Home › Security & privacy › Privacy notice for remote identification service (identity service broker)

Privacy notice for remote identification service (identity service broker)

1. Identity and contact information of the Data Controller

CSC – Finnish IT Сentre for Science Ltd
P.O. Box 405 (Keilaranta 14)
FI-02101 Espoo
tel. 09 457 2821 (operator)
servicedesk@csc.fi
https://csc.fi

2. Contact person for register-related matters

CSC Service Desk
tel. 09 457 2821 (operator)
servicedesk@csc.fi

CSC’s data protection officer
privacy@csc.fi

3. Name of the register

CSC user remote identification service (identity service broker). This register complements the general CSC customer register privacy notice.

4. Purpose and legal basis for the processing of personal data

The processing of personal data is based on the activities in the purpose of using CSC services or fulfilling of a commercial contract, depending on which role the account use is associated to.

CSC user remote identification service (identity service broker) is used to raise the level of assurance of the identity of the person using CSC services.

It is based on the consent of the data subject (GDPR 6(1)(a)), our legitimate interests (GDPR 6(1)(f)) and the controllers legal obligation (GDPR 6(1)(c)).

We may use the personal data you provide to uniquely identify the user within CSC’s systems. e.g. include it / or combine it with data you have provided via CSC’s customer portal.

If you decide not to supply personal data that we have requested, then you will be unable to use the remote identification and thus, our services that require medium or high level of assurance of the identity. In this case you have a possibility for alternative ways of proving your identity, please contact the service desk for further information.

5. Personal data groups in this privacy notice

Based on the on the consent of the data subject

Basic information:

  • First name
  • Last name
  • Social security number or other national identification code

Based on controller’s legitimate interests

  • Log files related to the remote identification process, which will be automatically removed after one year.

Based on controller’s legal obligation

  • The results of the remote identification can also be used as input when enforcing export restriction policy.

6. Information on the source of personal data

Source of personal data:

  • The data subject provides his / her full name when signing up for a CSC account in MyCSC.
  • The data subject provides his / her personal data, which is transmitted to CSC when authenticating via the OP Identity Service Broker Service. The information transmitted includes the users full name and their social security number or other national identification code.

7. Recipients and recipient groups of personal data

Personal data will not be disclosed to third parties outside the organization unless the disclosure is based on the data subject’s consent, required by applicable legislation, or mandated by a competent authority.

8. Information on transferring data to third countries

The data will not be transferred or disclosed to parties outside the EU or the European economic region.

9. Retention period of personal data

Personal data will be archived when end-user finishes the use of CSC services. The archived data will be deleted after 2 years.

10. How do we protect your data 

The systems that store your personal data are protected using for example firewalls and role based access control. The data is transferred using encrypted channels. The User is responsible for the data security of the User’s own systems and devices.

11. Information on the existence of automatic decision making, including profiling

After successful identification user personal information will be automatically validated by the CSC identity management system and the persons identity assurance level will be raised unless the system indicates inconsistencies in the personal data we receive from the OP Identity Service Broker Service. In the latter case the validation process will be continued manually.

12. Principles for the protection of data

The registered data is stored according to the best practices, good information security and legislative regulations so that it is protected from external parties. The register is protected with user identification and passwords as well as structural and group-specific authorization. Registers containing personal data can be accessed only by the members of personnel who require the use of personal data for performing their work tasks. The system can be accessed only through a protected network connection.

The use of the service creates log entries which are used for ensuring the information security of the service, developing the technology of the service, and for detecting, preventing, or investigating technical faults or errors (Sections 138, 141, 144, and 272 of the Information Society Code (917/2014)). The logs are retained for these purposes for the required time period and they will not be used for any other† purposes.

13. Rights of the data subject

Data subjects have the rights provided under the GDPR, including the right to access their personal data and the right to request the rectification of inaccurate information concerning them. Requests for access or inspection will be fulfilled without undue delay, subject to available resources, and always within the timeframe required by the GDPR. The identity of the data subject is verified before any information is disclosed. Upon request, the information will be provided in writing.

The controller must, either on its own initiative or upon the data subject’s request, rectify or complete any inaccurate or incomplete data. The controller must also delete any unnecessary or outdated data, unless legislation or a contract entitles or obligates the controller to retain such data.

If the processing is based on consent, the data subject has the right to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

The data subject has the right to request the restriction of processing or to object to the processing of their personal data, within and in accordance with the applicable data protection legislation.

Data subjects have the right to data portability, meaning the right to receive their personal data in a structured, commonly used and machine‑readable format and to transmit those data to another controller, within and in accordance with the applicable data protection legislation.

You may send the above‑mentioned requests and any questions concerning this privacy notice or CSC’s processing of personal data to: servicedesk@csc.fi.

You also have the right to lodge a complaint with the Data Protection Ombudsman. The contact details of the Data Protection Ombudsman can be found on the website tietosuoja.fi.

14. Who should you contact?

If you have any questions about this privacy notice please use the following contact point: servicedesk@csc.fi or contact the person specified in section two (2).

15. Changes to this notice

This privacy notice is valid from as of October 2026. If there are essential changes to this privacy notice, or in how we will process your personal data, we will use reasonable efforts to notify you.

This privacy notice has last been edited on October 2026.