Data protection in student papers

When writing a scientific paper or carrying out a research project based on information about individuals, you are required to adhere to data protection rules in relation to informants and the processing of data that you collect.

What is data protection?

Data protection refers to the safeguarding of the right of the individual to privacy, self-determination and self-expression. Everyone has the right to control their private sphere and control the use of information held on them. The most important rules on data protection can be found in the EU’s General Data Protection Regulation (GDPR), Norway’s Personal Data Act and other Norwegian laws on the subject (e.g. the Health Research Act).

Informants have a fundamental right to control the use of personal data held on them. To successfully carry out your work, and to ensure that informants are willing to share information about themselves, it is important that you follow the data protection rules. Before you get started, familiarise yourself with NLA University College’s guidelines for data protection in research.

What is personal data?

All information that relates to an individual and enables them to be identified either with or without combining it with other information is defined as personal data. Examples of personal data are name, address, email address, national identity number, photo, voice (audio recordings) and video. Other examples of personal data are IP address, encrypted information and pseudonymous information. The determining factor is whether the information can be linked back to an individual. All information that includes an identifier is considered personal data.

Some categories of personal data require extra protection and are subject to stricter rules. This type of personal data is placed in special categories and is known as ‘sensitive personal data’. Examples of special categories are racial/ethnic origin, religion and health data. You must always confer with your supervisor if you are going to use sensitive personal data in your work.

Anonymous data is not subject to data protection rules

Rules on data protection do not apply to the use of anonymous data. Anonymous data cannot be linked to an individual, e.g. through a list of names or an identifier. Remember that audio or video recordings are not anonymous.

Project manager in student papers

Student papers must have a project manager. The supervisor acts as the project manager for student papers and is responsible for assessing whether it is necessary to collect and use personal data. Students can assist as project team members. All project team members must sign a declaration of confidentiality.

Send registration form to Sikt before starting

All research that will use personal data must be reported to the Norwegian Agency for Shared Services in Education and Research (Sikt). Sikt shall ensure that you comply with the data protection rules. Further details at sikt.no.

Sikt’s tool for approving student papers is a registration form that you must fill in. This form can be found at minside.nsd.no. The form must be submitted no later than 30 days before starting the paper, and must be shared with your supervisor. To correctly complete the registration form, use the prompts in the form actively and ask your supervisor. You can start collecting personal data when you receive permission from Sikt.

Sikt does not need to be notified about work that is carried out anonymously. Always consider whether your work can be carried out anonymously, e.g. by using a printed questionnaire without identifiers and free text fields, or by using an online form where the IT solution enables full anonymity. See more examples at sikt.no. It is important to note that the data must remain anonymous throughout the course of your research. If you are in doubt, you can take the duty to report test on Sikt’s website.

Information letter to informants

As a student, you have a duty of disclosure to your informants. This means that you must provide them with an information letter. The language must be clear and understandable, and adapted to the participants. When drawing up an information letter, you must use Sikt’s template for information letters.

Check that the information you provide in the information letter and Sikt’s registration form matches. The information must be provided before you start collecting personal data.

Informants’ consent

Before you can collect personal data about the informants, you must identify a legal basis for the work. Consent is the most common legal basis for student papers. For instance, this may entail you asking informants to sign a consent form. This may be in digital format. A signed consent form shows that you have a legal basis for collecting personal data for your paper. When drawing up a consent form, you must use Sikt’s template for consent.

Draw up a plan for the rights of the informants

Informants have the right to access, rectify and erase their personal data among other things. Informants can at any time, orally or in writing, request access to their personal data. The right to access is important for enabling informants to have control over the personal data held on them. It also allows them to arrange to see personal data held on them, and they can request that such information is rectified or erased.

Together with your supervisor, you must draw up a plan for how to deal with informants’ enquiries. Such enquiries must be answered quickly, and their rights are enforceable where informants are identifiable in the dataset. The supervisor’s contact details must be provided in the information letter.

Use approved ICT tools

Personal data must be treated in a secure and responsible manner. Use ICT tools approved by NLA University College (e.g. for data storage/or selecting a questionnaire services provider). For more information on approved ICT tools, see the procedures for data protection in research at NLA University College.

Before starting

·  Consider who you are going to conduct research on, which methods you are going to use and what personal data you need in order to answer the research question. An important principle is not to collect more personal data than you need (data minimisation).
• Prepare an information letter and consent form for the informants (enclosed with the registration form).
• Prepare an interview guide, questionnaire, list of variables etc. (enclosed with the registration form).
• Familiarise yourself with the procedures for data protection in research at NLA University College. Use tools that are approved by NLA University College.
• Establish whether you need permission from any official bodies to carry out the project (e.g. Regional Committees for Medical and Health Research Ethics, the Norwegian Correctional Service, etc.).
• Send the registration form to Sikt.

As the work progresses

·  • Respond to enquiries from informants about their rights.
• Delete data if consent is withdrawn.
• Ensure that personal data is not used for other purposes.
• Report changes to Sikt as you work. See sikt.no for more information.
Project completion
• Delete personal data upon project completion.
• Stored personal data must be approved by Sikt and stored responsibly.
• Send a notice of completion to Sikt.

Useful tips

• Information about data protection in research is available at sikt.no and nla.no.

Good luck with your project!