Ä¢¹½Ö±²¥

1. Communicate information about data protection in a positive tone.
2. Identify your role and the duties that involve the processing of personal data.
3. Complete online training courses and attend lectures that are held annually.
4. Always process the personal data of job applicants and employees with care, regardless of whether you are processing it in electronic format, orally or as hard copies.
5. Take special care when processing sensitive information (such as information on a person’s health) or confidential information (such as information on performance reviews and performance assessments).
6. Do not retain copies of any information that has been saved in electronic format in the HR system.
7. Review the data you have saved every six months and make a habit of deleting any unnecessary data.
8. Report any suspected data protection/information security breaches to help.jyu.fi.
9. Make sure that your unit uses the data protection self-assessment tools to develop data protection.
10. Keep in mind the confidentiality obligation and adapt your discussions to the environment (particularly when travelling):

•  Consider what to speak about in front of outsiders.
•  Protect the screen of your laptop from outsiders, especially when travelling (place an order for a laptop privacy screen via help.jyu.fi).
• Choose the location (room) for a performance review or other confidential discussion with care to ensure that the confidentiality of the discussion can be guaranteed (outsiders will not be able to hear the discussion).

If you need help you can contact data privacy team (tietosuoja(at)jyu.fi)!

All persons working under you are aware of the fact that whenever personal data is processed (collected), the data subjects must be informed of the processing (data privacy notice), and the lifecycle of the data must be planned, taking into account the university’s information management system (). The information management system specifies the retention periods of key documents. In the case of academic studies, the retention period varies depending on the research needs.

Privacy notices for permanent retention are available on the university’s website at . Research notifications and privacy notices (final versions) must always be submitted for information to the registry office (kirjaamo(at)jyu.fi).

Please note that personal data (confidential) and sensitive personal data (secret) must never be sent via unsecure email. For example, if an employee sends you an email where they provide detailed information about their state of health, send a secure reply (as the reply will contain the health information provided by the employee, unless you separately delete the information).

• Instructions on using
• Outsiders can send you confidential emails via the following service:

The university has instructions on the classification and processing of confidential information specifying which personal data may be saved. The instructions are also useful in research projects. The instructions are available . There are instructions and tips on using a variety of information systems on the website of Digital Services.

New information systems, such as new survey software, are taken into use in compliance with the KA process to ensure the data protection and information security of the information systems. 

Instructions on how to use data subject rights are explained

If personal data from the university’s personal data register is requested (for a study, survey, reporter or a private person, for example), a disclosure request must be submitted to the registry office at kirjaamo@jyu.fi. Personal data must not be disclosed to any parties outside the university before determining whether the recipient has the right to process the personal data. A reporter may request the personal data of job applicants for editorial purposes, for instance, in which case the personal data may be disclosed, but even in such a case, it must be verified that the request was actually made by a reporter and it was not a phishing attempt. If you are unsure, contact the data protection officer (tietosuoja(at)jyu.fi) or one of the university’s lawyers (legal(at)jyu.fi).

If you perform hiring duties, you may receive the right to use the Saima information system for a predetermined period of time. These user rights are personal and you do not have the right to hand them over to anybody.

Materials pertaining to hiring may be processed by employees whose work duties involve hiring matters. Make sure that you will not, of your own accord or based on a request, share any information about job applications or any impressions about a job applicant you have based on a job interview.

All materials pertaining to hiring is saved in a centralised manner. When the hiring process is concluded and the decision has been made, there is no reason for you to save any materials pertaining to the process on your computer or print any related forms. Any and all such data (applications, expert assessments, etc.) and any related hard copy documents must be deleted/destroyed in a secure manner.

Received job applications contain personal data. Applications submitted via Saima, including their appendices, will be retained for 36 months (3 years). The application of the person who was selected for the job will be permanently retained (in the university’s permanent archives). A summary list of the applicants will be permanently retained in the university’s permanent archives. Other documents pertaining to the recruitment process will also be permanently retained in the university’s permanent archives. Documents and data on aptitude tests and security clearances must be deleted/destroyed in a secure manner as soon as possible after the decision has been made. These documents must only be retained for as long as they are needed. HR coordinators will ensure that all documents will be delivered to the permanent archives (the registry office).
Any notes on the job interview you have made may be considered hiring materials, and the data subject has the right to obtain the notes if they exercise their right of review. The notes must be saved in a centralised manner in the same way as other recruitment documents.

Publishing employees’ personal data online/on a notice board

The data may be published on the employer’s website without the employee’s consent if the publication is justified and necessary for the employer’s operations. Such publication may be possible if, for example, the employee’s duties include being identifiable and accessible based on their title, work contact details and photograph. Please note that publishing a photo is not a general rule, because an employee being accessible based on their name and phone number usually suffices.

The employer must consider with care whether such publication is necessary and justify the publication to the employees and the Data Protection Ombudsman as necessary. Even if consent is not required for publication, employees have the right to know the purpose for which their data is made available online.

All persons responsible for websites must ensure that any outdated or erroneous data is deleted when employees transfer to another position, retire, resign, etc.

Employees’ salary data

The salary data of employees is secret. Any assessments made to determine the salary level are also secret. A list of employees who have received a salary increase with related information constitutes a personal data register.

Retirement

Information on an employee retiring may be published online if it is justified because, for instance, a news article about the retirement is being written or the employer wishes to mark the retirement. No information about the grounds for the pension are to be published (such information, such as disability pension, unemployment pension and part-time pension, is confidential).

Digitisation

Due to the Act on Information Management in Public Administration (which entered into force on 1 January 2020), the university is obligated to digitise in practice the entire document management process. This is also an opportunity to ensure compliance with the GDPR by automating the implementation of the data subjects’ rights and by supervising the appropriateness of processing. The university must maintain a case register including cases under processing and past cases. The register must include information on the cases, their processing and related documents.