Finnish Act on the Secondary Use of Health and Social Data (552/2019)

Comprehensive framework governing the use of health and social care data for secondary purposes including AI development and research. Establishes strict controls for processing health data in AI applications, requiring specific permits and ethical reviews. Includes requirements for data minimization, pseudonymization, and mandatory impact assessments for AI systems using health data.

JurisdictionFinland
CategoryHealthcare
StatusActive
Latest development

Analysis

Key Requirements

The Finnish Act on the Secondary Use of Health and Social Data (552/2019) establishes a comprehensive framework for utilizing health and social care data for secondary purposes. Key requirements include:

  • Centralized permit authority: Findata was established as the national permit authority for granting access to health and social data for secondary use[1].
  • Permitted secondary uses: Data can only be used for specific purposes like scientific research, statistics, development and innovation, education, and knowledge management[2].
  • Secure processing environment: Data must be processed in a closed, secure environment with access monitoring[3].
  • Data minimization: Only the minimum necessary data should be used for the specified purpose[4].
  • Ethical review: Projects using sensitive health data may require review by an ethics committee[5].
  • Impact assessments: Mandatory data protection impact assessments for high-risk data processing activities[6].

Compliance Challenges

Organizations face several challenges in complying with the Act:

  • Complex data integration: Combining data from multiple sources while ensuring data quality and compatibility[7].
  • Ensuring proper anonymization: Balancing data utility with privacy protection when anonymizing or pseudonymizing data[8].
  • Implementing secure environments: Setting up and maintaining compliant data processing environments that meet Findata's strict security requirements[9].
  • Navigating permit processes: Understanding and fulfilling all requirements for data access permits, which can be time-consuming[10].

Implementation Best Practices

To implement the Act effectively, organizations should:

  • Conduct thorough data mapping: Identify all relevant data sources and flows within the organization.
  • Implement robust data governance: Establish clear policies and procedures for data handling, access, and security.
  • Invest in secure infrastructure: Implement or utilize certified secure processing environments that meet Findata's requirements.
  • Train staff: Ensure all personnel handling health data are trained on compliance requirements and best practices.

Recent Updates

As of February 2025, there have been no major recent updates to the Act. However:

Related Regulations

The Act interacts with several other regulations:

  • EU General Data Protection Regulation (GDPR): The Act complements and specifies GDPR requirements for health data processing in Finland.
  • Finnish Data Protection Act: Provides the national framework for implementing GDPR in Finland.
  • Biobank Act: Regulates the collection and use of biological samples, often in conjunction with health data.

Industry Impact

The Act has had significant impacts on the healthcare and research sectors:

  • Accelerated research: Streamlined access to comprehensive health data has facilitated more efficient medical research.
  • Innovation boost: Easier access to health data has spurred development of new digital health solutions and AI applications.
  • International collaboration: Finland's progressive framework has attracted international research partnerships and investments in the health sector.

Sources

[1]: https://findata.fi/en/ [2]: https://stm.fi/en/secondary-use-of-health-and-social-data [3]: https://findata.fi/en/services-and-instructions/legislation/ [4]: https://tietosuoja.fi/en/processing-of-special-categories-of-personal-data [5]: https://tenk.fi/en/ethical-review-finland [6]: https://tietosuoja.fi/en/data-protection-impact-assessment [7]: https://www.aimspress.com/article/doi/10.3934/aci.2024009?viewType=HTML [8]: https://www.dittmar.fi/insight/european-pharmaceuticals-legislation-in-transition/ [9]: https://arxiv.org/pdf/2412.06800 [10]: https://www.roschier.com/newsroom/secondary-use-of-health-data-the-new-finnish-act : https://www.uef.fi/en/library/act-on-the-secondary-use-of-health-and-social-data : https://www.medizininformatik-initiative.de/sites/default/files/2020-10/2020-10-26__National%20Strategies%20For%20Making%20EHR%20Data%20Available%20For%20Secondayry%20Use%20in%20Research_Saara%20Malkam%C3%A4ki.pdf : https://findata.fi/en/services-and-instructions/ : https://findata.fi/en/services-and-instructions/legislation/ : https://stm.fi/en/secondary-use-of-health-and-social-data : https://findata.fi/en/services-and-instructions/legislation/ : https://stm.fi/en/secondary-use-of-health-and-social-data : https://gdpr-info.eu/ : https://tietosuoja.fi/en/data-protection-act : https://www.finlex.fi/en/laki/kaannokset/2012/en20120688 : https://www.aimspress.com/article/doi/10.3934/aci.2024009?viewType=HTML : https://www.dittmar.fi/insight/european-pharmaceuticals-legislation-in-transition/ : https://www.roschier.com/newsroom/secondary-use-of-health-data-the-new-finnish-act

Recent developments

  • — Findata says the Act on the Secondary Use of Health and Social Data was amended in 2025, with the remaining amendments entering into force on 1 May 2026. The changes are described as streamlining data use, clarifying authority responsibilities, and harmonizing practices. (source)
  • — Fimea announced that, from 1 January 2026, the Secondary Use Act no longer applies to obtaining register data for clinical trials, clinical investigations of medical devices, and performance studies of in vitro diagnostic medical devices. This is a major policy change affecting clinical research workflows in healthcare. (source)
  • — The University of Eastern Finland notes that, under the 2026 legislative amendment, the Secondary Use Act no longer applies to registry data processing in clinical research. It also says data requesters may now choose between a centralized Findata application and separate applications to each organization. (source)
  • — Findata states that the Act was amended in 2025, with amendments aimed at streamlining data use and clarifying authority responsibilities. This suggests an ongoing regulatory simplification effort affecting secondary use permissions and governance. (source)
  • — Findata says section 55 entered into force at the start of 2024, allowing individuals to be contacted when register-study findings are clinically significant and action could prevent health risks or improve treatment. The provision also allows people to set a contact prohibition via public healthcare units or My Kanta. (source)
  • — The Finnish Government extended the transition period for secure user-environment requirements to 1 May 2022. The same announcement also moved the rules on significant clinical findings to apply from 1 January 2024. (source)
  • — GA4GH summarized that, from 1 May 2021, secondary-use data must be processed only in secure information environments approved in Finland, generally the environment provided by Findata. The report also noted that exporting or downloading raw data is not allowed outside those environments. (source)
  • — GA4GH reported that, from 1 April 2020, Findata became responsible for decisions when data are requested from more than one organization and for all requests involving private-sector health and social care data. This centralized permitting model was a key operational change for researchers and data holders. (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates