Privacy notice for the processing of personal data in LEGIT project and 2IMATCH project

This privacy notice contains the information that must be communicated to data subjects under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council. The notice explains, among other things, how the Finnish Environment Institute (Syke) collects, uses, discloses, and stores your personal data. Your participation in the project is voluntary, and you may withdraw from the project at any time. There will be no negative consequences if you decide not to participate in the project or if you discontinue your participation.

Contact information for the data controller and data protection officer

Finnish Environment Institute (Syke)
Latokartanonkaari 11
00790 Helsinki 
Email: kirjaamo@syke.fi
Confidential email: https://turvaviesti.ymparisto.fi/
Tel. + 358 29 525 2001

Data controller’s contact person

Dr Paula Kivimaa, Research professor,
Finnish Environment Institute, Climate Solutions, Policies and Risks Group
Tel. +358400148849 
Email: firstname.lastname@syke.fi

Dr Marja Helena Sivonen, Researcher,
Finnish Environment Institute, Climate Solutions, Policies and Risks Group
Tel. +358 295 251 012
Email: etunimi.sukunimi@syke.fi

Data protection officer

Juha Ruotsalainen
tietosuojasyke@syke.fi

Legal basis for the processing of personal data

We process your personal data on the basis of your consent (Article 6(1)(a) of the General Data Protection Regulation).

Personal data to be collected and purposes of processing

Personal data is collected for the implementation of the LEGIT and 2IMATCH research projects. The personal data to be collected for interview, survey, or workshop material includes the participant’s name, job title, email address, and organisation name, as well as audio and video recordings and photographs taken during events. We use contact information to invite participants to project events and training sessions and for project related communications. For events where food is served, we also request dietary information in the invitation.  

The collected data, including personal data, may also be used in other projects carried out by Syke, provided the purpose of use is compatible with the original purpose for which the data was collected.

No decisions based on automated decision-making or profiling will be made using the personal data collected.

Sources of personal data

Personal data are collected primarily directly from participants during interviews / workshops / other events / from respondents using an online survey tool. In addition, the contact details of potential participants may be obtained, verified or supplemented using publicly available sources, such as organisations' websites.

Recipients of personal data

Personal data collected through interviews / survey / workshops will be processed and analysed by researchers at Syke and other project staff who are authorised to process as part of their duties.

Personal data may also be processed by researchers and other project staff from, who are research partners of Syke in these projects. In LEGIT, partner organisations are University of Copenhagen (Denmark), NIFU (Norway) and Linköping University (Sweden). The 2IMATCH consortium consists of Tampere University, Finnish Institute of International Affairs, University of Lapland and VTT Technical Research Ltd.

In addition, personal data may also be processed by service providers engaged to support the project, such as transcript provider company.

Research partners and service providers act as data processors in accordance with the General Data Protection Regulation (GDPR). Appropriate data processing agreements have been concluded with these parties to ensure the protection of personal data.

Transfer of personal data outside the European Union (EU) or the European Economic Area (EEA)

The project does not actively transfer or disclose personal data outside the EU or the EEA. However, the project uses cloud services provided by US service providers, such as Microsoft. As a result, personal data are considered to be transferred outside the EU or the EEA.

On 10 July 2023, the European Commission adopted an adequacy decision for transfers of personal data to organisations participating in the EU – US. Data Privacy Framework. On this basis, personal data may be transferred to US companies that have been recognised as providing an adequate level of protection. Syke ensures that the service providers it uses are committed to complying with these safeguards and data protection requirements.

Processing of personal data and the use of artificial intelligence

Artificial intelligence (AI) is used in the research as a tool to support the researchers' expertise. The researchers are responsible for the processing of the data, the quality of the analyses, the reliability of the research results, and the transparency of the data processing, analyses and research methods. All analyses and outputs generated by AI are critically evaluated by the researchers before they are used in the research.

The processing of personal data complies with the applicable data protection legislation and Syke's guidelines.

Data containing personal data are not processed using publicly available AI services.

The use of AI in the research is documented so that its impact on the processing of the data and the research results can be assessed afterwards.

Protection of personal data

Syke has implemented appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, and accidental loss and damage.

Personal data are stored and retained on password-protected network drives and in other secure electronic systems with appropriate access controls. Access to the data is restricted to persons who need the data for the purposes of the research project.

Retention and processing of personal data during the project

Interview recordings will be deleted once they have been transcribed into text files. Before the research data are analysed, direct identifiers of the research participants (name, job title and organisation) in the interview transcripts and survey data will be replaced with a research identification code. The identifying information and the code key will be stored in a separate file on Syke’s internal network drive, separately from the research data. The possibility of linking the identifying information to the research data will be retained throughout the research project and its follow-up project. The data will only be linked where necessary, for example to supplement or verify the data. Access to the identifying information and the code key is restricted to the researchers and other members of staff at Syke who have been assigned to this research project and its follow-up project.

When it is no longer necessary to identify the research participants, the research data will be processed so that individual participants can no longer be identified. The identifying information and the code key will then be permanently deleted. The data, processed so that individual participants can no longer be identified, will be retained on Syke's internal network drive until it is archived for future use.

Use of the data after the end of the project

After the project has ended, the research data may be used to complete the project, to publish and otherwise report the research results, and in subsequent research projects. Research results will be reported using data that has been processed so that individual participants cannot be identified. Your name will not be included in publications or other research outputs. Your role may be referred to only in general terms (for example, “expert”), and the name of the organisation you represent may be mentioned, provided that you cannot be identified on the basis of the organisational information. If you chose your name and/organisation to be visible, the details will be left for the archiving.

After the project has ended, the research data may be archived without personal data in the Finnish Social Science Data Archive, which makes the data available for research, teaching and study purposes only to its registered users. Data that has been processed so that individual participants cannot be identified may also be retained by Syke for use in future research and development activities.

Data protection rights related to the processing of personal data

As the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. Withdrawal of your consent does not affect the lawfulness of the processing carried out before your consent was withdrawn. If you withdraw your consent, the processing of your personal data will cease, and the personal data collected about you will be removed from the research data where this is possible. If your data have already been processed so that you can no longer be identified from them, they may continue to be used for the research, as they are no longer considered personal data.

In addition, you have the following rights.

You have the right to know for what purposes and in what ways we process your personal data. You also have the right to obtain a copy of the personal data we process about you. If your personal data are inaccurate or incomplete, you have the right to request that they be corrected or completed. You may also object to the processing of your personal data at any time on grounds relating to your particular situation. You have the right to request the erasure of your personal data and the restriction of their processing.If we correct or erase your personal data, or restrict their processing at your request, we are required, where possible, to inform all recipients to whom the personal data have been disclosed.

You also have the right to lodge a complaint with the Office of the Data Protection Ombudsman:

Street address: Lintulahdenkuja 4, 00530 Helsinki
Postal address: PL 800, 00531 Helsinki
Email: tietosuoja(at)om.fi
Switchboard: +358 29 566 6700
Registry: +358 29 566 6768

The purpose of this privacy notice is to provide you with comprehensive information about the purposes for which and the ways in which your personal data are processed. If there is anything you do not understand about the processing of your personal data, you may request further information by contacting the research contact persons listed at the beginning of this privacy notice.