Privacy in research

Personal data is any information that can be linked to an individual, such as name, address, telephone number, email address/IP address. Images or audio recordings are also personal data if individuals can be recognised. Remember that a person can also be identified indirectly if background information is combined, for example, municipality of residence combined with age, gender and occupation.

• General personal data includes most personal data and is subject to specific rules for collection, storage and deletion. Personal data related to master's theses usually falls into this category.
• Sensitive personal data, which in law has now been replaced by the term special categories of personal data, is information about racial or ethnic origin, political opinion, religion, philosophical belief, trade union membership, genetic information or health information, information about sexual orientation or sexual relations. More is required to process this type of information.

• Research projects must have a project manager who is responsible for assessing whether the collection of personal data is necessary in accordance with the project's purpose, issue and utility.
• The supervisor is the project manager for student projects. Students cannot be project managers themselves, but can assist as project staff.
• If the research project is to process personal data, a notification form must be sent to the Privacy Services for research at Sikt no later than 30 days before the planned start of data collection. The collection of personal data can start when an assessment from Sikt is available, and changes during the project must be reported to Sikt.
• A project description must be prepared which, among other things, states the purpose of the project, what information is to be included in the project and is necessary to serve this purpose, and how the project is to be carried out.
• A consent/information letter must be prepared with questions about participation in the research project. Sikt's notification form template for personal data in research must be used.
• Scientific staff and students who process personal data are subject to a duty of confidentiality pursuant to Section 13 of the Public Administration Act. A confidentiality declaration must be signed by all project staff. Publication or disclosure of personal data must be based on the data subject's consent.

Research projects that do not process personal data, or where data is collected and handled anonymously throughout the project period, are not subject to mandatory notification.

Examples of different approaches:
 

• Interviews and observations are recorded as data only in the form of notes (no audio or video recordings). Names or personally identifying background information must not be recorded in the data material.
• Questionnaires are collected in paper form, without names or indirectly identifying information.
• Web-based questionnaires where the IT solution is completely anonymous (including that respondents' email/IP addresses are not linked to the questionnaire at any point), and that the questionnaire itself does not contain questions about identifying information. (Most web-based questionnaires involve the registration of email/IP addresses, and the processing will then have to be reported, even if only the service provider has access to this information.)

If you are unsure whether a project is subject to mandatory notification, you can take the mandatory notification test on Sikt's website.

If you are unsure whether the data material has been sufficiently anonymized, contact the data protection officer at NLA University College.

Audio and video recordings where voice or image can identify a person must be handled with care.

• Audio recorders can be lent out to students and staff.
  Audio files can be edited by employees and stored in a password-protected area on OneDrive. It is not permitted to download an audio file with personal data on a private PC. Students can transcribe data by listening to the audio file via an audio recorder. The recording stored on the audio recorder must then be deleted. Academic staff can also use storage in Teams by using a closed Teams group. For encryption of audio files, NLA recommends the free program 7-Zip, which can be downloaded directly from the manufacturer's website.
• Audio recording with a smartphone is only permitted if the dictaphone app in Nettskjema is used. Get more information about the Nettskjema dictaphone app here.
• Devices with a network connection (mobile phone, tablet) cannot be used to record images or video.
• If you are going to transcribe data from an audio file (transfer the content from audio to written format), this can be done automatically.

The Nettskjema Dictaphone mobile app has an automatic transcription function that employees and students at NLA University College can use. The function is described by UiO's Nettskjema as follows:

«Audio recordings submitted to Nettskjema are automatically transcribed using the UiO internal service Autotekst. The speech language settings are set to be recognised from the audio recording. No data leaves UiO's infrastructure during transcription.

Transcriptions are available under "Recordings" as text and VTT file shortly after the recording is submitted to Nettskjema.»

NB! Students at NLA University College are not permitted to download audio files with personal data onto a private PC.

The data subject (the person whose personal data is processed by the research project) has the right to information about and access to their personal data, as well as the right to rectification and erasure of their personal data.

Requests for access, rectification and erasure of information must be in writing, dated and signed. It is not necessary to provide any justification for requesting access, rectification and erasure.

The project manager processes incoming inquiries on an ongoing basis. Requests for access shall be answered without undue delay, and no later than 30 days after NLA University College received the inquiry.

In the event of access, it must be assessed whether access should be restricted or rejected with another justification.

If the data subject no longer wishes to participate in the project, this shall be respected.

In the event of rejection of a request for access, rectification and erasure, the data subject must be informed that the decision can be appealed.

When further storage of personal data is no longer necessary to fulfill the purpose of the project, the data must be deleted or anonymized.

Before the project is completed, the project manager must assess whether personal data should be deleted, anonymized, or archived in accordance with an assessment from the Privacy Services for research at Sikt.

• All personal data that should not be stored after the project ends must be deleted.

• Personal data that is to be stored after the project ends must be anonymized.
  • All data that makes it possible to identify project participants must be deleted. In principle, this is done by the project manager deleting the linking key, i.e. where national identity number, name, address and other identifying information are registered.
  • In some cases, it may be possible to identify project participants even if the linking key has been deleted, i.e. that the data material contains indirectly identifiable information. Examples of ways to anonymize the data material:
    • Age is grouped instead of stating exact age (0-15 years, 15-25 years, etc.)
    • Municipality names are categorized to, for example, Western Norway.
• If it is difficult to anonymize the material, the information must be deleted.
• If you are unsure whether the data material has been sufficiently anonymized, contact the data protection officer at NLA Høgskolen.
• Personal data that is to be kept after the project ends must be stored securely. Sikt offers data storage after the project has ended.