UNIS /Student life /Regulations and routines /Privacy Policy for the Common Student System (Felles studentsystem, FS)

Privacy Policy for the Common Student System (Felles studentsystem, FS)

Updated 3 September 2019

Contents:
1) Brief presentation of the Common Student System (FS)
2) What is a privacy policy?
3) What is considered personal data?
4) The purpose of and legal basis for the processing of personal data in FS
5) What kind of personal data is processed in FS?
6) How long do we store your personal data?
7) Who can receive personal data about you?
8) Security relating to your personal information
9 Your rights
10) Contact information

1) Brief presentation of the Common Student System (FS)

The Common Student System (Felles studentsystem – FS) is a study administration system, developed for universities, scientific colleges and public university colleges. The system has now also been made available to private colleges. When you apply for admission to, and study at The University Centre in Svalbard (UNIS), your personal data will be registered, processed and stored in FS.

A number of different applications are connected to the study administration system FS. Consequently, data registered in these applications will also be stored in FS. In various contexts, data stored in FS is shared with a number of different parties/institutions.

2) What is a privacy policy?

This privacy policy describes how UNIS manages your personal data in the FS system. The purpose of this privacy policy is to inform you of the types of personal data processed, how it is processed, who is responsible for the processing, your rights and whom to contact.

3) What is considered personal data?

The term personal data includes any data, information and assessment that can be linked to you as an individual. The determining factor in whether data is considered personal information, is whether it is fit to identify a specific person.

In some cases, data which, on its own, cannot be linked to an individual person, may constitute personal data if it is used in combination with other data.

4) The purpose of and legal basis for the processing of personal data in FS

Purpose

The purpose of processing personal data in FS is to protect your rights as an applicant, student, course participant or doctoral candidate, and to fulfil the institution’s obligations and duties pursuant to the Act Relating to Universities and University Colleges.

Among other things, the processing of personal data in FS is necessary for UNIS to

  • process your application for admission to courses and registration for examinations
  • perform necessary administration of your studies and you as a student
  • document your results

Legal basis

This processing is authorized under Section 4-15 of the Act Relating to Universities and University Colleges and Article 6, no. 1, litra e), and no. 3, litra b), of the General Data Protection Regulation (GDPR). Processing is necessary for the performance of a task carried out in the exercise of official authority and to comply with provisions established by the Act Relating to Universities and University Colleges. Processing is also carried out to enable the institution to protect your interests as a student in the best possible way. In certain contexts, the institution has furthermore chosen to supplement this legal basis by seeking consent for the processing of certain types of data.

5) What kind of personal data is processed in FS?

The following personal data may be processed in FS: profile information (including your name, Norwegian national identity number/D-number/S-number (11 digits), gender, contact information, information about your background, native language), application information, consent given by you, status (including legal residence and criminal records certificate, where relevant), semester registration data, billing information and information about programmes and courses of study.

Your personal data may come from:

  1. You, submitted via Søknadsweb
  2. Other universities/university colleges
  3. Contact and Reservation Register
  4. Administrative officers at UNIS

Voluntary registration

  1. You, submitted via Søknadsweb

Registration of personal data via the application portal of Søknadsweb is voluntary, but without your personal data, UNIS cannot process your application(s). In the application portal of Søknadsweb you can register information about yourself related to applications for courses and upload documents. This information may be necessary in order for you to be able to study at UNIS and to provide documentation of your education at a later date.

  1. Other universities/university colleges
  2. Have you achieved results at other educational institutions in Norway?

If you apply for admission to UNIS and have earned credits from another Norwegian university/university college which also uses FS, you may consent to the institutions sharing your results with each other. With your consent, an administrative officer may retrieve all of your results from any institution in Norway that uses FS. In practice, that includes most universities and university colleges in Norway, with the exception of the Norwegian Business School (BI). We refer to the privacy policy of each respective institution for more information on how your personal data is processed.

  1. Register of banned students (RUST)

If a Norwegian learning institution has imposed one or more sanctions on you that may also affect your application to/enrolment in other Norwegian learning institutions (pursuant to Sections 3-7 (8), 4-8 (1) to (3) or 4-10 (3) of the Act Relating to Universities and University Colleges), UNIS will receive personal information about you via RUST. Only selected people at UNIS will have access to the personal information. See also the privacy policy for RUST.

  1. Contact and Reservation Register (KORR).

FS, including Søknadsweb, may retrieve your e-mail address and mobile phone number from the Contact and Reservation Register (KORR). If you do not want anyone to access this contact information from KORR, you may reserve against this in KORR. Please see the website of the Agency for Public Management and eGovernment (Difi) for more information.

Registrations made without your consent

  1. Administrative officers at The University Centre in Svalbard

In certain circumstances, it is necessary for administrative staff at UNIS to register information about you in connection with your applications or studies. Examples of this include assessments linked to applications for admission, explanations of grades and appeals against grades and registrations linked to completion of your studies.

6) How long do we store your personal data?

In principle, all of your personal data is stored in the Common Student System (FS) permanently. There are, however, some exceptions:

  • Personal data linked to sanctions, cf. Sections 3-7 (8), 4-8 (1) to (3), or 4-10 (3) is automatically deleted from FS six months after the expiration of the sanction period.
  • If UNIS receives notice that you are dead, we will delete your contact information. Any applications for admission, registrations for lectures, courses, examinations, etc. will be removed.

7) Who can receive personal data about you?

Disclosure or export of data is defined as any distribution of data other than to its own system/processing, to the registered person itself or to someone who receives data on its behalf. UNIS can disclose or export data that contain personal data to other systems, internal or external data processers in cases where it is considered necessary. Your personal data will not be distributed to countries outside the EU/EEA, or to international organisations.

Your personal data may be disclosed to the following parties/agencies:

  • Unit – The Norwegian Directorate for ICT and Joint Services in Higher Education and Research (Provider of FS)
  • University Centre for Information Technology (USIT) at the University of Oslo (operator of FS)
  • Internal systems and routines at UNIS
  • The Arctic Student Welfare Organisation in Longyearbyen
  • Other universities/university colleges
  • BIBSYS/other provider of library systems
  • Public 360 (filing ystem)
  • The Governor of Svalbard
  • Svalbard Tax office
  • Longyearbyen Hospital
  • Other parties with the right to access your personal data
  • Unit – The Norwegian Directorate for ICT and Joint Services in Higher Education and Research

FS is developed by Unit. Employees of Unit who need it in their work will have access to your personal data in order to carry out customer support and any troubleshooting in FS.

  • University Centre for Information Technology (USIT) at the University of Oslo (UiO)

FS is operated by USIT at UiO. USIT employees who need it in their work will have access to your personal data in order to carry out customer support and any troubleshooting in FS

  • Internal systems and routines at UNIS

Internal systems and routines at UNIS require that parts of your registered information is shared with the course responsible, UNIS reception, logistics and IT services. The information that is shared is name, student number, course(s) you are accepted to and private e-mail address. Your contact information can be used to perform surveys about your experiences with UNIS.

  • The Arctic Student Welfare Organisation in Longyearbyen (Samskipnaden)

For the Arctic Student Welfare Organisation in Longyearbyen to be able to process housing applications from UNIS students, they have access to UNIS FS to get an overview of accepted UNIS students.

  • Other universities/university colleges
    Information from UNIS to the Norwegian university you are registered at

When you accept the offer to follow a course at UNIS, your profile information (name, ID-number, gender, citizenship, contact information) and course information will be sent to the Norwegian university you are registered at. Students from international universities that come directly to UNIS without any exchange agreement with a Norwegian university will be registered at UiT – The Artic University of Norway.

Your exam results will also be sent to your Norwegian university.

  • Decision on sanctions related to behaviour (RUST)

In cases where it is recorded that the UNIS has reached a decision about sanctions for you, this decision will most often be sent to the Register for Banned Students (RUST). The decision on the sanction is linked to one or more of the following: use of false diplomas, disturbing/troublesome behaviour, dangerous behaviour, gross violation of confidentiality, gross improper behaviour in practical or clinical education, cheating, attempts at cheating, complicity in cheating, or exclusion resulting from a suitability assessment. If, during the sanction period, you have applied for admission to, or wish to take an exam, at a Norwegian university or university college, selected persons in this institution will have access to your personal information. In some cases this also applies if you have registered for exams. See also the privacy policy for RUST.

  • BIBSYS/ library system provider

In order for you to be registered as a borrower at UNIS Library and use the library’s services, we transfer personal data about you to BIBSYS. This only applies to students who are registered as students in the current semester.

  • Public 360 (filing system)

If you have an application and/or decision making process ongoing at UNIS, this will be recorded in the university’s administration and filing system called Public 360.

  • The Governor of Svalbard

UNIS will provide The Governor of Svalbard with your name, date of birth and the period you are registered as an UNIS student. The Governor of Svalbard needs this information in order to issue an alcohol card for you.

  • Svalbard Tax office

UNIS will provide Svalbard Tax office with your name, date of birth and the period you are registered as an UNIS student, if this period extends 6 months. This is needed for you to be able to register as a citizen of Longyearbyen.

  • Longyearbyen Hospital

Longyearbyen Hospital offers free tuberculosis vaccination to students from certain countries. If you are a student that fulfil the criteria for this vaccination programme, UNIS will give your name, date of birth, the period you are registered as an UNIS student and your private e-mail address to Longyearbyen hospital.

  • Disclosure of personal data pursuant to the Freedom of Information Act

In the event that UNIS receives applications for access according to the provisions of the Freedom of Information Act, the provisions of the Personal Data Act and the Personal Privacy Regulation will not be able to provide restrictions to right of access where the request applies to personal information. Therefore, it may be the case that UNIS sends personal information about you to parties other than those mentioned in this privacy declaration.

8) Security relating to your personal information

The University Centre in Svalbard regularly performs risk and vulnerability analyses to protect your personal data in FS. In addition, various security measures have been implemented, such as access control, to keep the number of people who have access to your personal data as low as possible. All registrations are logged.

9) Your rights

Right to information and access
You are entitled to information about how UNIS processes your personal data. This privacy declaration is intended to contain the information you are entitled to receive.

You are also entitled to see/gain insight into any personal information registered on you at UNIS. You are also entitled to receive a copy of your personal information upon request.

Right of correction
You have the right to have incorrect personal information about you corrected. You also have the right to have incomplete personal information about you supplemented. If you think we have registered incorrect or incomplete personal information about you, please contact us. It is important that you state the reason and, where appropriate, document why you think the personal data is incorrect or incomplete.

Right to limitation of processing
In certain circumstances, you have the right to demand limited processing of your personal data. Limiting the processing of personal data means that your personal data will still be registered, but the opportunities for further processing are limited.

If you think that personal data about you is incorrect or incomplete, or you have filed a complaint against the processing of your data (read more about this below), you have the right to demand that the processing of your personal data be limited temporarily. This means that processing will be limited until, if relevant, we have rectified your personal data, or until we have been able to assess whether your complaint is justified.

In other circumstances you may also demand a more permanent limitation on the processing of your personal data. In order to qualify for the right to limit processing of your personal data, the conditions established by the Personal Data Act and Article 18 of the GDPR must be met. If we receive a request from you to limit processing of your personal data, we will assess whether the statutory conditions have been met.

Right of deletion
In some cases, you are entitled to request that we delete personal information about you. The right of deletion is not an unconditional right, and whether or not you have the right of deletion must be considered in the light of the Personal Data Act and the Personal Data Protection Regulation. If you wish to have your personal information deleted, please contact us. It is important that you state the reasons why you want your personal information deleted, and if possible, which personal information you want to have deleted. We will then consider whether the legal conditions for requiring deletion are met. Please note that in some cases the legislation allows us to make exceptions from the right to deletion. For example, this would be the case when we are obliged to store your personal data to fulfil a task that is required by the University and University College Act, or to safeguard important societal interests such as archiving, research and statistics.

Right to object
You may have the right to file an objection against the processing, i.e. object to the processing, on grounds that you have a specific need to stop the processing, e.g. if you have a need for protection, have a secret address, etc. The right to object is not unconditional, and it is contingent upon the legal basis for the processing, and on your particular circumstances. The conditions are established by Article 21 of the GDPR. If you object to processing of your personal data, we will consider whether the conditions for filing an objection have been met. If we find that you have the right to object to the processing and that your objection is justified, we will discontinue processing, and you will have the right to demand erasure of the data. Please be advised that we, under certain circumstances, may make exceptions from erasure, e.g. if we have to store your personal data for the purpose of performing a task in compliance with the Act Relating to Universities and University Colleges, or for reasons of public interest.

Right to appeal against the processing
If you think we have not processed your personal data in a correct and lawful manner, or if you think that we have failed to fulfil your rights, you have the possibility to appeal against the processing. You can find information about how to contact us under Point 12.

If we do not accept your complaint, you have the option of presenting the complaint to the Norwegian Data Protection Authority. The Norwegian Data Protection Authority is responsible for verifying that Norwegian companies comply with the provisions of the Personal Data Act and the Personal Data Protection Regulation in processing personal data.

10) Contact information

If you wish to make use of your rights referred to in point 9 above, please contact us at post@unis.no. We will deal with your inquiry without undue delay and no later than one month after we receive the request.

Service provider

Unit – The Norwegian Directorate for ICT and Joint Services in Higher Education and Research is the provider of FS. This means that Unit develops and maintains FS, and Unit is also responsible for the day-to-day operation of FS. As part of this task, a select few of Unit’s staff have access to all personal data registered in FS, including personal data sent to and from FS.

Contact information for Unit: postmottak@unit.no