Rights of the data subject

Individuals have the right to know whether their personal data is being processed and what personal data has been stored about them. The municipality of Tuusula will provide the information requested by the data subject as soon as possible without undue delay. The deadline for providing the information or additional information related to the request is one month from the date of receipt of the request. If the request for information is exceptionally complex and extensive, we may extend the deadline by two months, in which case we will notify the data subject separately.

We provide the data subject’s information free of charge as a rule. However, if multiple copies are requested, we may charge a fee based on administrative costs. If the request for information is manifestly unfounded and unreasonable, in particular if it is repetitive, we may charge an administrative fee for providing the information or refuse to provide it.

If we do not provide the information, we will issue a written certificate to that effect. At the same time, we will inform you of your right to legal remedies, such as the possibility of lodging a complaint with the supervisory authority.

A person has the right to request that incorrect, inaccurate or incomplete personal data conce ing him or her be corrected or supplemented without undue delay. In addition, a person has the right to request that unnecessary personal data be deleted. Unnecessary and incorrect data is assessed at the time of storage.

If we do not accept the request for correction, we will provide written confirmation of this. We will also inform you of your right to legal remedies, such as the possibility of lodging a complaint with the supervisory authority, i.e. the Office of the Data Protection Ombudsman.

The deadline for correcting data is one month from receipt of the request. If the request is exceptionally complex and extensive, we may extend the deadline by two months.

Only in certain exceptional cases does a person have the right to have their personal data completely removed from municipal registers (the right to be forgotten). However, this right does not apply in cases where the processing of personal data is necessary for compliance with a legal obligation or for the exercise of public authority vested in the municipality. We comply with the municipal archiving plan and the retention periods required by law when storing and deleting data.

In certain situations, a person may have the right to request that the processing of their personal data be restricted until their data has been properly checked and corrected or supplemented.

This right does not apply to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. As a rule, this right is therefore not exercised in relation to the personal registers of the municipality of Tuusula.

A person has the right, based on their personal, specific situation, to object at any time to the processing of their personal data, even when the processing is based on the performance of a task carried out in the public interest or the exercise of official authority vested in the municipality. In this case, the data may only be further processed if there is a compelling and legitimate reason for the processing that can be demonstrated.

As the data controller, the municipality of Tuusula is obliged to notify the national supervisory authority of any personal data breaches within 72 hours of the breach occurring. The municipality is also obliged to notify the data subject or data subjects of a personal data breach if the breach poses a serious threat to the data subject’s privacy.

A person has the right to lodge a complaint with the supervisory authority in the location of their permanent residence or workplace if they consider that the processing of personal data violates the EU General Data Protection Regulation (EU) 2016/679. In addition, the person has the right to use other administrative remedies and legal remedies.

A person also has the right to bring an action against the controller or the organisation processing personal data if they consider that their rights have been infringed because the processing of their personal data has not complied with the Data Protection Regulation.