the right to file a complaint with the supervisory authority of your permanent place of residence or employment if you consider that the processing of personal data is in breach of the GDPR. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

Ratapihantie 9, 6th floor, 00520 Helsinki, P.O. Box 800, 00521 Helsinki

Tel.: +358 (0)29 566 6700

Email (registry office): tietosuoja@om.fi