What "processing of personal data" means
Processing of personal data refers to, in principle, any handling of personal data, such as entering, storing, scanning, photographing, editing, analysing, printing, emailing, scanning for viruses, backing up and deleting data.
Not only names and personal identity numbers are personal data, but also people's user names, email or biometric data, for instance. Some data are considered as regular personal data, other as sensitive personal data.
What is considered regular personal data?
Personal data is any kind of information that can be directly or indirectly linked to a living person. This means that not only names and personal identity numbers are personal data, but also people's user names, UMU ID, email or IP addresses, biometric data, physiological status and voice recordings. When you know who has submitted an answer to a survey, the answer is also considered personal data.
Combinations of data can also be regarded as personal data if the combined information can be used to link the data to a natural person. Even if no name, personal identity number or address is registered, any other registered data will be regarded as personal data if the information enables you to identify a particular individual.
What is considered sensitive personal data?
According to the General Data Protection Regulation, sensitive personal data are data that can reveal racial or ethnic origin, political opinion, religion or beliefs, trade union membership, sexual orientation, or personal data concerning genetic, biometric or health status. Health data can, for instance, be sickness absence, pregnancy or medical consultations.
Even if information is not classed as sensitive personal data, it can also be sensitive to someone’s integrity or be classed as particularly worthy of protection. This could be salary figures, transgressions of the law, assessing details such as notes from a development discussion, results from personality tests or personality profiles, information regarding someone’s personal life or social circumstances. Personal identity numbers are regarded as personal data particularly worthy of protection.
Are you going to do a student work where you will process personal data?
First of all, you need to decide whether the personal data you want to process are regular personal data or sensitive or integrity sensitive personal data.
Make sure to follow the rules!
You have to follow the rules described in the Rules and procedures for processing personal data in student assignments when you use personal data in your work. This applies to student assignments such as degree projects, theses, reports and other written assignments.
If you are processing regular personal data
To process personal data, you need individual consent from each person whose personal data you intend to process. Use the relevant version of the templates below to obtain consent.
When processing the personal data, you may only use the tools and services the University refers to, in this case Microsoft 365. Your supervisor or teacher will set up a team in Teams that only you and your teacher or supervisor will have access to. All data is to be collected, stored and processed through the team.
If you are processing sensitive personal data or personal data that merit special protection
The General Data Protection Regulation states that the processing of sensitive personal data is prohibited. However, there are some exceptions from this prohibition. In some cases, it may add value for students to be allowed to process sensitive personal data or personal data that merit special protection. However, the legal scope for this is very limited.
- For a student to be allowed to process this type of data, the project must have been conducted under ethically acceptable terms.
- The faculty that your department belongs to can assess the suitability of the processing of personal data for the needs of the education.
- Only the University´s approved IT services may be used when processing personal data. Find out how to handle sensitive and privacy-sensitive personal data.
Forms for obtaining consents
Use the Swedish or English version of the templates below.
- Edit the texts that are highlighted in yellow so that the content matches what applies to your particular student project.
- Print two copies of the form.
- The person giving consent should sign both copies, and keep one.
- You take care of the other copy. Keep the signed form in accordance with the instructions from your supervisor.
Consent form for the processing of personal data and information to data subjects (template in English)
Samtycke till personuppgiftsbehandling och information till registrerade (template in Swedish)
