It is therefore important that digital teaching solutions comply with the rules outlined in The Personal Data Act and the General Data Protection Regulation (GDPR). Unit has developed guidelines (pdf) to assist institutions in safely implementing video teaching solutions, and UiA has used these guidelines as the basis for its own.
The guidelines are effective from 15 April 2020 until one of the parties identifies a need for changes.
See also: Safety and security training (sikresiden.no)
1. Scope
The guidelines apply to recordings or live streaming of teaching through digital solutions that include audio and/or video of individuals (personal data). Recordings or live streams not part of a teaching programme are outside the scope of these guidelines.
2. The institution must define the purpose of any recording or live streaming
Institutions governed by the Act relating to Universities and University Colleges are required to provide education at a high academic level. When an institution plans to deliver teaching through recordings or live streams, it must document the purpose of these activities. This aligns with GDPR Article 5(1)(b), which mandates that personal data be collected for 'specified, explicit and legitimate purposes.'
The overarching purpose of processing personal data in connection with the use of digital teaching services is to enhance students' knowledge. This purpose can be described, for example, on the digital learning platform used by the institution and must always be clearly communicated to the individuals involved in the recording or live stream.
3. Legal basis for processing personal data in recordings or live streams
- The legal basis for teaching formats that only record the educator(s) is the employment contract and the employer’s right to manage, cf. GDPR Article 6(1)(b). The employment contract and the right to manage allow the employer to dictate that employees conduct teaching digitally, cf. also GDPR Article 88.
- Where there is an agreement with an external educator and such teaching is part of the service, the agreement will serve as the legal basis, cf. GDPR Article 6(1)(b). The aforementioned legal basis will only cover teaching situations equivalent to a lecture—where the educator has a connection to the institution via an employment or service contract and delivers the teaching to multiple recipients via recording or live stream. A legal basis based on an agreement with the educator is not sufficient for teaching formats that include students' voices or videos in the recording or live stream.
- The relevant legal basis for teaching formats that require students to actively participate with input is that the institution performs a task in the public interest, which necessitates processing personal data, cf. GDPR Article 6(1)(e).
- Teaching at universities and university colleges is considered a task in the public interest. The legal basis for processing personal data can be supplemented by reference to the Act relating to Universities and University Colleges, Section 3-8 on teaching, Section 4-2 on individual education plans, Section 4-3 on learning environments and the regulations on the supervision and control of the quality of Norwegian higher education (Studietilsynsforskriften), Section 2-2 (5).
Interaction between students and the lecturer during teaching is essential, whether through questions or responding to assignments, to ensure the necessary knowledge dissemination.
The legal basis will apply to teaching that includes students, such as webinars, allowing students to ask questions or complete assignments. It should always be assessed in advance whether active student participation is necessary/appropriate to achieve the teaching's objectives, or if these objectives can be met with a video recording of only the lecturer. To minimize the impact on students' privacy, provisions should be made for students to ask questions or submit task responses to the teacher via a chat function, instead of being part of the recording through audio or video.
Public interest as a legal basis is particularly relevant for teaching conducted during the COVID-19 pandemic. This is justified by the need for UiA to offer education to students while limiting the spread of infection.
4. Information
UiA must inform those affected by a recording or live stream about the following:
- that the recording is taking place,
- the purpose of the recording,
- the legal basis,
- how and for how long the recording will be stored,
- how the recording is made available to others,
- who has access to the recording.
This information must be provided before the teaching session, preferably on the learning environment platform and linked to the relevant course. If a course has multiple teaching activities of the same nature, such as a series of lectures, the purpose can be described collectively for similar teaching activities. Information to students is provided via the functionality in Zoom. Students receive a notification when the recording starts.
During live streaming of teaching, it is initially voluntary for students to decide whether they wish to participate using video and/or audio. This choice is managed by the student through settings upon connecting to the stream and can be adjusted by the student at any time during the stream.
Students' participation can be facilitated in the following ways without being included in the recording:
- Questions can be asked in the chat
- The recording can be stopped before a Q&A session at the end
- A video lecture that students have watched beforehand can be shared, and the Zoom session can be a seminar where no recording is made
Video recordings of teaching that include students should only be embedded in Canvas and made available to students and the lecturer within the relevant course room.
Sensitive personal data and national identification numbers should not be disclosed by the lecturer in recordings.
If the lecturer does not want students to have the ability to record, they can disable the recording function in Zoom.
5. Use of recordings and subsequent deletion
Recordings of audio or video made for teaching purposes that contain personal data should not be used for any other purpose. Any new purpose would require a new legal basis. The recording should be deleted once its intended purpose is fulfilled; for example, after the teaching is concluded and the regular and any new/re-scheduled examinations for the course are completed, but no later than the end of the following semester. The deletion is carried out by the lecturer.
The course room in Canvas is archived and made unavailable to students and staff after three semesters.