Privacy statements concerning benefit processing
This page contains the privacy statements for registers of data relating to customer service and benefit processing.
If you have questions about the statements, please contact Kela's customer service, a Kela service point or the person mentioned in the statement. Inquiries can be sent to Kela’s appointed privacy officer by e-mail at tietosuoja(at)kela.fi.
The register is used to record and store customer and service related data on Kela’s appointment booking system. The data are processed as part of Kela’s statutory responsibilities.
Privacy statement for Kela’s appointment booking system
1 Data controller
The Social Insurance Institution of Finland (Kela)
PL 450, 00056 Helsinki or Nordenskiöldinkatu 12, 00250 Helsinki
020 634 11, http://www.kela.fi/administration
2 Contact person for register-related matters
Sanna Manninen
Tel. 020 634 11 (exchange)
3 Name of register
Appointment booking system
4 Purpose and basis for the handling of personal data
register is used for the booking and administration of appointments made by customers and for the storage of the customers’ personal and service-related data. The processing of the data is part of Kela’s statutory benefit administration duties.
5 Data content of the register
Types of data contained in the register:
- reason for appointment
- specifier(s) indicating the reason for the appointment (life situation, benefit)
- type of appointment (e.g. phone appointment)
- language used during the appointment
- whether the customer requires interpreter assistance (yes/no)
- language interpreted
- region or municipality
- service point
- date and time of service
- customer’s name
- customer’s personal identity code
- customer’s phone number
- customer's email address
- type of notifications sent about the appointment (e.g. confirmation of appointment)
- method used to deliver the notifications (e.g. text message)
- whether the customer has been assigned a legal guardian (yes/no, obtained from Kela’s registers)
- whether access to the customer’s personal data is restricted (yes/no, obtained from Kela’s registers)
- additional information (free-form description)
- appointment status (e.g. completed, cancelled)
- Person who made or changed the appointment
- change history (what changes made, when and by whom)
6 Regular sources of data
Data are obtained directly from the customers, from Kela’s benefit register (personal da-ta and contact information) and from the Digital and Population Data Services Agency (name and personal identity code). Kela’s employees and partner organisations (e.g. so-cial welfare authorities) can add data to the register through the appointment booking system’s user interface. Representatives of Kela's partner organisations must verify their identity with a strong electronic authentication method (suomi.fi) before they can use the appointment booking system. When acting on behalf of another person, use of the service requires an electronic mandate (suomi.fi) or the existence of a statutory right to act on behalf of that person.
7 Regular disclosure of data
No personal data are disclosed.
8 Transfer of data outside the EU or EEA
None.
9 Retention period for personal data
Personal data are retained in the database for six months from the date for which the appointment was made and deleted thereafter. Retention of the data is part of Kela’s statutory benefit administration responsibilities. Personal data are retained for the duration needed for Kela to discharge its statutory responsibilities and to implement its benefit schemes.
10 Principles of register security
Kela exercises due care in all its operations and ensures a high level of data protection and data security.
All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.
11 Right of access to data
Article 15 of the EU General Data Protection Regulation (EU 2016/679), data subjects have the right to check the data on their person.
Those who wish to check their data must submit a request to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website www.kela.fi/administration.
The request can also be made by phone or by visiting a Kela service point, or by sending a message on the OmaKela e-service at www.kela.fi/e-services
12 Right of correction
According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data.
The request for correction must be submitted to Kela.
The request must specify the following:
- the specific information which is incorrect
- the reason why it is incorrect
- how it should be amended.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
The request can also be made by phone or by visiting a Kela service point, or by sending a message on the OmaKela e-service at www.kela.fi/e-services
13 Right of erasure
Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.
This right does not extend to personal data that Kela needs to carry out its statutory duties.
The request to erase personal data must be made to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
The request can also be sent as a message via the OmaKela e-service (www.kela.fi/e-service). Alternatively, the request can be made by phone or by visiting a Kela customer service point.
14 Right to file a complaint with a supervisory authority
According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of Kela personal data relating to him or her infringes this Regulation.
Benefit-related data are used in providing customer service and reviewing claims for benefit as part of a statutory social insurance programme.
Privacy statement for the Kela benefit register
1 Register controller
The Social Insurance Institution of Finland (Kela)
PL 450, 00056 HELSINKI or Nordenskiöldinkatu 12, 00250 HELSINKI
020 634 11
http://www.kela.fi/administration
2 Additional information and contact for register-related matters
Tel. 020 692 352
3 Name of register
Benefit register
4 Purpose and basis for the handling of personal data
Benefit-related data are used in providing customer service and reviewing claims for benefit as part of a statutory social insurance programme.
The data are also used by Kela for planning and research purposes as well as in the context of data exchange.
The handling of the data is based on the fulfilment of Kela’s statutory responsibilities. A list of the relevant statutory provisions is attached as Appendix 2.
5 Data content of the register
The benefit register contains general data on beneficiaries, benefit-related data, information about customer service and claims processing, and statistical data.
The types of data contained in the register are described in Appendix 1.
6 Regular sources of data
Data are obtained from customers personally and from government authorities and other entities, including the Population Register Centre, Finnish Immigration Service, the Finnish Tax Administration and its Income Register Unit, authorised pension providers, insurance companies, workplace funds, social welfare and healthcare authorities, and labour authorities.
Data are also obtained from pharmacies and parties to direct reimbursement agreements (health service providers and transport operators providing services under the Health Insurance Act). Further, data are obtained from the Board of Education’s Opintopolku.fi and KOSKI data resources. Study-related data on higher education students are obtained from the VIRTA data resources administered by the Ministry of Education and Culture.
Kela can ask the social services of a wellbeing services county to issue a statement if Kela needs one to process a basic social assistance matter.
7 Regular disclosure of data
Provided the requirements set out in law are met, Kela discloses customer data electronically to such entities as the Finnish Tax Administration, the authorised pension providers, employment accident insurance providers, social welfare and healthcare authorities, and pharmacies.
8 Data Processors
Kela uses subcontractors for the provision of its cloud-based information systems, who act as data processors on behalf of Kela. Our key processors are:
- PricewaterhouseCoopers Business Services SRL – system development and maintenance
- Salesforce.com Italy SRL – technology supplier for the information system
9 Transfer of data outside the EU or EEA
In individual cases, data is transferred outside the EU or European Economic Area in accordance with social security agreements concluded. Personal data disclosed for booking travel and accommodation is also processed both within the EU/EEA area and outside it.
In Kela's information systems, your personal data is stored within the EU/EEA area. In limited individual situations, Kela may allow temporary access to your personal data from outside the EU/EEA area if it is necessary to resolve technical issues in the information systems. Temporary access is based on a decision by the EU Commission regarding the adequacy of data protection in the third country, EU Commission-approved standard contractual clauses or binding corporate rules for corporate groups approved by a data protection authority and applies only to those personal data that are essential to resolve the technical issue.
10 Retention period for personal data
The retention periods for benefit-related data are based on the legislation governing the benefits and the Accounting Act. The standard retention period is 10 years from the discontinuation of the benefit, which is based on the six-year retention period specified in the Accounting Act and the additional time needed for appeal and recovery of overpayment.
Some data, such as the data on prescription medicines reimbursed at the pharmacy, are deleted after three years have elapsed from the end of the accounting year in which the reimbursement was paid.
11 Principles of register security
At Kela, data security and protection of personal data are systematically taken into account in all use and handling of information. Kela handles all personal data with data protection in mind and in the manner determined by law.
All persons at Kela who handle personal data sign a confidentiality agreement. The register data are used only by authorised persons who need them to perform their official duties.
12 Right of access to data
According to Article 15 of EU Regulation 2016/679, the data subject has the right to access personal data concerning him or her, i.e. a right to check information concerning the person himself or herself.
The request can be made by phone, by using the Message function on Kela’s e-service, by submitting a written request to Kela’s Registry, or by contacting a Kela office personally. Please note that our e-service is only available in Finnish and Swedish. The contact information can be found in section 1.
13 Right of correction
According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data concerning him or her.
In the request, they must identify the incorrect information, indicate why it is incorrect and specify how it should be amended.
The request can be made by phone, by using the Message function on Kela’s e-service, by submitting a written request to Kela’s Registry, or by contacting a Kela office personally. The contact information can be found in section 1.
14 Right of erasure
According to Article 17 of EU Regulation 2016/679, the data subject has the right to request the erasure of personal data concerning him or her.
This right does not concern personal data that Kela needs to carry out its statutory duties.
15 Right to file a complaint with a supervisory authority
According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
Appendix 1: Types of data contained in the register
GENERAL INFORMATION
General information may be used in the administration of benefit schemes. General information includes the following:
- personal information
- address and residential information
- other contact information such as e-mail and telephone
- payment details and payee information
- family and other relationship information
- resident permit information
- tax information
- information about earnings and assets
- tax withholding information
- benefit reference data
BENEFIT-RELATED DATA
The benefits and the data used in connection with them are listed in the order of which customers may encounter them in their lives.
1. PREGNANCY, CHILDBIRTH, CHILDCARE
- Maternity, paternity and parental allowances: Claim, review, determination, payment and processing data
- Maternity grant: Claim, review, determination, delivery and processing data
- Child benefit: Claim, review, determination, decision and payment data
- Child benefit: Overpayment and recovery data
- Child benefit follow-up data
- Child care allowance: Claim, review, determination, payment and processing data
- Child maintenance allowance: Claim, review, determination, payment and processing data
- Payment of child support debt
- Dependent child increase data (unemployment benefits, labour market training subsidy, national pension)
- Compensation for family leave costs: Claim, review, determination, payment and processing data
2. ILLNESS, INJURY OR FUNCTIONAL IMPAIRMENT OF CHILD/FAMILY MEMBER
- Disability allowance for persons under 16 years: Claim, review, determination, payment and processing data
- Special care allowance: Claim, review, determination, payment and processing data
- Spouse supplement data (national pensions)
3. OWN ILLNESS, INJURY OR DISABILITY
- Reimbursements of medical expenses: Claim, determination, payment and processing data
- Cross-border medical care benefits: Determination, payment and processing data
- Entitlement to reimbursement of medicine expenses: Claim, review, determination and processing data
- Reimbursements of medicine expenses: Follow-up and cumulative data
- Sickness allowance: Claim, review, determination, payment and processing data
- Rehabilitation: Claim, review, determination, decision, payment, processing and implementation data
- Rehabilitation follow-up data
- Rehabilitation allowance: Claim, review, determination, payment and processing data
- Disability pension and its components, special assistance to immigrants: Claim, review, determination, payment and processing data
- Individual early retirement pension and its components: Claim, review, determination, payment and processing data
- Disability allowance for persons aged 16 years or over: Claim, review, determination, payment and processing data
- Data on the care allowance for pensioners (disability pension, individual early retirement pension, old-age pension, early old-age pension)
- Data on purchases of medicine with a social assistance voucher
4. STUDENTS
- Financial aid for students: Claim, processing, review, determination, payment and decision data
- Financial aid for students: Overpayment recovery and follow-up data
- School transport subsidy: Claim, processing, review, determination, payment and decision data
- School transport subsidy: Overpayment recovery and follow-up data
- Student loan and interest allowance data
- Financial aid for students: Student selection data
- Financial aid for students: Data on debts repayable under government loan guarantee
- Labour market adult education subsidy: Claim, review, determination, payment and processing data
- Adult education subsidy: Loan guarantee data
- Vocational rehabilitation data (rehabilitation data in section 3)
- Housing data (in section 8)
- Orphan’s pension data (survivor pensions in section 9)
5. UNEMPLOYMENT
- Basic unemployment allowance: Claim, review, determination, payment and processing data
- Basic unemployment allowance follow-up data
- Labour market subsidy: Claim, review, determination, payment and processing data
- Labour market subsidy follow-up data
- General social security benefit: Claim, review, determination, payment and processing data
- General social security benefit follow-up data
- Job alternation compensation payment data
- Job alternation compensation follow-up data
- Unemployment pension and its components: Claim, review, determination, payment and processing data
- Pension assistance for the long-term unemployed: Claim, review, determination, payment and processing data
- Integration allowance: Claim, review, determination, payment and processing data
- Integration allowance follow-up data
- Job alternation compensation: Claim, review, determination, payment and processing data
- Travel allowance: Claim, review, determination, payment and processing data
- Travel allowance follow-up data Commuting and relocation allowance: Claim, review, determination, payment and processing data
- Commuting and relocation allowance follow-up data
- Pension assistance: Claim, review, determination, payment and processing data
6. WAR VETERANS, CONSCRIPTS
- Data on supplements paid to front-veterans and to persons having participated in mine clearance operations (national pension)
- Front-veteran's supplement payable abroad: Claim, review, determination, payment and processing data
- Conscript’s allowance: Claim, review, determination, payment and processing data
7. OLD AGE
- Pensions and their components: Claim, review, determination, payment and processing data
- Special assistance to immigrants: Claim, review, determination, payment and processing data
- Guarantee pension: Claim, review, determination, payment and processing data
8. HOUSING AND OTHER ECONOMIC SECURITY
- General housing allowance: Claim, review, determination, decision, payment and processing data
- General housing allowance: Tabulated data, municipality data and exempt income data
- Financial aid for students: Housing supplement data
- Conscript’s allowance: Housing assistance data
- Housing allowance for pensioners: Claim, review, determination, decision, payment and processing data
- Basic social assistance: Claim, review, determination, decision, payment and processing data
- Basic social assistance: Voucher data
9. DEATH OF A FAMILY MEMBER
- Survivor’s pension and its components: Claim, review, determination, payment and processing data
10. OTHER CUSTOMER-RELATED DATA
- tax information
- information about earnings and assets
- Pension directory data
- Pension insurance: Historical data
- Earnings-related pension, worker’s compensation, military injury and traffic accident data, data on voluntary pensions, and data on earnings-related unemployment benefits
- Overpayment recovery data (sickness allowance, reimbursements of medical expenses, allowances for parents, child care allowances, child home care allowance, basic unemployment allowance, labour market adult education, labour market subsidy, rehabilitation benefits, pension benefits, special assistance for immigrants, financial aid for students, interest allowance, school transport subsidy, conscript’s allowance and general housing allowance)
- Amount and recovery of child support debt; Claim, review, determination and processing data for exemptions from payment
- European Health Insurance Card orders
- Non-photo Kela Card/Health Insurance Card orders
- Identity card register
- Annual notifications
- Requests for further information
- Occupational health care for entrepreneurs and other self-employed persons: Claim, determination, payment and processing data
- Data on insurance coverage and residence abroad
- resident permit data
- Additional information
- Personal records
- Electronic records management data
- Technical amendments of register data
- Basic social assistance
- Integration assistance
- Travel allowance
- Job alternation compensation
- Commuting and relocation allowance
11. STATISTICAL DATA
- Pension insurance and special assistance for immigrants
- Health insurance benefits
- Unemployment benefits
- Student benefits Family benefits
- Rehabilitation benefits
- Other social security
- Insurance status
- Basic social assistance
The data content is equivalent to that presented above in the context of each category of benefit.
12. DATA HANDLED MANUALLY
- Personal records (arranged alphabetically by office)
- Benefit claims and supporting documents
- Certain other short document series related to benefit administration
Appendix 2: List of legislation relevant to the Benefit Register
- Section 2, Act on the Social Insurance Institution
- Section 3, Act on National Pensions
- Section 6, Act on Guarantee Pensions
- Section 3, Pensioners’ Housing Allowance Act
- Section 3, Act on Special Assistance for Immigrants
- Section 21, Act on Pension Assistance to the Long-Term Unemployed
- Section 14, Act on Front-Veterans’ Pensions
- Section 8, Act on Front-Veterans’ Supplements Payable Abroad
- Section 3, Act on the Labour Market Subsidy
- Chapter 1, Section 3, chapter 15, section 1Health Insurance Act
- Chapter 1, Section 4, Unemployment Security Act
- Chapter 12, Section 3, Act on Public Employment Service
- Chapter 16, Section 21, Act on Job Alternation Compensations
- Sections 7 and 17, Act on the Integration of Immigrants and the Reception of Asylum Seekers
- Sections 4 and 5, Act on Rehabilitative Work Activity
- Section 8, Act on Child Home Care and Private Day Care Allowances
- Section 3, Act on Child Benefits
- Section 1, Act on the Rehabilitation Services and Cash Benefits Provided by Kela
- Section 11, Housing Allowances Act
- Section 4, Maternity Grants Act
- Section 5, Act on Conscripts’ Allowances
- Section 8, Act on Student Financial Aid
- Section 3, Act on Child Maintenance Allowances
- Sections 7 and 14, Act on School Transport Subsidy of General and Vocational Upper Secondary Education Students
- Section 2, Act on the Application of the Legislation on Residence-Based Social Security
- Section 4, Act on Adult Education Allowances
- Section 2, Government Decree on the Responsibilities of Kela in Implementing Certain Provisions of Regulation (EC) No. 1408/71
- Social security agreements
- Section 4, Act on Social Assistance
- Section 24, Act on Pension Assistance
- Section 2, Act on the Basic Income Experiment
To monitor the management of benefit fraud matters and to produce regional and nationwide statistics for the Kelasto statistical database.
Privacy statement for Kela's benefit fraud register
1 Data controller
The Social Insurance Institution of Finland (Kela)
PL 450, 00056 Helsinki or Nordenskiöldinkatu 12, 00250 Helsinki
020 634 11, www.kela.fi/administration
2 Contact person for register-related matters
Tiina Niskanen
Tel. 020 634 11 (exchange)
3 Name of register
Benefit fraud register (EVAREK)
4 Purpose and basis for the handling of personal data
Personal data are processed as part of monitoring the management of benefit fraud matters. The data are also processed for purposes of producing regional and national statistics for the Kelasto statistical database.
Closed cases are removed from the register, and the data are only used for statistical purposes. When compiled into statistics, the data are converted into a format that prevents individual persons from being recognised.
The handling of personal data is based on the fulfilment of Kela’s statutory responsibilities.
5 Data content of the register
The register contains the following identifying data:
- name
- personal identity code
- insurance district
- benefit that has been the target of fraud
- how the fraud was committed and discovered
- amount paid as a result of fraud
- Kela’s decision with regard to suspected fraud
- police, prosecutor or court decision.
6 Regular sources of data
Data are received from customers, Kela’s benefit systems and, as provided for by law, other public authorities, such as the Finnish Tax Administration, police, prosecutor’s officer and courts of law.
7 Regular disclosure of data
None.
8 Transfer of data outside the EU or EEA
None.
9 Retention period for personal data
Personal data are retained for fourteen (14) months starting from the data on which the case was registered as closed.
10 Principles of register security
Kela exercises due care in all its operations and ensures a high level of data protection and data security.
All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.
11 Right of access to data
According to Article 15 of EU Regulation 2016/679, data subjects have the right to access personal data concerning them, i.e., to you can check the data concerning their person.
Those who wish to check their data must submit a request to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
12 Right of correction
According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data.
The request for correction must be submitted to Kela.
The request must specify the following:
- the specific information which is incorrect
- the reason why it is incorrect
- how it should be amended
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
13 Right of erasure
Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.
This right does not concern personal data that Kela needs to carry out its statutory duties.
The request to erase personal data must be made to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
14 Right to file a complaint with a supervisory authority
According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of Kela personal data relating to him or her infringes this Regulation.
To verify on the basis of Kela’s customer data that the criteria for issuing a European Disability Card are fulfilled and to register eligible persons as such in the browser-based system of the Service Foundation for People with an Intellectual Disability.
Privacy statement for the register on permissions to order a European Disability Card
1 Data controller
The Social Insurance Institution of Finland (Kela)
PL 450, 00056 HELSINKI or Nordenskiöldinkatu 12, 00250 HELSINKI
020 634 11
http://www.kela.fi/administration
2 Contact person for register-related matters
Viivi Pelkonen
Tel. 020 634 11 (exchange)
3 Name of register
Register on permissions to order a European Disability Card
4 Purpose and basis for the handling of personal data
To verify on the basis of Kela’s customer data that the criteria for issuing a European Disability Card are fulfilled and to register eligible persons as such in the browser-based system of the Service Foundation for People with an Intellectual Disability.
The processing of the data is based on the consent of the registered persons.
5 Information content of the register
Data used for identification
- Name
- Personal identity code
- E-mail address
- Telephone number
Other data needed for the permission (indication that the customer wishes to order a European Disability Card, A marking, authorisation).
6 Regular sources of data
Data are obtained from the customers or their authorised representatives on Kela’s customer service channels.
7 Regular disclosure of data
Kela may release customer data as specified by law.
8 Transfer of data outside the EU or EEA
None.
9 Retention period for personal data
The permission form and its supporting documents are retained for ten (10) years.
10 Principles of register security
At Kela, data security and protection of personal data are systematically taken into account in all use and handling of information. Kela handles all personal data with data protection in mind and in the manner determined by law.
All persons at Kela who handle personal data sign a confidentiality agreement. The register data are used only by authorised persons who need them to perform their official duties.
11 Right of access to data
According to Article 15 of EU Regulation 2016/679, the data subject has the right to access personal data concerning him or her, i.e. a right to check information concerning the person himself or herself.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
12 Right of correction
According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data concerning him or her.
In the request, they must identify the incorrect information, indicate why it is incorrect and specify how it should be amended.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
13 Right of erasure
According to Article 17 of EU Regulation 2016/679, the data subject has the right to request the erasure of personal data concerning him or her.
This right does not concern personal data that Kela needs in order to carry out its statutory duties.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
14 Right to file a complaint with a supervisory authority
According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
The personal data contained in the register are used in the Electronic Exchange of Social Security Information (EESSI) system of the EU member states. The data are used to identify persons who will be covered by the Finnish social security system.
Identification of natural persons in EESSI message exchange
1 Data controller
The Social Insurance Institution of Finland (Kela)
PL 450, 00056 KELA or Nordenskiöldinkatu 12, 00250 Helsinki
020 634 11 http://www.kela.fi/administration
2 Contact person for register-related matters
Mia Sundblad
Tel. 020 634 11 (exchange)
3 Name of register
Identification of natural persons in EESSI message exchange
4 Purpose and basis for the handling of personal data
The personal data contained in the register are used in the Electronic Exchange of Social Security Information (EESSI) system of the EU member states. The data are used to identify persons who will be covered by the Finnish social security system. The processing of the data is based on the fulfilment of Kela’s statutory responsibilities.
5 Data content of the register
The register contains data used to identify specific individuals and cases.
Personal identifying data:
- name and address
- nationality
- personal identity code
- foreign social security number or equivalent
- whether access to personal data has been restricted.
6 Regular sources of data
Personal data are received from the data subjects, the institution which sent the EESSI message and the Digital and Population Data Services Agency.
7 Regular disclosure of data
Data are disclosed to the Digital and Population Data Services Agency and to the recipient EESSI institution in Finland.
8 Transfer of data outside the EU or EEA
None.
9 Retention period for personal data
Personal data are retained for ten years. The retention period has been set in accordance with the principles outlined in Article 5 of the EU General Data Protection Regulation.
10 Principles of register security
Kela exercises due care in all its operations and ensures a high level of data protection and data security.
All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.
11 Right of access to data
According to Article 15 of EU Regulation 2016/679, data subjects have the right to access personal data concerning them, i.e., them in can check the data concerning their person.
Those who wish to check their data must submit a request to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
12 Right of correction
According to Article 16 of EU Regulation 2016679, the data subject has the right to request the correction of inaccurate personal data.
The request for correction must be submitted to Kela.
The request must specify the following:
- the specific information which is incorrect
- the reason why it is incorrect
- how it should be amended.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
13 Right of erasure
Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.
This right does not extend to personal data that Kela needs to carry out its statutory duties.
The request to erase personal data must be made to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
14 Right to file a complaint with a supervisory authority
According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of Kela personal data relating to him or her infringes this Regulation.
1 Data controller
The Social Insurance Institution of Finland (Kela)
PO Box 450, 00056 Helsinki, Finland or Nordenskiöldinkatu 12, 00250 Helsinki, Finland
Tel. 020 634 11
www.kela.fi/administration-contact-us
2 Contact person for register-related matters
Tel. 020 634 11 (switchboard)
3 Name of register
Privacy statement for the system used to record phone calls with customers, second-line support phone calls and chat conversations.
4 Purpose and basis for the processing of personal data
Personal data are processed for the purposes of administering the statutory social insurance scheme, which includes the provision of various benefits and customer service. The data are used primarily for the purpose of verifying customer service transactions. The data may also be used for the training of customer service staff and for operational development aimed at improving service quality.
5 Data content of the register
Kela records all telephone conversations with customers. Kela also records calls that are made due to an appointment set up via the appointment booking system. In addition, Kela records all chat conversations.
Phone calls to and chat conversations with second-line customer support are recorded. Kela also records calls about the Kanta e-service.
Remote service (video channel) sessions are not recorded. This includes chat conversations had during the remote service sessions.
The data consist of information provided by the customer or, in second-line support calls, by the Kela specialist, including
- identifying information
- name
- personal identity code
- address
- phone number
- residential data
- family relationships
- insurance status data
- tax information
- information about earnings and assets
- tax withholding information
- benefit reference data.
For phone calls, Kela records personal data consisting of the customer’s phone number, the customer’s personal identity code if their identity has been verified and the name of the Kela specialist who handled the matter. For chat conversations, Kela records the name of the Kela specialist who handled the matter and the customer’s personal identity code if their identity has been verified. For remote service sessions held with a customer whose identity has been verified, Kela records the customer’s personal identity code and the name of the Kela specialist who handled the matter. For appointments booked with a government entity at a joint remote service point, the customer’s name, email address and phone number will be recorded in the eKonsultaatio remote service system used at Suomi-piste service points.
6 Regular sources of data
Personal data are received from the customer or from a Kela specialist or via a chat conversation.
7 Regular disclosure of data
No personal data are disclosed.
8 Transfer of data outside the EU or EEA
Data are not transferred outside the EU or the EEA.
9 Retention period for personal data
The recordings of phone calls and chat conversations are usually retained for one (1) year.
10 Principles of register security
Kela exercises due care in all its operations and ensures appropriate data protection and data security.
All Kela employees who process personal data sign a confidentiality agreement. The data stored in the register may be used only by authorised persons who need access to the data to perform their official duties.
11 Right of access
Under Article 15 of the EU General Data Protection Regulation (EU 2016/679), data subjects have the right to access personal data concerning them. This means that persons included in the register have the right to check data concerning themselves.
Those who wish to check their data must submit a request to Kela.
The request can be addressed to Kela's Registry at kirjaamo@kela.fi.
The request can also be made by phone, by visiting a Kela service point, or by sending a message in the OmaKela e-service.
12 Right to rectification
Under Article 16 of the General Data Protection Regulation, data subjects have the right to request the correction of any inaccurate personal data stored in the register.
The request for correction must be submitted to Kela.
The request must specify the following:
- the specific information which is incorrect
- the reason why it is incorrect
- how it should be amended.
The request can be addressed to Kela's Registry at kirjaamo@kela.fi.
The request can also be made by phone, by visiting a Kela service point, or by sending a message in the OmaKela e-service.
13 Right to erasure
Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.
This right does not extend to personal data that Kela needs to carry out its statutory duties.
The request to erase personal data must be made to Kela.
The request can be addressed to Kela's Registry at kirjaamo@kela.fi.
The request can also be made by phone, by visiting a Kela service point, or by sending a message in the OmaKela e-service.
14 Right to lodge a complaint with the supervisory authority
Under Article 77 of the General Data Protection Regulation, data subjects have the right to lodge a complaint with the Data Protection Ombudsman if the data subject is of the opinion that Kela infringes the General Data Protection Regulation when processing personal data.
The data are used as part of Kela’s statutory responsibilities.
Privacy statement for the service provider register
1 Data controller
The Social Insurance Institution of Finland (Kela)
PL 450, 00056 Helsinki or Nordenskiöldinkatu 12, 00250 Helsinki
020 634 11, http://www.kela.fi/administration
2 Contact person for register-related matters
Merja Larikka (Healthcare service providers, healthcare professionals and transport service providers)
Tomi Mielonen (Rehabilitation service providers)
Auri Syrén (Providers of early childhood education)
Tel. 020 634 11 (exchange)
3 Name of register
Service provider register
4 Purpose and basis for the handling of personal data
The handling of personal data is based on the fulfilment of Kela’s statutory responsibilities.
- Chapters 3 and 4; chapter 15, section 9 of the Health Insurance Act
- Sections 6, 9, 10, 12, 14, 15, 41, 46 and 53 of the Act on the Rehabilitation Benefits and Cash Allowances Provided by the Social Insurance Institution
- Sections 15, 16, 20 and 24c of the Act on Child Home Care and Private Day Care Allowances
Some of the data contained in the rehabilitation service provider register may be looked up without signing in via the rehabilitation service provider search function at www.kela.fi.
The data contained in the register are used by Kela to determine
- whether the person performing examinations and therapies and the service provider have the necessary professional qualifications and legal authorisation to provide a statutory social insurance benefit and
- whether the service provider or pharmacy signed an agreement concerning the claiming of reimbursements,
- whether the provider of early childhood education is a private day care centre, a private group family day care provider, a private family day care provider or a day care provider working under a contract of employment, and whether the data remain current.
5 Data content of the register
The register contains the following types of data:
1. For doctors,
- name, registration number and identifying code
- contact information
- professional and licensing details and related additional information
2. For dentists,
- name, registration number and identifying code
- contact information
- professional and licensing details and related additional information
3. For physiotherapists, nurses, nurse practitioners, midwifes, dental hygienists and medical laboratory technicians,
- name, registration number and identifying code
- contact information
- professional and licensing details and related additional information
- additional rehabilitation data
4. Specialist dental technician data
- name, registration number and identifying code
- contact information
- professional and licensing details and related additional information
5. Psychologist data
- name, registration number and identifying code
- contact information
- professional and licensing details and related additional information
- additional rehabilitation data
6. For rehabilitation service providers,
- name, registration number and identifying code
- contact information
- professional and licensing details and related additional information
- additional rehabilitation data
7. Transport service provider data
- Name and business ID
- contact information
- additional data
8. For providers of early childhood education,
- name and identifying code
- form of operation and incorporation
- contact information
- bank details and payment reference data
- claims data
9. Contractual and confirmation data
- type and term of contract, areas of operation or measures
- contract doctors and dentists
- rehabilitation service provider price data
- supplementary contractual data
10. Data handled manually
- agreements relating to powers of attorney, direct reimbursement and transport services (stored at Kela insurance districts)
- Finnish Supervisory Agency notifications concerning physicians’ licence to practice (Legal Affairs Unit)
- rehabilitation service agreements (insurance districts and Legal Affairs Unit)
- applications for accreditation and Kela approval notifications for rehabilitative psychotherapy and discretionary neuropsychological rehabilitation service providers (Legal Affairs Unit)
6 Regular sources of data
Data are obtained from the service providers, from benefit applicants and various government authorities, including the Finnish Supervisory Agency (LVV), the National Institute for Health and Welfare (THL), university medical faculties, the Digital and Population Data Services Agency (DVV), and municipal authorities.
7 Regular disclosure of data
Data on physicians and dentists are disclosed to pharmacies as required by the direct reimbursement system.
8 Transfer of data outside the EU or EEA
None.
9 Retention period for personal data
Personal data are stored for the duration needed for Kela to discharge its statutory responsibilities and to implement its benefit schemes.
10 Principles of register security
Kela exercises due care in all its operations and ensures a high level of data protection and data security.
All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.
11 Right of access to data
According to Article 15 of EU Regulation 2016/679, data subjects have the right to access personal data concerning them, i.e., to check the data concerning their person.
Those who wish to check their data must submit a request to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
12 Right of correction
According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data.
The request for correction must be submitted to Kela.
The request must specify the following:
- the specific information which is incorrect
- the reason why it is incorrect
- how it should be amended.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
13 Right of erasure
Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.
This right does not concern personal data that Kela needs to carry out its statutory duties.
The request to erase personal data must be made to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
14 Right to file a complaint with a supervisory authority
According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of Kela personal data relating to him or her infringes this Regulation.
The personal data contained in the register are used by Kela to discharge its statutory responsibilities in providing access to interpreter services for persons with disabilities.
Privacy statement for the interpreter service for persons with disabilities
1 Data controller
The Social Insurance Institution of Finland (Kela)
PL 450, 00056 HELSINKI or Nordenskiöldinkatu 12, 00250 HELSINKI
020 634 11
http://www.kela.fi/administration
2 Contact person for register-related matters
Suvi Liuski
Tel. 020 634 11 (exchange)
3 Name of register
Register on the interpreter service for persons with disabilities
4 Purpose and basis for the handling of personal data
The personal data contained in the register are used by Kela to discharge its statutory responsibilities in providing access to interpreter services for persons with disabilities.
Data on remote interpretation services are needed to monitor and compile statistics on the use of the service and to provide equipment and an online connection for remote interpretation and to monitor their usage.
The register data are also needed to troubleshoot errors and to bill for the use of the equipment.
The processing of the personal data is based on the Act on Interpreter Services for Persons with Disabilities (133/2010) and the consent given by the clients at the time of application.Clients have the right to withdraw their consent.
The processing of data on the interpretation service provider and interpreter is based on the procurement contract signed by Kela and the service provider.
5 Data content of the register
The register contains data on persons entitled to interpreter services arranged by Kela.
The register contains data on interpretation service providers that have an agreement with Kela to provide such services. The register also contains data on the interpreters under contract with the service providers.
Types of data contained by the register:
1. Clients receiving interpreter services for persons with disabilities
- name
- personal identity code
- client number
- contact information
- interpreter referral information
- The following data are stored about remote interpretation:
- delivery of remote interpretation equipment and online connection
- data collected when monitoring the use of the remote interpretation service
2. Interpretation service providers
- business ID
- name
- contact information
- service provider number
- employees (interpreters)
3. Interpreters
- name
- date of birth
- interpreter number
- contact information
- interpreter referral information
6 Regular sources of data
Client data stored in the register are obtained from interpreter requests made by the clients, from letters, from remote interpretation usage data, and from reports submitted by the service providers.
The service providers are selected on the basis of bids for a specified contract term. Additional services may be procured during a contract term as needed. Information about the service providers covered by the framework agreement and the interpreters in their employ is entered into the register upon the signing of the contract.
7 Regular disclosure of data
Kela may disclose client data as authorised by the prevailing legislation. Necessary data may be disclosed to the service provider in accordance with section 24 of the governing law for the purpose of providing the interpreter service requested by the client.
The service providers are subject to a confidentiality obligation.
In order to provide the remote interpretation equipment and the required online connection, as well as to troubleshoot errors, data may be released as needed to outside service providers under contract to Kela. In such cases, the release of the information requires the client’s separate written consent, which the client may withdraw.
8 Transfer of data outside the EU or EEA
None.
9 Retention period for personal data
The generally applicable retention period for client data is 10 years from the date on which the payment of a benefit ended, which is based on the 6-year retention period specified in the Accounting Act and the time required to deal with possible appeals and recoveries. Information on service providers and interpreters is retained for the duration of the contract and an additional 10 years.
10 Principles of register security
At Kela, data security and protection of personal data are systematically taken into account in all use and handling of information. Kela handles all personal data with data protection in mind and in the manner determined by law.
All persons at Kela who handle personal data sign a confidentiality agreement. The register data are used only by authorised persons who need them to perform their official duties.
11 Right of access to data
According to Article 15 of EU Regulation 2016/679, the data subject has the right to access personal data concerning him or her, i.e. a right to check information concerning the person himself or herself.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
12 Right of correction
According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data concerning him or her.
In the request, they must identify the incorrect information, indicate why it is incorrect and specify how it should be amended.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
13 Right of erasure
According to Article 17 of EU Regulation 2016/679, the data subject has the right to request the erasure of personal data concerning him or her.
This right does not concern personal data that Kela needs in order to carry out its statutory duties.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
14 Right to file a complaint with a supervisory authority
According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
Personal data are handled in the course of providing an interpreting service to and from foreign languages (for example as part of Kela’s customer service). The personal data are handled when booking an interpreter for rehabilitation and functional assessment.
Privacy statement for the interpreting service to and from foreign languages
1 Data controller
The Social Insurance Institution of Finland (Kela)
PL 450, 00056 KELA or Nordenskiöldinkatu 12
00250 Helsinki
020 634 11
http://www.kela.fi/administration
2 Contact person for register-related matters
Luhta Jouni, Pouttu Merja, Sola Tuomas
Tel. 020 634 11 (exchange)
3 Name of register
Interpreting service to and from foreign languages.
4 Purpose and basis for the handling of personal data
Personal data are handled in the course of providing an interpreting service to and from foreign languages (for example as part of Kela’s customer service). The personal data are handled when booking an interpreter for rehabilitation and functional assessment. They are used to provide rehabilitation and to carry out the functional assessment.
Interpretation to and from foreign languages is based on the following laws:
- Section 19 of the Constitution Act
- Section 26 of the Administrative Procedure Act §
- Section 61 of the National Pensions Act §
- Chapter 15, Section 13 of the Health Insurance Act §
- Section 3 of the Rehabilitation Act §
5 Data content of the register
The following data are stored in the register for the interpreting service to and from foreign languages:
- name of client
- name of interpreter
- Oiwa ID code
- language interpreted
- date and time of interpretation
- service in which interpretation is used (customer service, rehabilitation or functional assessment)
- type of interpretation (on-site/remote)
6 Regular sources of data
The customer data stored in the register are retrieved from Kela’s Oiwa system. The interpreter data are obtained from the interpretation provider.
7 Regular disclosure of data
None. However, data may be disclosed to outside service providers contracted by Kela for the purpose of enabling them to provide needed interpretation services. In that case, the data needed to produce the service are disclosed to the providers.
8 Transfer of data outside the EU or EEA
None.
9 Retention period for personal data
Client data are generally retained for 10 years starting from the time the benefit was discontinued. This is based on the six-year retention period specified in the Accounting Act and the additional time that may be needed for appeals and the recovery of over-payments. Data on interpreters are retained for the duration of the contract period and an additional 10 years. The data are confidential.
10 Principles of register security
Kela exercises due care in all its operations and ensures a high level of data protection and data security.
All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.
11 Right of access to data
Under Article 15 of the EU General Data Protection Regulation (EU 2016/679), data subjects have the right to check the data on their person.
Those who wish to check their data must submit a request to Kela.
can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
12 Right of correction
According to Article 16 of EU Regulation 2016/679, the data subject has the right to request the correction of inaccurate personal data.
The request for correction must be submitted to Kela.
The request must specify the following:
- the specific information which is incorrect
- the reason why it is incorrect
- how it should be amended.
can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
13 Right of erasure
Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.
This right does not extend to personal data that Kela needs to carry out its statutory duties.
The request to erase personal data must be made to Kela.
can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA e-service (in Swedish).
14 Right to file a complaint with a supervisory authority
According to Article 77 of the General Data Protection Regulation, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of Kela personal data relating to him or her infringes this Regulation.
Queue management system
1 Data controller
The Social Insurance Institution of Finland (Kela)
PL 450, 00056 KELA or Nordenskiöldinkatu 12
00250 Helsinki
020 634 11
http://www.kela.fi/administration
2 Contact person for register-related matters
Marianne Eliander
Tel. 020 634 11 (exchange)
3 Name of register
Queue management system.
4 Purpose and basis for the handling of personal data
The register is used in Kela’s queue management system to process the personal identity code of customers who use the on-site terminal to register. The handling of the personal data is based on the fulfilment of Kela’s statutory responsibilities.
5 Data content of the register
Data contained by the register:
- service point
- time of arrival
- customer’s personal identity code.
6 Regular sources of data
Data are received from the customers themselves. Customers register at the service point by scanning the barcode on their ID card, driving licence or Kela card on the queue management terminal. The terminal reads the customer’s personal identity code, which is embedded in the barcode.
7 Regular disclosure of data
No personal data are disclosed.
8 Transfer of data outside the EU or EEA
None.
9 Retention period for personal data
Personal data are retained in the queue management system database until the end of the day of visit, and are deleted overnight.
10 Principles of register security
Kela exercises due care in all its operations and ensures a high level of data protection and data security.
All Kela staff members who handle personal data sign a confidentiality agreement. The register data may be used only by authorised persons who need them to perform their official duties.
11 Right of access to data
Under Article 15 of the EU General Data Protection Regulation (EU 2016/679), data subjects have the right to access personal data concerning them. This means that per-sons included in the register have the right to check data concerning themselves.
Those who wish to check their data must submit a request to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA (in Swedish).
12 Right of correction
According to Article 16 of EU Regulation 2016679, the data subject has the right to re-quest the correction of inaccurate personal data.
The request for correction must be submitted to Kela.
The request must specify the following:
- the specific information which is incorrect
- the reason why it is incorrect
- how it should be amended.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA (in Swedish).
13 Right of erasure
Under Article 17 of the General Data Protection Regulation, data subjects have the right to request the erasure of their personal data.
This right does not extend to personal data that Kela needs to carry out its statutory duties.
The request to erase personal data must be made to Kela.
The request can be addressed to Kela's Registry. The contact information of the Registry can be found on Kela’s website at www.kela.fi/administration.
Alternatively, the request can be made by phone or by visiting a Kela customer service point or by sending a message on the OmaKela e-service (in Finnish) or MittFPA (in Swedish).
14 Right to file a complaint with a supervisory authority
According to Article 77 of EU Regulation 2016/679, the data subject has the right to lodge a complaint with the Data Protection Ombudsman, if the data subject considers that the processing of Kela personal data relating to him or her infringes this Regulation.