Ä¢¹½Ö±²¥

The data subjects are University staff members, students, pupils, guests and individuals using the University’s information system services as members of other stakeholders of the University.

The information on the data subjects stored in the register includes the

• name, personal identity code, user ID, email addresses and nationality
• Contact details: address, phone numbers, email addresses, office and job description
• The information on staff members stored in the register includes: Employment relationship details obtained from the HR system, such as the personnel number, job title, unit, supervisor, and state of the employment relationship
• The information on students kept in the register includes: details of the student status obtained from the study information system, such as the student number and the status of studies (right to study, targeted degree, study programme, etc.)
• The information on pupils kept in the register includes: details of the pupil status obtained from the pupil register (such as pupil number, validity of pupil status, class and pupil code)
• For guests and actors outside the University: university unit acting as the stakeholder partner
• Other additional information: approval of the terms and conditions of use, marketing permit and strength of user identification

In a number of systems using the register, the users themselves may also update their information (such as additional details and contact information)

Information directly entered in the access management system or the information entered by the users (registration) and the information transferred from the HR information system (SAP), study register (ROTI) and the pupil register (Primus) are used as the main sources of data.

Information concerning strong identification are obtained from the Suomi.fi e-Identification service.

The following personal data describing the archived identities are retained:

• identity number
• person’s name
• identity creation and end date
• user IDs in use
• acceptance of terms of use
• marketing permit
• strength of identification and verifier of identity
• personal identity code
• gender
• nationality
• University email address

Personal data (information entered by individuals or linked with them) may be stored in the University’s information systems that are outside the centralised management of access rights and resources. It must be possible to associate data kept in other systems with specific individuals when data contents or resources are removed from these systems or when efforts are made to determine their ownership. Such situations may arise when an individual has stored data files in a project workspace and has not removed the files at the expiry of their access rights (even though the project is still continuing). In such cases, when the project ends, the individuals associated with the data can be identified and it can be determined whether the data should be retained or whether it can be permanently removed. For individuals entered in the archives, the University will only retain the data that may be required for connecting unidentified data with persons who no longer have active access rights to the University’s information systems. Data used to ensure that future system users can rely on resources tailored to their needs is also retained (including data for situations in which more than one person have the same name).

Identity life cycle model: Creating identity → activation of user ID, resources and access rights → use of information systems and resources → end of employment relationship or student, pupil or guest status → end of access rights and resources → grace period → archiving the identity → removal of resources and data contents.

Role                                                      Grace period                       Removal of resources and data contents

Students                                     End date + 61 days         End date + 184 days

Staff members                           End date + 14 days         End date + 184 days

Teacher Training School           End date + 14 days         End date + 184 days

Guests                                        End date + 0 days          End date + 184 days

Table 1: Life cycle of data and resources in centrally managed information systems