Responsibility for privacy in student projects
Supervisors are responsible for the privacy protection in student research at the master level, but you as a student also have an independent responsibility to protect the privacy of respondents or informants in your research project. The supervisor agreement between you and your supervisor clarifies the responsibility for the privacy protection and data handling in your project.
At the Faculty of Educational Sciences, it is mandatory for both master students and supervisors to have completed an e-learning course on privacy protection in Canvas (the course is not mandatory for external supervisors, but they are required to have the necessary knowledge. There is an open course they can take). For master students, the course on privacy protection is included as a compulsory component in one of the courses you take in the master programme. You will receive information about this when you take the relevant course.
You can read more about obligations and responsibilities for privacy protection in student projects on UiO's website.
What is personal data?
Personal data is all the information and assessments that can be linked to you as a private individual, either directly or indirectly.
Examples of personal data are name, date of birth and personal identification number, e-mail address, photographs, health information, voice, behaviour and a number of other data about a person.
For more information:
Processing personal data
If you process personal data in your project, it is vital that you make sure to process them in a professional and secure manner. You are obliged to follow the current regulations as well as the rules set by the UiO regarding research on personal data. You must also consider whether or not your project is in line with the guidelines for research ethics.
At UiO all research projects which process personal data must be registered with the Data protection services at Sikt). SIKT must assess whether or not your plan on processing personal data is in accordance with the regulations. They will help you find solutions that fit your project and ensure that the planned processing is in accordance with data protection legislation. If you are collecting data abroad (outside of the EU/EEA), note that in addition to following the ordinary regulations, you must follow local regulations. Talk to your supervisor about this.
Prior to registering your project with SIKT you must clarify several issues. You are therefore recommended to read through the SIKTs checklist. The time it takes for SIKT to assess your project may vary from a couple of days up to a month, depending on the complexity of your project. SIKT therefore recommends that you register your project with them no later than 30 days before you begin your data collection.
In case you plan to process medical or health related data, your project must also be approved by the Regional Committees for Medical and Health Research Ethics (REK). As a main rule, the Faculty of Education does not recommend master students to choose REK-projects, due to the time frame.
Please contact your supervisor in case you have questions concerning data processing of personal data in relations to your master thesis.
Anonymous information
Anonymous information is information that cannot in any way be used to identify individuals in a data material, either directly through name or personal identification number or indirectly by additional information. Indirect identification can be obtained by providing information that can be linked to names using other registers or the like. Examples include telephone number, car registration number, address, or combinations of information such as gender, age, school affiliation and number of siblings.
Anonymous information is not personal data since it cannot be linked to identifiable individuals. If you only process anonymous information in your project, you do not need to report the project to SIKT.
What to think about in the startup of the project if you are to collect personal data
What do you want to investigate and who will be the focus of your research?
State as clearly as possible: What you want to investigate; Who will be the focus of your research; Who will be included in the sample; and What type of personal information you need about the informants in order to achieve your research purpose.
What type of personal data will you be processing?
Together with your supervisor you must classify the personal data you are going to collect: Are they green, yellow or red data in accordance with the UiO classification? The category the data belongs to determines where the data can be stored and which IT services you can use. Special categories of personal data, often called sensitive personal data, are classified as red data and must be especially well secured.
How will you collect data?
Collection of personal data must be conducted in a secure manner and by using approved equipment and devices. How to collect data is something that you discuss and plan with your supervisor.
You may use UiO-nettskjema (a digital tool for questionnaires) to collect data. Nettskjema also offers a dictaphone-app.
How and where will you store the data?
Once you have classified your data, you must ensure that the data will be stored in compliance with UiO's data storage guide. You must ensure that no unauthorised persons can access information that can identify someone. Make sure to erase temporary files, and make sure that the main data and potential backups are saved in a proper and secure manner.
Storage of red data in TSD
If you are to collect red data in your project, you may need to store them in UiO's Services for Sensitive Data (TSD). Please contact your department for more information:
Department of Special Needs Education
Centre for Educational Measurement
How will you recruit informants/respondants?
This is something you need to discuss with your supervisor at an early stage of the process. It is important to note that you must have an agreement with the place(s) where you are planning to collect data. With regards to recruiting informants/respondents at institutions such as schools and nurseries, it may be wise to look outside the Oslo-area.
- UiO has certain regulations concerning whether or not you may send out surveys among UiO students. Students are usually not permitted to send out such surveys. Any requests about conducting surveys among UiO students must be sent to: sporreundersokelser@admin.uio.no
How will you give information to and obtain consent from the informants/respondents?
When you collect personal data, you must be able to document later on that you have given the informants/respondents full information about what it means to them to take part in the project, and that they have given consent (Unless you use data at an aggregated level, i.e. register data). The information you give the informants/respondents shall be provided in a brief, open, understandable and easily available format and in a plain and simple language, in particular information directly targeting a child. See SIKTs checklist to see what you need to inform the informants/respondents about.
As a common rule, SIKT recommends written information and written consent. You may use SIKT's template for information letter and consent in your project. It is also possible to use the electronic consent form in UiO's tool for online surveys, Nettskjema, to collect consents.
If you use the electronic consent forms, and you are going to collect red data, you must use the highest security level for signing. The consent form must be connected to TSD.
Consent forms must be stored in a secure place
Consent forms must be stored according to the same colour codes as the data set in general. Talk with your supervisor about how the consent forms should be stored (i.e in a locked file cabinet, scanned server area, online consent management system). For projects with red data, the consent forms must be stored in TSD.
Data management plan (DMP)
In consultation with your supervisor you must produce a data management plan that describes how you intend to ensure professional and safe process of data in your project from the start to the completion, even after the project is completed.
The data management plan may be uploaded as an attachment once you register your project with SIKT.
Once you have clarified the above issues you are ready to register your project with the SIKT (and possibly REK).
This is how you register your project with SIKT
You register your project with SIKT by filling out a notification form. Your supervisor may help you, but the submission of the form is your responsibility. SIKT has a chat-function that you may use in case you have questions while filling out the form.
When you register your project with SIKT you must register the person responsible for the project. This person must be employed by UiO. The person responsible is normally your supervisor, but if the supervisor is not employed by UIO you must make yourself familiar with your department's procedures on who shall be registered as the responsible person.
- At IPED it is the Head of Studies
- At ISP it is the person with responsibility for SNE4390-Master's thesis
Remember to register your private e-mail address and mobile number in order to make sure that SIKT and UiO can contact you once the project (and master programme) is completed.
In case you need to make alterations with the project after submitting the notification form, you must notify SIKT so that they can make another assessment.
About application to REK
Discuss with your supervisor on how to send an application to REK (in Norwegian) if this is relevant to you.
You may begin your research project once you have received a clearance from SIKT (and REK). In order to save time, you should send the forms to both SIKT and REK at the same time.
When can I start collecting data?
You can only start with data collection after you have received approval from SIKT (and possibly also from REK).
Some tips to avoid unnecessary person-identifying data
- Avoid informants using names and information that may be identifying.
- Prevent people from accidentally joining the recording. (If necessary, stop recording).
If you nevertheless collect personal data that you have not been approved to collect, you must delete it immediately, and you should contact your supervisor.
Any discrepancies in the processing of personal data must be reported to UiO.
Transcribing and anonymizing data
If you are going to take data out of the storage location, you must transcribe the data and ensure that all personal data is de-identified or anonymized. After transcription, it is customary to delete raw data.
- De-identification (pseudonymisation): personally identifiable information has been removed, but indirect personally identifiable information exists, e.g. in the form of link keys.
- Anonymization: all personally identifiable information is deleted (including link keys). NB: It is no longer possible for informants to withdraw from the survey.
What do I do when my project is completed?
The project has not been completed until you have finished your examination. When the project is completed, the data shall be deleted, unless otherwise agreed and approved.
Remember to notify SIKT when the project is completed
If you have reported your project to SIKT, it is important that you report that the project has been completed and what will happen to the personal data.
More information about what to ensure when the project is completed can be found here.
Do you have questions, need technical guidance or need to borrow equipment?
Contact your supervisor if you have any questions about privacy.
If necessary, your supervisor can consult the privacy contacts at the departments.
The IT service at the faculty assists with technical guidance in connection with data management, and lending of some equipment. We do not recommend lending a dictaphone for an extended period of time.
Students can also contact SIKT directly.
Want to know more about privacy?
You can find a lot of useful information about privacy on SIKT's website.