Description of document publicity

Pursuant to section 28 of the Act on Information Management in Public Administration (9.8.2019, 906/2019), information management entities shall maintain a description for the implementation of document publicity in order to implement the publicity principle (hereinafter the “description of document publicity”). 

The information provided in the description of document publicity helps the public and parties concerned to provide more specific details on their requests for access to official documents as required under section 13(1) of the Act on the Openness of Government Activities. 

The purpose of this description of document publicity is to provide a general description of how the Government ICT Centre Valtori has structured its case register and the information management of its services. 

Valtori’s case register and the information pools for its services consist of datasets accumulated and accrued as a result of activities in two business areas: the establishment and operations of Valtori and the operation of TUVE services. (Act on the Arrangement of the Government’s Shared Information and Communication Technology Services 30.12.2013/1226, Government Decree on the Arrangement of the Government’s Shared Information and Communication Technology Services 20.2.2014/132 and Act on the Operation of the Government Security Network 15.1.2015/10, Government Decree on the Operation of the Government Security Network 27.8.2015/1109.)

In this description, Valtori has divided its data into seven different information pools for the following purposes: 1) case register and information management, 2) human resources management and administration, 3) financial management, 4) procurement, partners and stakeholders, 5) communications, 6) customer relationship management, customer data and service development, and 7) service provision.  

Each information pool is a logical entity. The information pools contain datasets that are categorised by data group and/or register. 

When the datasets were described, some search terms that can be used to retrieve information from the information systems that contain the information pool were listed by way of example. The description of document publicity contains information and instructions on how information can be requested.

The description of document publicity indicates whether the dataset is openly available via a technical interface. “Technical interface” refers to an information transfer solution that enables information to be transferred digitally between two or more information systems.

This description of publicity describes the information pools that, in principle, contain information deemed public on the basis of the Act on the Openness of Government Documents.  

A description of the legislation related to the disclosure of datasets is provided at the end of each information pool.

Valtori’s case register and information management information pool form a logical entity that includes metadata describing the case processing activities. The case registers are registers of pending cases, the phases in the processing of cases, and the related documents. The information in the case register and management information pool is included in the case management systems, records, contract register and document management system, as well as in the store of paper material. 

The case register and information management information pool consists of the following registers and information pool grouped by case entity: 

• Valtori’s case registers, case management systems 
• Records (old)
• Contract register
• Valtori’s document management systems. 

The maintenance of the case register and information management information pool is based on the following regulations:

• Act on Information Management in Public Administration 9.8.2019/906 inter alia sections 25, 26.
• Administrative Procedure Act 6.6.2003/434 inter alia sections 5, 8, 17, 19, 42. 
• Archives Act 23.9.1994/831 inter alia sections 6, 8,16. 
• Act on the Openness of Government Activities 21.5.1999/621 section 18. 
• Act on Electronic Services and Communication in the Public Sector 24.1.2003/13 sections 10–12.
• Government Decree on Security Classification of Documents in Central Government 28.11.2019/1101 section 14.
• Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereafter the “EU General Data Protection Regulation”.
• Data Protection Act 5.12.2018/1050. 

Valtori’s case registers and case management systems 

The following types of information are stored in Valtori’s case registers (cf. records) and case management systems: 

• Name and description of commencing cases
• Person bringing the case, date of arrival of the document or, if the document was prepared by an authority, the date of preparation, as well as the nature of the case 
• Interim actions taken, such as proceedings and requests for clarification and additional information or statements and the related documents
• Date when the document was sent
• Final measures taken in the case and the related documents 

Contract registers

The contracts drawn up by Valtori, contractual amendments and contracts that are no longer in force are registered in case management as well as in the contract register, which stores the following types of information about contracts:

• Name of the contract and description of the context
• Valtori’s case number and contract number, as well as any contract number stated by the counterparty
• Name of the other contracting party or parties (customer or supplier)
• Date and/or signature date of the contract document
• Validity of the contract

Document management systems 

The document management systems are intended for Valtori’s internal use for preparing and storing documents and managing information. They consist of electronic workspaces, which contain document libraries and documents. Valtori aims to save the documentary datasets stored on this document management system in digital format in the case management systems if they were not initially prepared in the case management systems.  

The case register and information management information pool, contract register and document management systems also contain secret information pursuant to the Act on the Openness of Government Activities 21.5.1999/621, section 24(1) inter alia points 7, 17 and 20. 

Valtori’s human resources management information pool consists of datasets in various human resources management registers and information systems. The datasets in the human resources management information pool are also included in the aforementioned Valtori case management systems and in the store of paper material, as well as the document management systems.

Valtori’s human resources management information pool consists of the datasets in the following registers and information systems: 

• Human resources management information system – Finnish Government’s shared human resources system
• Job application and recruitment system – Finnish Government’s shared job application and recruitment service
• HR enterprise resource planning system
• Competence information systems
• Register of matters related to lunch and leisure benefits

Human resources management information system – Finnish Government’s shared human resources system

The human resources management information system is used to store and process the data and datasets needed to handle Valtori’s human resources matters and payroll. 

The information system also stores personal information as referred to in the Personal Files Act (1010/1989) and the Personal Files Decree (1322/1989).

The human resources management information system contains the following types of information:

• Information on current and former employees
• Personal file data
• Information related to the management of employment relationships
• Information related to remuneration 

Job application and recruitment system – Finnish Government’s shared job application and recruitment service

The job application and recruitment system is maintained for the purpose of discharging the state’s duties as an employer. The register is used to prepare job vacancy notices and receive and process job applications, send information to applicants about the application phases and, if necessary, request supplementary information from applicants, process applications in order to fill public offices and positions, and report key indicators on the recruitment of personnel, such as the number of vacancies and the number of applications received for each position.

Job applicants provide information about themselves on the application form and save the information in the register. Applications sent by means other than the job application and recruitment system (such as by post or email) are also stored on this system.  

Datasets in the HR enterprise resource planning system 

The HR enterprise resource planning system stores the service activities and requests of supervisors and personnel in matters related to the employment relationships of the personnel. The system contains certain employment relationship documents and datasets related to recruitment, working hours, secondary occupation notifications and permits, and certificates. The system also contains service activity data and assignments with the Finnish Government Shared Services Centre for Finance and HR Palkeet in HR matters. 

Datasets concerning competences

Datasets concerning personnel competences are stored in the human resources management information system and a separate electronic training system. The human resources management information system is maintained for managing the maintenance of personnel competences, and the separate electronic training system is a tool for learning and competence development. 

The human resources management information system contains descriptions that members of the personnel save concerning their competences and qualifications, as well as the completed diploma and other training information. The system also contains information related to the planning and development of competences and training, as well as monitoring. Some corresponding qualification information is also included in the personal files.  

The electronic training system contains training and teaching materials, as well as user data. 

Lunch and leisure benefit system

The lunch and leisure benefit system for the provision of the supplier’s range of personnel benefits, such as its services related to lunch, cultural and exercise vouchers. 

The system contains the following types of information:

• Orders, preparation, delivery and topping up of lunch and leisure benefit cards 
• Orders and delivery of voucher products 
• Contact related to a product or service ordered by the customer 
• Handling, managing, maintaining and developing the customer relationship 
• Invoicing of products and services 
• Marketing measures to strengthen the customer relationship, such as customer messages and newsletters 

Office visit information

Valtori’s visitor and office spaces use camera surveillance, and visitors’ personal data is entered into the visitor information system. Valtori processes data on the people who visit its offices in order to safeguard Valtori’s personnel, assets and information. The processing of datasets is based on sections 16 and 17 of the Act on the Protection of Privacy in Working Life 13.8.2004/759. 

The lobby and public meeting rooms are also equipped with camera surveillance. In some of these areas, Senate Properties acts as the controller of the data from the camera surveillance system, and their data protection policies are available on the page about Senate Properties as a controller. The camera surveillance system records video but not audio.

The visitor data that is stored includes the visitor’s contact details, which may include the name, organisation, phone number and email address. The event’s subject, timing, venue and host may also be stored, as well as the restaurant orders related to the event.

The publicity and secrecy of the human resources management and administration information pool is determined according to the Act on the Openness of Government Activities 21.5.1999/621. Sections 16 and 17 of the Act on the Protection of Privacy in Working Life 13.8.2004/759 also apply. The disclosure of data is also governed by the EU General Data Protection Regulation 27.4.2016/679, the Personal Files Act 24.11.1989/1010 and the Personal Files Decree 29.12.1989/1322. 

Valtori’s financial management information pool consists of datasets in various financial management registers and information systems. The datasets in the financial management information pool are also included in the aforementioned Valtori case management systems and in the store of paper material, as well as the document management systems.

The financial management information pool consists of the datasets in the following registers and information systems: 

• Financial management system – Finnish Government’s shared financial management system
• Order management and invoice processing system – Finnish Government’s shared order management and invoice processing system
• Travel management system – Finnish Government’s shared information system
• Travel portal 
• Financial and operational planning and monitoring system
• Datasets in the financial enterprise resource planning system

Financial management information system

Valtori uses the financial management information system to store and process the data and datasets required for operational and financial planning, implementing the budget, payment transactions, accounting and monitoring authorisations, as well as productivity and management calculations and the financial statements (State Budget Act 13.5.1988/423 and State Budget Decree 11.12.1992/243). 

The financial management information system includes the following types of information about financial management processes:

• Income processing data
• Expenditure processing data
• Accounting information
• Internal accounting information 

Order management and invoice processing system

The order management and invoice processing system is maintained for the purpose of processing the Government’s orders and invoices. In addition, the documents and datasets from the Government’s human resources and financial management information system are transferred to this system for archiving. (State Budget Act 13.5.1988/423 and State Budget Decree 11.12.1992/243) 

The order management and invoice processing system contains:

• Order data
• Information related to invoices
• Information on the approval cycle for expense receipts 
• Payment information
• Other documents and datasets related to the use of the system
• Human resources management and financial management documents and data transferred from the human resources management and financial management information systems.

Travel management system  

The travel management system is intended for approving, settling and paying the personnel’s travel plans, daily allowances, travel expenses, travel compensation, credit card transactions and fees. 

The following types of information are stored in the travel management system:

• Travel plans and any associated programmes
• Expense and driving information related to travel
• Information on daily allowances
• Travel approval information  
• Travel agency events organised by the travel agency
• Credit card events arranged by the credit card company
• Personal data from the human resources management information system
• Exchange rate data from the bank’s internet service
• Receipt information
• Payment information
• Accounting information

Travel agency reservation system

The travel agency reservation system is intended for reserving travel and hotels. The personnel of the service provider’s contractual customers have access to the information system. 

The travel reservation system contains the following types of information concerning travel: 

• Travel reservations (register of travellers)
• Itinerary, destination and timing 
• Travel schedule 
• Ticket and mode of transport (car, train, aeroplane)
• Information related to hotels
• Expense information for services 

Financial and operational planning and monitoring system

The financial and operational planning and monitoring system is maintained for monitoring and reporting on Valtori’s internal activities. 

The financial and operational planning and monitoring system contains:

• Business accounting transactions (daily and/or monthly reconciliation file) and 
• Personal data, absences, time management events, person-year data and allocation centres for human resources management 

Datasets in the financial enterprise resource planning system

The financial enterprise resource planning system stores the service activities and requests of supervisors and personnel in matters related to financial management. The system also contains service activity data and assignments with the Finnish Government Shared Services Centre for Finance and HR Palkeet in financial matters. 

The disclosure of data in the financial management information pool is governed by the Act on the Openness of Government Activities 21.5.1999/621 and the EU General Data Protection Regulation 27.4.2016/679, as well as special legislation. 

Valtori’s procurement, partner and stakeholder information pool consists of competitive tendering and contract management for procurement processes, as well as the management of supplier and stakeholder information. In addition, the datasets in the procurement information pool are included in the aforementioned Valtori case management systems and in the store of paper material, as well as the document management systems.

Competitive tendering system

The maintenance of the electronic competitive tendering solution is based on the competitive tendering of public purchases, as well as the maintenance and management of the procurement process.

The competitive tendering process includes the datasets belonging to the competitive tendering and procurement process, such as requests for proposals and any associated appendices, participation applications, notices and any associated appendices, proposals and any associated appendices, and procurement decisions and any associated appendices. In addition, the system contains information on pending and completed procurement processes. 

Procurement contract management system

The procurement contract management system is used for information management related to the procurement contracts made with suppliers and the lifecycle management of such contracts.

The procurement contract management system contains information management on the contracts made with suppliers and information related to the lifecycle management of such contracts. The system may contain individual pieces of information about other contracts, such as customer contracts.

Supplier register

Datasets are processed in order to fulfil Valtori’s statutory obligations. Datasets are collected and processed for various supplier management functions. Examples of such functions include supplier contracts and service duties related to supplier’s tasks.  The data on the register is also processed for the purpose of paying suppliers’ fees. 

The supplier register contains the following datasets, among others:

• Suppliers’ contact details: name, email address, organisation, phone number
• Certain information related to payments: The name of the beneficiary (whether a private person or legal entity), along with the beneficiary’s bank account, EDI ID, in some cases also the personal ID code, invoice information, a picture of the invoice and any associated attachments, background information on the payment, such as information on attendees at an event, the supplier’s business ID.
• Information related to contract management: names, email addresses and phone numbers of the contact persons for the contract, as well as the names and contact details of the members of the management and steering groups. 
• Reference requests: email address, organisation, phone number, content of the reference request (note: this information is also included in Valtori’s case management system)

Enterprise resource planning licence management system

The licence management system is maintained for the purpose of managing the software assets of Valtori and its customer organisations. 

The licence management system contains: 

• User data (name, organisation, location)
• Contact details
• The software installed on the user’s workstation
• Data on the use of software
• Information on the licence agreements acquired and the licences conferred, information related to licence management, and allocation information
• Information on licence suppliers and their contact details

The publicity and secrecy of the procurement, partner and stakeholder information pool is determined according to the Act on the Openness of Government Activities 21.5.1999/621. 

The communication information pool is maintained in order to implement Valtori’s communications and the openness of its activities. 

The communication information pool consists of the website, social media channels, intranets, the video editing and distribution system, the newsletter tool and survey systems. In addition, the datasets in the communication information pool are included in the aforementioned Valtori case management systems and in the store of paper material, as well as the document management systems. 

Website

The purpose of use is based on Valtori’s external communications. Personal data may be included in current news releases and the other content or files on the website. 

Users can give feedback and order materials on the website. Datasets are used to respond to feedback that is received and to deliver the ordered materials to the client’s email address.

Data content: “Give feedback” form: the data subject’s email address and the content of the feedback provided. “Order Valtori’s newsletter” and “Order the latest information from Valtori” form: the data subject’s email address.

Social media channels

Valtori provides information about relevant matters, shares news, blogs, recruitment notices, images and relevant links, and engages in discussion about its activities in its social media channels. Valtori creates some of the content that it shares, such as material published on the website, and some of the content is produced by others.

Intranets 

The use of intranets is based on internal communication. The intranets contain Valtori’s internal newsletters, guidelines, event information, files and discussions. The intranets mainly contain Valtori’s own contact details.

Video editing and distribution system

The video editing and distribution system contains recordings of various events and training courses, as well as videos such as a presentation of Valtori and videos on the use of services. Some of the material is for Valtori’s internal use, and some is for customers and other stakeholders. Public videos are also published on Valtori’s website. 

Survey systems 

Valtori uses survey systems to conduct surveys and arrange events among its personnel, customers and other stakeholders. 

The survey systems contain Valtori’s own contact details, as well as the contact details of customers and other stakeholders. Respondents produce content on the system either anonymously or in identifiable form, depending on the content of the survey.

Newsletter tool 

The newsletter tool is used for the page-setting and distribution of Valtori’s newsletters and releases. Public newsletters are also published on Valtori’s website, where users have the option to subscribe to newsletters. The system contains Valtori’s own contact details, as well as the contact details of customers and other stakeholders.

The publicity and secrecy of the communication information systems is determined on the basis of the Act on the Openness of Government Activities 21.5.1999/621. 

The customer relationship management and customer data information pool consists of the information pools of various customer relationship management and customer information systems. The datasets are also included in the aforementioned Valtori case management systems and in the store of paper material, as well as the document management systems.

The customer relationship management and customer data information pools are included in the following systems and registers: 

• User support enterprise resource planning systems 
• Call log and recording register 
• Customer encounter survey and feedback survey systems
• Customer relationship management systems
• Datasets related to the development of services and customer organisations in enterprise resource planning

User support enterprise resource planning systems 

Datasets are processed in order to fulfil statutory obligations. 

The user support enterprise resource planning systems include customer support and regional service support datasets. 

The enterprise resource planning systems process Valtori’s datasets and those of its customer organisations, including personal data, so that Valtori can take measures related to the resource planning and supervision of its employees and customers, implement service requests, respond to incident reports and monitor their implementation. 

User details: name, phone number, organisation, unit in which the person works, cost centre, location, workstation, email, phone number, supervisor, job title, job description, Kieku number/user ID, Virtu ID, and a description of the content of the request. 

Call log and recording register

Valtori logs and records incoming calls to its switchboard and customer service line. The call contact history and recordings are primarily used to improve customer service. The recordings may also be used to train the customer service personnel and to study the service level. Processing is based on the controller’s legitimate interests. 

The register covers the customer support phone service and the switchboard. The information stored is the caller’s phone number, the timestamp of the call, the service number called, and the recording of the call.

Customer encounter surveys and feedback surveys

Customer encounter surveys and feedback surveys are related to the collection and processing of immediate customer service feedback, as well as the evaluation of Valtori’s customer feedback and monitoring of customer satisfaction.

The system contains the following types of information related to surveys and feedback:

• Information on the respondent and the person handling the case
• Grades on a scale from 1 to 10 
• Verbal feedback 

Customer relationship management systems 

Valtori has a legal obligation (1226/2013, 10/2015) to provide its customers with basic information technology and communications services. Customer data is needed in order to provide, develop and charge for these services. 

The basis for processing datasets is the controller’s statutory obligation and legitimate interests. Valtori also invokes the controller’s legitimate interests in its customer communications for the purposes of marketing and monitoring customer satisfaction. 

The datasets in the customer relationship management system are collected and processed for various customer relationship management functions. These include providing and developing customers’ services, customer communications and customer invoicing. 

Contents of the register:

• Customer relationship management: name, job title, communication role, organisation, administrative branch, email address. 
• Customer communications and surveys: name, organisation, email address, information related to customer events such as dietary requirements and the content and timing of events.
• Incident communication: names, email addresses and phone numbers of the customer’s contact persons, as well as incident descriptions.
• Customer invoicing: the name of the invoice recipient (whether a private person or legal entity), along with the beneficiary’s bank account, EDI ID, in some cases also the personal ID code, invoice information, a picture of the invoice and any associated attachments, background information on the payment, such as information on attendees at an event.
• Contract management: names, email addresses, phone numbers and job titles of the customer’s contact persons, as well as the names and descriptions of the contracts.

Datasets related to the development of services and customer organisations in enterprise resource planning

The enterprise resource planning systems contain datasets related to customer organisations and the development of services. Valtori’s own datasets related to operational development are also included in this section. 

The secrecy and disclosure of information in the customer relationship management and customer data information pool are subject to the Act on the Openness of Government Activities 21.5.1999/621 and other special legislation. 

The service provision information pool consists of information and datasets on communication technology services, end device services, telecommunications services, operating services, platform and system services, information security and cybersecurity services, and ICT support services related to integration services. 

Some of the service provision datasets and information are also included in the aforementioned Valtori case management systems and in the store of paper material, as well as the document management systems.

Service management entity for enterprise resource planning systems 

Datasets are processed in order to fulfil statutory obligations. 

The service management entity for enterprise resource planning systems involves processing requests, assignments and queries from Valtori and its customer organisations so that Valtori can take measures related to the resource planning and supervision of its employees and customers, implement service requests, respond to incident reports and monitor their implementation. The dataset contains personal data and contact details. 

User details: name, phone number, organisation, unit in which the person works, cost centre, location, workstation, email, phone number, supervisor, job title, job description, Kieku number/user ID, Virtu ID.

Device details: device details and the related organisational, personal and software details are processed.    

The contents of support requests may include personal data. Registered users can access the open and closed support requests related to them using the service portal in the enterprise resource planning system.

The secrecy and disclosure of information in the service provision information pool are subject to the Act on the Openness of Government Activities 21.5.1999/621 and other special legislation. 

In principle, the Government ICT Centre Valtori does not disclose datasets via technical interfaces. The majority of the datasets consist of information owned by the customer organisations. Valtori processes this data, and the customer organisations act as the controllers.  

Valtori’s own data cannot usually be disclosed via a technical interface for information security reasons. Valtori addresses the disclosure of datasets via a technical interface on a case-by-case basis whenever the need arises. 

Accessibility refers to a set of principles and technologies that must be followed when designing, developing, maintaining and updating digital online services in order to ensure that as many people as possible can use them. 

Valtori aims to guarantee the accessibility of its website in accordance with the Act on the Provision of Digital Services 15.3.2019/306. Valtori develops the accessibility of its website content continuously, thereby making it easier for all people to use the website equally. The accessibility statement for the Valtori.fi website is based on a third-party assessment of whether the website meets the requirements of the Directive (EU) 2016/2102. 

Presenting information requests

Valtori complies with the Act on the Openness of Government Activities, the EU General Data Protection Regulation, the Data Protection Act and special legislation when providing and disclosing data. 

Information on public documents is provided as quickly as possible, and no later than two weeks after the information request is received. If the processing and resolution of the matter requires special measures to be taken or involves an unusually large amount of work, Valtori either provides information on the public document concerned or resolves the case within one month of receiving the information request. 

The processing time for the disclosure of secret information and documents is also one month. Secret documents and datasets are only disclosed in the event that the party requesting the information is entitled to receive secret information in accordance with the law. 

Information requests concerning the contents of an official document or dataset must be sufficiently detailed to enable the authority to identify which document the request concerns (Act on the Openness of Government Activities 621/1999, section 13). If necessary, the authority can help the requesting party to identify the document or information concerned.

Information requests should be sent to Valtori’s registry, where they are recorded in order to monitor deadlines. The registry forwards information requests to the relevant personnel for processing.

• Email: [email protected]
• Postal address: Government ICT Centre Valtori, Registry, Lintulahdenkatu 5, 00530 Helsinki, Finland
• Further information: Data Management Specialist, tel. +358 295 505714

Verification, rectification and erasure of a person’s own data

The Government ICT Centre Valtori collects, processes and maintains various types of personal data (on its personnel and those of its customer organisations) in order to discharge the duties assigned to it by the law. Any person is entitled to view the personal data that is stored about them on Valtori’s systems. In accordance with the EU General Data Protection Regulation 2016/679, data subjects have the rights to:

• check their own personal data
• request the rectification or erasure of their own data
• request the restriction of data processing or object to data processing
• request the transfer of personal data from one system/controller to another
• withdraw their consent if the processing of personal data is based on the data subject’s consent 
• submit a complaint to the Office of the Data Protection Ombudsman if the data subject believes that the applicable data protection legislation has been violated during the processing of personal data concerning them

A person can propose the rectification or erasure of their data if the data contains errors or omissions. The rights to erase data, restrict processing or object to processing do not apply to statutory registers. Regulations, orders and instructions concerning data retention apply to the erasure of data that a public authority accrues in the course of discharging its statutory duties. 

When Valtori is the controller, data subjects should address requests for the verification, rectification and erasure of incorrect data to Valtori’s registry, where they will be recorded in order to monitor deadlines. The registry forwards requests to the relevant personnel for processing.

• Email: [email protected]
• Postal address: Government ICT Centre Valtori, Registry, Lintulahdenkatu 5, 00530 Helsinki, Finland
• Further information: Data Management Specialist, tel. +358 295 505714 and Data Protection Officer, tel. +358 295 505029.

The Government ICT Centre Valtori’s information pools collect the datasets and documents that are accrued, processed, maintained and retained in the course of Valtori’s operations in accordance with laws and regulations. 

Data stored in information pools and registers is retrieved by searching for attributes associated with a person, customer organisation or supplier, such as the name, personal ID code, identifier issued by the human resources management information system, case number (record number), contract number, case or search terms, descriptive data, ticket number or any ID numbers issued by the information system. 

This description of document publicity will be published on Valtori’s website and presented in a manner that takes accessibility into consideration.