In November, the municipality of Muurami dismissed the office holder who looked at the students’ data from Wilma without permission. Individual Wilma urkins have also come to light elsewhere in Finland.
It has become apparent in Muurame Wilma data mining is a very rare case.
The municipality of Muurami dismissed the office holder in November, because he had looked at student data from the Wilma information system without legal grounds.
Deputy Data Protection Commissioner Annina Hautala says that the data protection commissioner’s office has received a notification about Muurami’s data security breach, but the matter is still being processed. He commented on the subject in a general way.
In the last couple of years, the office has only come to the attention of a few cases where someone has viewed Wilma data without permission. Hautala is not aware that anyone has been fired for urinating.
Nor has information reached the Confederation of Municipalities or the Association of Municipal and Welfare Area Employers that someone was previously dismissed from Wilma due to information deemed unauthorized.
What can you glean from Wilma?
Wilma is a teaching and training management system with approximately two million users. In Wilma, you can view, among other things, work arrangements, grades and school bulletins.
Some of the personal information in Wilma is confidential and sensitive. For example, the system can be used if the student needs special support.
According to Hautala, unauthorized processing of personal data is basically always a breach of data security.
Preparedness and security development manager of the municipal association Ari Korhosen according to which information on Wilma has been viewed without permission does not directly affect the termination. Instead, the grounds for dismissal can be, for example, a violation of the employer’s instructions.
– It’s always a matter of overall consideration, says Korhonen.
Termination of employment in Muurame is determined by the decision of the office holder. According to the decision, the procedure of the office holder was against the law and contrary to the municipality’s information security and data protection guidelines.
Wilma belongs to the Visma Group. Business Director of Visma Teemu Lehtonen says that customers can define very freely what information each sees in the system.
According to Lehtonen, access rights are usually decided by the management of the school, i.e. for example the director of education.
The vast majority of data security breaches are damages
The European Union’s data protection regulation, or GDPR, entered into force in 2018. Since then, organizations handling personal data have had the obligation to report data security breaches targeting personal data to the data protection commissioner’s office.
According to Hautala, notifications have increased in recent years. For example, in 2024, the office was notified of more than 6,000 data security breaches. A lot of announcements come from the social and health sector, because the sector is large.
Not all breaches concern the intentional mining of personal data, but according to Hautala, a large part of data security breaches are damages caused by human causes.
For example, sending an e-mail containing personal data to the wrong address meets the criteria of a data breach.
“Very unfortunate”
Korhonen says that all cases like Muuramen’s Wilma-urkinna are very unfortunate. According to him, one can learn from the cases how important instructions and supervision are in handling sensitive information.
Hautala also highlights how important education is. According to him, the task of the organization is to ensure that people have sufficient knowledge and understanding of how to handle personal data.
According to Hautala, it is possible that more individual Wilma urkins will appear.
Muurami’s administrative director Riitta Sokka is quite silent about the mining case
