Privacy declaration for applicants, students, alumni and PhD candidates at UiO
Information on how the University of Oslo (UiO) handles your personal information when you have applied for admission, while you are a student/PhD candidate and afterwards.
1. What is a privacy declaration?
A privacy declaration describes the personal information that is processed, how it is processed, who is responsible for the processing, what your rights are, and who you can contact about your personal information. This privacy declaration describes how UiO processes your personal data if you are an applicant, student, alumnus or PhD candidate.
2. What is personal information?
Personal information is any form of data, information, identifiers and assessments that can be linked to you as an individual. The key as to whether a piece of information is personal information is whether the information can identify a specific person either directly or indirectly. Information that on its own cannot be linked to a specific person, may constitute personal information where is appears together with other personal information. Examples of personal information that is registered and processed at UiO is your name, photograph, contact information, course- and examination registration, grades and achieved degrees.
3. Brief information on the course administration system, Common Student System (FS)
The Common Student System (Felles studentsystem - FS) is a course administration system developed for universities, scientific university colleges and national university colleges in Norway. The system is also available for private colleges. When you apply for admission and study at UiO, your personal information will be registered, processed and stored in FS.
A number of web applications such as Søknadsweb, Nominasjonsweb, and Studentweb are part of FS. That means that data registered in these applications is also stored in FS. That data in FS is reported in various contexts to a number of parties/businesses.
4. The purpose of, and the legal basis for, the processing of personal data in FS
The purpose of the processing of personal data in FS is to safeguard your rights as an applicant, student, PhD candidate or course participant and to fulfil UiO’s duties and obligations according to the University- and University College Act.
It is necessary for UiO to process your personal data so that UiO can, for example,
- process your application for admission to a study programme/subject/course
- carry out the necessary administration related to your course of study and to you as a student
- document your educational results.
Processing has its legal basis in the provisions of the University and University College Act, section 4-15 and the Data Protection Regulation article 6 no. 1 letter e and no. 3 letter b. The Data Protection Regulation is the new EU legislation on privacy protection and applies to the entire EU/EEA since the summer of 2018. Processing is necessary for exercising public authority, and to fulfil and comply with provisions in the University- and University College Act. In some cases we have also chosen to supplement the legal basis with consent declarations.
5. What kind of personal data is processed in FS?
The following personal data may be processed in FS: Profile information such as your name, personal identification number (11 digits), gender, contact information, background information, citizenship and photo. Further information regarding your course of study, results on coursess, degrees achieved, consents you have given, registration details for each semester, invoicing information, whether a police certificate has been provided and the status of your residence permit where this is relevant. In addition, various forms of sanctions in connection with any quarantine and exclusion.
Your personal information can be entered into FS by:
- yourself via the applicant portal in Samordna opptak
- yourself via Søknadsweb
- yourself via Studentweb
- the National diploma database
- other universities / university colleges
- the Contact- and reservation register (KORR)
- other people who register you in Nominasjonsweb
- administrators at the University of Oslo
- the central public registry (Norwegian National Population Register)
- the Norwegian State Educational Loan Fund
- the digital examination system
- user administrative system
- yourself via the applicant portal in Samordna opptak (SO)
- yourself via Søknadsweb
- yourself via Studentweb
It is voluntary for you to enter your personal information in the applicant portal of Samordna opptak, Søknadsweb and Studentweb, but without your personal information, we may not be able to process your applications. In the application portal of Samordna opptak and Søknadsweb you can register information about yourself related to applications for courses and upload documents. In Studentweb, you can register and see information about your course of study, including information about your study place, examination registration and results. This information may be necessary in order for you to be able to study at UiO and to provide documentation of your education at a later date.
- National diploma database (NVB)
If you are applying for admission to UiO via Søknadsweb, you may consent to us collecting your personal data from the National Diploma Database. The National Diploma Database contains most of the electronic diplomas from upper secondary schools issued in the year 2000 or later. If you give your consent, we collect your name, your personal identity number (11 digits), the name of the school, subjects and grades.
- other universities and university colleges
- Have you achieved results at other educational institutions in Norway?
Are you applying for admission to UiO, or are you applying for approval for courses from other educational institutions during your course of study at UiO? In that case, you can consent to UiO obtaining your results from other educational institutions in Norway that also use FS. As soon as you have given your consent, an administrator can obtain all of your results from all institutions in Norway that use FS. This means most universities and university colleges, except for BI Norwegian Business School.
- Emrex - results from universities/university colleges outside Norway
If you have achieved results at a university/university college outside Norway that participates in the EMREXcooperation, you can take your results with you to the University of Oslo. You can do this via Søknadsweb and Studentweb.
- Register of banned students (RUST)
- Have you achieved results at other educational institutions in Norway?
- Contact- and reservation register (KORR)
FS, including Søknadsweb and Studentweb, can retrieve your private e-mail address and mobile number from the Contact & Reservation Register (KORR). If you do not want the University of Oslo to retrieve your contact information from the Contact & Reservation Register, you may opt out of this in KORR. You can find more information on the website of the Agency for Public Management and eGovernment (Difi).
Registrations made without your consent
- Other people who register you in Nominasjonsweb
Nominasjonsweb (the nomination web) is a web application where foreign institutions can nominate exchange students for Norwegian educational institutions. The purpose of the processing of personal data in Nominasjonsweb is to be able to identify the person who is nominated. If you have been nominated in Nominasjonsweb, you will have been notified by e-mail. The following personal data is entered into Nominasjonsweb and then transferred to FS: First and last name, gender, e-mail address, mobile number, date of birth, citizenship and what you are nominated for. The nominator can also upload any documents along with the nomination. Persons who have been nominated can see their personal data and any documents in Søknadsweb.
- Case managers at the University of Oslo
In some cases it is necessary for the case managers at the University of Oslo to record information about you related to your studies. Examples of this may be assessments related to application for admission, justification for and appeal to censorship and registrations related to completion of studies.
- The central public registry (National Population Register)
In order for your name to be properly registered in FS, we will collect your name from the National Population Register at regular intervals. We also collect the address that is registered to you in the National Population Register.
- The Norwegian State Educational Loan Fund
The Norwegian State Educational Loan Fund collects personal data about you from FS if you have a customer relationship with them. The information that the Loan Fund receives is whether you are a student in the current semester. The Loan Fund also obtains information as to whether the exam has been taken and the number of credits, and approval cases.
- The digital examination system
More and more exams are being conducted in the digital examination system. Marking of examinations and the grounds for the results, which are registered to you in the examination systems of subject lecturers and external examiners, are sent to FS.
In the same way as with the digital exam system, examination results and the grounds for the results can also be recorded in Fagpersonweb. Fagpersonweb is a web application used by subject lecturers and external examiners. In addition to examination results and the grounds for the results, registration of attendance in classes is done in Fagpersonweb. Personal information about you that is recorded in Fagperson web is sent to FS.
- User administrative system
To get an IT account at the University of Oslo and access to our IT services, your personal information is registered in a user administrative system called Cerebrum. We register your name and your personal identity number (11 digits), and where you are a student (faculty/department).
6. In some cases, we perform administrative procedures automatically
When you apply for admission to, or if you are a student at the University of Oslo, a number of procedures related to admission and your course of study will be conducted as partially or fully automated administrative procedures. This applies to:
- assessment as to whether you are eligible for admission
- calculating credits
- placement in a study programme
- calculation of who is allowed to register for which courses via Studentweb
- application for a placement on a study programme and registering for examinations
- calculation of overall grade for courses with more than one examination part
- control of the education plan
- creating invoices
- applying for student exchange
- calculation of achieved degree
- withdrawal of admission to a study programme when the progression is too low
7. How long do we store your personal data?
Your personal data related to admission and studies will normally be stored and deleted in accordance with UiO's archive regulations.
Your personal data which is registered in FS will normally be stored indefinitely. There are some exceptions:
- Documents related to applicants who apply through Samordna opptak and who do not receive a place on a programme of study will be deleted when the admission process is completed.
- Personal data related to the actions you perform in Studentweb, including your IP address and, for example, if you register for or withdraw from an exam, will be stored for 365 days before being deleted.
- Personal data relating to sanctions cf. Section 3-7 (8), 4-8 (1) to (3) or 4-10 (3) of the University and University College Act will be deleted automatically from FS six months after the sanction period has expired.
- If UiO receive information that you are dead, we will delete your contact information. Any applications for admission, study programmes and examination registration will be removed.
8. CRIStin (Current Research information system in Norway)
CRIStin is a database of research findings and information for the documentation of scientific activity. If you study at the doctorate level, your data can be transferred from the personnel system at UiO to CRIStin:
- E-mail address
- Personal ID number
- Telephone number
In addition, you can register your research yourself in CRIStin.
9. Who can receive personal data about you?
Disclosure or export of data is defined as any distribution of data other than to its own system/processing, to the registered person itself or to someone who receives data on its behalf. UiO can disclose or export data that contain personal data to other systems. That is to say to external data processers in cases where it is considered necessary. Your personal data will not be distributed to countries outside the EU/EEA, or to international organisations.
Your personal data may be distributed to the following parties/organisations:
9.1 Unit – The Agency for Public Management and eGovernment and joint services in higher education and research – supplier and developer of FS
Employees of Unit who need it in their work and will have access to your personal data in order to carry out customer support and any troubleshooting in FS.
9.2 Student Welfare Organization in Oslo and Akershus (SiO)
If you have paid your semester fee for the current semester, or have been accepted for admission to a specific study programme in the past two months, SiO may retrieve personal information about you from UiO. This in order for them to know that you are a student and that you are entitled to a student discount on the student welfare organization’s services. The Student Welfare Organization can retrieve your personal ID number (11 digits), your name, when you last paid the semester fee and the ID on your student card.
9.3 The central public registry (Norwegian National Population Register)
If you come to Norway to study and are not yet registered in the National Population Registry, UiO will apply to Samordna opptak for you to be given a temporary personal ID number (S number). Samordna opptak checks with the National Population Registry that you are not already registered before you are given an S number.
9.4. Norwegian Directorate of Immigration (UDI)
If you are not registered with a permanent residence permit in Norway, UiO will prepare a report about you regarding study progression and part-time work permit. The report is provided to you in paper form from UiO, and then you yourself give it to the Norwegian Directorate of Immigration (UDI). Read more about UDI’s regulations.
9.5 The Norwegian State Educational Loan Fund
In order for you to avoid documenting that you are a student and that you have taken examinations and obtained results from part of a programme of study abroad, the Loan Fund will receive this personal data on you directly from FS at UiO. They also obtain information on your Norwegian ID number/D number (11 digits) and the name of the university/university college to which you are admitted to as a student.
9.6 User administrative system
To receive an IT user account at UiO and access our IT services, your personal data must be registered in our user administrative system called Cerebrum. FS sends personal information, such as your address, group affiliations and information about registration for classes and examinations to Cerebrum.
9.7 Canvas (digital learning environment system)
UiO uses Canvas for educational purposes. This means that Instructure, which develops and operates Canvas, will have access to your name, your username and your UiO e-mail address.
9.8 Inspera and other providers of digital exam systems
- At UiO, we use the Inspera Assessment digital exam system for a number of exams. To make it possible for you to take a digital examination, we send your personal data to Inspera, who develops and operates the Inspera Assessment system. They will have access to this personal data: Feide ID, candidate number, other examination data from FS and your IP-address.
- For the professional study programme in medicine, and certain other programmes in clinical nutrition at the Faculty of Medicine, the examination system Questionmark Perception (QP) is used.
- For certain scourses at the Faculty of Mathematics and Natural Sciences the assignment delivery solution, Devilry is used.
- The Faculty of Mathematics and Natural Sciences offers digital courses in health, safety and the environment (HSE) in the eHMS system. The courses are offered to students at UiO who are entitled to HSE training in the course of study.
9.9 My Studies
At UiO, you as a student will have a personalized calendar and messaging service. The solution collects from FS information about which study programme and courses you are registered for.
9.10 UiO’s access control system
Information about you will be registered in the university's access control system in order for you to access the University buildings and rooms during your studies by using your student card. Students who want a student card are photographed at the SiO customer service centre. The photos on active study cards are stored in FS and will be the same photos that are transferred to the mobile app Studentbevis, for students who choose to use the app.
If you consent i the Studentweb (My profile), your photo might be visible to your teachers at UiO in order to identify you when attending classes and on student overviews of courses or programmes of study.
9.11 Computas (supplier of the Studentbevis app)
If you are a student at UiO, have registered for the semester and have paid the semester fee, you can download the Studentbevis app. With the app, you can prove that you are a student. Your personal data is only sent to the app if you log into the app with your UiO user name and password (Feide). The Studentbevis app shows your name, study location, and whether you have paid the semester fee and registered for the current semester. The app also shows the photo that SiO has taken of you on behalf of UiO. You download the app yourself and log in, and you control to whom you show the digital student card. Using the app is voluntary.
9.12 ePhorte (filing system)
If you have an application and/or decision making process ongoing at UiO, this will be recorded in the university’s administration and filing system called ePhorte.
UiO uses robot software to automate the processing of appeals against grades and complaints about formal examination errors.
9.13 Other universities and university colleges
- Application for admission through Samordna opptak
When you apply for admission to UiO through Samordna opptak, your application will, in most cases, be handled by UiO. If you have applied for admission to one or more other universities or university colleges, they may want to process your application on behalf of all the universities/university colleges you have applied to. In such cases, they will process and store personal information about you relating to your application(s). Your application will mainly contain personal information that you register in the application portal of Samorda opptak.
- Consent to exchange of examination results
If you have achieved results on subjects, obtained degrees from a university or university college, and would like to use these results in connection with your application for admission to another Norwegian university/university college, you can consent to the exchange of examination results. As soon as you have given your consent, an administrator can retrieve all of your results from all institutions in Norway that use FS. That means most universities and university colleges, except for BI Norwegian Business School.
- Approval of foreign education (GAUS)
If you have applied for approval of foreign education, the details linked to the application, including personal data about you, will be transferred to GAUS – a search service for the approval of foreign education. Other universities and university colleges in Norway have access to search for and see personal information about you in GAUS.
- Decision on sanctions related to behaviour (RUST)
In cases where it is recorded that the University of Oslo has reached a decision about sanctions for you, this decision will most often be sent to RUST (register for banned students). The decision on the sanction is linked to one or more of the following: use of false diplomas, disturbing/troublesome behaviour, dangerous behaviour, gross violation of confidentiality, gross improper behaviour in practical or clinical education, cheating, attempts at cheating, complicity in cheating, or exclusion resulting from a suitability assessment. If, during the sanction period, you have applied for admission to, or wish to take an exam, at a Norwegian university or university college, selected persons in this institution will have access to your personal information. In some cases this also applies if you have registered for exams. See also the privacy declaration for RUST.
9.14 NOKUT - The Norwegian Agency for Quality Assurance in Education
- Approval of foreign education
If you have applied for approval of foreign education, the details linked to the application, including personal data about you, will be transferred to GAUS – a search service for the approval of foreign education. NOKUT has access to search for and see personal information about you in GAUS.
Studiebarometeret is an annual survey which provides information to universities/university colleges, students and others about the students’ view on the quality of education. The results are used by the institutions for improving the quality of education, as well as for research purposes. The survey is conducted by NOKUT on behalf of the Norwegian Ministry of Education and Research.
9.15 BIBSYS/library system provider
In order to be able to be established as a borrower at UiO and make use of the library services, we will send your personal information to BIBSYS. This happens only when you are registered for the current semester and have paid the semester fee.
9.16 Norwegian Centre for Research Data (NSD) and Database for Higher Education (DBH)
In certain cases, UiO sends personal information about you to NSD and DBH for research and statistical purposes. This is personal information related to
- your application for admission to study programmes
- your registration for the current semester, paid semester fee and registration(s) for course(s)
- exams you have passed
- your obtained degrees
- your exchange stays
- if you have obtained credits according to your educational plan
- you and your doctorate study programme
9.17 Statistics Norway
In some cases, UiO sends personal information about you to Statistics Norway for research- and statistical purposes. The information is transferred via DBH. This is personal information related to
- your registration and payment for the semester
- your examination result(s)
- your completed study programme
- your achieved degrees
- you and your admission to a doctorate study programme
9.18 Norwegian Institute for the Study of Innovation, Research and Education (NIFU)
In some cases, UiO sends personal information about you to NIFU for research purposes. This is personal information that is related to your Master's degree (in some cases your bachelor's degree), and your doctorate degree. The information is transferred via DBH.
9.19 Department of Health
If you have completed a course of study that can lead to authorization or license according to the Health Personnel Act, UiO sends your personal information to the Health Department (HPR). The information includes your name, personal identity number (11 digits), information on your study programme, and the degree you have obtained. That way you will not have to apply for authorization when you have completed such a study programme.
9.20 The Norwegian Armed Forces
Each year the Norwegian Armed Forces requests and receives lists of the names of students who are admitted for programmes of professional study at UiO, as well as lists of those who UiO expects to complete these studies.
9.21 UNINETT AS
It is possible to log in to Søknadsweb and Studentweb with the login service Feide. Feide is developed and provided by UNINETT AS. Employees of UNINETT AS, who needs it in his/her job, will have access to your Feide name and IP address. This is to provide user support and error correction in the service. After six months, your personal information in Feide will be deleted.
9.22 The Agency for Public Management and eGovernment (Difi)
It is possible to log into Søknadsweb and Studentweb with the login solutions MinID, BankID, Buypass and Commfides via the ID port. The Agency for Public Management and eGovernment (Difi) is responsible for personal information processed in the ID port, as well as information used to manage MinID. If you log in with the ID port, employees in the help desk and Difi management can see your personal identity number and contact information as well as time-limited login history. The need arises when Difi needs to provide assistance to users or for fault isolation/troubleshooting in the service.
The suppliers of the electronic IDs (BankID, Buypass, and Commfides) are responsible for the processing of personal data necessary for managing of their login solutions.
9.23 Disclosure of personal information according to the Freedom of Information Act
In the event that UiO receives applications for access according to the provisions of the Freedom of Information Act, the provisions of the Personal Data Act and the Personal Privacy Regulation will not be able to provide restrictions to right of access where the request applies to personal information. Therefore, it may be the case that UiO sends personal information about you to parties other than those mentioned in this privacy declaration.
9.24 Student evaluations in the quality assurance system for educational activities
Students at UiO are regularly invited to take part in evaluations of study programmes and courses as part of the quality assurance system for educational activities. The quality assurence system ensures that there are regular reviews of the quality and of measures for improvement in educational programmes and in the educational activities as a whole.
10. Security relating to your personal information
UiO regularly conducts risk- and vulnerability analyses of the data processing systems we use in order to safeguard your personal information. We also have several security measures, such as access controls to prevent more employees than necessary from being able to gain access to your personal information. Employees have a duty of confidentiality in respect of personal information they receive as part of their work.
11. Your rights
Right to information and access
You are entitled to information about how UiO processes your personal data. This privacy declaration is intended to contain the information you are entitled to receive.
You are also entitled to see/gain insight into any personal information registered on you at UiO. You are also entitled to receive a copy of your personal information if you wish.
Right of correction
You have the right to have incorrect personal information about you corrected. You also have the right to have incomplete personal information about you supplemented. If you believe we have registered incorrect or incomplete personal information about you, please contact us. It is important that you state the reason and, where appropriate, document why you believe the personal data is incorrect or incomplete.
Right to limitation of processing
In certain cases you may have the right to require that the processing of your personal data be limited. Limitation of personal data means that your personal information is still being stored, but that the possibilities for further use and processing will be limited.
If you believe that your personal information is incorrect or incomplete, or you have protested against the processing, you are entitled to require that your personal information be temporarily restricted. That means that the processing will be restricted until we have corrected your personal information, or have assessed whether your protest is justified.
In other cases, you may also require a more permanent restriction of your personal information. In order to be entitled to require the restriction of your personal data, the terms of article 18 of the Personal Data Protection Regulation must be met. If we receive a request from you for restriction of personal data, we will assess whether the conditions of the law are being met.
Right of deletion
In some cases, you are entitled to request that we delete personal information about you. The right of deletion is not an unconditional right, and whether or not you have the right of deletion must be considered in the light of the Personal Data Act and the Personal Data Protection Regulation. If you wish to have your personal information deleted, please contact us. It is important that you state the reasons why you want your personal information deleted, and if possible, which personal information you want to have deleted. We will then consider whether the legal conditions for requiring deletion are met. Please note that in some cases the legislation allows us to make exceptions from the right to deletion. For example, this would be the case when we are obliged to store your personal data to fulfil a task that is required by the University and University College Act, or to safeguard important societal interests such as archiving, research and statistics.
The right to object
You may have the right to object to the processing, that is, to protest the processing, if you have a special need for the processing of your personal data to be stopped. Examples may be if you have a need for protection, a secret address, or similar. The right to protest is not an unconditional right, and it depends on what is the legal basis for the processing and whether you have a special need. If you protest against the processing, we will consider whether the conditions for protesting are met. If we determine that you have the right to protest the processing, and that the objection is justified, we will stop the processing and you will also be able to demand the deletion of the information. Please note that in certain cases we can make an exception from deletion. For example, this could be the case when we are obliged to store your personal data to fulfil a task that is required by the University and University College Act, or to safeguard important societal interests.
Right to appeal against the processing
If you believe we have not processed your personal data in a correct and lawful manner, or if you believe that we have failed to fulfil your rights, you have the possibility to appeal against the processing. You can find information about how to contact us under Point 12.
If we do not accept your complaint, you have the option of presenting the complaint to the Norwegian Data Protection Authority. The Norwegian Data Protection Authority is responsible for verifying that Norwegian companies comply with the provisions of the Personal Data Act and the Personal Data Protection Regulation in processing personal data.
The university director of the University of Oslo (UiO) is the data controller for personal data in the common Student System (FS) and the other systems we use in connection with education, cf. the Personal Data Protection Regulation Article 4 No. 7. The daily follow-up of this responsibility is delegated to the IT director at UiO.
If you wish to make use of your rights referred to in Point 11 above, please contact us at email@example.com. We will deal with your inquiry without undue delay, and no later than one month after we receive the request.
Data protection officer
UiO has a data protection officer who safeguards the data privacy interests of both students and employees of UiO. The data protection officer for administrative processing of personal data at UiO can be contacted by e-mail at firstname.lastname@example.org.