Privacy in student assignments

Privacy in student papers

Are you writing a bachelor's or master's thesis? Will you be collecting and using information about individuals? Then you need to know this!

What is privacy?

• Privacy is the protection of individual rights and freedoms.
• Privacy is about individuals' right to a private life and the right to decide over information about themselves.

Central rules on privacy can be found in the EU's General Data Protection Regulation (GDPR), the Personal Data Act and other Norwegian special laws (e.g. the Health Research Act). You can read the legal texts, with explanations, on Rettsdata.no (login with Feide).

Informants have a fundamental right to control the use of personal information about themselves. Before you start the assignment, you should familiarize yourself with NLA University College's guidelines for privacy in research.

What is personal information?

Personal information is any information about an identified or identifiable natural person.

Examples of personal information are name, address, e-mail, social security number, picture, voice (audio recording) and video. Other examples of personal information are IP address, encrypted information and pseudonymous information. The decisive factor is whether the information can be linked to an individual. If there is a link key, the information is always considered personal information.

Some categories of personal information require extra protection and are subject to stricter rules. These are called special categories of personal information (sensitive personal information). Examples of special categories of personal information are racial/ethnic origin, religion and health information. You should always consult with your supervisor if you are going to use special categories of personal information in the assignment.

The rules do not apply to anonymous data

Rules on privacy do not apply when using anonymous data. Anonymous information must not be linked to a physical person, e.g. through a name list or a link key. Remember that audio or video recordings are not anonymous.

Project manager in student papers

Student papers must have a project manager. The supervisor will be the project manager in student papers, and is responsible for assessing whether it is necessary to collect and use personal information in the paper. Students can assist as project staff. All project staff must sign a confidentiality declaration.

Send a notification form to Sikt before starting

All assignments that will use personal information must be reported to Sikt (the knowledge sector's service provider). Sikt must ensure that the privacy rules are followed. Read more at sikt.no.

Notification form, Sikt's notification form, must be submitted no later than 30 days before the start of the assignment. The notification form must always be shared with the supervisor before submission. For correct completion of the notification form, use the help texts in the form actively and ask your supervisor along the way. Collection of personal information can start when permission from Sikt is available.

Assignments that are carried out anonymously must not be reported to Sikt. Student projects should be carried out anonymously if:

• The interviews are only recorded in the form of notes
• Questionnaires are obtained in paper form (without free text fields or identifying elements)
• Online form where the IT solution is completely anonymous is used

It is important to note that data must be anonymous throughout the assignment period. If in doubt, you can take the reporting obligation test on Sikt's website.

Information letter to the informants

As a student, you have a duty to provide information to the informants in your assignment. This means that you must prepare an information letter to the informants. The language must be clear and understandable, and adapted to the participants in your assignment. When you design an information letter, you must use Sikt's template for information letters.

Check that the information you give to the informants in the information letter and the notification form to Sikt matches. Information must be given before you collect personal information.

Consent from the informants

Before you can collect personal information about the informants, you must obtain a legal basis for the assignment. Consent is most common as a legal basis for student papers. This means that you, for example, obtain a consent form with a signature from the informants or in another digital way. A documented consent shows that you have a legal basis for collecting personal information in your assignment. When you design a consent form, you must use Sikt's template for consent.

Make a plan for the rights of the informants

The informant has, among other things, the right to access, correct and delete their personal information. The informants can at any time, orally or in writing, request access to their own personal information. The right to access is important for the informant to be able to have control over personal information about themselves. The right to access implies facilitating the informant to see personal information about themselves, and the informants can request that information about themselves be corrected or deleted.

Together with your supervisor, you must make a plan for how inquiries from the informants will be handled. Such inquiries must be answered quickly, and the rights must be enforceable as long as the informants can be identified in the data set. The supervisor's contact information must be stated in the information letter.

Use approved ICT tools

Personal information must be handled in a safe and responsible manner. Use ICT tools that are approved by NLA University College (e.g. for how data should be stored/or which supplier of questionnaires should be used). For more information about approved ICT tools, see procedures for privacy in research at NLA University College.

Before you start the assignment

• Think about who you are going to research, which methods you are going to use and which personal information you need to answer the question. An important principle is not to collect more personal information than you need (data minimization).
• Create an information letter and consent form for the informants (attached to the notification form)
• Create an interview guide, questionnaire, variable list, etc. (attached to the notification form)
• Familiarize yourself with procedures for privacy in research at NLA University College. Use tools that are approved by NLA University College.
• Check whether you need permits from various bodies to carry out the project (for example REK, the Prison Service or similar).
• Send a notification form to Sikt.

During the assignment

• Answer inquiries from the informants about their rights.
• Delete data if consent is withdrawn
• Check that personal information is not used for other purposes
• Report changes to Sikt during the assignment. See sikt.no for more information.
  End of assignment
• Delete personal information at the end of the project
• Personal information that is retained must have approval from Sikt, and must be stored securely
• Send a final notification to Sikt
• Useful tips
• Information about privacy in research can be found at sikt.no and nla.no

Good luck with the assignment!