Privacy Policy - Common Student System (Felles Studentsystem, FS)

**Privacy Policy for the Common Student System (Felles Studentsystem, FS)**

Last edited: 3 august 2018

Brief presentation of the Common Student System (FS)
What is a privacy policy?
What is considered personal data?
The purpose of and legal basis for the processing of personal data in FS
Which kinds of personal data are processed by FS?
In some cases, we process cases automatically
How long do we store your personal data?
We disclose your personal data to third parties
Personal data safety
Your rights
Contact

1) Brief presentation of the Common Student System (FS)

The Common Student System (FS) is a study administration system, developed for universities, scientific colleges and public university colleges. The system has now also been made available to private colleges. When you apply for admission to and study at the University of Bergen, your personal data will be registered, processed and stored in FS.

A number of different applications are connected to the study administration system FS. Consequently, data registered in these applications will also be stored in FS. In various contexts, data stored in FS is shared with a number of different parties/institutions.

2) What is a privacy policy?

This privacy policy describes how the University of Bergen manages your personal data in the FS system. The purpose of this privacy policy is to inform you of the types of personal data processed, how it is processed, who is responsible for the processing, your rights and whom to contact.

3) What is considered personal data?

The term personal data includes any data, information and assessment that can be linked to you as an individual, cf. GDPR Article 4 no. 1. The determining factor in whether data is considered personal information, is whether it is fit to identify a specific person.

In some cases, data which, on its own, cannot be linked to an individual person, may constitute personal data if it is used in combination with other data.

4) The purpose of and legal basis for the processing of personal data in FS

Purpose

The purpose of processing personal data in FS is to protect your rights as an applicant, student, course participant or doctoral candidate, and to fulfil the institution’s obligations and duties pursuant to the Act Relating to Universities and University Colleges.

Among other things, the processing of personal data in FS is necessary for the University of Bergen to

process your application for admission to programmes of study/courses and registration for examinations
perform necessary administration of your studies and you as a student
document your results

Legal basis

This processing is authorized under Section 4-15 of the Act Relating to Universities and University Colleges and Article 6, no. 1, litra e), and no. 3, litra b), of the GDPR. Processing is necessary for the performance of a task carried out in the exercise of official authority and to comply with provisions established by the Act Relating to Universities and University Colleges. Processing is also carried out to enable the institution to protect your interests as a student in the best possible way. In certain contexts, the institution has furthermore chosen to supplement this legal basis by seeking consent for the processing of certain types of data.

5) Which types of personal data are processed in FS?

Currently, no sensitive personal data about you is stored or processed in FS.

The following personal data may be processed in FS: profile information (including your name, national identity number/D-number/S-number (11 digits), sex, contact information, information about your background, native language, photograph), application information, consent given by you, status (including legal residence and criminal records certificate, where relevant), semester registration data, billing information and information about programmes and courses of study.

Your personal data may come from:

1. You, submitted via the application portal on the Norwegian Universities and Colleges Admission Service website

2. You, submitted via Søknadsweb

3. You, submitted via EVUweb

4. You, submitted via Studentweb

5. Norwegian Digital Contact Information Register

6. National database of upper secondary school leaving certificates of education (Nasjonal vitnemålsdatabase, NVB)

7. Other universities/university colleges

8. Others registering you in EVUweb

9. Others registering you in Nomination

10. Administrative officers at the University of Bergen

11. The National Population Register

12. The Norwegian State Educational Loan Fund

13. Digital examination systems

14. Fagpersonweb

15. User administration systems

16. Application for payment of the semester fee and OCR Giro

17. Access control system

Voluntary registration

1. You, submitted via the application portal on the Norwegian Universities and Colleges Admission Service website

2. You, submitted via Søknadsweb

3. You, submitted via EVUweb

4. You, submitted via Studentweb

Registration of personal data via the application portal on the Norwegian Universities and Colleges Admission Service website, Søknadsweb, EVUweb and Studentweb is voluntary, but without your personal data, we may not be able to process your applications. In the application portals on Søknadsweb, EVUweb and the Norwegian Universities and Colleges Admission Service website, you can register information about yourself and link it to your application to a programme of study or enrolment in courses. On Studentweb you can register information about yourself and link it to your application to a programme of study, information about your background, enrolment in classes and registration for exams, applications and documents you upload. This information may be necessary for us to process your applications and for you to study at the University of Bergen.

5. Norwegian Digital Contact Information Register (KORR).

FS may retrieve your e-mail address and mobile phone number from the Norwegian Digital Contact Information Register (KORR). If you do not want anyone to access this contact information from KORR, you may reserve against this in KORR. Please see the website of the Agency for Public Management and eGovernment Links to an external site. for more information.

Information registered without your consent

6. The national diploma database (NVB)

If you apply for admission to the University of Bergen via the Norwegian Universities and Colleges Admission Service or via Søknadsweb, we will retrieve personal data about you from the National Diploma Database. The National Diploma Database includes most electronic diplomas issued by upper secondary schools from the year 2000 forward. We will retrieve your name, national identity number (11 digits), the name of your school, subjects and results.

7. Other universities/university colleges

If you apply for admission to the University of Bergen and have earned credits from another university/university college which also uses FS, you may consent to the institutions sharing your results with each other. With your consent, an administrative officer may retrieve all of your results from any institution in Norway that uses FS. In practice, that includes most universities and university colleges in Norway, with the exception of the Norwegian Business School (BI). We refer to the privacy policy of each respective institution for more information on how your personal data is processed.

If you have earned credits from a university or college outside of Norway, and the institution is part of the EMREX network, you may transfer your results to the University of Bergen. You can do this via Søknadsweb and Studentweb.

If a Norwegian learning institution has imposed one or more sanctions on you that may also affect your application to/enrolment in other Norwegian learning institutions (pursuant to Sections 3-7 (8), 4-8 (1) to (3) or 4-10 (3) of the Act Relating to Universities and University Colleges), the University of Bergen will receive personal data about you from the Register for Banned Students (Register for utestengte studenter, RUST). Only a select few individuals at the University of Bergen will have access to this personal data. Please cf. the privacy policy for RUST Links to an external site..

8. Others registering you in EVUweb

In some cases, employers and others may register information about you in EVUweb. This normally happens when your employer is arranging for your studies or further and/or continuing education at the University of Bergen. This data may be necessary for us to process the application/registration for enrolment in studies/courses.

9. Others registering you in Nomination

Nomination is a web application where external institutions can nominate exchange students for programmes at Norwegian institutions. If you have been nominated in Nomination you will have already been notified via e-mail. The following personal data may be registered in Nomination and transferred to FS: first and last names, sex, e-mail address, date of birth, nationality, and what you have been nominated for. The person nominating you may also upload documents to go along with the nomination. Anyone who has been nominated can access the personal data, as well as any uploaded documents, linked to them in Søknadsweb.

10. Administrative officers at the University of Bergen

In certain circumstances, it is necessary for administrative staff at the University of Bergen to register information about you in connection with your studies. Examples of this includes assessments linked to applications for admission, explanations for grades and appeals against grading, registrations linked to study completion.

11. The National Population Register

In order for your name and address to stay current in FS, we retrieve your name and address from the National Population Register.

12. The Norwegian State Educational Loan Fund

The Norwegian State Educational Loan Fund sends the University of Bergen lists of every individual who is a client of the loan fund. They do this so that we can know whose data to return to the loan fund for loan repayment purposes. See also item 8.6 below.

13. Digital examination systems

More and more examinations are administered in digital examination systems. Grades and explanations for grades, which are registered to you in these examination systems by lecturers and examiners, are forwarded to FS.

14. Fagpersonweb

Just like in digital examination systems, grades and explanations for grades may be linked to you in Fagpersonweb. Fagpersonweb is a web application used by lecturers and examiners. In addition to grading and explanations for grades, Fagpersonweb is also used for attendance registration. All personal data registered about you in Fagpersonweb will be forwarded to FS.

15. User administration systems

In order for the University of Bergen to create an account for you so that you can access our ICT services, your personal data is registered in a user administration system called Sebra. We register your name and national identity number (11 digits), as well as information about your studies. From Sebra FS recieves your IT-account username and your email address at the University of Bergen.

16. Application for payment of semester fee and OCR Giro

At the University of Bergen your semester fee payment is collected in cooperation with Sammen Studentsamskipnaden på Vestlandet. No information about you is given to Sammen in this process.

FS receives data about your payments in the application for payment of the semester fee (http://semesteravgift.uib.no).

FS also receives information about your semester fee payment from a system called OCR Giro delivered by Nets Branch Norway (if you used the provided KID number when paying).

17. Access control system

If you have aquired a student access card information (student access card number, issue date, expiry date and photo) about this card will be transferred to the Common Student System.

6) In some cases, we process cases automatically

When you apply to the University of Bergen, a number of steps in the processing of your application will be performed automatically, either entirely or in part. Automatic processing is used in the following circumstances:

assessment of whether you qualify for admission
calculation of scores for admission
allocation of places on programmes of study
calculation of eligibility for various courses (via Studentweb)
registration for lectures and examination and allocation of places in restricted courses
monitoring of individual education plan
creation of invoices
calculation of qualifications when you complete a programme of study
termination of admission in the event of insufficient progression
calculation of final grade in courses with several assessments throughout the course

7) How long do we store your personal data?

In principle, all of your personal data is stored in the Common Student System (FS) permanently. There are, however, some exceptions:

Documents linked to applicants who apply via the Norwegian Universities and Colleges Admission Service, and who do not get admitted, are deleted when the admissions process is completed.

Personal data linked to sanctions, cf. Sections 3-7 (8), 4-8 (1) to (3), or 4-10 (3) is automatically deleted from FS six months after the expiration of the sanction period.

If the University of Bergen receives notice that you are dead, we will delete your contact information. Any applications for admission, registrations for any current and comming lectures, courses, examinations, etc. will be removed.

8) We disclose your personal data to third parties

Disclosure or export of data is defined as any transfer of data save for use in the controller’s own systems/processing or to the data subject itself or any other party receiving data on the data subject’s behalf.

the University of Bergen may disclose or export data including personal data to other systems, i.e. external data processors, whenever it is deemed necessary.

Your personal data will not be disclosed to countries outside of the EU/EEA, or to any international organizations.

Your personal data may be disclosed to the following parties/agencies:

Unit – The Norwegian Directorate for ICT and Joint Services in Higher Education and Research (provider of FS)
University Center for Information Technology (USIT) at the University of Oslo (operator of FS)
Student Welfare Organization Sammen Studentsamskipnaden på Vestlandet
National Population Register
Norwegian State Educational Loan Fund
The IT division at the University of Bergen (provider of the user administration system Sebra)
The IT division at the University of Bergen (provider of LMS)
Inspera AS (provider of Inspera Assessment - digital examination system)
University Center for Information Technology (USIT) at the University of Oslo (provider of scheduling system)
University Center for Information Technology (USIT) at the University of Oslo (provider of accounting system)
The IT division at the University of Bergen (provider of integration services to several systems)
Other universities/university colleges
Norwegian Agency for Quality Assurance in Education (NOKUT)
BIBSYS (provider of library systems)
Statistics Norway (SSB)
Norwegian Centre for Research Data (NSD) and Database for Statistics on Higher Education (DBH)
Nordic Institute for Studies in Innovation, Research and Education (NIFU)
Norwegian Directorate of Health
National Service Administration (Vernepliktsverket)
Mira Network (provider of alumni system)
University Center for Information Technology (USIT) at the University of Oslo (provider of election system)
Other internal systems at the University of Bergen
Other parties with the right to access your personal data

1. Unit – The Norwegian Directorate for ICT and Joint Services in Higher Education and Research

FS is developed by Unit. Unit staff who need to access your personal data as part of their job will be granted such access.

2. University Center for Information Technology (USIT) at the University of Oslo (UiO)

FS is operated by USIT at UiO. USIT staff who need to access your personal data as part of their job will be granted such access.

3. Student Welfare Organization Sammen Studentsamskipnaden på Vestlandet

If you have paid the semester fee for the current semester or if you have received an offer for admission to a study programme in the last two months, the various student welfare organizations across Norway may access personal data about you from the University of Bergen. They do this so they can know that you’re a student and that you are entitled to as a student discount when you use their services. The student welfare organization may retrieve your national identity number (11 digits), your name, when you last paid the semester fee and your student ID.

4. National Population Register

The University of Bergen will send the following personal data about you to the National Population Register: name, national identity number (11 digits) and address.

5. Norwegian State Educational Loan Fund

If you are a client of the Norwegian State Educational Loan Fund, data about you will be sent to the loan fund as soon as your status as a student has been registered. The following personal data is transferred to the Norwegian State Educational Loan Fund once a day: national identity number/D-number (11 digits) and the university/college you are enrolled at.

If you have completed an examination and/or have had education completed abroad or stays abroad pre-approved, data about you will be sent to the loan fund. The following personal data is transferred to the Norwegian State Educational Loan Fund once a day: national identity number/D-number (11 digits), which university/college you have completed your examination at, the results from the examination (pass/fail/not graded, if pass: also the grade).

We transfer your personal data to the Norwegian State Educational Loan Fund so that you don’t have to document your student status and completed education.

6. The IT division at the University of Bergen (provider of the user administration system Sebra)

In order for the University of Bergen to create an account for you so that you can access our ICT services, your personal data needs to be registered in a user administration system called Sebra. For this purpose, we send your personal data, including address data, group affiliations and information about registrations for courses and examinations from FS to Sebra.

7. The IT division at the University of Bergen (provider of LMS)

The University of Bergen uses Canvas (MittUiB) for teaching purposes, and sometimes also in connection with examinations. As a result, the IT division, who operates Canvas, will have access to your personal data like username, name and course registrations.

8. Inspera AS (provider of Inspera Assessment - digital examination system)

The University of Bergen uses the Inspera Assesment as examination system for a number of examinations. In order for you to take a digital examination, we send personal data about you to Inspera Assessment. As a result, Inspera AS, who develops and operates Inspera Assessment, will have access to your username, exam candidate number and your name.

9. University Center for Information Technology (USIT) at the University of Oslo (provider of scheduling system)

The University of Bergen uses the TP scheduling system to schedule lectures and examinations. As a result, University Center for Information Technology (USIT) at the University of Oslo, who develops and operates TP, will have access to your username and information about your teaching activities if you teach activities scheduled in this system.

10. University Center for Information Technology (USIT) at the University of Oslo (provider of accounting system)

If you are a student on a continuing education module/programme where there is a fee to be paid the University of Bergen can transfer information about you to the accounting system Oracle which is provided by the University of Oslo. Information about your national identification number, name, contact information and course information will be transferred.

11. The IT division at the University of Bergen (provider of integration services to several systems)

In order for you to access and use systems like Canvas (Mitt UiB) and Application system for grants and bequests at the University of Bergen, FS transfers personal data to several systems using a integration tool calles FS-REST. As a result, The IT division at the University of Bergen, who develops and operates integration services that transfer data between systems, will have access to your personal data.

12. Other universities/university colleges

- Application for admission through the Norwegian Universities and Colleges Admission Service

When you apply for admission to the University of Bergen through the Norwegian Universities and Colleges Admission Service, your application will in most cases be processed by the University of Bergen. If you have applied for admission to one or several other universities/colleges, they may process your application on behalf of all of the universities/colleges to whom you have applied. In these cases, they will process and store personal data about you in connection with your application(s). Your application will primarily include personal data you have registered yourself, through the application portal on the admission service website.

- Consent to exchange of results

If you have earned assessments and grades from another university/college and wish to use these results in connection with an application for admission to another Norwegian university/college, you may consent to an exchange of results. When you have given your consent, an administrative officer may retrieve all of your results from any institution in Norway that uses FS. In practice, that includes most universities and university colleges in Norway, with the exception of the Norwegian Business School (BI). We refer to the privacy policy of each respective institution for more information on how your personal data is processed.

- Recognition of education completed abroad

If you have applied for recognition of education completed abroad, case-specific data related to your application, including personal data about you, will be transferred to GAUS, which is a search service for recognition of education completed abroad. Other Norwegian universities/colleges may search for and access personal data about you in GAUS. Please cf. the privacy policy for GAUS.

- Sanctions imposed as a result of student conduct

In cases where a sanction issued against you by the University of Bergen is registered, the administrative decision to order the sanction will normally be forwarded to the Register for Banned Students (RUST). Sanctions are issued as a result of one or more of the following: use of a false diploma, disruptive/harassing conduct, dangerous conduct, aggravated breach of confidentiality, gross negligence during internship or clinical instruction, cheating, attempted cheating, aiding in cheating or expulsion based on a suitability assessment. If you, during the sanction period, have applied for admission to another Norwegian university/college, your personal data will be transferred to this university/college. A few select staff at this information will be able to access your personal data. In some circumstances, this also applies if you have registered for an examination. Please cf. the privacy policy for RUST.

13. Norwegian Agency for Quality Assurance in Education (NOKUT)

- Recognition of education completed abroad

If you have applied for recognition of education completed abroad, case-specific data related to your application, including personal data about you, will be transferred to GAUS, which is a search service for recognition of education completed abroad. NOKUT may search for and access personal data about you in GAUS.

14. BIBSYS (provider of library systems)

In order for you to be registered as a borrower at the University of Bergen and use the library’s services, we transfer personal data about you to BIBSYS. This only applies to students who are registered as students in the current semester and who have paid their semester fee.

15. Statistics Norway (SSB)

In various contexts the University of Bergen will transfer personal data about you to Statistics Norway for statistical purposes. This includes personal data related to

semester registration
your examination result(s)
your completed programme(s) of study
your earned qualification(s) for which a diploma will be issued
you and your eligibility for admission to a doctoral programme

16. Norwegian Centre for Research Data (NSD) and Database for Statistics on Higher Education (DBH)

In various contexts the University of Bergen will transfer personal data about you to NSD and DBH for research and statistical purposes. This includes personal data related to

your application for admission to programmes of study
your semester registration, payment of semester fees and registration(s) for courses
your completed examinations
your earned qualifications
your exchange period(s)
whether your study progression is on par with your individual education plan
you and your doctoral programme

17. Nordic Institute for Studies in Innovation, Research and Education (NIFU)

In various contexts the University of Bergen will transfer personal data about you to NIFU for research purposes. This includes personal data related to your master’s degree (in some cases your bachelor’s degree) and your doctoral degree.

18. Norwegian Directorate of Health

If you have completed a programme of study qualifying you for authorization or a licence pursuant to the Health Personnel Act or the Act Relating to Veterinarians or Other Animal Health Personnel, the University of Bergen will transfer personal data about you to the Norwegian Directorate of Health/Health Personnel Register (HPR). This data includes your name, national identity number (11 digits), information about your programme of study and of the qualifications you have earned. That way, you don’t have to personally apply for authorization when you complete eligible programmes of study.

19. National Service Administration (Vernepliktsverket)

The University of Bergen delivers information about it's students to National Service Administration. By virtue of law (Lov om verneplikt i forsvaret m.m., chapter 2, §7) the National Service Administration can request information about active students.

20. Mira Network (provider of alumni system)

Mira Network will as provider of the alumni system receive information about you and your studies in order to facilitate your registration process.

21. University Center for Information Technology (USIT) at the University of Oslo (provider of election system)

To be able to carry out electronic elections information about your username, name and national identification number is transferred to our election system which is provided by the University of Oslo.

22. Other internal systems at the University of Bergen

The University of Bergen uses several systems designed to offer various services to applicants and students. These systems will collect data about you from the Common Student System. These services include Application for special arrangements for examinations, automated student counselling, Litteraturkiosken (system for digital literature), Application system for grants and bequests, Application system for hire of welfare cabins, Application system for using UiB computer for digital exam, application for payment of the semester fee, UiBTreet and other systems used for teaching.

23. Disclosure of personal data pursuant to the Freedom of Information Act

When the University of Bergen receives petitions for access pursuant to the provisions of the Freedom of Information Act, the provisions of the Personal Data Act can not be used to limit this right of access whenever the petition includes personal data. Therefore, the University of Bergen may transfer personal data about you to other parties beyond those mentioned in this privacy policy.

9) Personal data safety

The University of Bergen perform risk and vulnerability analyses to protect your personal data in FS. In addition, various security measures have been implemented, such as access control, to keep the number of people who have access to your personal data as low as possible. All registrations are logged.

10) Your rights

Right to information and access
You have the right to information about how the University of Bergen processes your personal data. The purpose of this privacy policy is to provide you with any and all information you have the right to get.

You also have the right to view/access any and all personal data registered about you at the University of Bergen. You also have the right to request a copy of the personal data registered about you if you so wish.

Right to correction
You have the right to have corrected any and all incorrect personal data about you. You also have the right to supplement any and all incomplete data registered about you. Please contact us if you believe we have registered incorrect or incomplete personal data about you. It is important that you justify and, if relevant, document why you believe the personal data registered is incorrect or incomplete.

Right to limit processing
In certain circumstances, you have the right to demand limited processing of your personal data. Limiting the processing of personal data means that your personal data will still be registered, but the opportunities for further processing are limited.

If you believe that personal data about you is incorrect or incomplete, or you have filed a complaint against the processing of your data (read more about this below), you have the right to demand to demand that the processing of your personal data be limited temporarily. This means that processing will be limited until, if relevant, we have rectified your personal data, or until we have been able to assess whether your complaint is justified.

In other circumstances you may also demand a more permanent limitation on the processing of your personal data. In order to qualify for the right to limit processing of your personal data, the conditions established by the Personal Data Act and Article 18 of the GDPR must be met. If we receive a request from you to limit processing of your personal data, we will assess whether the statutory conditions have been met.

Right to erasure
In certain circumstances you have the right to demand that we erase your personal data. The right to erasure is not unconditional, and whether this applies to your situation must be assessed in light of relevant privacy legislation, i.e. the Personal Data Act and GDPR. Please contact us if you want to have your personal data erased. It is important that you justify why you want the personal data erased, and, if possible, that you also specify which personal data you want erased. We will den consider whether the conditions for erasure, as established by law, have been met. Please be advised that the law allows for us to make exceptions to your right to erasure. For example, we may need to store personal data for the purpose of performing a task in compliance of the Act Relating to Universities and University Colleges, or for reasons of public interest, such as archiving, research and statistics.

Right to object
You may have the right to file an objection against the processing, i.e. object to the processing, on grounds that you have a specific need to stop the processing, e.g. if you have a need for protection, have a secret address, etc. The right to object is not unconditional, and it is contingent upon the legal basis for the processing, and on your particular circumstances. The conditions are established by Article 21 of the GDPR. If you object to processing of your personal data, we will consider whether the conditions for filing an objection have been met. If we find that you have the right to object to the processing and that your objection is justified, we will discontinue processing, and you will have the right to demand erasure of the data. Please be advised that we, under certain circumstances, may make exceptions from erasure, e.g. if we have to store your personal data for the purpose of performing a task in compliance with the Act Relating to Universities and University Colleges, or for reasons of public interest.

Right to file complaint against processing
If you believe we processed your personal data incorrectly or unlawfully, or if you believe we failed to protect your rights, you have the right to file a complaint against processing. Please see item 11 below for how to contact us.

If we dismiss your complaint, you may file your complaint with the Norwegian Data Protection Authority (DPA). The DPA is responsible for making sure Norwegian enterprises comply with the provisions of the Personal Data Act and the GDPR in their processing of personal data.

11) Contact information
Data controller
The University of Bergen is the data controller of personal data in the Common Student System, cf. GDPR Article 4 no. 7.

If you wish to exercise your rights as established in item 10 above, please contact us at fs-hjelp@uib.no. We will process your request as soon as possible and within 30 days at the latest.

Data protection officer

The University of Bergen has appointed a data protection officer whose responsibility it is to protect the personal data interests of both students and staff at the University of Bergen. You may contact the data protection officer about the administrative processing of personal data at the University of Bergen via e-mail: personvernombud@uib.no.

Service provider

Unit – The Norwegian Directorate for ICT and Joint Services in Higher Education and Research is the provider of FS. This means that Unit develops and maintains FS, and Unit is also responsible for the day-to-day operation of FS. As part of this task, a select few of Unit’s staff have access to all personal data registered in FS, including personal data sent to and from FS.

Contact information for Unit: fs-sekretariat@fsat.no