Processes de-identified data, in Finland

Laki sosiaali- ja terveystietojen toissijaisesta käytöstä 552/2019, 14, 15, 51 and 52 § · Read the law's page

• If you are the permit authority or an organisation named in section 6 that has granted a data permit or made a positive data request decision, pseudonymise or anonymise the data set before the permit holder processes it, or produce the aggregated statistical data the request asks for (section 14).
• If you are the permit authority or an organisation named in section 6, keep a description of how you formed each data set and aggregated statistic you released, of the pseudonymisation and anonymisation methods you used and of the results you released (section 14).
• If you release personal data as pseudonymised data under several different data utilisation plans, pseudonymise it with a different identifier for each release (section 14).
• If you are the authority that granted a data permit on pseudonymised data, keep the identifiers securely, so that the data set can be made identifiable again and reproduced, for as long as the research and the checking of its results need them (section 15).
• If you hold a data permit and want to bring results out of the secure processing environment, anonymise them, tell the permit authority that you intend to bring them out, and expect the permit authority to verify the anonymisation on a risk-based assessment (section 52).