Privacy policy for Fagpersonweb

Last changed 3 august 2018

1) Brief presentation of Fagpersonweb

Fagpersonweb is a web application where academic staff can perform certain necessary procedures and tasks related to study administration. Fagpersonweb is intended to act as a support tool in teaching and grading.

Fagpersonweb is linked to the study administration system Common Student System (FS). This means that any data registered in Fagpersonweb will also be stored in FS. In various contexts, data stored in FS is shared with a number of different parties/institutions. Please cf. the privacy policy for FS.

2) About this privacy policy

This privacy policy describes how the University of Bergen manages your personal data in Fagpersonweb. The purpose of this privacy policy is to inform you of the types of personal data processed, how it is processed, who is responsible for the processing, your rights and whom to contact.

3) What is personal data?

The term personal data includes any data, information and assessment that can be linked to you as an individual, cf. GDPR Article 4 no. 1. The determining factor in whether data is considered personal information, is whether it is fit to identify a specific person.

In some cases, data which, on its own, cannot be linked to an individual person, may constitute personal data if it is used in combination with other data.

4) The purpose of the processing of personal data in Fagpersonweb

Purpose

The primary purpose of processing your personal data in Fagpersonweb is to give you a summary of your roles in courses, seminars and programmes of study, as well as of any candidates you supervise, to help you perform certain administrative tasks related to teaching and supervision.

Legal basis

Fagpersonweb is subject to the provisions of the Personal Data Act and Personal Data Regulations.

The legal basis for processing personal data in Fagpersonweb is regulated in the contract between you, as an employee, and your employer.

5) Which kinds of personal data are processed in Fagpersonweb, and how long to we store your personal data?

No sensitive personal data is stored in Fagpersonweb.

When you log in to Fagpersonweb, we register your serial number in the institution’s FS database, your IP address and any errors you encounter. If you use FEIDE to log in, we also register your FEIDE user name. This is for Unit to be able to provide assistance and troubleshooting should the need arise. Personal data related to your log-ins is stored for a period of three months, and then the data is erased.

We also store information about your actions in Fagpersonweb. This data is erased after a period of 6 months.

In addition, we link your identity to study administrative tasks you perform in Fagpersonweb, such as attendance registration, approval of compulsory activity and grading. This type of personal data is normally not erased.

Fagpersonweb will also process information about your current and previous roles related to teaching and assessment, as well as any contact information registered in the institution’s FS database. This type of personal data will be retained until the information is erased by your employer.

Any personal data about students registered by you in Fagpersonweb is shared with the study administration system Common Student System (FS).

6) Automatic processing

Your personal data will not be made subject to automated processing or profiling.

7) Disclosure of your personal data to third parties

Disclosure or export of data is defined as any transfer of data save for use in the controller’s own systems/processing or to the data subject itself or any other party receiving data on the data subject’s behalf.

The University of Bergen may disclose or export data including personal data to other systems, i.e. external data processors, whenever it is deemed necessary.

Your personal data will not be disclosed to countries outside of the EU/EEA, or to any international organizations.

Your personal data may be disclosed to the following parties/agencies:

Unit – The Norwegian Directorate for ICT and Joint Services in Higher Education and Research

Fagpersonweb is developed by Unit. Unit staff who need to access your personal data as part of their job will be granted such access. They need this access in order to provide user support and, if relevant, correct errors as part of their duties.

University Center for Information Technology (USIT) at the University of Oslo (UiO)

Fagpersonweb is operated by USIT at UiO. USIT staff who need to access your personal data as part of their job will be granted such access. They need this access in order to provide user support and, if relevant, correct errors as part of their duties.

UNINETT AS

It is possible to log in to Fagpersonweb using the log-in solution FEIDE. FEIDE is developed and provided by UNINETT AS. If you log in with FEIDE, UNINETT AS staff may access your FEIDE user name and IP address, provided they need such access in order to perform their duties. They need this access in order to provide user support and, if relevant, correct errors as part of their duties. Your personal data will be erased from FEIDE after six months.

Agency for Public Management and eGovernment (Difi)

It is possible to log in to Fagpersonweb using the log-in services MinID, BankID, Buypass and Commfides through ID-porten. ID-porten is a service provided by the Agency for Public Management and eGovernment (Difi). If you log in to Fagpersonweb using one of the log-in solutions offered in ID-porten, Difi staff may access your national identity number and any data associated with your log-in to Fagpersonweb, provided they need such access in order to perform their duties. They need this access in order to provide user support and, if relevant, correct errors as part of their duties.

Difi is the data controller for any and all data used in the administration of MinID. Providers of electronic IDs (BankID, Buypass and Commfides) are data controllers for any and all personal data required for the administration of their log-in solutions. Please see their respective privacy policies for more information.

Other academic staff at your institution

Other users who have logged in to Fagpersonweb may see information about your current and previous roles, as well as your contact information. This access is given to facilitate for interaction in connection with lecture planning. Similarly, your name and contact information is made available to your co-examiners in examination committees in order to facilitate for interaction in the grading process.

8) Personal data safety

The University of Bergen perform risk and vulnerability analyses to protect your personal data in Fagpersonweb. In addition, various security measures have been implemented, such as access control, to keep the number of people who have access to your personal data as low as possible.

9) Your rights

Right to information and access
You have the right to information about how the University of Bergen processes your personal data. The purpose of this privacy policy is to provide you with any and all information you have the right to get.

You also have the right to view/access any and all personal data registered about you at the University of Bergen. You also have the right to request a copy of the personal data registered about you if you so wish.

Right to correction
You have the right to have corrected any and all incorrect personal data about you. You also have the right to supplement any and all incomplete data registered about you. Please contact us if you believe we have registered incorrect or incomplete personal data about you. It is important that you justify and, if relevant, document why you believe the personal data registered is incorrect or incomplete.

Right to limit processing
In certain circumstances, you have the right to demand limited processing of your personal data. Limiting the processing of personal data means that your personal data will still be registered, but the opportunities for further processing are limited.

If you believe that personal data about you is incorrect or incomplete, or you have filed a complaint against the processing of your data (read more about this below), you have the right to demand to demand that the processing of your personal data be limited temporarily. This means that processing will be limited until, if relevant, we have rectified your personal data, or until we have been able to assess whether your complaint is justified.

In other circumstances you may also demand a more permanent limitation on the processing of your personal data. In order to qualify for the right to limit processing of your personal data, the conditions established by the Personal Data Act and Article 18 of the GDPR must be met. If we receive a request from you to limit processing of your personal data, we will assess whether the statutory conditions have been met.

Right to erasure
In certain circumstances you have the right to demand that we erase your personal data. The right to erasure is not unconditional, and whether this applies to your situation must be assessed in light of relevant privacy legislation, i.e. the Personal Data Act and GDPR. Please contact us if you want to have your personal data erased. It is important that you justify why you want the personal data erased, and, if possible, that you also specify which personal data you want erased. We will den consider whether the conditions for erasure, as established by law, have been met. Please be advised that the law allows for us to make exceptions to your right to erasure. For example, we may need to store personal data for the purpose of performing a task in compliance of the Act Relating to Universities and University Colleges, or for reasons of public interest, such as archiving, research and statistics.

Right to object
You may have the right to file an objection against the processing, i.e. object to the processing, on grounds that you have a specific need to stop the processing, e.g. if you have a need for protection, have a secret address, etc. The right to object is not unconditional, and it is contingent upon the legal basis for the processing, and on your particular circumstances. The conditions are established by Article 21 of the GDPR. If you object to processing of your personal data, we will consider whether the conditions for filing an objection have been met. If we find that you have the right to object to the processing and that your objection is justified, we will discontinue processing, and you will have the right to demand erasure of the data. Please be advised that we, under certain circumstances, may make exceptions from erasure, e.g. if we have to store your personal data for the purpose of performing a task in compliance with the Act Relating to Universities and University Colleges, or for reasons of public interest.

Right to file complaint against processing
If you believe we processed your personal data incorrectly or unlawfully, or if you believe we failed to protect your rights, you have the right to file a complaint against processing. Please see item 10 below for how to contact us.

If we dismiss your complaint, you may file your complaint with the Norwegian Data Protection Authority (DPA). The DPA is responsible for making sure Norwegian enterprises comply with the provisions of the Personal Data Act and the GDPR in their processing of personal data.

10) Contact information

Data controller
The University of Bergen is the data controller of personal data in Fagpersonweb, cf. GDPR Article 4 no. 7.

If you wish to exercise your rights as established in item 9 above, please contact us at fs-hjelp@uib.no. We will process your request as soon as possible and within 30 days at the latest.

Data protection officer

The University of Bergen has appointed a data protection officer whose responsibility it is to protect the personal data interests of both students and staff at the University of Bergen. You may contact the data protection officer about the administrative processing of personal data at the University of Bergen via e-mail: personvernombud@uib.no.

Service provider

Unit – The Norwegian Directorate for ICT and Joint Services in Higher Education and Research is the provider of Fagpersonweb. This means that Unit develops and maintains Fagpersonweb, and Unit is also responsible for the day-to-day operation of Fagpersonweb. As part of this task, a select few of Unit’s staff have access to all personal data registered in Fagpersonweb.

Contact information for Unit: fs-sekretariat@fsat.no.