1) Brief presentation of RUST
RUST, the Register for Banned Students, is a common register that enables secure and efficient communication of decisions to impose sanctions, cf. Sections 3-7 (8), 4-8 (1) to (3), or 4-10 (3) of the Act Relating to Universities and University Colleges, as well as the exchange of information about sanctions, between learning institutions.
Sanctions may be issued as a result of one or more of the following: use of a false diploma, disruptive/harassing conduct, dangerous conduct, aggravated breach of confidentiality, gross negligence during internship or clinical instruction, cheating, attempted cheating, aiding in cheating or expulsion based on a suitability assessment.
3) What is personal data?
The term personal data includes any data, information and assessment that can be linked to you as an individual, cf. GDPR Article 4 no. 1. The determining factor in whether data is considered personal information, is whether it is fit to identify a specific person.
In some cases, data which, on its own, cannot be linked to an individual person, may constitute personal data if it is used in combination with other data.
4) The purpose of the processing of personal data in RUST
The purpose of processing personal data in RUST is to prevent you, provided you have been deprived of certain rights due to having sanctions imposed on you, from acquiring similar rights at another institution. Personal data is used to securely identify data subjects.
The legal basis for the processing of personal data in RUST is established by the Regulations Relating to a Register for Banned Students (RUST), and Section 4-12 of the Act Relating to Universities and University Colleges.
5) Which kinds of personal data are processed in RUST, and how long to we store your personal data?
No sensitive personal data is stored in RUST.
If a university or university college has decided to impose sanctions against you pursuant to Sections 3-7 (8), 4-8 (1) to (3) or 4-10 (3) and has registered this sanction in the study administration system Common Student System (FS), the decision may be sent to RUST.
Whenever relevant and necessary, RUST may have the following data on you: your national identity number, the institution number for the institution you are enrolled at/have applied to, the type of sanction, the sanction period, statutory authority, study classification and the name of the administrative officer at the institution.
When the sanction period is over, your personal data will automatically be erased from RUST.
If you, during the sanction period, have applied for admission to another Norwegian university/college, your personal data will be transferred to this university/college. A few select staff at this information will be able to access your personal data. In some circumstances, this also applies if you have registered for an examination. Your personal data will be automatically erased from the institution’s database 12 months after the expiration of the sanction period.
6) Automatic processing
Your personal data will not be made subject to automated processing or profiling.
7) Disclosure of your personal data to third parties
Disclosure or export of data is defined as any transfer of data save for use in the controller’s own systems/processing or to the data subject itself or any other party receiving data on the data subject’s behalf. Unit may disclose or export data including personal data to other systems, i.e. external data processors, whenever it is deemed necessary.
Your personal data will not be disclosed to countries outside of the EU/EEA, or to any international organizations.
The personal data registered about you in RUST may be disclosed to the following parties/agencies:
- University Center for Information Technology (USIT) at the University of Oslo (UiO)
RUST is operated by USIT at UiO. USIT staff who need to access your personal data as part of their job will be granted such access. They need this access in order to provide user support and, if relevant, correct errors as part of their duties.
- Other universities/university colleges
Norwegian universities and university colleges will only have access to your personal data in cases where you have applied for admission or attempted to register for examinations at their institution. This is to prevent you, in cases where you have been deprived of certain rights due to having sanctions imposed on you, from acquiring similar rights at another institution.
8) Personal data safety
In order to protect your privacy, all transfers of data to and from RUST are encrypted. Only a small number of administrative staff, who need access in order to perform their duties, have access to personal data in RUST. In addition, Unit regularly performs risk and vulnerability analyses and test the security of RUST to protect your personal data.
9) Your rights
Right to information and access
You also have the right to view/access any and all personal data registered about you at Unit. You also have the right to request a copy of the personal data registered about you if you so wish.
Right to correction
You have the right to have corrected any and all incorrect personal data about you. You also have the right to supplement any and all incomplete data registered about you. Please contact us if you believe we have registered incorrect or incomplete personal data about you. It is important that you justify and, if relevant, document why you believe the personal data registered is incorrect or incomplete.
Right to limit processing
In certain circumstances, you have the right to demand limited processing of your personal data. Limiting the processing of personal data means that your personal data will still be registered, but the opportunities for further processing are limited.
If you believe that personal data about you is incorrect or incomplete, or you have filed a complaint against the processing of your data (read more about this below), you have the right to demand to demand that the processing of your personal data be limited temporarily. This means that processing will be limited until, if relevant, we have rectified your personal data, or until we have been able to assess whether your complaint is justified.
In other circumstances you may also demand a more permanent limitation on the processing of your personal data. In order to qualify for the right to limit processing of your personal data, the conditions established by the Personal Data Act and Article 18 of the GDPR must be met. If we receive a request from you to limit processing of your personal data, we will assess whether the statutory conditions have been met.
Right to erasure
In certain circumstances you have the right to demand that we erase your personal data. The right to erasure is not unconditional, and whether this applies to your situation must be assessed in light of relevant privacy legislation, i.e. the Personal Data Act and GDPR. Please contact us if you want to have your personal data erased. It is important that you justify why you want the personal data erased, and, if possible, that you also specify which personal data you want erased. We will den consider whether the conditions for erasure, as established by law, have been met. Please be advised that the law allows for us to make exceptions to your right to erasure. For example, we may need to store personal data for the purpose of performing a task in compliance of the Act Relating to Universities and University Colleges, or for reasons of public interest, such as archiving, research and statistics.
Right to object
You may have the right to file an objection against the processing, i.e. object to the processing, on grounds that you have a specific need to stop the processing, e.g. if you have a need for protection, have a secret address, etc. The right to object is not unconditional, and it is contingent upon the legal basis for the processing, and on your particular circumstances. The conditions are established by Article 21 of the GDPR. If you object to processing of your personal data, we will consider whether the conditions for filing an objection have been met. If we find that you have the right to object to the processing and that your objection is justified, we will discontinue processing, and you will have the right to demand erasure of the data. Please be advised that we, under certain circumstances, may make exceptions from erasure, e.g. if we have to store your personal data for the purpose of performing a task in compliance with the Act Relating to Universities and University Colleges, or for reasons of public interest.
Right to file complaint against processing
If you believe we processed your personal data incorrectly or unlawfully, or if you believe we failed to protect your rights, you have the right to file a complaint against processing. Please see item 10 below for how to contact us.
If we dismiss your complaint, you may file your complaint with the Norwegian Data Protection Authority (DPA). The DPA is responsible for making sure Norwegian enterprises comply with the provisions of the Personal Data Act and the GDPR in their processing of personal data.
10) Contact information
The Ministry of Education and Research is the data controller of personal data in RUST, cf. GDPR Article 4 no. 7. The Ministry of Education and Research have delegated the day-to-day responsibility to Unit – The Norwegian Directorate for ICT and Joint Services in Higher Education and Research. Unit manages RUST and processes personal data in the Diploma Registry on behalf of the data controller.
Contact information for Unit: firstname.lastname@example.org