Processing of personal data for lecturers, organisers and students

Processing of personal data for lecturers, organisers and students

Audio and visual recordings entail processing of personal data. If you are going to record a lecture, course or seminar for which you are the lecturer or among the students, you are obliged to ensure this is done securely and lawfully.

  • For lecturers and organisers

    For lecturers and organisers

    Recording lectures, courses or seminars on campus

    1. Area of application

    The procedures for using recording equipment apply to all audio and/or visual recordings carried out at the Norwegian School of Economics (NHH).

    The procedures encompass two different recording situations:

        1. Presentations and the voice of the lecturer.

    This includes recordings of what the lecturer shows on the screen and his/her voice.

        1. Recordings (audio, visual, video) from the room.

    This includes recordings of everything taking place in the room during the lecture. Everyone in the room is potentially in the recording either by voice, visually or both.

    It is important to conduct a concrete assessment of each recording situation in terms of need and implementation.

    2. Assessment of purpose

    In accordance with the General Data Protection Regulation (GDPR), NHH is required to document the purpose of personal data processing. This follows from the GDPR Article 5 (1) (b), which states that personal data shall be collected for ‘specified, explicit and legitimate purposes’.

    (i) Teaching

    This assessment of purpose applies to all recordings carried out at NHH as part of teaching activities. The purpose of recording teaching activities at NHH is to provide teaching at a high academic level, and increase the students’ learning by giving them an opportunity to watch or listen to the whole or parts of lectures, courses etc. after they took place. If a course has several teaching activities of the same nature, the purpose will be the same for all recordings of the series of lectures.

    (ii) Recording for purposes other than teaching

    For all other types of recordings than those made in connection with teaching at NHH, the person responsible for the recording must document its purpose. The purpose must be related to NHH's activities.

    3. Grounds for processing

    The person responsible for the audio/visual recording must ensure that they have grounds for processing, legal grounds, for the recording. This must be assessed every time they wish to make a new recording. By grounds for processing is meant clear lawfulness in accordance with the list given in the GDPR Article 6.

        1. Lawfulness based on performance of a contract – the GDPR Article 6 (1) (b)

    NHH's grounds for processing in relation to ordering lectures to be recorded is the lecturer’s employment at NHH. Lecturers, and those holding courses and giving talks who make recordings on their own initiative must document consent to recording. The settings of all recording equipment must require the recording to be activated manually.

        1. Public interest – the GDPR Article 6 (1) (e)

    Teaching at universities and university colleges is in the public interest. The legal grounds for processing personal data are supplemented with reference to the Act relating to Universities and University Colleges Section 3-8 on teaching, Section 4-2 on individual education plans and Section 4-3 on the students’ learning environment. Grounds for processing for other recordings in the public interest (but that are not related to teaching) exist when it is clearly stated in an act or regulations pursuant to an act that personal data can be processed. This means that in addition to the legal grounds set out in Article 6 (1) (e), additional grounds must exist in other legislation in order to use this Article as legal grounds for the processing.

        1. Consent – the GDPR Article 6 (1) (a)

    As a rule, consent is not recommended as the legal grounds for recording in teaching situations. The GDPR stipulates stringent requirements for consent and this will in most cases be so stringent that consent can easily be deemed invalid. The fact that consent must be entirely voluntary also means that it cannot be used in a teaching situation where attendance is compulsory.

    4. Information about the recording

    The person responsible for the recording must inform the persons present in advance of the following:

        • That NHH wishes to make a recording
        • The purpose of the recording
        • The legal grounds for the processing
        • Where the recording will be stored, for how long and who has access to it
        • How the recording will be published

    It is very important to remember that if the lecturer or a person holding a course or giving a talk chooses to record a lecture, it must be ensured that it is only that person who is in the recording. If the intention is an active lecture, it is recommended that the recording is stopped when the participants ask questions. If this is not done, it must be ensured that the recording is edited or that consent is obtained from those exposed in the recording.

    5. Use of the recording

    Audio and/or visual recordings made for a specific purpose cannot be used for another purpose than that which applied at the time of recording, without conducting a new assessment of the grounds for processing. This follows from the requirements for processing in the GDPR Article 5 (1) (a).

    6. Deletion of the recording

    A recording must be deleted when the purpose of the recording has been fulfilled. This follows from the requirements for storage in the GDPR Article 5 (1) (e).

    7. Responsibility for recording equipment

    Equipment used for audio and/or visual recordings are made available to the user ‘as they are’. NHH cannot guarantee the accuracy or relevance of the information made available from using the tool. The person who uses the equipment understands and accepts that data and telecommunication systems are not without their faults and that there may be periods of downtime. NHH cannot guarantee that the recordings will be uninterrupted, secure or faultless, or that loss of data will not occur.

    The user of the recording equipment alone is responsible for their actions relating to use of the recording equipment. If NHH becomes aware that use of NHH's resources and tools entails a breach of our internal rules and procedures or Norwegian law, the right to use NHH’s recording equipment will be withdrawn with immediate effect.

    Streaming and recording of digital teaching

    Streaming of digital teaching

    When streaming teaching sessions, it is in general voluntary for students to participate using video and/or sound. The student controls this through the settings when connecting to the stream and he/she can also change the settings at any time during the stream. 

    Recordings of digital teaching

    Recordings of digital teaching sessions where only the lecturer is in the recording are considered to be on a par with the recording of normal teaching at NHH. The lecturer can consent to recording by starting the recording him or herself.

    It must be considered whether NHH’s need to record the session is strictly necessary to fulfil the purpose of the education. This means that the recording must be suitable to fulfil the purpose, necessary for the purpose and proportional in relation to the disadvantages to the students’ protection of privacy. NHH shall not order students to be filmed without informing them of this in advance.

    As a rule, if it is not necessary to make a recording to fulfil the students’ rights and the department’s obligations, it must not be done.

    This assessment of lawfulness assumes that NHH’s standard settings in Zoom are used. This means that as standard, students who log in to see the streamed teaching session cannot be seen or heard by others.

    Information must be given before or at the start of the lecture that students who wish to ask questions during the lecture using a microphone or camera will be part of the recording. The following information must be provided: 

    • that the session is being recorded and all questions ‘from the floor’ will be part of the recording. Those who do not want to be included in the recording can be encouraged to use the chat function in Zoom or send questions by email. 
    • the purpose of the recording 
    • how long the recording will be stored 
    • where the recording will be stored and, if relevant, who it will be shared with 
    • who has access to the recording 
    • the legal grounds for the processing (Ordinary teaching: the GDPR Article 6 (1) (e), cf. the Act relating to Universities and University Colleges Section 1-3) (NHHE’s activities: the GDPR Article 6 (1) (b))

    If the recordings are going to be used for a purpose other than their necessity in teaching (e.g. quality assurance/research/learning analytics etc.), consent must be obtained from those in the recording. 

    Systems which can be used in the context of teaching at NHH

    Canvas

    • contains websites for all courses at NHH
    • only students who have registered for the course have access to the course content
    • access is controlled by registrations in StudentWeb (FS)
    • the person responsible for the course shares files, videos, links etc.

    Canvas Studio

    • sharing of videos in Canvas
    • same access control as Canvas
    • screen recordings made in e.g. Zoom can be distributed here

    Office365

    • available to all students and staff with valid NHH accounts
    • includes Office, OneNote, Teams, etc.

    Zoom

    • Video conferences
    • Webinars
    • Screen recordings
    • Available to all students and staff

    Adobe Connect

    • Video conferences
    • Webinars
    • Screen recordings
    • Limited use. Uninett is phasing it out and replacing it with Zoom

    MS Teams

    • Video conferences
    • Screen recordings
    • Recordings are uploaded automatically to Stream (Office365) and are available to the people participating in the meeting that was filmed – the meeting organiser owns the recording.

    Qualtrics

    • Questionnaire surveys
    • Available to all students and staff

    Aventia

    • Recordings of lectures
    • Built-in system in Aud Max, A, B, C, D, M33 and Jebsen
    • The recording is started/stopped by the lecturer in the auditorium
    • The recording is made available on a video server operated by NHH: https://video.nhh.no
    • Recordings are normally deactivated after one year, i.e. they are available for the current and following semester (for students retaking the course)
  • For students

    For students

    The following procedures apply to recordings made of lectures, courses or seminars at the Norwegian School of Economics. The procedures were prepared with a particular focus on the protection of privacy.

    What do I have to do before I can make a recording?

    Making recordings is permitted. If you make a recording on your own initiative, the recording can only be used for private purposes. It is a good idea to clarify with the lecturer in advance that you will be making a recording. This means that you cannot share the recording with anyone. If you want to share the recording, you have to ask everyone in the recording for their consent and inform them in an expedient manner.

    Consent must be obtained in accordance with the guidelines set out in the Personal Data Act. This means that the consent must be:

    • voluntary – without pressure and the person in question must be able to choose freely
    • specific – what the consent concerns must be precisely worded
    • informed – enough information must be provided so that the person in question understands what he/she is consenting to
    • unambiguous – there must be no doubt that the individual persons have consented
    • given through an active action – that the person in question must actively confirm his/her consent. Consent cannot be given passively, for example through pre-checked boxes
    • documentable – it must be possible to document the consent
    • possible to withdraw as easily as it was given – the person in question must be able to withdraw his/her consent without negative consequences

    What do I do after making the recording?

    Recordings for private use must not be distributed. If you want to distribute a recording that was originally intended for private use, you have to obtain the consent of everyone who was in the room at the time the recording was made.

    I have consented to being in a recording or I have given my consent to a recording being distributed. I wish to withdraw my consent. What do I do?

    You should be able to withdraw your consent at any time. You do not have to give a reason for withdrawing your consent. Consent must be withdrawn in writing to the person you gave your consent to.

    I am a student assistant and supervise other students. What systems can I legally use?

    The following systems can be used in cases where the Norwegian School of Economics is the controller

    Canvas

    • contains websites for all courses at NHH
    • only students who have registered for the course have access to the course content
    • access is controlled by registrations in StudentWeb (FS)
    • the person responsible for the course shares files, videos, links etc.

    Canvas Studio

    • sharing of videos in Canvas
    • same access control as Canvas
    • screen recordings made in e.g. Zoom can be distributed here

    Office365

    • available to all students and staff with valid NHH accounts
    • includes Office, OneNote, Teams, etc.

    Zoom

    • Video conferences
    • Webinars
    • Screen recordings
    • Available to all students and staff

    MS Teams

    • Video conferences
    • Screen recordings
    • Recordings are uploaded automatically to Stream (Office365) and are available to the people participating in the meeting that was filmed – the meeting organiser owns the recording.