Privacy statement for the register of Save the Children Finland’s Nettivihje.fi service

Updated 26.10.2022

1. Controller
Save the Children Finland (Business ID: 0116788-1)
Address: P.O Box 95, 00601 Helsinki, Finland
Visiting address: Koskelantie 38, 00610 Helsinki
Telephone: +358 (0)10 843 5000

2. Contact person for register matters
Data Protection Officer of Save the Children Finland
Lawyer Maria Haarajoki,
maria.haarajoki(at)pelastakaalapset.fi
tel. +358 (0)10 843 5000

3. Name of the register
Register of Save the Children Finland’s Nettivihje.fi service.

4. Legal basis for the processing of personal data and IP address
To protect the vital interests of a natural person.

5. Purpose of processing reported information and registered IP address information
Save the Children Finland (SCF) and its Child Protection and Finnish Hotline function manage the Finnish Hotline (Nettivihje.fi) where anyone can report online child sexual abuse material or illegal activities related to online child sexual abuse or suspicions of those. SCF works in close cooperation with the National Bureau of Investigation (NBI), and information indicating illegal material and activities is submitted to Finnish authorities for evaluation and possible further measures, in accordance with mutually agreed code of practice. In addition, information (URL address) of material on foreign servers deemed illegal and a violation of children’s rights is forwarded to the INHOPE network hotline[1] of the country where the material is hosted for possible further action in accordance with national legislation. The aim of the INHOPE network is to promote the removal of child sexual abuse material (CSAM), with the help of national and international cooperation.

The IP address of the sender of the report forms specified below is stored in a separate service used by SCF, creating a register. Only SCF Child Protection and Finnish Hotline employees can, at the request of the police, process an IP address in the service for authority purposes. After assessing the situation, the police might need the sender’s IP address to investigate the offence and identify the victim. The sender’s IP address is only disclosed if an authority demands it based on Chapter 4, Section 3, Subsection 2 of the Police Act. Contact details and/or personal data recorded on the form are not disclosed to the police unless the police specifically requests it or unless the reported information creates a legal obligation to notify authorities (such as the police and child protection services).

The IP address is stored from the following forms:

“That a child or a young person (under 18 yrs.) has been groomed for sexual purposes online”
“A child or young person’s (under 18 yrs.) nude image or video that has been distributed online”
“Child (under 18 yrs.) trafficking for sexual purposes”
”Sexual harassement of a child or a young person (under 18 yrs.) online”

The IP address is stored also from the form “Nettivihje nuorille”, which is available in Finnish.

The IP address is not stored from the form “Child sexual abuse material, CSAM (Note! You can report anonymously.)”.

6. Personal data to be processed
IP address of the sender of the specified forms (see section 5). IP address is a series of numbers, and it cannot be linked to an individual by SCF.

Any contact details or personal data recorded or attached to the form.

7. Regular information sources
The sender’s IP address is automatically stored from the forms specified in section five (5) when the form is sent.

The sender can also enter contact details or personal data on the form. That information is not stored after the report has been processed.

8. Protection of personal data and information security
Information contained in the registry is treated confidentially. Electronically processed register data is appropriately protected against unauthorised access by firewalls and other technical protection measures. Databases and their backup copies are stored in a locked room, and the information can only be accessed by certain previously designated people. Manual material is stored in a locked room. The register is only used by persons working for the controller or companies acting on behalf of the controller who use it to perform their work tasks. People who belong to the controller’s organisation have a personal ID and password for the register. Users are bound by confidentiality and nondisclosure.

9. Regular disclosure and transfer of personal data and transfer of data outside the EU or EEA
Data is not disclosed or transferred regularly. Data is disclosed or transferred only at the request of the police or if the information reported on the form creates a legal obligation to notify authorities.

SCF works in close cooperation with the National Bureau of Investigation (NBI), and information indicating illegal material and activities is submitted to the Finnish authorities for evaluation and possible further measures, in accordance with mutually agreed code of practice. In addition, information (URL address) of material on foreign servers deemed illegal and a violation of children’s rights is forwarded through INHOPE’s ICCAM system[2] to the INHOPE network hotline of the country where the material is hosted for possible further action in accordance with national legislation. The INHOPE network includes members located outside the EU or the EEA.

Transfer of data through INHOPE’s ICCAM system is not regular because not all reports are forwarded through the ICCAM system. The ICCAM system is only used to forward reports that are assessed to contain material that can be analysed in the ICCAM system and contain illegal material or material that violates children’s rights. This means that the transfer is necessary for important reasons of public interest (Article 49(1)(d) of the EU General Data Protection Regulation).

10. Storage period of personal data
Reports and their content are not stored. Reports are deleted from email as soon as their storage is no longer necessary. As a rule, reports are deleted immediately after processing.

IP addresses of the report forms referred to in section five (5) are stored for nine (9) months at the recommendation of the police. Other information is not registered.

11. Can I exercise my rights to personal data included in the report or to the registered IP address?
Due to the nature of the operations and the fact that SCF cannot link the IP address to the sender, data subjects cannot exercise their rights to a registered IP address. SCF does not register other personal data that might be included in the report. The information is immediately submitted to the police, when necessary.

You have the right to complain about the processing of personal data to the Data Protection Ombudsman acting as a supervisory authority.

12. Automated decision-making and profiling
Automated decision-making and profiling is not used.

13. Contacts
All contacts and requests concerning this privacy statement should be submitted in writing or in person to the contact person referred to in section two (2). Data subjects may also contact us in person or in writing at the following address:

Pelastakaa Lapset ry, Koskelantie 38, 00610 Helsinki

Please be prepared to verify your identity with a photo identification.

14. Amendments to the privacy statement
This privacy statement may be updated from time to time, for example, due to changes in legislation. We recommend visiting our website regularly to view possible amendments to the privacy statement.

[1] INHOPE (International Association of Internet Hotlines) www.inhope.org

[2] ICCAM: What Is It & Why Is It Important? https://www.inhope.org/EN/articles/iccam-what-is-it-and-why-is-it-important