Processing of personal data within the framework of the educational programme, e.g. assignments, academic papers, and degree projects may only take place in accordance with these rules and on the instruction of teachers. 

Sensitive personal data may never be processed in Bachelor’s and Master’s level educational programmes. However, during VFU/student placements/internships, such data may be processed if the processing is not included in an academic paper, report, or the like, and the VFU/student placements/internship allows the processing.

Consent

All collection, storage, dissemination and other processing of personal data made by a student in connection with the educational programme must be done with the consent of the person whose personal data is to be processed. The processing of minors' personal data requires the consent of the child's guardian(s).

Consent must be obtained before the processing of personal data begins and be in writing. The university's templates for obtaining consent must be used. Obtained consents must be submitted to the course's administrators.

State purpose and document

Before personal data begins to be processed, it must be clear how the processing is to be carried out. The processing must be documented in the university's templates for obtaining consent, which constitute both the information that the person whose personal data they want to process must receive and approve, and the framework for how collected personal data may be processed. The information must state, among other things, what the purpose of the processing is, how the personal data will be processed, what rights those whose personal data you want to process have, etc. The information must be complete and so clear that the person whose personal data you want to process understands what the personal data processing means.

An important question in the preparation of the planned processing of personal data is which personal data needs to be collected and for what purpose. Therefore, consider what personal data is necessary to collect in order to fulfil the purpose of the work. Contact your teacher or supervisor for consultation in case of uncertainty. In case of disagreement between teacher and student about the need for processing personal data, the teacher's instructions apply.

New processing requires new consent

Consent must always relate to one or more specific processing operations of personal data. In the event that any other processing is to take place, a new consent must therefore be obtained that relates to the new processing. This new consent must be obtained before the new processing begins.

Withdrawal of consent

The person whose personal data is processed always has the right to withdraw the consent given, in which case the personal data must be deleted and not processed further. This means, for example, that the personal data may not be included in new calculations, compilations, etc. However, processing that has already taken place before the consent is revoked, and any results thereof, are not affected. In the event that a consent is revoked, the university will contact you regarding the deletion of the personal data.

Storage of personal data

Information containing personal data must, as a general rule, be stored in the university's IT systems and storage facilities, such as Canvas, one’s own home directory in the university's IT environment ("F:"), or one’s own Microsoft OneDrive provided by the university, i.e. not any private Microsoft OneDrive.

If there is a need to process personal data outside the university, e.g. when working on an academic paper at home, when shooting/filming in connection with VFU/student placements/internships, or during interviews, personal data may be stored temporarily on your own mobile devices or removable storage media such as a USB stick. 

Deletion of personal data

Personal data must be deleted from all storage areas when the information is no longer necessary, but no later than when the assignment has received a passing grade. This does not apply to final products such as completed assignments, academic papers, degree projects and the like.

According to the GDPR, personal data may not be stored longer than necessary. Therefore, consider when that time falls for the different kinds of personal data processed in the work in question. For example, it may be necessary to save certain personal data for a longer period of time in order to be able to substantiate the conclusions of the work, while other data may be deleted relatively immediately. Consult your teacher or supervisor in case of uncertainty. In case of disagreement between teacher and student about the need for processing personal data, the teacher's instructions apply.

Deletion here means that the personal data cannot be recovered. This can be done in two ways. Firstly, personal data can be deleted by completely removing the information containing personal data, such as a Word document. Secondly, personal data may be deleted by de-identifying the information containing personal data. This means that information that can be linked to an individual is removed from the information while other information is retained. Provided that the connection to the individual is broken and it is not possible to find his or her way back, the personal data is considered deleted.

Please note that personal data stored on one’s own home directory F: or on Microsoft OneDrive and that has not been deleted as above, will be deleted along with all other information stored there in connection with the completion of studies at the university.

Sharing of personal data

Any transfer, sharing, or dissemination of personal data to/with other persons, such as teachers, supervisors or students, requires that the person whose personal data is being processed has consented to this. To the extent that it is necessary to share personal data with other persons, this therefore needs to be stated in the information provided to the data subject when consent is obtained. 

Follow-up

The university is responsible for, and must be able to demonstrate, that all processing of personal data takes place in a secure and correct manner in accordance with the General Data Protection Regulation. In order for this to be possible, some follow-up of the processing of personal data at the university is required.

When using the university's IT systems, processing history ("logs") are kept. These logs include information on the username, time, actions taken, and whether the actions were successful or unsuccessful. The logs are analysed regularly to detect, investigate, limit, report on, and otherwise manage incidents. In connection with suspected incidents, more data may need to be collected. 

Disciplinary measures under Chapter 10 of the Higher Education Ordinance may be taken against students who violate these rules. Such actions can be a warning or suspension.