Processing of personal data is based on the EU General Data Protection Regulation, the controller's legal obligation under Article 6 (1) and the role of public authority in the public interest.
Processing of special categories of personal data is based on the EU's general data protection regulation, the consent of the data subject under Article 9 and laki Euroopan unionin ja kansallisen oikeuden rikkomisesta ilmoittavien henkilöiden suojelusta 30 § [The Finnish national law of the protection of whistleblowers 30 §].
University of Lapland is the data controller. The purpose of the processing of personal data is to enable the use of a Whistleblower system that enables University of Lapland's employee, former employee or other person to report a detected crime, violation, misconduct, other act or omission. The notification and related personal data will be deleted when the notification is no longer relevant to the legal claim. The notification will be removed from the Whistleblower system in 5 years. Personal data will not be transferred outside the EU or the EEA. The rights of the registered person depend on whether the registered person is the notifier or the object of the notification. When the registrant is a notifier, he or she has the right to get access to the data and request correction of his or her data. When the registrant is the subject of the notification, he or she has the right to get access to the information when the processing of the case has ended and if providing the information does not cause harm.