Privacy Notice for the Matriculation Examination Register

Updated

Legal references:

  • Act on the Matriculation Examination (502/2019)
  • Act on the National Registers of Education Records, Qualifications and Degrees (884/2017)
  • Act on the Openness of Government Activities (621/1999)
  • EU General Data Protection Regulation (GDPR 2016/679)

1. NAME OF THE REGISTER

Matriculation Examination Register

2. CONTROLLER

Matriculation Examination Board

Hakaniemenranta 6, 00530 Helsinki

Telephone (switchboard): 0295 331 700

Email: lautakunta@ylioppilastutkinto.fi

Data Protection Officer

Email: tietosuoja@oph.fi

Telephone (switchboard): 029 533 1000

3. PURPOSE AND LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA

The Matriculation Examination Register is maintained and used for organising the Matriculation Examination, for storing information on completed Matriculation Examinations and the tests included in them, and for monitoring the functioning of the Matriculation Examination (Act 884/2017, section 12).

The legal basis for the processing of personal data is the controller’s need to comply with a legal obligation (GDPR 2016/679, Article 6(1)(c)). 

In addition, data may be used for archiving purposes in the public interest and for scientific, historical and statistical purposes (GDPR 2016/679, Article 6(1)(e)).

On the basis of legislation and for reasons of substantial public interest, the Matriculation Examination Board has the right to process special categories of personal data (GDPR 2016/679, Article 9(2)(g)) in order to ensure that:

  • a candidate who, due to illness, disability, dyslexia, foreign- language background, or another comparable reason, is unable to complete the matriculation examination tests in the same way as other candidates, may complete a test under special arrangements (Act 502/2019, section 9)
  • if a candidate’s test performance has been adversely affected by illness, disability or another comparable particularly compelling reason, and special arrangements cannot be considered sufficient to safeguard the candidate’s ability to complete the test on an equal basis with other candidates, the Matriculation Examination Board may take this into account in the assessment (Act 502/2019, section 18)
  • the Matriculation Examination Board may accept an enrolment submitted after the deadline due to a candidate’s illness or another comparable particularly compelling reason (Act 502/2019, section 8)
  • upon application, the Matriculation Examination Board may cancel a candidate’s enrolment for a test due to illness, studies or work abroad, or another comparable particularly compelling reason (Act 502/2019, section 8)
  • a candidate who has participated in at least one examination round but is unable to take part in the tests of an examination round due to illness, full-time study abroad or another comparable compelling reason may continue completing the examination in the round immediately following the end of the maximum time limit; if the candidate is prevented from participating in two consecutive examination rounds for such a reason, they may continue completing the examination in the two rounds immediately following the end of the maximum time limit (Act 502/2019, section 13).

4. DATA SUBJECT GROUPS

  • Matriculation Examination candidates

5. DATA PROCESSORS

  • Teachers appointed by the principal to carry out preliminary assessment and persons appointed to implement the Matriculation Examination
  • Censors and officials of the Matriculation Examination Board
  • Technical administrators of the register

All processors act on behalf of the controller and are bound by confidentiality.

6. DATA CONTENT OF THE REGISTER

The register contains the data provided for by law (Act 884/2017, section 14):

  • the name, personal identity code, learner ID, gender and mother tongue of candidates who have enrolled for and participated in tests, as well as information on the education required for participation in and the award of the Matriculation Examination
  • information on a candidate’s selection of free-of-charge tests if the candidate enrols for several tests in the same examination round and, due to the number of tests, not all of them are free of charge
  • test performances and assessment entries, as well as the grades and scores awarded to candidates in different tests
  • the date of completion or failure of the examination, tests retaken after completion of the examination, and the supplementation of the examination.

In addition to the above, the Matriculation Examination Register may contain candidate-specific data necessary for the purpose of the register concerning the Matriculation Examination and the manner in which it is completed and organised (Act 884/2017, section 14).

Candidates’ test performances are confidential official documents (Act on the Openness of Government Activities 621/1999, section 24(1)(30)).

Test performances in paper form are not stored in the Matriculation Examination Register (Act 884/2017, section 32(7)).

Documents showing the division of assessment duties between censors appointed by the Matriculation Examination Board on an institution-specific basis are confidential until one year has elapsed from the examination round in question (Act on the Openness of Government Activities 621/1999, section 24(1)(30)).

The tests of the Matriculation Examination are subject to technical monitoring. As a result of such monitoring, the Matriculation Examination Board receives data on the behaviour of the candidate and their computer during the test. Only data necessary for detecting cheating are collected through monitoring. Data obtained through technical monitoring are confidential under section 11(1) and section 24(7) and (30) of the Act on the Openness of Government Activities (621/1999).

The use of the Matriculation Examination Register generates log data and user management data. These data may be used to monitor the use of the register and to investigate incidents and disruptions.

The data in the Matriculation Examination Register are retained permanently (Act 884/2017, section 16). However, information on the selection of free-of-charge tests is retained for five years after the right to free education referred to in section 16 of the Compulsory Education Act (1214/2020) has ended.

Data may be deleted if they are deemed not necessary for the purpose of the register.

7. REGULAR SOURCES OF DATA

Education providers are required, upon request, to submit to the Matriculation Examination Board the information necessary for organising and implementing the Matriculation Examination (Act 502/2019, section 24). The general regulations and guidelines issued by the Matriculation Examination Board specify the data to be provided.

Candidates in the Matriculation Examination produce test performances, which are submitted to the Matriculation Examination Board for assessment.

Through the data transfer service for study and qualification records (Act 884/2017, Chapter 6), the Matriculation Examination Board receives information from the Finnish National Agency for Education:

  • from the register of compulsory education, information on the candidate’s right to free education (Act 884/2017, Chapter 2a), and
  • from the national data registry for education and qualifications, information on the candidate, the completion of the general upper secondary school syllabus or other qualification or education required for the examination, and information on the free-of-charge nature of the right to study (Act 884/2017, Chapter 2).

From the Population Information System, information on the candidate’s name and mother tongue(s) is obtained.

8. REGULAR DISCLOSURES OF DATA

The disclosure of personal data from the Matriculation Examination Register is governed by the provisions laid down in the Act on the Openness of Government Activities. (Data Protection Act 1050/2018, section 28)

The Matriculation Examination Board discloses the examination results to all general upper secondary schools simultaneously once they have been finalised. The matriculation certificate and the certificate indicating completion of tests are delivered to the general upper secondary school in which the candidate has enrolled for the Matriculation Examination.

The results of the Matriculation Examination and the candidate’s assessed test performances are disclosed to the candidate and, if the candidate is under 18, to their guardian through the Studyinfo service maintained by the Finnish National Agency for Education. (Act 502/2019, section 18)

The Matriculation Examination Board discloses to the register of compulsory education (Act 884/2017, Chapter 2a) the data necessary for verifying compliance with compulsory education and the right to free education.

The Matriculation Examination Board discloses to the student admissions register (Act 884/2017, Chapter 4) the data necessary for selecting students for studies leading to lower and higher university degrees referred to in the Universities Act, and for studies leading to a university of applied sciences degree and a higher university of applied sciences degree referred to in the Universities of Applied Sciences Act, as well as, at the discretion of the university or university of applied sciences, for other education provided by higher education institutions.

Notwithstanding the provisions on confidentiality, the Matriculation Examination Board discloses from the register to Statistics Finland the personal data describing an individual’s education that are necessary for compiling statistics. (Statistics Act 280/2004, section 15, subsection 5)

9. TRANSFER OF DATA OUTSIDE THE EU OR EEA

Data are not transferred outside the European Union or the European Economic Area.

10. PRINCIPLES OF REGISTER PROTECTION

The register is protected by appropriate technical and organisational measures in accordance with Article 32 of the GDPR.

A) Manual data

Manual data are stored in a supervised environment. The processing of manual data is carried out under supervision.

B) Data processed by IT systems

The data transferred to the examination service after the test (the candidate’s personal data and test responses) is protected using a strong asymmetric encryption algorithm. The data processed in the examination service for general upper secondary schools is protected through strong authentication. Logins to the examination service and activities within the service are logged for the purposes of monitoring compliance with the terms of use and developing the system.

All user accounts in the register used by officials of the Matriculation Examination Board are personal and assigned to roles that determine which data and functions the user may access. If necessary, successful and unsuccessful login attempts of individual users can be traced afterwards. All data retrieval and modification activities are logged.

The register’s log data is protected against unauthorised alterations, and access to the logs is restricted. The personal identity codes contained in the register are encrypted.

Users’ connections to the register and data transfers to the information systems of the Finnish National Agency for Education (see section 7) are encrypted.

Backups of the register are protected. The production environment of the register includes automated distribution of security updates.

11. DATA SUBJECT RIGHTS

The data subject has the right to know whether personal data concerning them are being processed. (GDPR, Article 15(1))

The data subject has the right to request the Matriculation Examination Board to rectify inaccurate, outdated, incomplete or otherwise incorrect personal data. (GDPR, Article 16) Upon receiving a request for rectification, the Board shall take action without undue delay. If the Board detects inaccuracies in the personal data it processes, the data shall be rectified even if the data subject has not requested it.

The data subject may not request the erasure of their personal data for as long as the processing is necessary for compliance with a legal obligation of the controller or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. (GDPR, Article 17(3)(b))

The data subject may request the restriction of the processing of their personal data. (GDPR, Article 18) The right to restriction may be applied only to the extent that it does not prevent the controller from complying with a statutory obligation.

The data subject does not have the right to object to the processing of their personal data, as the processing is based on statutory obligations of the controller and the exercise of official authority vested in the controller. (GDPR, Article 21) The right to object may be applied only to processing that is not based on law.

Through the Studyinfo service, the candidate and, in the case of a candidate under 18, their guardian are given the opportunity to access the assessed written or otherwise recorded test performance. (Act 502/2019, section 18)

A decision of the Matriculation Examination Board on the assessment of a test performance may be subject to a request for administrative review as provided in the Administrative Procedure Act. The request for administrative review must be submitted to the Matriculation Examination Board within 14 days of the date on which the person entitled to request review has had the opportunity to be informed of the assessment result and the application of the assessment criteria to the candidate’s test performance. (Act 502/2019, section 22)

The data subject has the right to be informed of a personal data breach concerning them where the breach is likely to result in a high risk to their rights and freedoms. (GDPR, Article 34)

Every data subject has the right to lodge a complaint with the Data Protection Ombudsman regarding an alleged violation in the processing of personal data. (GDPR, Article 77)

12. USE OF DATA IN AUTOMATED DECISION-MAKING AND PROFILING

The data contained in the register are not used for profiling, nor are they subject to automated decision-making. Data from technical monitoring are processed solely for the purpose of detecting cheating, and no automated decisions are made on the basis of such data.