Security, Emergency Preparedness and Data Protection at UiT

Background

As the world’s northernmost university, UiT is strategically placed to develop and disseminate knowledge about the Arctic and the High North. UiT focuses on research and education about nature, society, technology, environment, culture, humans and the interaction between these. Our academic breadth and closeness to nature and society make UiT uniquely suited to contribute knowledge and competence to transformation and adaptation processes and future-oriented solutions across disciplines, trade and industry and civil society.

UiT has students and staff from different countries and places and collaborates with research and educational institutions at home and abroad, as well as with public and private actors.
UiT is a comprehensive university at the international forefront that, due to its location and research profile, may be particularly vulnerable to threats and attacks. Activists, criminals, and state intelligence seek to achieve financial gain, political goals or other advantages through manipulation, sabotage, and espionage. UiT's research data may be particularly vulnerable to physical or digital security breaches in the event of, for example, sabotage and/or espionage.

Purpose and intention

Through preventive security, UiT will reduce the probability of an undesirable incident occurring and reduce the consequences of such an incident. This work must be seen in the context of emergency preparedness, which does not prevent an undesirable incident from taking place, but includes planning prior to an incident, the actual handling when this either occurs or is imminent, and the subsequent recovery. Through good work with emergency preparedness, UiT will be able to increase the level of security at short notice.

UiT has an extensive amount of assets, information and infrastructure that must be protected and preserved, and this requires a systematic and coordinated approach to the work. This also includes proper safeguarding of values worthy of protection, good export control routines to prevent illegal transfer of knowledge and ensuring that international cooperation takes place in a prudent manner.

Measures that are necessary for security purposes may be invasive to employees, students and others affiliated with UiT. When assessing which, and how, security measures should be implemented, it is essential to simultaneously consider how privacy is affected and best safeguarded. Furthermore, UiT processes a large amount of personal data in all parts of its organization, and good compliance with data protection legislation is important to maintain trust among employees, students, research participants, partners and guests.

Appropriate and good management of these areas requires that they are seen in context rather than separately, and that the work is organized and established as a coherent service. This is a challenging exercise, but at the same time necessary for UIT to achieve a proper level of security, and good protection of privacy for everyone associated with UiT.

To succeed in this, UiT has established a common management system for security, emergency preparedness and data protection.

Scope and content of the management system

The main areas to be safeguarded through this management system are information security, civil protection, emergency preparedness, data protection, export control and national security. All of these areas intervene, and they encompass the physical, human, organizational and digital domains. All these domains can constitute a vulnerability that can be exploited consciously or unconsciously, by external or internal actors. In order to achieve an adequate level of security, UiT is dependent on seeing these in relation to each other and taking into account the interaction between these different areas and above-mentioned domains. For example, digital systems may be well secured in themselves, but if the physical security is weak and a dishonest actor gets into a data centre, a lot of damage can be done.

Societal developments and a changed threat and risk picture blur the distinction between civil protection and state security. The work of identifying and safeguarding values that are important for national security is complicated, partly because relevant measures for compliance with the Security Act and export control regulations may interfere with the core activities and potentially UiT's opportunity for fulfilling its social mandate as a research institution.

In today's higher education, there is a strong focus on learning-promoting technology and digital examination methods, and it is difficult to balance the need to frequently use new services while at the same time safeguarding information security and privacy/data protection. Both the Ministry of Education and Research and UiT have ambitious digitalization strategies, and fulfilling these while safeguarding information security and privacy is a demanding task.

Furthermore, UiT processes a large amount of personal data about employees, students, research participants and others. The regulations for legal handling of personal data are extensive and complex, and good guidelines, routines, tools and knowledge are required to ensure that UiT complies with relevant regulations in all processing of personal data.

In addition, major accidents can occur as a result of technical or human error, pandemics, supply failures or other disasters triggered by unintended events such as natural disasters, or intentional actions of those who want to harm us. Such events can be in the physical or digital space, or a combination. The incidents can be so varied in scope and type that it is challenging to build good emergency preparedness that allows UiT to respond quickly and adequately.

The establishment of a common management system will ensure that UiT has a planned and good handling of this complex field. Safeguarding security, emergency preparedness and data protection is a managerial responsibility, and this work shall be an integral part of overall corporate governance.

The management system for security, emergency preparedness and data protection at UiT includes

• Anyone¹ who gets access to UiT's information assets
• All UiT study sites/campuses
• All organizational units
• All technology²
• All information assets³
• All critical national values (information, objects and infrastructure)

This management system does not include UiT's work within Health, Safety and Environment (HSE), which is regulated through its own internal control system. It is incumbent upon the university management to ensure good interaction between the management system and the HSE system.

------------------------------------------------------------------------------
¹ Students, employees, guests, partners etc.
² ICT systems, computer networks, databases/registers etc.
³ Information value is a collective term that includes both the information itself and associated support values such as ICT systems, digital services, computer equipment of various variants, etc.

Vision, goals and principles

UiT shall establish and maintain a sound security-culture, administration, management and safeguarding of its values in order to safeguard society's trust in the university's education, research and dissemination.

UiT shall:

• work targeted, systematic and risk-based with civil protection, information security, emergency preparedness and data protection
• take a comprehensive and common approach internally at UiT to this work
• reduce vulnerabilities to UiT's information assets
• include civil protection, emergency preparedness, information security and data protection in the university's decision-making processes
• simplify and improve the University's security, preparedness and data protection policies and processes
• improve the ability to detect and handle incidents, deviations and breaches quickly so that any consequences for the organisation are minimised
• provide training and awareness that enables managers, employees and students to prevent, detect and report incidents
• Include civil protection, emergency preparedness, information security and data protection as regular topics in management meetings and training

Risk management

UiT's risk picture is dynamic and will vary over time. It is therefore necessary to work systematically on risk management and acceptable risk. Effective risk management shall give students and staff the best possible basis for understanding how much risk UiT is willing to accept in the process of creating value. UiT has a risk-based approach to safeguarding security and emergency preparedness.

Risk management is central to good safeguarding of information security, data protection, civil protection, physical and personnel security, fire and emergency preparedness, and national security. Often, risk can be reduced to an acceptable level through measures, but in some cases the risk is too high for the projects in question, procurement of the desired systems, etc. This may be because there are no measures, or the measures are too costly to implement.

Risk assessment shall take place within the limits laid down in the management system, and there are some differences in how risk is assessed within the various areas, see Chapter 4. Carrying out risk assessments will depend on knowing which values are being processed, including how these are classified. See Chapter 3 for regulation and information on valuation and classification.

It is not possible to eliminate every risk, but UiT will work systematically and purposefully to have a risk level that is acceptable, seen in relation to UiT's goals and risk picture. UiT has set limits for acceptable risk within information security and civil protection.

Structure of the management system

The management system consists of three main elements (parts):

• Governing part – structure, vision and goals, risk management as well as roles, tasks and responsibilities
• Implementing part – specific policies and routines, including classification of information, risk and data protection impact assessment, fundamental security of the digital and physical domain, organizational and human measures.
• Controlling part – internal audit and control, reporting and handling of incidents and deviations, and management's review/annual report.

Chapter overview

	Chapter number	Chapter
Governing part	1	Introduction and structure
	2	Roles, responsibilities and tasks
Implementing part	3	Classification and valuation
	4	Risk and data protection impact assessments
	5	Physical security
	6	Digital security
	7	Personnel security
	8	Emergency Preparedness
	9	Procurement/maintenance/development
	10	Data protection / privacy
	11	ICT resources and users
	12	International cooperation and export control
Controlling part	13	Internal control and audit
	14	Handling of incidents and non-conformities
	15	Management Review/Annual Report

University board

• Processes and adopts the management system for security, emergency preparedness and data protection at UiT
• Supervises UiT's work within security, emergency preparedness and data protection

Rector

• Has overall responsibility for security, emergency preparedness and data protection at UiT
• Is responsible for preventive safety work, and that this work results in a proper level of security
• Responsible for allocating the necessary resources for adequate safeguarding of security, emergency preparedness and data protection

Administrative Director

• has the administrative responsibility for the management system for security, emergency preparedness and data protection, and shall ensure that it is implemented and maintained
• responsible for the organization of UiT's work on security, emergency preparedness and data protection, including the associated service
• exercises overall responsibility for all processing of personal data at UiT
• is a strategic leader in crisis situations, and heads the Central Preparedness Group (SBG)
• shall ensure that UiT has appropriate preparedness with regard to handling crises and accidents
• shall ensure that the rector is involved in the handling of incidents and deviations to the extent warranted by the nature of the case
• has coordinating responsibility for the regular meetings between The Norwegian Police Security Service (PST) and the university management, and is the contact point for PST if they want meetings with UiT beyond these
• is responsible for the preparation of the annual report for security, emergency preparedness and data protection
• appoints members of the group for overall assessment of Data Protection Impact Assessments (UiT's DPIA group)

Unit boards

• The unit boards refer to the faculty boards, the University Library Board and the board of the Arctic University Museum of Norway and the Academy of Fine Arts
• Supervises their unit's work within security, emergency preparedness and data protection

Heads of faculties and units

• Head of unit means the Dean, Library Director, Director of the Arctic University Museum of Norway and the Academy of Fine Arts, and the department directors in the joint administration.
• Responsible for ensuring that the unit
• comply with the requirements set by law, regulations and UiT's internal management system for security, emergency preparedness and data protection, including the performance of associated tasks
• prepares internal guidelines and routines if necessary to fulfil the requirements and perform the tasks in the above point
• allocates the necessary resources for adequate safeguarding of security, emergency preparedness and data protection within one’s area of responsibility and emergency preparedness, including that the unit has the appropriate expertise available
• Conducts and coordinates work on risk and vulnerability assessments (ROS) and emergency preparedness with local emergency preparedness groups at the location in question
• Shall ensure that incidents and non-conformities are followed up and closed, in accordance with UiT's internal guidelines.
• Shall ensure that employees, students and guests are informed of the routines and guidelines that apply at all times
• Shall ensure that employees and students are given the necessary training in the areas of security, emergency preparedness and data protection, and that these topics are integrated to a relevant extent in all internal training for which the unit is responsible
• Shall ensure compliance with requirements in central emergency preparedness plans related to training, ROS and exercises within its emergency preparedness area, and if the unit has a local emergency preparedness group, the unit manager must either lead this or be a member.

Units and others with special responsibilities and authority

Some units and others have special responsibility for parts of UiT's work within security, emergency preparedness and data protection. This applies to all departments in the joint administration as well as individual faculties.

Data Protection Officer

• reports directly to the leader of the rector's staff
• shall inform and advise UiT's employees and students about current obligations under data protection legislation
• shall monitor UiT's compliance with data protection legislation
• shall be involved at the right time and level in matters relating to data protection
• shall advise on the Data Protection Impact Assessment (DPIA) and monitor the implementation of these assessments
• shall be involved at an appropriate level in the handling of non-conformities pursuant to data protection legislation, and as a minimum be informed of the content and scope of non-conformities
• shall prepare an annual report to be submitted to the University Board
• have the right to attend and speak in UiT’s Information Security and Privacy Forum
• can be contacted directly by data subjects with questions about UiT's processing of their personal data, and about the exercise of their rights under the General Data Protection Regulation (GDPR)
• cannot be instructed on the performance of the duties of the Data Protection Officer pursuant to Article 39 of the General Data Protection Regulation (GDPR)

Special roles and responsibilities in research

Internal forums for security, emergency preparedness and data protection

Employees and students

• Have an obligation to
• familiarize themselves with and comply at all times with applicable law, regulations and UiT's internal regulations within security, emergency preparedness and data protection, including reviewing available information and training from UiT
• prevent and report nonconformities when they occur, including incidents that may involve non-conformities

Operational safety and system management

System changes with consequences for vulnerability and access control, and technical security measures related to basic and/or important infrastructure, devices, systems and services at UiT must be reported to the Operational Security Team (OST). This includes the schedule for implementation of measures, as well as the status of their implementation. Such measures will typically be identified by the system owner through risk assessments or incidents, but it may also be measures that the OST identifies and decides should be implemented.

OST is also responsible for preparing and maintaining an overview of planned central technical safety measures and following up the progress of these measures throughout the year. This includes measures that the group itself identifies as necessary. The group can assign responsibility for the measures to the various units at UiT, depending on the topic. See also Chapter 2 for a description of the Operational Security Team.

Guidelines and procedures

<will be posted here in early January 2024>

Key terms

The General Data Protection Regulation (GDPR) uses a number of terms, the most important of which are described here.

Use of Data Processors

There are a number of obligations that must be fulfilled when using data processors:

• If UiT is the data controller and use a data processor:
• There must be either a signed data processing agreement or other legal act binding for the data processor vis-à-vis UiT, which meets the requirements under the GDPR
• No personal data may be sent or made available to the data processor until the agreement or equivalent is in place
• Risk assessment shall be carried out to the extent required, see chapter 4.
• The data processor must be followed up to ensure that the obligations under the agreement are complied with.

• If UiT is a data processor for others:
• There must be a signed data processing agreement that meets the requirements under the GDPR
• It is the data controller's duty that such an agreement is in place, but UiT shall not receive or otherwise process personal data until this agreement has been signed
• Ensure that personal data from the various data controllers are kept sufficiently separate (separated) from each other and from UiT's own data, unless there are justifiable reasons why this is not required, and the GDPR is still complied with
• Ensure adequate information security for personal data processed on behalf of the client (data controller), in accordance with what is agreed in the data processing agreement.

Protocol of processing activities

UiT shall keep records of all processing activities involving personal data.

For activities where UiT is responsible for processing, this protocol is twofold:

• Research projects: protocol is maintained by Sikt data protection services on UiT's behalf (“Institution portal”, formerly “message archive”)
• All other activities: A unified protocol, and each unit maintains its part of the protocol. The units shall appoint a contact person who is made visible via uit.no/security.

In addition, a protocol must be kept of activities where UiT is the data processor. These are reported to the units' contact person.

Transfer to external parties and abroad

The transfer of personal data out of UiT encompasses more than that copies are sent to an external party or that data is stored in a data center at a data processor. Remote access (e.g. through support) is also considered a transfer, and this is especially important to bear in mind if the person or organization who is to have access is outside the EU/EEA. In the case of information that may be subject to export restrictions, this must be taken special account of and assessed specifically.

• Disclosure to external parties

If personal data is to be transferred to external parties (persons or businesses) who are not data processors, there must be a legal basis for this.

In many cases, the extradition is required by law (e.g. to the Norwegian State Educational Loan Fund, the Norwegian Tax Administration, requests for access pursuant to parts of the Freedom of Information Act, etc.). In cases where disclosure is not required by law, UiT shall ensure that the recipient has an adequate legal basis for its processing of personal data.
If the disclosure entails that the personal data is processed for new purposes, UiT must also consider whether this is permitted reuse under the GDPR.

• Transfer abroad

If personal data is to be transferred out of Norway, either to a data processor or other data controllers, there are different rules that apply depending on the country/region in question.

A distinction is made between transfers within the EU/EEA, and to countries outside the EU/EEA, as well as to international organizations. Within the EU/EEA, a separate transfer basis is not required, while the latter two cases require such a basis.

It is important to note here that

• This only refers to the requirement for a legal basis for the actual transfer of the information out of Norway and to another country/international organization. In addition, there must always be a legal basis for transferring to the recipient in question (e.g. a data processing agreement), regardless of whether the recipient is in Norway, within/outside the EU/EEA or is an international organization.
• Remote access from abroad (e.g. from user support) is also considered a transfer in this context

Guidelines, routines and guides

• Student Data Processing Policy [In Norwegian]
• Guidelines for the processing of personal data for UiT's personell [In Norwegian]
• Guidelines for the processing of personal data in research and student projects
• Routines for the use of private equipment when processing personal data in research and student projects [In Norwegian]
• Routines for health research [In Norwegian]

Regulations, guidelines and routines

• Regulations for users of ICT resources
• Guidelines for implementing access to emails and files [In Norwegian]
• Guidelines for disclosure of digital material to the police [In Norwegian]
• Guidelines on the prohibition of the use of certain digital services [In Norwegian]
• Guidelines for handing over and handing in ICT equipment for UiT's employees [In Norwegian]

• Guidelines for the use of UiT's IT equipment and services when travelling to risk countries [In Norwegian]

Risk levels

Undesirable incidents can lead to breaches of information security, which means breaches of the information

• Confidentiality: the information shall not be known to unauthorized persons
• Integrity: the information shall not be altered unintentionally or by unauthorized persons
• Availability: the information is available when legitimately needed

Breaches of information security can have consequences for all parts of UiT's activities, for example [the example is only available in Norwegian for now]:

The risk level is the sum of the probability of an undesired event occurring, and the consequence if it occurs. This is mapped and assessed through risk assessments (see chapter 5 of the management system).

The probability of an undesired event occurring is assessed on a scale from 1 – 4, according to a set of criteria established by UiT.

The consequences if an undesired event should occur are assessed on a scale from 1 – 4, according to a set of criteria established by UiT.

The risk level for the adverse events is categorized into four levels:

• 7 – 8 Very high risk
• 6       High risk
• 4 – 5 Moderate risk
• 2 – 3 Low risk

To ensure that there is as similar and correct an assessment as possible of which risk UiT is willing to accept, it is necessary to set some general requirements for the management of identified risks, see below under "requirements for the management of identified risks (undesirable incidents").

Moreover, it is necessary to set some more absolute outer limits that should not be passed, no matter what gain can be obtained. The latter is determined by the University Board, see below under "the outer limit of acceptable risk".

The type of data, and the associated classification according to UiT's guidelines for classification of information (chapter 3 of the management system), will be a key part of the basis for the assessment.

Requirement for handling identified risks/non-conformities

7-8	Risk-reducing measures shall be implemented. If the risk cannot be reduced from the red level through measures, the following applies: If the risk is related to the type of data, activities and processes where the University Board has set external limits for acceptable risk (see table below), the project, process, change, IT service / system, etc. cannot be initiated.  If the risk relates to possible breaches of confidentiality for strictly confidential/black data, then it's not possible to initate the project, process, change, etc., approve the IT services/systems for use for this type of data. If the risk is related to possible integrity violations for data subject to UiT's higheste requirements for integrity,  then it's not possible to initate the project, process, change, etc., approve the IT services/systems for use for this type of data. If the risk is related to possible accessibility violations for data subject to UiT's highest requirements for accessibility, then it's not possible to initate the project, process, change, etc., approve the IT services/systems for use for this type of data. For other risks and/or data, the decision on whether the risk is acceptable must be made by the unit leader*, based on the type of data, situation, legal requirements, possible benefits, and any negative consequences of omitting implementation/introduction.
6	If the risk cannot be reduced from the orange level through measures: The decision on whether the risk is acceptable must be made by the unit manager*, based on the type of data, situation, legal requirements, possible benefits, and any negative consequences of omitting implementation/introduction.
4-5	Risk level 5: Risk-reducing measures shall be implemented. Risk level 4: Risk-reducing measures shall be assessed and, as a general rule, implemented.
2-3	Risk-reducing measures may be considered.

 

*By unit manager is meant dean, director UMAK, director UB, department director. The rector and the chief administrative officer can also make these decisions.

Legal basis for processing personal data

During the period when lectures and seminars at UiT’s campuses/physical locations are cancelled, digital lectures and seminars will be utilised where possible.

A legal basis for the processing is always required.

UiT has categorised various activities where video is utilised (in teaching, examinations, dissemination and for administrative purposes). These activities have so many similarities that we have decided a relevant basis for the processing – for the personal data of both the employees and the students.

Important: It is essential that the unit/lecturer always assesses whether, for instance, video is necessary and, if it is deemed necessary, whether streaming the video is sufficient or if it must be recorded? Is it possible to combine different teaching methods, e.g. publishing a video from a lecturer followed by a chat discussion? These are just examples, and this is largely an academic (educational) decision. However, it is necessary to consider this. One must always undertake such a necessity consideration for the processing of personal data to be lawful. In other words, one cannot simply point to a given basis for the processing and then take it as a “blank authorization”. There must be a balance between what is achieved and how comprehensive this is for the student and the employee, and whether one can utilise means to reduce this impact on employees and students.

General/introduction
Many people often think of GDPR as a “consent law”, i.e. if you are going to process personal data, you must have consent from the person(s) the data applies to. However, this is incorrect. There are numerous bases for the processing and consent is just one of these. For teaching and administrative purposes, consent will often not be applicable and other bases must be used.

Basis for the processing is referred to in two different articles in GDPR:

• For general personal data (most types of data): Article 6
• For special categories of personal data (health, religion, politics, etc.): Article 9 (in addition to Art. 6)

Furthermore, several of the bases for the processing in GDPR require a so-called supplemental authority (“where Union or Member State law”).

• 6 (1) (c): the processing is necessary for compliance with a legal obligation to which the controller is subject
• If this basis for the processing is used, one must refer to a correct legal obligation to which UiT is subject (via an act or regulation)
• 6 (1) (e) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• If this basis for the processing is used, one must be able to show that a “task in the public interest” or “exercise of official authority” is vested in UiT. One must also refer to the correct provisions in this context.
• This also applies to several of the bases pursuant to Article 9.

Specifically about consent

Consent is probably the “best known” basis for the processing. We find this basis in both Article 6 (1) (a) and Article 9 (2) (a). However, it is a widespread misunderstanding that consent is the only basis for the processing (“If you are going to process personal data, you must have consent”) or that consent is the preferred basis for the processing and that the order in Articles 6 and 9 give the impression of a “ranking”. This is incorrect. Consent is one of several possible bases for the processing, and these have equal status. Moreover, there is not necessarily any conflict between using any of the other bases for the processing and the fact that the subjects participate freely.

There will be some instances where it will be correct to use consent and where perhaps it will be the only relevant basis for the processing (e.g. this is often the case in research projects).

If one plans to use consent, one must be certain that this consent is valid pursuant to GDPR, as numerous conditions must be met for the consent to be valid. If even one of these conditions are not met, then the consent will be invalid. The consequence will be that the processing is unlawful and nay data collected or generated on the basis of the consent in question must be erased. Reactions can also come from regulatory authorities. In these situations, it will not “help” if you have obtained a consent from everyone because, if the validity conditions are not met, the processing is unlawful.

For UiT, there are numerous situations where we are prevented from using consent as a basis for the processing, and it is important to be aware of this. We will now look briefly at the conditions for consent, especially one that is often problematic for UiT to meet. The conditions for consent are stipulated in Article 4 (11) cf. Art. 7 of GDPR.

However, it is important to emphasize that there are certain limits about what one can consent to. A consent pursuant to GDPR is only a basis of the processing. This means that a person cannot, for instance, consent to other requirements in GDPR being deviated from (e.g. the requirement concerning information security).

Consent must be freely given, specific, informed and unambiguous. If it applies to personal data, the data subject must give his/her consent by a statement or clear affirmative action. Furthermore, it must be possible to demonstrate that the data subject has consented to processing of his or her personal data. If the consent is given in the context of a written declaration that also concerns other matters, the request for consent shall be presented in a manner that is clearly distinguishable from the other matters in the declaration. It must be given in an intelligible and easily accessible form, using clear and plain language. If the processing activities can be distinguished from one another, one must ensure that the consent is not obtained in an ‘’everything or nothing’’ form. The person must have a choice between the various processing activities. A consent may be withdrawn at any time, and the data subject shall be informed of this prior to giving his or her consent. The processing of the personal data about this person must then cease, which often involves erasing the data. Moreover, it shall be as easy to withdraw as to give consent, i.e. If consent can be given with “one click”, it must be possible to withdraw it with “one click”. Finally, it is important to be aware that passive consent is invalid. An active action is required (e.g. ticking a check box. If the box is pre ticked, it means the consent is invalid).
Consequently, many requirements must be fulfilled for a consent to be valid. One must keep track of who has given their consent and be ready to act if someone withdraws their consent.

However, for UiT, we must pay particular attention to the condition that consent must be given freely.

The consent shall genuinely be freely given. When there exists an imbalance of power between the controller and the relevant data subject, this is extremely difficult to achieve. This is described in the following manner in point 43 of the preamble in GDPR (our emphasis): “In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller (...)”.

In working conditions, it will be difficult to meet the requirement that consent be given freely, owing to the uneven balance of power between employer and employee. It is not entirely inconceivable but, in the vast majority of cases, one should avoid trying to use consent as the basis for the processing. Please note that this does not mean it never can be voluntary for an employee to, for instance, perform a task or give information. However, the everyday understanding of “freely given” has a much lower threshold than GDPR. WP29 (advisory group in the EU) stated the following about this question [1] (our emphasis):
“There may be situations when it is possible for the employer to demonstrate that consent actually is freely given. Given the imbalance of power between an employer and its staff members, employees can only give free consent in exceptional circumstances, when it will have no adverse consequences at all whether or not they give consent. [Example 5:] A film crew is going to be filming in a certain part of an office. The employer asks all the employees who sit in that area for their consent to be filmed, as they may appear in the background of the video. Those who do not want to be filmed are not penalize in any way but instead are given equivalent desks elsewhere in the building for the duration of the filming”.

There does not need to be explicit ‘threats’ of reactions if one does not consent, or more obvious pressure, for the requirement relating to ‘freely given’ not to be met. More implicit or informal pressure or expectations (“this is desirable for UiT to achieve”, “everyone must pull together”, etc.) will also lead to the requirement relating to ‘freely given’ not being met. Consequently, as an employer, UiT should not use consent as a basis for the processing. However, if one still chooses to use this, it must be thoroughly reasoned and discussed, particularly concerning the requirement relating to ‘freely given’.

Many of the above-mentioned considerations are also applicable when it comes to processing of the students’ personal data. This is a clear imbalance of power between UiT and the students. This applies to everything from UiT as the overall institution to the lecturers. Consequently, UiT must be extremely constrained in the use of consent as a basis for the processing of the students’ personal data, especially in a teaching context. This does not mean that there are not instances when the use of consent is both relevant and correct. However, in such cases, one must ensure that through and documented assessments have been implemented. The main rule is that other bases for the processing should be utilised.

Specifically regarding the situation with Corona (for the time periods when national measures are in place):
Given the situation UiT is currently in with Corona-related measures and the fact that all instruction must be digital for an unknown period, it seems that there is little doubt that, as a main rule, consent cannot be utilised as a basis for the processing. In practice, the lecturer who refuses will not be able to do his or her job and the student who refuses to participate in, for example, a video lecture/seminar (streaming and/or recording with student participation, either directly in video or via chat) in reality misses out on part of the education or will be the “reason” why seminars cannot be held. This means that in reality the choice is not as free as GDPR requires. Consequently, other bases for the processing must be used.

[1] See Personopplysningsloven og personvernforordningen (GDPR) med kommentarer, Jarbekk (ed.), Gyldendal 2019, p. 151.

You must provide information

The clear main rule in GDPR is that information must be given before one can collect personal data. We will provide more details later, but in brief the following applies for recording of video:

Before you start recording, you must inform those who will be included in the recording:

1. That the lecture etc. will be recorded
2. What it will be used for
3. Who will gain access (this can be at the group level, e.g. the course students?)
4. When it will be erased (if not a specific date, the criteria for erasure, e.g. after the re-sit examination for this course this semester has been held)

[Skriv tittel her]

Countless video services are available; some for streaming, some for recording and some for both. Many have their personal preference and perceive clear advantages by using precisely their preferred service.

We understand that, but unfortunately it does not help. The reason for this is that when UiT utilises video, the person data in this video are processed. This can involve employees, students or even external actors. In a video service, the personal data in the actual video and those associated with it (e.g. login, activity logs, chat, etc.) are processed.

We are subject to stringent requirements when it comes to the processing of personal data, and as a minimum we must have a data processor agreement with the supplier. Moreover, a risk assessment must be conducted. Compliance with statutory requirements is not our primary motivation for doing this. These requirements exist for a reason. It concerns safeguarding the data protection of our employees, students and guests, etc. If you use “private” video services in a teaching context, UiT cannot attend to the obligations we have. What happens if the supplier chooses to use the personal data for a completely different purpose, e.g. advertising? If the correct agreements are lacking, it is realistic that they actually have this access.

Furthermore, UiT often purchases services on other terms that those that apply for private individuals or even for a research group or unit. For several services, UiT’s terms of purchase mean that personal data is stored within the EU. However, if you go directly to the same supplier and purchase the service, you will be subject to the purely commercial terms and the data could be stored in, for instance, USA. Have you conducted a risk assessment? Do you have the necessary basis for the transfer (as required by law)?

Even if you manage to not include any personal data (it is difficult to practically impossible when using a digital service), the data you enter or generate probably has a certain value for you and for UiT? Do you know what the supplier is permitted to use these for, cf. the terms you approved when you purchased or registered yourself in the service?

Consequently, it is important that you use the services that UiT (via the Department of Information Technology) has purchased and that you use them as intended. We refer to the information under “IT services and systems – What are you permitted to use?”

Working from home

After corona it's more common that UiT’s employees are working from home part of the time. However, it is important that data protection and information security are still safeguarded, and you have an important responsibility in this respect.

UiT manages vast amounts of research data, as well as personal data about employees, students, research participants, guests, partners and others, and other information of great importance to the organisation. Failure here can cause significant harm to UiT and individuals. Attending to information security and data protection is your responsibility and is fulfilled by being careful, complying with relevant legislation, guidelines and procedures, and reporting any undesirable incidents you discover or experience.

If there are other people in your household, remember that your duty of confidentiality also applies to them. This can easily be overlooked if you leave papers lying around, your computer is unlocked or you lend it to your children or you conduct Skype meetings with others present in the room, etc.

Consequently, we would like you remind you of some rules that everyone must be aware of (whenever you are working from home, including post-Corona):

Basic rules

• Work involving confidential (red) and strictly confidential (black) data shall only occur on equipment owned by UiT.
• Papers and notes must be stored in such a way that others in your household cannot read them.
• ICT equipment owned by UIT (e.g. computers and tablets) must not be loaned to others in your household, including children.
• This is not only because they can gain access to confidential information, but they can also erase or share the information by mistake.
• Moreover, we wish to minimise the risk of your device getting malware (which can steel or destroy information, e.g. a crypto virus), and one of the measures to achieve this is that only you use the device and only in a work-related context.
• Private cloud computing services (e.g. Dropbox) shall not be used
• You must lock your screen when you leave the computer unattended (even for short periods) if other people are home.
• Learn to use the keyboard shortcut Win + L to lock your screen quickly: 
• On UiT’s computers, you can activate a PIN code to avoid entering your password every time you need to unlock the screen. With newer computers face recognition can also be utilised.
• https://www.microsoft.com/nb-no/windows/windows-hello

 

Skype/video meetings
Communication tools like Skype, Teams and Adobe Connect, etc. will be widely used for meetings, teaching, etc. As confidential topics are often discussed (especially during meetings), it is important to be aware of your surroundings. This also applies to teaching, e.g. when you are holding seminars and tutorials. Students expect to ask questions and share their views with you, not you and your immediate family.

Please be aware of the following:

• If others are present in the room, you must use a headset
• We recommend this anyway as using a headset enhances sound quality and reduces background noise.
• Be conscious of what you are say if others are present in the room.
• We remind you about the duty of confidentiality.

VPN
Unless you need to reach services that require you to be connected to UiT’s network (e.g. Ephorte, PAGA, the home drive, etc.), you do not have to be connected to VPN.

 

The communication with Office 365 (e-mail, OneDrive, SharePoint, Teams, etc.) is encrypted and thus VPN is unnecessary.

• Owing to the large number of people who are now working outside the campus, we ask that you are not connected to VPN if this is unnecessary.
• VPN may be required for certain updates on your computer. We will publish a message here and as an operational message if you need to do something and, if so, how.
• This does not apply to all updates, e.g. Microsoft (Windows/Office) updates will function normally.

How to avoid attempted scams and attacks

There is an ever present challenge with criminals and other hostile actors trying to scam or otherwise attack UiT. They will continuously come up with new methods, and will try to exploit periods of big changes or vulnerabilites.

For instance, during the Corona pandemic Norway and other parts of the world quickly experiened that criminalst tried to exploit the upheaval caused by the pandemic. There is a vast requirement for information, employees are working at different locations than usual (such as at home) and following different routines and there is rapid development and exchange of information about how to do this. Dishonest and criminal actors are trying to exploit this by hacking into IT systems, steal personal data and committing financial crime, etc.

Consequently, it is especially important to be careful during this period because we know that UiT can be exposed to purposeful attacks. It does not have to be an “IT attacks” where someone tries to hack into systems, but may be “social manipulation” where someone impersonates a person, company or organisation to create trust and entice you into divulging or changing information or accesses. They may also try to get you to install malicious programs (“malware”), which give them direct access to your computer and perhaps the systems, storage services, etc. you have access to at UiT.

Consequently, we will remind you of some of the things you need to be especially aware of. These tips are basically no different from those that apply at other times. However, as mentioned, we can expect additional activity during this period. As such, many of the examples deal directly with the Corona virus (COVID 19).

E-mail

• We can expect phishing attacks to increase in volume.
• Do you want to read more about phishing and how to discover it? See this lesson (https://app.xtramile.no/new/training/d2caa932-96ca-4566-8aa3- 3a3567ec81fb) UiT created in conjunction with National Cyber Security Awareness Month.
• Be extra vigilant if you receive e-mail related to the Corona virus.
• Naturally, you will receive some legitimate e-mail related to the Corona virus, but check the content, context and sender carefully. For information about how to check if an e-mail is legitimate, please send the link in the point above.
• This involves knowledge and habits that are useful at other times too, both in a work and private context.
• False/illegitimate e-mail will often try to
• play on fear
• deal with financial interests (such as “updated delivery info”, “amended payment details”, etc.)
• get the recipient to act in haste (“Important!”, “Respond immediately”, “Urgent clarification required” etc.)
• give the impression they are a public body/authority (such as WHO, FHI, etc.) or employer and encourage you to implement immediate action
• UiT will provide messages about measures via en.uit.no/corona. We may send updates by e-mail, but the information in these will be reflected on https://en.uit.no/corona or in the official operational messages. If you don’t find it there and the e-mail asks you to log in to a website, open an attachment or install a program, take the time to check the content before you do anything further.
• If you are in doubt, ask your manager or a colleague if this is genuine.
• WHO does not send out e-mail that require you to log in to gain access to the information, attachments that you have not requested or information on pages outside the domain www.who.int.
• get you to click on/open evil-minded links or attachments
• If you are not expecting an e-mail, check that it is genuine, see the point above about phishing attacks.

Still in doubt? send a question about the e-mail to sikkerhet@UiT.no (mailto:sikkerhet@UiT.no)

More information:

• https://www.europol.europa.eu/covid-19/covid-19-phishing-and-smishing-scams
• https://nettvett.no/falske-e-poster/ [in Norwegian]
• https://nettvett.no/hvorfor-far-jeg-svindel-e-post/ [in Norwegian]

 

SMS
There have been cases in Norway where employees have received an SMS that gives the impression that it is from the management. They were asked to install a specific tool to simplify the communication while they are working from home. That was an attempted scam and the “tool” in question was malware.

• UiT would not provide this type of information via SMS.

More information about "smishing"

• https://www.fintechmagazine.com/fraud-and-cybersecurity/covid-19-slater-and-gordon-rising-homeworking-challenges

Example from Norway

• https://www.nrk.no/osloogviken/fikk-sms-fra-_sjefen_-_-viste-seg-a-vaere-korona-svindel-1.14942801 [in Norwegian]

 

Phone
You may also receive phone calls from scammers.

• For example, “Microsoft” will be extra active at this time. Scammers claiming to be from Microsoft (sometimes they say they are calling from Windows) will call and say they have discovered a problem with your computer that they can help you with. Microsoft would not call anyone like this, so just hang up if you receive such calls.
• The phone number they call from can be a Norwegian number, an overseas number or neither (just a collection of numbers). This is because they hide their real number and give the impression that they are someone else. The actual owner of the phone number has nothing to do with call and have not been hacked (the scammers have simply chosen a number, which they give the impression is their own number).
• If you have followed the scammer’s instructions, in full or in part, please notify sikkerhet@uit.no immediately so we can help you.

 

Websites
Many false websites have been created to take advantage of the situation the society is now in

• This includes a false “coronavirus map” that claims to be providing “live” information about the spread of the virus. It is actually malware.
• These sites are usually based on the information and appearance of genuine sites and can be challenging to uncover.
• “Fake news” is a recurring problem, including in this situation. Be vigilant and practice source criticism.

Examples:

• https://nrkbeta.no/2020/03/11/slik-spres-falske-nyheter-om-koronaviruset/
• https://www.forbes.com/sites/thomasbrewster/2020/03/12/coronavirus-scam-alert-watch-out-for-these-risky-covid-19-websites-and-emails/#880fff71099f
• https://www.digi.no/artikler/slik-bruker-hackere-koronavirus-frykten-til-a-spre-skadevare/487347

 

More information/sources
Here are some links to more information. Please be aware that the advice to employees/users here is general. In a work-related context, please follow the advice given by UiT.

 

Does something look not quite right? Please contact sikkerhet@uit.no and we can have a chat about it.

 

• https://www.nsr-org.no/aktuelt/svindelforsok-og-angrep-relatert-til-covid-19 [in Norwegian]
• https://nsm.no/fagomrader/digital-sikkerhet/nasjonalt-cybersikkerhetssenter/varsler-fra-ncsc/varsel-i-forbindelse-med-koronaviruset [in Norwegian]
• https://www.nrk.no/osloogviken/fikk-sms-fra-_sjefen_-_-viste-seg-a-vaere-korona-svindel-1.14942801 [in Norwegian]
• https://www.digi.no/artikler/slik-bruker-hackere-koronavirus-frykten-til-a-spre-skadevare/487347 [in Norwegian]
• https://nrkbeta.no/2020/03/11/slik-spres-falske-nyheter-om-koronaviruset/ [in Norwegian]
• https://www.forbes.com/sites/thomasbrewster/2020/03/12/coronavirus-scam-alert-watch-out-for-these-risky-covid-19-websites-and-emails/#880fff71099f

Controller

• Purpose: The determination of the purpose is extremely central to the processing of personal data and must be determined by the controller himself/herself - before collection of the data can commence. The purpose shall describe why it is necessary to process the relevant data, e.g. carry out admission to a programme of study, the goal of a research project, appointment of a new employee, etc.
  
  It is important to be conscious of what the purpose is, so that the data subjects (the people the data deals with) understand what the data is used for, as well as why any subsequent further processing of the data is subject to restrictions. For instance, the data cannot be further processed in a manner that is incompatible with the original purpose(s), cf. Article 5 (1) (b).
  
  The purpose(s) must be specified, explicit and legitimate.

• Means: The term “means” covers more than simply which technical aids shall be utilised. Central assessments and decisions related to how the personal data shall be managed are also covered, such as:
• Which data shall be processed?
• Which third parties shall have access? Which data shall be erased (and when)
• The choice of technical tools may be delegated to the processor, under certain conditions. However, the controller must ensure that the information security is safeguarded. Risk assessments cannot be conducted by the data processor alone (but they can assist)
• The controller cannot delegate assessments as mentioned in the bullet points above to the data processor.

Joint Controllers

One does not always have sole processing responsibility, as this can be shared with others, e.g. in a research project that is a joint project involving several institutions. Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers, cf. Article 26 (1)

This is permitted providing certain requirements are fulfilled, cf. Article 26 of GDPR:

In a transparent manner, each actor (controller) shall determine their respective responsibilities for compliance with the obligations under the regulation, by means of an arrangement between them (particularly regarding the exercising of the rights of the data subjects):

• This arrangement may designate a contact point for data subjects
• The arrangement shall reflect the respective roles of the joint controllers and their relationships with the data subjects
• The essence of the arrangement shall be made available to the data subject
• Please note: Irrespective of the terms of the arrangement, the data subject may exercise his or her rights under the regulation in respect of and against each of the controllers, e.g. one of the actors has the internal responsibility for dealing with requests for access to data. The data subject may choose to send their request to one of the other controllers, who must then deal with the internal communication to process the request. The data subject cannot be rejected on the grounds that they have sent their request to the “wrong” controller.

There is no necessity for equal distribution of responsibility and decision-making authority between the various controllers. There may be different levels of “cooperation”, and different controllers may be involved in different activities/operations and at different stages of (the same) processing. As mentioned, this must be clarified in the arrangement one is responsible for stipulating pursuant to Article 26. Furthermore, it is important to be aware that the establishing of joint processing responsibilities does not give any party a “greater” right to process personal data than they would have had alone. For example, each of the parties must have a lawful basis for the processing and one party cannot simply “expand” on the lawful basis for the processing of one of the other parties.

 

Please be aware that it is the actual processing that is in focus and the subject of the assessment of whether there shall be joint controllers or not.

• Example: If the same personal data is the subject of processing, but each of the controllers determine their own purpose separately, it sounds more like disclosure of personal data from the original controller rather than joint processing responsibility.

Disclosure to another organization (e.g. a higher education institution)

In many instances, the transfer of personal data to external actors (enterprises, organisations, institutions, physical people) is simply the disclosure/transfer of personal data to a new controller.

When UiT has disclosed the personal data to the new controller, this person/authority is fully responsible for their processing of the personal data. We have no influence over or responsibility for how the data is processed by the external actor. Please note: If UiT still has a copy of the personal data, we are naturally still controller for our processing of these data.

For the disclosure of the personal data to be lawful, we must have a lawful basis for the processing for this disclosure. This lawful basis for the processing must comply with Article 6. If the processing involves special categories of personal data, the lawful basis for the processing must comply with Article 9. Please be aware that disclosure may involve further processing of existing data for a new purpose. In such instances, an assessment must be undertaken of whether the original purpose and the purpose of the further processing are compatible. One cannot determine a new basis for the processing (in isolation) and then the disclosure is lawful.

In instances where the disclosure is not required by law, we must assure ourselves that the recipient has a lawful basis for the processing of the data (before disclosure of the data).

Requirement before data processors may be utilised

Requirements for the data processor agreement

Some requirements must be fulfilled before one starts to use a data processor:

• A written data processor agreement must be entered into, cf. Article 28 (https://lovdata.no/lov/2018-06-15-38/gdpr/a28).
• There are some specific requirements concerning the content of such agreements (see below).
• You can find a template for data processor agreements here
• A risk assessment must be conducted to ensure the information security is attended to (cf. GDPR art. 32)
• This can be completely basic or extremely complicated and comprehensive, depending on the nature of the assignment/service.
• Ensure this is conducted at a sufficiently early stage to avoid the risk of entering into a binding agreement for something (e.g. for a service) that one cannot then use because the risk assessment revealed unknown risks of such a nature that they are unacceptable
• alternatively, include a “subject to approved risk assessment” clause

The data processor agreement must stipulate:

• the subject matter and duration of the processing,
• the nature and purpose of the processing,
• the type of personal data,
• categories of data subjects, and
• the obligations and rights of the controller

Furthermore, the agreement shall, in particular, stipulate that the data processor

• processes the personal data only on documented instructions from the controller, cf. Article 28 (3) (a)
• including any transfer of personal data to a third country or an international organisation
• ensures that persons authorised to process the personal data have committed themselves to confidentiality, Article 28 (3) (b)
• takes all measures required to attend to the information security (comply with Article 32, cf. Article 28 (3) (c)).
• can only enage other data processors (subcontractors) under the following conditions, cf. Article 28 (3) (d):
• the controller’s approval has been obtained. There are two methods to achieve this and the chosen method must be clarified in the agreement
• The data processor must obtain prior specific authorisation from the controller for each subcontractor, or
• The data processor receives general authorisation but must inform the controller of intended changes concerning additional/replacement subcontractors so the controller has the opportunity to object to such changes, cf. Article 28 (2)
• the data processor must impose the same binding obligations they are subject to, especially with respect to information security, cf. Article 28 (4).
• If the subcontractor fails to fulfil its data protection obligations, the data processor shall remain fully liable to the controller
• at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services and deletes all existing copies, cf. Article 28 (3) (g)
• makes available to the controller all information necessary to demonstrate the data processor’s compliance with the obligations, cf. Article 28 (3) (h).
• allows for and contributes to audits, cf. Article 28 (3) (h).
• including inspections, conducted by the controller or another auditor mandated by the controller
• taking into account the nature of the processing and to the extent possible
• assists the controller to fulfil its obligation to respond to requests for exercising the data subject’s rights, cf. Article 28 (3) (e)
• assists the controller in ensuring compliance with the obligations pursuant to Articles 32-36 of GDPR, cf. Article 28 (3) (f)

 

The above mentioned template for the data processor agreement includes all these points but must be adapted for each agreement. It cannot be signed as it is because it does not contain all the information/details required.

Sometimes the contractor may insist on using their own agreement template. This is acceptable providing it is reviewed carefully and it is concluded that the requirements of the data processor and data processor agreement are fulfilled. Please be aware that this is not always the case, even for major contractors. In such instances, one must negotiate changes of the agreement.

When is an external organization not a data processor?

Being a data processor involves processing personal data on behalf of the controller. The purpose of the agreement/assignment must, in full or in part, be to process on the controller’s behalf. If such processing is not part of the purpose of the assignment, then the contractor is not a data processor. However, a declaration of confidentiality may be necessary if there is a possibility the actor can see personal data or other confidential information. See the example declaration of confidentiality in the right-hand menu.

Some examples:

• An agreement is entered into for the repair of photocopiers. It is possible that the service technician may see personal data during the execution of his duties (e.g. on a document left in the photocopier), but this is not part of the purpose of the agreement, which is to repair the photocopier. The service technician is not a data processor even if he/she happens to see personal data.
• An agreement was entered into with a consulting firm to assist with developing a service. The consultants will perform their work on UiT’s systems, locally at UiT. No information will be transferred to their own systems. The parts of the service they will work on will not normally involve personal data. Consequently, they will not be regarded as a data processor.
• We use an external postal service to deliver letters containing personal data. The assignment is to deliver letters from A-B, not to process the personal information, and they are not a data processor.
• For more examples, see this guidance from the Danish Data Protection Agency (where some of the above-mentioned examples come from).

Please note: One cannot simply agree that someone is a controller and a data processor because it is practical or convenient. What is decisive here are the realities – who does what? Who has influence? The situation may involve joint controllers, or is in fact a disclosure/transfer of personal data to another controller.