Finnish National Gallery’s Privacy policy
Updated 29.3.2022
Data controller and contact details
The controller is the Finnish National Gallery, Kaivokatu 2, 00100 Helsinki, Finland.
For privacy and personal data issues, you can contact us by email at kirjaamo@kansallisgalleria.fi
Processing of personal data by the Finnish National Gallery and its legal basis
The Finnish National Gallery was founded with the Finnish National Gallery Act (889/2013) to strengthen cultural legacy and promote knowledge of art in society. The purpose of the Finnish National Gallery is to maintain and augment its art collection, to conduct exhibition and other art museum activities, and to participate, as an expert in the field of art museums, in the development of the museum sector (Finnish National Gallery Act, Section 2). Personal data are processed in the museums and other units of the Finnish National Gallery in order to perform the above-mentioned tasks provided for by law.
Personal data submitted to the Finnish National Gallery are processed under EU regulation 2016/679 (GDPR) and the Finnish Personal Data Act (1050/2018).
In order to fulfil their duties, the units of the Finnish National Gallery process personal data when they
- augment and maintain the art-historical databank, a research archive that contains documents, images, audio-visual recordings, newspaper clippings, printed matter and sketches of artists and the art world, in both analogue and digital formats;
- serve researchers and clients by publishing and making available archival materials, within the limits set for their use in current legislation and donation agreements;
- collaborate with professional and other communities;
- organise art exhibitions and other events such as seminars, events and art education projects;
- provide a range of customer services to the public;
- communicate its activities to stakeholders and market their services to audiences.
As a cultural heritage institution, the National Gallery processes personal data as part of its museum and archive records. The protection of cultural heritage data is subject to a number of specific provisions in EU and national legislation that aim to safeguard the freedom of research, information, the arts and communication. As a consequence, certain exceptions apply to the processing of personal data and, for example, not all data subjects’ rights extend to cultural heritage material. The documentation generated in conjunction with exhibition activities can be accessioned to cultural heritage materials.
In its operations, the National Gallery and its museums maintain close contacts with visual arts professionals, other stakeholders and the public. The museums serve their audiences and other stakeholders by providing information about their exhibitions, research materials, events and other activities and services. These operations require that the museums process personal data and establish and maintain personal data records. Personal data are also used to target more specific information pertaining to various client groups.
The legal grounds for processing personal data are those listed in Article 6 of the EU General Data Protection Regulation. These include processing or accessioning to a register of personal data on the basis of consent, contract or legal obligation. It may also be necessary for reasons of public interest – particularly in the case of cultural heritage materials, where documents containing personal data accumulate in the archival collections of a library or archive serving the public interest. All processing of personal data is subject to impact assessment related to requirements of necessity and proportionality.
The Finnish National Gallery processes a large amount of personal data in the pursuit of the legitimate interest of the National Gallery or of an individual involved in its activities, as stipulated in Article 6 of the GDPR. In such cases, a customer relationship or other relevant relationship exists between a museum and the data subject that justifies the processing of personal data for the purpose of enabling communication between the parties. The National Gallery considers it important to disseminate information about its operations to artists, partners and customers, and to facilitate research in the visual arts. Appropriate exchange of information and contacts between the above-mentioned groups is important for the operation of the National Gallery and its museums.
How personal data are collected
The data are either provided by the data subject, obtained and collected during the planning and implementation of operations, recorded in the course of documentation or obtained from various public sources.
Cultural heritage materials with its personal data also accumulate in conjunction with research and donations of archives. Art historical and other research material do not contain any restrictions pertaining to the content of the data.
What data are collected
In the course of performing its above-mentioned tasks, the Finnish National Gallery collects the following types of personal data:
1. Information provided by individuals to the National Gallery:
- Name or pseudonym
- Email address and other contact details
- Other personal information about the user, such as date of birth
- Permissions, consents and information about the data subject’s language or other similar choices
- Interests, preferences and thematic priorities
- Information collected in research and surveys
- Customer feedback
Other information provided by the data subject or otherwise disclosed, such as information collected from external sources.
2. Data observed and derived from the use of the Finnish National Gallery website:
- Data collected by online analytics systems
- Customer communication data; e.g., information accessed through links
- Website URL from which the user was redirected to the National Gallery website
- Device identifiers, such as device model and unique device and/or cookie identifier
- Data collection channel: browser, mobile browser, application and browser type
- IP address
- Device operating system
- Session ID, time and duration of session
- Location data
- Information associated with the user, based on the user’s history of use of the National Gallery’s services, derived from observed use and/or information provided by the user, such as demographics, interests and other user categories.
3. The Finnish National Gallery collects a wide range of data on art history and phenomena in the world of art, which also include personal data.
This may include special categories of personal data. In conjunction with the organisation and cataloguing of records, the National Gallery assesses whether the personal data records have value pertaining to research or cultural heritage that would warrant its permanent preservation; unnecessary personal data records are removed.
How personal data is stored
We use appropriate physical, technical and administrative safeguards to protect personal data against misuse. The data is stored on secure servers, accessible only to designated persons. Access to systems containing personal data is limited only to legitimate need.
The Finnish National Gallery maintains valid cooperation agreements with partners as stipulated by the GDPR. This ensures secure and appropriate use of personal data, including in situations where partners have access to personal data.
The National Gallery stores all personal data in accordance with applicable law and only for as long as necessary to fulfil the purposes set out in this Privacy Statement. Once the grounds for processing the personal data have expired, the data is deleted.
- As a rule, personal data in marketing and communications are kept for two years.
- Visitors’ personal data are kept for two years as a rule as well.
Disclosure of personal data
In principle, personal data are not disclosed outside the Finnish National Gallery. The exceptions to this are images used for journalistic and/or other purposes mentioned in the GDPR and disclosures required by mandatory legislation.
Cultural heritage materials, such as art historical and cultural historical materials are available to researchers and others who require access to such materials. They are, for the most part, outside the scope of data protection.
Right to inspect and rectify personal data
Under the law, individuals have the right to review what data has been collected about them. They also have the right to request the rectification or deletion of inaccurate, incomplete, unnecessary or outdated personal data.
A request for review of personal data can be made in person using a form available at the customer service desks of the Finnish National Gallery museums (Ateneum Art Museum, Museum of Contemporary Art Kiasma, the Sinebrychoff Art Museum). A valid form of identification (passport, driving licence, identity card) must be presented.
A request for personal data review can also be made by submitting a Personal Data Access Request Form by post (address: Kansallisgalleria, Kirjaamo, Kaivokatu 2, 00100 Helsinki, Finland) or by email to kirjaamo@kansallisgalleria.fi. For identification purposes, you must append a copy of a valid form of identification (passport, identity card, driving licence).
The EU General Data Protection Regulation contains restrictions on the rights of data subjects when personal data are processed for archiving purposes in the public interest. This applies to the cultural heritage materials held by the Finnish National Gallery. For instance, research materials relating to art history and cultural history are excluded from the right to access personal data; nor is it possible to request rectification, deletion or restriction of the personal data they contain.
Individuals can prohibit the National Gallery from using personal data for direct marketing, customer satisfaction and other surveys. However, the National Gallery may continue to send them notifications about its services, such as information about changes to and failures and disruptions in the National Gallery’s services.
The data subject has the right to lodge a complaint with the supervisory authority, which is the Data Protection Ombudsman.
Changes to the Privacy Policy
The Finnish National Gallery is constantly developing its operations. Changes to the Privacy Policy may be made from time to time and may be made without prior notice. Changes may also made because of new or amended legislation. In such a case, we will inform you about Updates to this Privacy Policy by appending a notification to the beginning of this statement.
This Privacy Policy is a description of data protection principles, practices and personal data records of the Finnish National Gallery. Additionally, data protection clauses relating to specific operations may describe in more detail the personal data records of the National Gallery and their contents on a service-specific basis.