Processing of personal data in degree projects

Personal data is any information that relates to an identified or identifiable natural person. This person is called the data subject. All information that can directly or indirectly identify a person is considered to be personal data. This includes any information that can be linked individually or together with other information to a living person. Examples include name, personal identity number, IP address, pictures, audio recordings and email addresses.

In order to determine whether a natural person is identifiable, all aids that can reasonably be used to directly or indirectly identify the person must be considered. If, for example, there is a saved key code that allows the information to be linked to a person, this is a matter of personal data. Even if you as a student do not know which person the information applies to, it constitutes personal data. It is enough that someone can link the data to a natural person.

If the information is completely anonymous and cannot be linked to a natural person, the information falls outside the scope of GDPR.

Sensitive personal data

Some personal data is considered sensitive and has stronger protection in the General Data Protection Regulation. This is personal data that applies to:

• information about race or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;
• information about health or a natural person's sex life or sexual orientation;
• processing of genetic and biometric data to identify a natural person.

The main rule according to GDPR is that it is prohibited to process sensitive personal data. However, there are certain exceptions, for example if the data subject has consented to the processing.

The first thing you should do is consider whether it is necessary to process personal data for your work. Think about the purpose of the work and whether this purpose can be achieved without processing personal data. If you consider it necessary to process personal data, you should also consider what types of data and to what extent it is necessary to process them.

Formulate the purpose of the work and why the personal data is to be processed. Decide what the goal of the work is and in what way the personal data contributes to achieving this goal. A brief description of what the personal data is to be used for and why it is processed is sufficient. The important thing is for the purpose to be clear and distinct.

It is not permitted to process more personal data than is necessary to achieve the purpose. Also decide which categories of personal data are to be processed and whether sensitive personal data will be processed. Examples of categories are contact information, information concerning political opinions, etc.

All personal data collected must be processed in a secure manner. It is important that unauthorised persons do not have access to personal data.

Decide what will happen to the personal data when the work is completed. Personal data may not be retained for longer than is necessary and is to be deleted when the work has been presented and graded.

This step is the practical work of your study.

When the work is completed, the personal data must be deleted as determined in step 4.