Information to the data subject by the data controller.
The EU General Data Protection Regulation (EU 2016/679), Articles 13 and 14
Data Controller
City of Lahti. This is a joint register of customers in the Päijät-Häme region public libraries (Asikkala, Hartola, Heinola, Hollola, Kärkölä, Lahti, Orimattila, Padasjoki, and Sysmä).
Register Contact Person
Leena Lähdesmäki, Senior Library Assistant
Lahti City Library
Kirkkokatu 31, 15140 LAHTI
Phone: 044-4163235 Email: leena.lahdesmaki@lahti.fi
Legal Basis for Processing Personal Data and How Data is Obtained by the Data Controller
The customer register is used for the library’s customer service activities, loan monitoring, recovery of material, self-service functions, and collecting statistical, monitoring, and planning information related to library services.
Processing personal data is necessary to fulfil a statutory duty (Public Libraries Act 1492/2016). When obtaining a library card, customers consent to the processing of their personal data, and when acting as a guarantor for a customer who is under 15 years of age, they consent to the processing of the personal data of this individual.
Where Data is Stored
The data is stored in the Aurora library system. Only library staff whose duties include the processing of personal data have access to the personal data in the library card applications and the data in the Lastu Library customer register. Access to the Aurora system requires a personal username and password. For viewing and processing personal data, user log data is recorded in the system.
Library card applications are processed by a software robot which, in accordance with its program code, records application information in the Aurora library system. The robot logs into the system with its own username and password.
What Personal Data is Processed
- Customer information: customer’s ID number, name details (last name and first names), Finnish personal identification number, date of birth, contact information (address, address2, phone number, email address), gender, preferred language of communication, information on guarantors for individuals under 15 years of age and on guarantors for organizations as customers, bans on library use, customer group, home unit.
- Library card: number and encrypted PIN code for library transactions, date when customer data was last changed or used, possible expiration date of the library card.
- Method of notifying customers (pickup, overdue fine and due date notifications, invoices).
- Loan monitoring event data: information on borrowed material, existing material reservations, unpaid overdue fines and other fees, library bus stops used by the customer, loan bans, bans on using the self-service libraries, loan history if requested to be recorded by the customer.
- Messages about customer service.
- In addition, home delivery service customer data includes information required for transporting material, permission or refusal to record the kinds of material preferred by the customer, i.e. the customer profile, and permission or refusal to record the customer’s loan history.
Disclosure of Personal Data
Data is not given outside the EU/EEA area.
Personal Data Retention Period
A customer’s personal data is stored for as long as the customer wishes to use library services that require a library card or as long as the libraries have the legal right to collect outstanding payments from the customer.
The libraries may delete a customer’s information from the customer register if it is considered appropriate because the customer is not using library services. At the same time, customer information is removed from the Lastu web library. A customer’s loan information is retained for 60 days in the item specific loan history.
Software robotics is used in the processing of personal data. A software robot records library card applications on the server of the City of Heinola, regardless of the municipality where the customer resides. The applications are held on the server for one month to be processed by the robot. The robot records application information in the Lastu libraries’ Aurora customer register. If customer information is already found in the register, the data is updated.
Rights of the Data Subject
If data subjects wish to check, correct, delete, or restrict the use of their data, or delete their personal data in the registers of the City of Lahti, they should contact tietosuoja@lahti.fi or the data protection officer at 040 183 4334.
Data subjects also have the right to make a complaint to the national supervisory authority about flaws in the processing of personal data.
Prepared by Tanja Ojakangas, Head of Web Services
Lahti City Library
Kirkkokatu 31, 15140 LAHTI
Updated on October 5, 2023