Purpose of the processing of personal data and the legal basis for the processing
The Bank of Finland uses in its communications the following social media channels:
- X
- Facebook
- Instagram
- LinkedIn
- YouTube
When using the social media channels, the Bank of Finland processes information of other social media users, which also includes personal data, as an essential element of social media is that content is published there and it is possible to react to content. The personal data of social media users areprocessed to analyse the Bank of Finland’s visibility on social media, the success of social media posts, the penetration of the Bank of Finland's main messages and the volume, tone and level of social media conversations about the Bank of Finland. The analyses are used in communications to create a snapshot of the situation, develop communications and support action recommendations/decision-making for management and departments.
The basis for processing the personal data of social media users for the aforementioned purposes is that communications on social media and evaluation of communications is necessary for the Bank of Finland’s performance of tasks in the public interest.
The Bank of Finland maintains a list of Bank of Finland staff on X to show which Bank of Finland experts are communicating on X. The maintenance of data on the list is based on the consent of the said experts.
Categories of data subjects and categories of personal data
Categories of data subjects:
- Users of X, Facebook, Instagram, LinkedIn and YouTube who comment, share or otherwise react to posts on the Bank of Finland’s social media accounts
- Users of X, Facebook, Instagram and LinkedIn who tag the Bank of Finland in their social media posts or use subject tags monitored by the Bank of Finland
- Those who have registered to the list of Bank of Finland staff on X
The personal data processed are:
- Names/screen names of users of X, Facebook, Instagram, LinkedIn and YouTube, comments, sharings and other reactions to posts on the Bank of Finland’s social media accounts, posts mentioning the Bank of Finland or the Bank of Finland’s subject tags
- The X usernames of those who have registered to the list of Bank of Finland staff on X
The personal data are obtained from the data subjects themselves on social media services or from Meltwater, which produces and sells social media analysis reports.
Recipients or categories of recipients of the personal data
The Bank of Finland does not, as a rule, disclose the data. The personal data may be disclosed in possible requests for information insofar as the information is public on the basis of the Act on the Openness of Government Activities or the party requesting the data otherwise has the right to receive the data.
The following processors are used for the processing of the personal data
- IT service providers
- communications service providers
- providers of publicity and social media analysis services
Joint controllers
The Bank of Finland is a joint controller with Meta Platforms Ireland Limited ("Meta") with regard to the Facebook community pages. When a Facebook user comments, shares or otherwise reacts to content on the Bank of Finland’s Facebook community pages, the Bank of Finland and Meta process the personal data together in order to develop the community page and services. An Addendum (Facebook Controller Addendum), which specifies the responsibilities of the Bank of Finland and Meta for complying with their obligations under data protection regulations, has been prepared for the joint register. In the Addendum, it has been agreed that the Bank of Finland will provide these data and Meta is obliged to enable the data subjects to exercise their rights under Articles 15–20 of the EU General Data Protection Regulation (GDPR) in relation to personal data stored by Meta after joint processing. The information required by Article 13(1)(a) and (b) of the EU General Data Protection Regulation, further information on Meta’s processing of personal data and also on the legal basis on which Meta Ireland relies and the ways in which data subjects can exercise their rights against Meta Ireland, is available in Meta’s Privacy Policy at: https://www.facebook.com/about/privacy.
The Bank of Finland is a joint controller with LinkedIn Ireland Unlimited Company (“LinkedIn”) with regard to the LinkedIn community page. When a LinkedIn user visits, follows, comments or otherwise reacts on the Bank of Finland’s LinkedIn page, the Bank of Finland and LinkedIn process the personal data together in order to develop the LinkedIn page and services. An Addendum (LinkedIn Pages Joint Controller Addendum), which specifies the responsibilities of the Bank of Finland and LinkedIn for complying with their obligations under data protection regulations, has been prepared for the joint register. In the Addendum, it has been agreed that LinkedIn is responsible for complying with obligations under EU data protection regulations, including informing LinkedIn users and enabling data subjects to exercise their rights. More information about the use of LinkedIn personal data and ways for data subjects to exercise their rights is available at: https://www.linkedin.com/legal/privacy-policy
Notification of possible transfer of personal data to a third country or an international organisation
Data on social media are accessible from outside the EU and EEA. The Bank of Finland does not, as a rule, transfer the personal data included in analysis reports outside of the EU or the EEA. In individual cases, however, processors of the personal data may have access to reports or presentations from outside the EU or EEA in connection with support and maintenance activities. If the data are transferred outside of the EU or the EEA, an adequate level of protection of personal data is ensured as required by data protection legislation, for example by transferring data to a country where, by decision of the European Commission, an adequate level of data protection is ensured or using standard contractual clauses approved by the European Commission.
Period for which the personal data will be stored or the criteria used to determine that period
The data contained in analysis reports are retained for 10 years. Presentation material related to analysis reports are retained for 6 years. Data regarding those registered in the list of Bank of Finland staff on X are retained until the person requests that they be removed from the list or stops working in the service of the Bank of Finland.
General description of technical and organisational security measures
In order to protect the personal data against unauthorised access, disclosure, destruction or other unlawful processing, the personal data are processed in systems that have been protected with appropriate technical data protection solutions, taking potential risks into consideration. Manual material is located in premises to which unauthorised persons are prevented from accessing. Only those employees who need to process the personal data in order to perform their duties have access to the personal data being processed.
Rights of data subjects
The data subjects have the right:
- to request from the controller access to the personal data concerning them as well as the right to request the correction or erasure of such data or a restriction of processing or to object to processing as well as the right to transfer data from one system to another.
- insofar as processing of the personal data is based on consent, to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
- to lodge a complaint about the processing of the personal data with the supervisory authority.
Statutory or contractual requirement to provide data and consequences of failure to provide such data
It is not possible to add a person to the list of Bank of Finland staff on X if the person does not provide their X username.
