How to apply for data permit from Kela

Permission to use Kela’s register data is applied for on an electronic form. All applications must include the following documents:

• data permit application (Word)
• an updated research plan
• specification document (Word) for the data request
• privacy statement (Word) (either an internal statement of the applicant organisation or the form linked here)
• publication plan
• confidentiality agreement (Word) signed by all who will have access to the data
• invoicing details (Word).

A statement by a research ethics committee should be provided where appropriate.

Send the application and the enclosed documents to the Statistical Information Service electronically to the address tietoaineistot@kela.fi. Name and number the documents clearly so that the application can be processed speedily.

Check that the application includes the following information:

• the principal research institute and investigator as well as other persons who will have access to the data
• where the study is to be carried out, how the confidentiality of the information is ensured and how the information is to be destroyed
• environment in which the data will be used
• schedule of the research
• sources of financing for the research and any ties or conflicts of interest of the research team
• the type of information requested from Kela and the period for which it is requested
• the purpose for which the data will be used in compliance with the Act on the Secondary Use of Health and Social Data
• other information used in the research.

A confidentiality agreement must be signed by the principal investigator and by researchers who handle encoded or pseudonymised data. The data is considered to constitute a register of personal data as long as it remains possible to recognise individuals from the data either directly or indirectly or as long as the code key for the data is retained.

If the purpose is to use register data available from Kela in combination with information gathered directly from the subjects (by means of interviews or surveys), either the consent form signed by the subjects or the information notice must state clearly what types of data (e.g., data on purchases of prescription medicines) obtained from Kela will be combined with such information.

A model consent form and information notice must be enclosed with the application. The consent form must conform to the General Data Protection Regulation (GDPR). Plan the research project carefully in advance so that you can request consent that covers the whole research project.

Change in the research team:

Permission must be obtained from Kela to add a new investigator to the research team. To request the permission, send the following documents to Kela:

• data permit application (Word)
• copies of any prior permits obtained
• a confidentiality agreement (Word)
• an up-to-date privacy statement (Word)
• invoicing details (Word).

Expansion of the data file:

It is possible to apply for an expansion of the data file in order to add contents or topics not covered by the original permit. The application must describe the new data to be added. Send the following documents to Kela:

• data permit application (Word)
• copies of any prior permits obtained
• an updated research plan
• an up-to-date privacy statement (Word)
• a specification document (Word) for the data request
• invoicing details (Word).

In accordance with the Act on the Secondary Use of Health and Social Data, Kela will only release the data for use in a secure and audited environment. Also, permit holders must transfer any data previously released by Kela for research purposes to the same secure and audited environment.

Database of secondary-use environments (valvira.fi)

Extension of the permit:

Data permits granted by Kela are valid for a specified period of time (up to 5 years from the date of the letter of permit). If you wish to extend the permit, send the following documents to Kela:

• data permit application (Word)
• copies of any prior permits obtained
• a rundown of the various stages of the research project and the publications emerging from it, a statement explaining how the specified requirements to qualify for the permit are being met, and a schedule for the remaining part of the research
• a list of participating investigators and other persons who process confidential research materials
• an up-to-date privacy statement (Word)
• invoicing details (Word).

In accordance with the Act on the Secondary Use of Health and Social Data, permit holders must transfer any data previously released by Kela for research purposes to the same secure and audited environment.

Database of secondary-use environments (valvira.fi)

Send the application and the enclosed documents to the Statistical Information Service electronically to the address tietoaineistot@kela.fi. Name and number the documents clearly so that the application can be processed speedily.

The time required to review the research permit application depends on the clarity and accuracy of the information and statements submitted. The process can be expedited by ensuring that all application documents are completed carefully and are accompanied by all necessary supporting documents. Applications should be submitted well in advance of the start of the research.

Applicants are notified of the outcome of the review as soon as possible and in any event within three months of the date on which the full application was received by Kela.

Having to contact the applicant for further information will delay the processing of the application. An exact specification of the data is also necessary in order for Kela to be able to provide a cost estimate for the information retrieval.

Fee schedule for research data permits:

• New permit or permit covering a large dataset: EUR 1,000
• As above except if related to a thesis: EUR 150
• Extension of permit or addition of new members to the research team: EUR 300.

The prices are exclusive of and exempt from VAT.

The fees charged for permit decisions and information retrieval are based on the Act on Criteria for Charges Payable to the State (150/1992).

Following a favourable decision, Kela will retrieve the requested data. The retrieval schedule depends on the number and extent of currently pending requests. After retrieval, Kela keeps the data related to the study on file for one year, unless otherwise separately agreed on with the applicant. Kela will only release data for use in a secure and audited environment designated by the applicant.

During the processing of the permit, Kela provides the applicant with a cost estimate for the work required to retrieve the requested data. The price for the retrieval is EUR 138 per hour (VAT 0%).

Kela is responsible for ensuring that the data comply with the specification document drawn up on the basis of the data request. Kela corrects errors in the data without charge, if the requester reports the error in writing within 3 months of gaining access to the data. Kela assumes no responsibility for any errors in the source data. Kela assumes no responsibility for errors or delays caused by the requester’s failure to discharge agreed responsibilities.

Kela has the right to outsource tasks specified in the request to third parties. Kela assumes responsibility for all such tasks as if they were sourced internally. Kela will not release data if doing so would infringe upon confidentiality provisions governing such data or would be otherwise unlawful.

Kela assumes no responsibility for errors, delays or indirect damage caused by a force majeure event. Kela’s liability for damages does not extend beyond the agreed price for the service that resulted in the damage. The limitation of liability does not apply in case of any damage caused by Kela due to wilful or gross negligence.

Please read the following relevant Acts that govern the secondary use of personal data in healthcare and social services:

• Act on the Secondary Use of Health and Social Data 552/2019
• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR, eur-lex.europa.eu)
• Data Protection Act 1050/2018 (finlex.fi)
• Act on the Openness of Government Activities 621/1999 (finlex.fi)

• Findata (findata.fi)
• Office of the Data Protection Ombudsman (tietosuoja.fi)