In late November, the Finnish parliament approved the reform of the Finnish Act on Secondary Use of Social and Health Data (552/2019) (the “Secondary Use Act”). The reform aims to address certain criticised shortcomings in the current legislation, with the general objective of fostering the secondary use of health and social data in research and development. The revisions will, for most parts, be applied as of 1 May 2026.
The Secondary Use Act has initially entered into force in May 2019 and lays out rules on the use of social and health data for secondary purposes, such as statistics, scientific research, development and innovation, education, policy-making and regulatory activities by public authorities. The newly voted reform stems from the feedback of several stakeholder groups, which have criticised the Secondary Use Act as being unclear in relation to other regulations and troublesome to apply in practice. The reform addresses especially the topics of application process, data permits, anonymisation, international R&D cooperation, costs and the applicability of the Secondary Use Act in clinical research.
Application process and data permits
Current situation: The Social and Health Data Permit Authority (“Findata”) processes all data permit applications when data is applied from several public data controllers, the private sector or Kanta Services (nationwide digital services storing citizens’ social welfare and health care data). In addition, the compilation and preprocessing of data is also the responsibility of Findata. In practice, only data applications targeted to data, which is held by one specific public organisation, can be processed by the organisation in question. All applications regarding access to aggregated data are processed by Findata. This approach, in which most of the application process is centralised to Findata, has been criticised for being too slow and thus creating bottlenecks to the data access.
After the reform: In the revised form of the Secondary Use Act an applicant may, in cases, where the applicant requests data from several public data controllers decide whether to submit its data permit application centrally to Findata or separately to the public data controllers. Further, certain predefined public authorities, such as the Finnish Institute for Health and Welfare (“THL”) or the Social Insurance Institution of Finland (“KELA”), could compile and preprocess (including, for instance, anonymise or pseudonymise) the data requested from several organisations. Moreover, public data controllers may, in addition to Findata, process applications for aggregated data.
Practical benefit: The described measures are aimed to facilitate the data access and make the process faster and smoother for all involved. Ideally, researchers and organisations would experience faster data access as they could choose the most efficient route for their specific needs, potentially reducing waiting times notably. For instance, a researcher needing data from several wellbeing services county may address the data permit applications directly to such wellbeing services counties, rather than being obliged to go through Findata.
Anonymisation
Current situation: Findata is mainly responsible for the anonymisation of both the disclosed data and the outcome of the secondary use.
After the reform: In addition to the above-described changes regarding the possibility of anonymisation taking place already at the data source, the process for anonymisation of results will change too. When the results are extracted from the secure processing environment, the data recipient will be responsible for the anonymisation of the results, although it can request support from Findata. The anonymised results may, under certain conditions, be disclosed outside of the secure processing environment. Findata may issue guidelines on the anonymisation of results to ensure the harmonisation.
Practical benefit: Both data sources and data recipients will have more control over the anonymisation process, potentially speeding up the timelines.
International R&D cooperation
Current situation: The Secondary Use Act has been criticised to limit the possibilities of international research and development cooperation as there are currently no secure processing environments fulfilling the requirements of the Secondary Use Act outside of Finland. In practice, this has proven an obstacle for researchers in participating in international R&D projects in which compilation of Finnish and non-Finnish datasets are required.
After reform: The revised Secondary Use Act includes a mechanism for exceptions in this respect. Based on a case-by-case risk assessment process, Findata could give a permission to process the data in another environment.
Practical benefit: After the reform, a Finnish researcher could potentially participate in an international research process in which the data is processed abroad in an environment held by a well-established and trustworthy university or university hospital.
Fees
Current situation: The fees related to the secondary use have been criticised as being high and multiple, and the invoicing process complex.
After the reform: The revised Secondary Use Act expressly provides that the fees must be transparent. The data recipients will still pay to Findata e.g. for the authorisation process, preprocessing of disclosed data and/or the use of the secure data processing environment. Further, the data controller disclosing the data will directly invoice the recipient, and the invoicing will no longer be done through Findata.
Practical benefit: The reform aims to make the fees more transparent and the invoicing process more straightforward. However, the revision does not as such target the fee level.
Clinical research
Current situation: The application of the Secondary Use Act to clinical research under the Finnish Act on Clinical Trials on Medicinal Products, the Finnish Medical Devices Act and the Finnish Medical Research Act has been unclear.
After the reform: The revised Secondary Use Act will expressly provide that it is not applied to processing of personal data in the context of clinical research. Further, in connection with the revision of the Secondary Use Act the said acts regulating clinical research will be amended to include relevant provisions concerning the conditions under which processing the relevant personal data is allowed.
Practical benefit: Clinical trials will thus no longer face uncertainty about which regulatory framework applies, streamlining compliance and reducing administrative burden. These provisions take effect on 1 January 2026, four months earlier than the reform in general.
Key takeaways
The reform is a welcomed revision of the Secondary Use Act and will hopefully bring some much-awaited improvements by making application processes faster and international cooperation easier. It is good to keep in mind that the Secondary Use Act will eventually in the near future be further amended or partly revoked in connection with the national implementation of the European Health Data Space Regulation (EU) 2025/327 (the “EHDS”) which will set out EU-wide standards and requirements for, inter alia, secondary use of health data. The EHDS is already in force but will only be applicable after a transition period. The provisions regarding the secondary use will be applied as of March 2029 (and only as of March 2031 for certain data categories).
Contact authors
