What privacy rights does the data subject have?
When UiO processes assessments or information about specific individuals, such as employees, students, guest researchers, guests or respondents/informants in research projects, these individuals have certain privacy rights.
The rights are pursuant to The General Data Protection Regulation and the Personal Data Act. The following rights are the most important:
- the right to information: When UiO obtains information directly from the data subject, they (the data subject) have the right to know the contact information of the Data Controller and the Data Protection Officer, and the legal basis for the processing. They also have the right to know who will receive the information, the time period of which the information will be stored and any other rights they have accordning to the Privacy Act. UiO has a corresponding information obligation when they obtain information about individuals from other sources than the individuals themselves.
- the right to access information: The data subject has the right to request access to the personal data about him or her that UiO processes. The individual may also ask UiO for information about what has been done to ensure that data relating to him or her is processed in a secure manner
- the right to demand rectification: The data subject has the right to ask UiO to rectify inaccurate, incomplete or outdated information about him or her
- the right to demand erasure: The data subject has, on certain conditions, the right to have personal information about themselves erased by UiO. This may happen, for example, if the data subject withdraws the consent on which the processing is based, if the personal information has been processed illegally or if the personal information no longer is necessary for the purpose for which they were collected.
- the right to limited processing: The data subject has, on certain conditions, the right to demand that the UiO processing of personal information is limited. This may happen, for example, if the processing is illegal and if the data subject is opposed to erasure.
If UiO processes personal data based on the consent of the data subject, such as respondents or informants in research projects, the individual has the right to withdraw consent at any time. UiO must then erase or anonymise all data that he/she has given consent for UiO to process.
The data subject may claim compensation from UiO if he or she has suffered financial or non-financial injury as a result of serious privacy violations in the processing of personal data.
Also, the general public is entitled to obtain general information on how UiO processes personal data in research, education, administration and communication. Among other things, they shall be informed of what types of personal data UiO processes and what the data is used for.
UiO informs students of this in its privacy declaration.
Who can employees, students, guest researchers and guests approach to safeguard their privacy rights?
It is the owners of UiO’s electronic services and systems who administer the privacy rights of employees, students, guest researchers or guests at UiO.
The individual shall contact the person who exercises data controlling responsibility at UiO if he or she wishes to assert his or her rights in relation to a particular system or service. This can be done by sending an e-mail to the following address: behandlingsansvarlig@uio.no.
If the individual does not receive the help that he or she needs from the person who exercises data controlling responsibility, he or she can approach the Data Protection Officer at UiO. This can be done by sending an e-mail to the following address: personvernombudet@uio.no.
Who can participants in research projects – respondents or informants – approach to safeguard their privacy rights?
It is the managers of the research projects at UiO who administer the privacy rights of respondents or informants in research projects.
Persons who participate as respondents or informants in research projects performed at UiO must contact the manager of the relevant research project if they wish to assert their rights, for example if they wish to withdraw consent to participate in the project.
If respondents or informants in research projects do not receive the help they need from the project manager, they may approach the person who exercises data controlling responsibility at UiO. This is done by sending an e-mail to the following address: behandlingsansvarlig@uio.no.