Data Protection Impact Assesment (DPIA)
Information for participants of the research project “HUMAN DIVERSITY”
You are taking part in a scientific study conducted at the University of Turku. This notice describes how your personal data will be processed in the study.
1. Data Controller
University of Turku
2. Description of the study and the purposes of processing personal data
HUMAN DIVERSITY conducts scientific research on the co-evolution of humans and their culture in Finland, from prehistoric times to the contemporary era. Our research strategy takes a holistic approach, bringing together expertise from the research disciplines of genomics, ancient DNA, natural language processing, evolutionary health, archaeology, epidemiology, mathematics, and linguistics. Pseudo-anonymized personal data collected by the THL and DVV will be processed in order to develop a comprehensive understanding of how genetic, cultural, linguistic, and social diversity has evolved and continues to evolve in contemporary Finland.
3. Principal investigator or research group
Name: Professor Virpi Lummaa
Address: Natura building, University of Turku, 20014, Turku, Finland
E-mail: virpi.lumma@utu.fi
4. Contact details of the Data Protection Officer
The Data Protection Officer of the University of Turku is available at contact address: dpo@utu.fi.
5. Persons processing personal data in the study
UTU = University of Turku
Ronan James O’Sullivan, Postdoctoral researcher, University of Turku
Sanni Peltola, Postdoctoral researcher, University of Turku
Mirkka Lahdenperä, Associate Professor, University of Turku
Susanna Ukonaho, Postdoctoral researcher, University of Turku
Somnath Chindhe, PhD researcher, University of Turku
Tina Saupe, Postdoctoral researcher, University of Turku
6. Name, nature and duration of the study
Name of the study: HUMAN DIVERSITY
Duration of the processing of personal data: 20/12/2024 (provisional start date) until the 31/03/2029.
7. Lawful basis of processing
Personal data is processed on the following basis, which is based on Article 6(1) of the General Data Protection Regulation:
☐ data subject’s consent;
☐ processing is based for the performance of a contract;
☐ compliance with a legal obligation to which the controller is subject;
☐ processing is necessary in order to protect the vital interest of the data subject;
☒ performance of a task carried out in the public interest or in the exercise of official authority vested in the controller:
☒ scientific or historical research purposes or statistical purposes;
☐ archiving of research materials or cultural heritage materials;
☐ legitimate interest pursued by the controller or by a third party.
8. Personal data included in the research materials
No personal data is collected by HUMAN DIVERSITY in this project. Pre-existing personal data stored by THL and DVV will be analysed.
9. Sensitive personal data
Following categories of sensitive personal data will be processed in the study:
Birth dates, death dates, place of birth, place of death, sex, health data, genomic data.
Sensitive personal data is processed on the following basis, which is based on Article 9(2) of the General Data Protection Regulation:
☐ data subject’s consent;
☐ processing is necessary in order to protect the vital interest of the data subject;
☒ performance of a task carried out in the public interest or in the exercise of official authority vested in the controller:
☒ scientific or historical research purposes or statistical purposes;
☐ archiving of research materials or cultural heritage materials.
10. Sources of personal data
Data is requested from THL and the DVV
11. Transfer and disclosure of the personal data to third parties
The personal data will not be transferred to other recipients outside the University of Turku/research group/researcher.
12. Transfer or disclosure of personal data to countries outside the EU/European Economic Area
Personal data will not be transferred outside the EU/ European Economic Area.
13. Automated decisions
No automated decisions are made.
Safeguards to protect the personal data:
☒The data is confidential.
☐ Protection of manual material:
☒ Personal data processed in IT systems:
All those who will analyse data in a research capacity will be required to undertake training on how to securely access and analyse the data on the CSC Secure Server. “Securely access” means that all those who access data on the server will do so (1) using an individual username-password combination, (2) using only University of Turku-networked computers with all of the protection such networking entails, (3) secure their connection using SSH keys, and (4) not access the data in an indiscrete manner in public. Furthermore, this training will require those who wish to access the data to sign a declaration stating they have undertaken the required training and are aware that if they commit a data breach, either knowingly or through gross negligence, will lose access to the data and the right to be involved in any publication involving any of the data released to the HUMAN DIVERSITY consortium by THL and DVV.
☐ other
Processing of direct identifiers:
☐ Direct identifiers will be removed in the analysis phase
☐ The material to be analyzed includes direct identifiers.
Reason:
14. Processing of personal data after the completion of the study
The research material will be deleted.
15. Your rights as a data subject, and exceptions to these rights
The Data Protection Officer of the University of Turku is available at contact address: dpo@utu.fi.
Exceptions to data subject rights
Under the General Data Protection Regulation and the Finnish Data Protection Act, certain exceptions to the rights of data subjects can be made when personal data is processed in scientific research and fulfilling the rights would render impossible or seriously impair the achievement of the objectives of the processing (in this case, scientific research).
The need to make exceptions to the rights of data subjects will always be assessed on a case by case basis. It is likely that exceptions to the following rights will be necessary in this study:
☐ Right of access (GDPR Article 15)
☐ Right to rectification (GDPR Article 16)
☐ Right to erasure (GDPR Article 17)
☐ Right to restriction of processing (GDPR Article 18)
☐ Right to data portability (GDPR Article 20)
☐ Right to object (GDPR Article 21)
Reasons and the extend for the exceptions:
Right to lodge a complaint
You have the right to lodge a complaint with the Data Protection Ombudsman if you think your personal data has been processed in violation of applicable data protection laws.
Contact details of Data Protection Ombudsman:
Office of the Data Protection Ombudsman
Visiting address: Lintulahdenkuja 4, 00530 Helsinki
Postal address: P.O. Box 800, 00531 Helsinki, Finland
E-mail: tietosuoja(at)om.fi
Switchboard: +358 (0)29 566 6700