Guidelines for personal data in student projects

Espen Bariås

Forsknings- og innovasjonsavdelingen

Email

espen.barias@uia.no

Phone

+47 38 14 27 16

Trond Hauso

Personvernombud

Email

trond.hauso@uia.no

Adopted by the University Director 17 January 2023

Single courses in bachelor's and master's programmes, continuing education, one-year study programmes

We recommend that, as a general rule, only anonymous data is collected. This includes anonymous questionnaires, notes from interviews or observations, and no recordings of sound or images. Please note that publicly available personal data cannot be used in such projects either. Literature studies without the use of datasets will also be suitable in many student projects.

Exceptions: 

If the person with course responsibility believes that it is absolutely necessary for the students to collect personal information from individual subjects, they can contact the Division of Education’s lawyer to assess whether an agreement can be made so that the person with course responsibility can deliver a joint message to Sikt on behalf of the course group. The data privacy adviser at the Division of Research and Innovation and the data protection officer can contribute to discussions about needs.

If it is considered crucial to collect personal data, Sikt and guidelines for privacy protection in student assignments must be used. Special categories of personal data (sensitive data) cannot be collected. 

Bachelor's theses

We recommend that in bachelor’s theses the collection of personal data is not encouraged, and to use anonymous data as far as possible. In projects where personal information is necessary, the projects are submitted together by the person with course responsibility, who is also responsible for the following:

• The projects have a common subject matter 
• Special categories of personal data (sensitive data) must not be collected (with certain exceptions, e.g. the party affiliation of well-known politicians)Data collection takes place in the form of interviews with recordings, questionnaires, or observations without recordings.
• Written information must be provided, and consent must be obtained from those included in projects
• All participants/informants must be over 18 years of age and competent to consent to participation 
• All raw data (sound recordings, transcriptions) must be anonymised or deleted on the same date.

See further clarification from Sikt.

Master's theses

We recommend that in master's theses the collection of personal data is not encouraged, if the purpose can be achieved without personal data.

All master's projects are encouraged to complete a data management plan that is shared with the supervisor, so that the student and supervisor have an overview of which categories of data are involved, and are better able to plan a Sikt application and storage needs. Projects where the supervisor believes that personal information is necessary can be reported by the student themself to Sikt. The registration form must be shared with the supervisor who must accept the sharing (confirm via link in email). The supervisor is responsible for the student's processing of personal data, and is responsible for the following:

• Special categories of personal data (sensitive data) are restricted. If it must be collected, the student must be allocated secure storage space before collecting the sensitive data. ATTENTION! This must be arranged before registering the project. Please contact the Division of Research and Innovation.
• The notification form must be submitted no later than 30 days before the planned data collection.
• Assessment from Sikt, including approval of changes and requested additional information, must be completed before data collection can be initiated.
• High-risk projects (with a need for DPIA, assessed by Sikt) are to be avoided, but master's students can participate in larger research projects where risk assessment (DPIA) is carried out by qualified researchers. This is to be clarified with the data privacy adviser in the Division of Research and Innovation, if applicable. 
• All personal data must be anonymised or deleted at the end of the project and registered as completed within the deadline. 

Combined overview of categories of data linked to variousstudent projects