Data privacy notice – Video surveillance
Data privacy notice updated 14.10.2026
Data controller
University of Oulu
Pentti Kaiteran katu 1, Linnanmaa
P.O. Box 8000
90014 University of Oulu
Phone +358 294 48 0000
Unit in charge of the processing
University Data Protection Officer:
dpo(at)oulu.fi
Purpose of processing personal data and legal basis for processing personal data
Purpose of processing personal data
The purpose of video surveillance is to prevent criminal activity and damage to property located in the University’s public, teaching and equipment facilities, to determine liability for any damage caused, and to prevent and investigate other infringements.
The University of Oulu's recording camera surveillance is indicated at its entrances. There are surveillance cameras in the university buildings' entrances, lobbies, electronically supervised examination facilities, IT class and equipment facilities and in the immediate vicinity of the buildings.
Legal basis for data processing
- The controller's legal obligation
-
The processing of personal data is based on legislation concerning the University of Oulu. The purpose of camera surveillance is to prevent crimes and damages affecting the university's property in its public, teaching and equipment facilities, to investigate the liability for the damage caused, and to prevent and investigate other violations.
- The legitimate interests of the controller or a third party
-
The processing of personal data is based on university's legitimate interests. The purpose of the surveillance is to monitor the safety of the premises and maintain order, thus ensuring and increasing the safety of staff and students as well as persons visiting or working at the university's premises. Therefore, the legitimate interest is balanced for all parties.
Personal data to be processed
Recipients or categories of recipients of personal data
The video can only be viewed by the employees of the university and the partner providing security services whose duties include monitoring the security of the property and the system administrators for installation, maintenance and research purposes.
Access to the recordings is restricted and can only be viewed by the system administrator and their deputies, the University of Oulu security team and the employees of the security services; when separately agreed, the representatives of the units of the University of Oulu can also access the video. For other persons, the person responsible for the register determines on a case-by-case basis who the recording can be displayed to.
Information may be disclosed to authorities (the police) to the extent deemed necessary if the information is or is suspected to be related to vandalism or a criminal offence.
Information of transfers of personal data to third countries or international organisations
Data are not transferred outside the EU and EEA or to an international organisation.
Information of data storage time
The retention period for the video recording is basically thirty (30) days after the data is collected. Data is destroyed by storing new data on top of it. Data is accessed by printing from a hard disk. If, during the retention period, a notification of damage, other offence or infringement is received, the record is kept for the time that is needed to investigate the incident. If the information is or is suspected to be related to an offence, vandalism or infringement, it is kept for the time that is needed to resolve the incident.
Data subject rights
You have the following rights as a data subject:
- Right to access your data
- Right to have inaccurate data corrected (make sure to keep your contact information up to date)
- In certain situations, the right to have data erased ("right to be forgotten")
- In certain situations, the right to restriction of processing
- In certain situations, the right to object to processing
- In certain situations, the right to have data transferred from one system to another if the processing is based on consent or agreement and is performed automatically.
Please note that the applicability and scope of your above-mentioned rights will be specified on a case-by-case basis in accordance with the EU General Data Protection Regulation, depending on e.g. the grounds for processing the data, and that you do not have the above-mentioned rights in all cases.
How can you exercise your rights?
If you have questions concerning your rights, you can contact the data protection officer or unit’s contact person.
If you wish to exercise your rights mentioned above, please send your request to: kirjaamo(at)oulu.fi.
You will get a reply with necessary instructions.
Right of appeal to the supervisory authority
In addition to the rights mentioned above, you have the right to file a complaint about the processing of your personal data with the Office of the Data Protection Ombudsman as the supervisory authority.
The contact details and opening hours can be found on the website of the Data Protection Ombudsman.
Automated decision-making or processing the personal data for other purposes
General description of the technical and organisational protection measures
The University as the Data Controller uses appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against damage or loss of personal data.
Personal data in digital format (on a computer or hard disk of similar equipment) is password protected. Each person entitled to the processing of personal data has been given a unique password, the use of which can be monitored.