Mikko Rusama, Helsinki: Writing the rule book on personal data

Opaque practices by tech giants and various breaches have created a climate of mistrust or resigned cynicism about the use of personal data.

Despite the amount of personal data they hold, cities often shy away from the topic of using it for innovation, wary of controversy or intimidated by the legal and ethical complexities.

Mikko Rusama, Chief Digital Officer, City of Helsinki, and his team are tackling these thorny issues head on because they want to use data and artificial intelligence (AI) to deliver personalised, proactive services to benefit citizens.

Rusama hopes the work can not only improve quality of life in the Finnish capital but also help to lay the groundwork for advances at a national and global level.

“As public servants we have to show an example to the rest of the world for how we treat people and their data,” Rusama said.

A city government that anticipates your needs is an uncomfortable proposition for some – an accusation levelled at certain projects in China for example, but Rusama firmly believes this can be done in an ethical and “human-centric” way.

The key to doing things differently, he says, is trust, consent – and action.

“There are a lot of declarations and talk but few cities that are actually doing something about it,” Rusama said.

Roaming, for personal data

Helsinki has joined the MyData Global Network. MyData is a concept for personal information management which allows people to understand the data which is gathered from them and provide consent for how it is used. The city is working with Vastuu Group to provide a MyData solution which enables secure data transfer based on individual consent.

Rusama commented: “There are many ideas on, for example, what a MyData operator is. We are actually clarifying that plus what is meaningful is that we are trying to figure out how to make these trust networks interoperate.”

He uses the analogy of credit cards or mobile phones, envisioning an “international roaming for personal data on people’s terms”.

He is under no illusions as to the complexity of this on several fronts, from the regulatory to the philosophical.

“At this stage, I probably have more questions than answers,” Rusama comments.

When no service is the best option

Defining the rulebook for personal data is part of the strategy to make Helsinki “the most functional city in the world”.

For Rusama this is about convenience and removing friction. Self-service is one way but “no service is sometimes the best option,” Rusama said, referring to the power of automation to reduce the processes citizens have to go through.

In January 2020, Helsinki ran a pilot to demonstrate this. In two areas of the city, a total of 1,058 families were sent a proactive text message offering them a preschool placement. The response rate was 89 percent, and 85 percent of families accepted the offer that was recommended to them.

In January this year, this was scaled across the city with a text sent to 5,591 families. This time there was a 93 percent response rate and an 89 percent acceptance rate.

Previously, families had to fill in online or paper forms and the process could take up to two months.

“It took about one minute to get confirmation,” Rusama said. “This is a paradigm shift. Before, citizens had to come to the city. Here, the city comes to you.”

In future, the approach could be applied to more statutory services. As long as the city has the appropriate permissions to use the data: “Why don’t we just give the service automatically or at a minimum recommend the service?” Rusama asks.

In the preschool example, express consent wasn’t required as privacy officers confirmed that the communication was an information message as recipients were not forced to do anything and traditional school application methods were still available. This can be considered a “legal innovation,” Rusama said.

The concept will be further developed to potentially expand to subsidised daycare for under-fives.

This would involve getting consent from parents for the city to check the income registry maintained by tax authorities and automatically offer placements and discounts. This is a particularly important use case right now as education has been heavily impacted by the COVID-19 crisis, especially for lower-income families in many instances.

This initiative gets into the practical nitty gritty, too, such as looking at the ‘customer journey’ and the most suitable touchpoints to ask people for their data permissions.

This should result in “a more seamless user journey across different authorities,” Rusama said.

Also in Rusama’s ambitious sights is one of the most sensitive areas of all, healthcare.

Demographic trends such as an ageing and growing population and immigration, as well as the COVID-19 crisis, are putting pressure on Helsinki’s healthcare system.

Estimates suggest that in Finland, 10 percent of people — mostly elderly residents and patients with multiple health problems — generate 80 percent of the country’s health and social care costs.

“The question is can we identify these people in advance? Because clearly, it would be beneficial for the economy but also it would be very beneficial for these individuals,” Rusama said.

He and his team have been working with Finnish medical society Duodecim on a proactive Health Benefit Analysis tool which aims to help prevent serious ill health before it occurs by analysing a patient’s data and applying a set of rules — based on medical guidance — to identify care gaps and recommend the appropriate actions and treatment. All data is pseudonymised and pulled from existing health records, giving medical professionals an overview of a patient’s test results, previous diagnoses and medication history, but without disclosing their identity.

Alongside this work, the Apotti system is being rolled out gradually. It is a common system for health and social care services in Greater Helsinki, developed in collaboration with six neighbouring municipalities and the Helsinki University Hospital (HUS). Apotti integrates both health and social care data into a single system so that it can be used by multiple agencies if permission is given by patients. The Health Benefit Analysis tool will be integrated into Apotti.

Helsinki is also developing a Helsinki Profile dashboard where people can manage data consent for various services centrally.

So, the technology isn’t the major problem. The much bigger question is: What is allowed? Rusama has written to Finland’s data protection ombudsman to ask under what conditions the city could use this preventative healthcare approach. He highlights the ‘tension’ between privacy and healthcare laws.

“If we have the data and we do not act upon the data, are we guilty of neglect as it is?” Rusama said. “Or if we use the data, are we guilty of breaking privacy rules?”

As technology enables new, advanced capabilities this need for further clarity and frameworks goes beyond Helsinki to the wider ecosystem and national governments, as well as the EU.

Fixing the foundations

As they tackle the challenges on the front end, Rusama’s team is simultaneously building the internal foundations, or ‘plumbing’, to deliver these more proactive services to citizens.

In early 2021, Helsinki’s Mayor, Jan Vapaavuori, established a new Digitalisation Unit to centralise this work. It has around 150 staff, led by Rusama, with a budget of €100 million (US$121 million), and an additional €10 million for 2021 to accelerate the work and help the city recover from COVID-19.

“We also need to have a culture revolution, towards a more user-centred agile culture,” Rusama said. “We have a massive programme here at the City of Helsinki. Just a fraction of it is visible and some of the biggest things are happening under the hood.”

This includes focusing on underlying infrastructure and common platforms and streamlining services to pave the way for advanced data and AI capabilities.

A compliance and ethics board will evaluate legal and ethical questions as they arise and the city launched an AI registry for transparency about which city systems use AI and how. On this, Helsinki collaborated with the City of Amsterdam and it is also working closely with London, Barcelona and others through the Cities for Digital Rights Coalition.

Many cities want to innovate but they are often risk-averse, so Rusama hopes that Helsinki’s example can inspire others to follow.

“The slogan of our digitalisation programme is ‘from a reactive to proactive city on citizens’ terms’. My hope is that the world becomes a better place and we can set the example for how we can treat personal data and use technology in a human-centric way,” says Rusama.

“We have to crack this, we have to make it work and this is just the start.”