1. Scope
The scope of these routines are any sound and/or image recordings done by the University of Oslo, or at events organized by the University of Oslo. This routine includes any type of recording equipment. No sound and/or image recording can take place in violation of these routines.
The routines for using recording equipment include two different recording situations:
A) Only recording the speaker, or
B) Recording (sound, picture, video) also includes the audience/students
This routine is not applicable for recording made exclusively for research purposes. Research projects shall follow routines for processing personal data in research projects.
2. The different recording situations
A) Only recording the speaker
Prerequisite: Only the speaker is recorded, this also includes what is shown on the speakers' screen/presentation.
Purpose: It is important to determine the purpose of the recording in advance. Personal data shall only be collected for specific, explicit and legitimate purposes. Read more about purpose evaluation under section 6.1 Purpose limitation.
Lawfulness of processing: The person responsible for the recording needs to ensure that he or she has a legal basis for the recording. In recording situation A), the legal basis is either consent from the speaker, or the recording is necessary for the performance of a contract. It is possible when entering into an agreement with external speakers, to ensure that recording is part of the contractual obligation of the speakers.
For staff at the University of Oslo, where recording is necessary for the teaching or the event, the legal basis is performance of the employment contract. For employees at the University of Oslo, it must be agreed upon before planning a recording of a lecture, course or an event. Read more about legal basis under section 6.2 Lawfulness of processing.
It is assumed that consent to recording is given when a lecturer/speaker activate a recording. This presupposes that the lecturer/speaker has received the necessary information in advance and must take an active action to use the recording equipment. Those in charge of the recording equipment must ensure that the default setting is not recording.
If a cultural performance, such as a musical performance, in an event is intended to be part of a recording, this must be agreed upon at the conclusion of the agreement with the concerned parties. The legal basis for recording this performance is the performance of the contract.
Information: The lecturer/speaker must always inform about the purpose of the recording, where the recording is stored, and for how long the recording is stored.
B) Recording also including the audience/students
Prerequisite: Sound, picture, video from part of or entire auditorium/room is recorded. Everyone present may be part of the recording, either their voice, picture or both.
Purpose: It is important to determine the purpose of the recording in advance. Personal data should only be collected for specific, explicit and legitimate purposes. Read more about purpose assessments under section 6.1 Purpose limitation
Lawfulness of processing: The person responsible for the recording needs to ensure that he or she has a legal basis for the recording. In recording situation B), the legal basis may be national law, consent from everybody that are part of the recording, or legitimate interests. Read more about legal basis under section 6.2 Lawfulness of processing.
Information: information must be provided in advance to those who are part of the recording. The information must contain the following:
- That the University of Oslo will be recording
- The purpose of the recording
- Where the recording is stored
- How long the recording will be stored
- Where the recording will be published
- Who has access to the recording
- Where the audience/students may sit to ensure that they are not part of the recording
- Questions from the audience may be part of the recording
- The legal basis for the recording
There must be special areas where students/audience members, who do not wish to be included in the recording, can stay. Students who do not wish to be part of the recording, may for instance be encouraged to send the lecturer questions via email or ask questions during the break.
For some studies or courses, it is necessary and a requirement to record a teaching situation, for instance at the Faculty of Educational Sciences or the Faculty of Medicine. In these instances, is it not necessary with special areas for students to sit to ensure that they are not part of the recording, but information must be given in advance. Information shall also be given on the course pages of the program so that students can decide whether to apply for the study or the course.
If a cultural performance, such as a musical performance, in an event is intended to be part of a recording, this must be agreed upon at the conclusion of the agreement with concerned parties. The legal basis for recording this performance is the performance of the contract.
3. Utilization of and publishing recordings
Recordings of sound and/or pictures, made for a specific purpose cannot, as a rule of thumb, be used for any other purposes than the purpose stated at the time of the recording.
Pursuant to GDPR art. 6 (4), recordings should not be used for new purposes, without either assessing whether the new purpose is compatible with the original purpose, obtain consents for the new purpose, or the legal basis in national law states that the recording can be used for a new purpose. For example, if you want to use recordings taken to enhance the student's learning in a research project, you must, in principle, obtain the consent of those who are included in the recording so that the recording can also be used for research purposes.
Recordings shall only be stored and shared in accordance with the University of Oslo’s data storage and classification guide. Sharing and any publishing of the recording must be covered by the legal basis for the recording (e.g. the contract or the consent).
Public publishing of pictures and videos are only allowed if the person or persons in the picture/video consents to publishing, unless there is an exemption pursuant to the Norwegian Copyright act § 104 (?ndsverkloven).
The responsible unit must register recurring recordings/events in "Meldeappen" (UiOs protocol of processing activities, in Norwegian).
4. Erasure of recordings
A recording shall be deleted when the purpose is fulfilled, cf. GDPR art. 5 litra e. If the legal basis for the recording is consent, the recording must be deleted if one of the participants withdraws their consent, or at the time it was stated that the recording would be deleted.
It is assumed that recordings based on the University of Oslo’s primary activities, can be retained as long as they have a professional relevance. This means that recordings must be deleted when they are considered professionally outdated, unless further storage can be justified on the basis of historical value. This must be assessed specifically for each recording and by each lecturer, course holder etc. and it is important to have routines that ensure that recordings are not stored longer than necessary to fulfill the purpose of the recording. If the recording is to be kept beyond what was informed at the time of recording, new information on storage time must be provided and, if necessary, new consent for the extended storage time must be obtained.
5. Responsibility for recording equipment
Recording equipment is available “as is”. The university cannot guarantee the accuracy of the information made available through the use of tools and equipment. Whoever uses the equipment agrees and accepts that computer and telecommunication tools are not flawless, and periods of downtime may occur. The University of Oslo cannot guarantee that recordings will be uninterrupted, secure or flawless, or that data will never be lost.
The user of the equipment is solely responsible for his/her actions when using the equipment. If the University of Oslo becomes aware that the use of the university's resources and tools is in violation of our internal rules and routines or Norwegian law, the right to make use of the university’s recording equipment will be revoked with immediate effect.
6. Detailed information
6.1 Purpose limitation
It is important to determine the purpose of the recording in advance. Personal data shall only be collected for specified, explicit and legitimate purposes cf. GDPR art. 5. It is not legal to use the recording for other purposes than the original purpose, unless it is a compatible purpose or consent is obtained from those involved in the recording.
Lectures and teaching situations
The purpose of recording lectures at the University of Oslo will usually be to strengthen the students learning, by giving them the opportunity to play back all or part of the lecture, course etc. In some cases, the purpose is also quality assurance of the students work.
Here are two examples of purpose assessments for recording lectures:
- The purpose of recording the lecture at the University of Oslo is to strengthen the students learning by giving the students the opportunity to play back all or part of the lecture, course etc.
- The purpose of the recording of the teaching situation, or where students are in practice/internship, is to strengthen the students learning by giving the students the opportunity play back all or part of the situation, or in quality assurance.
Recordings for other purposes than teaching
The person or unit responsible for recordings not done in connection with teaching must document the purpose of the recording. The purpose must be in connection with the university’s activities.
6.2 Lawfulness of processing
The person responsible for recording must ensure that he or she has a legal basis. The legal basis may be national law, performance of a contract, consent from the parties involved, or the recording is part of the University of Oslo’s legitimate interests.
Before each time a recording is taking place, the one responsible need to ensure the lawfulness of the recording. It is not possible to assess the legal basis in general for all recordings at the University of Oslo.
National law
There is a legal basis for a recording when it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the University of Oslo. The public interest or the official authority must be recognized by national law.
If the recording is necessary to ensure the University of Oslo’s obligations as an educational institution cf. The university and university college act § 1-3, there will usually be a sufficient legal basis for the recording. Recordings can only be made for explicitly stated purposes that are objectively justified in the university’s primary functions. Recordings of lectures, courses, internships etc. are in most circumstances clearly covered by a purpose that is objectively justified in the University of Oslo’s primary activities; research, education, innovation and dissemination.
It must be assessed whether the university’s need to record is strictly necessary in order to ensure the purpose with the education. This entails that the recording need to be suitable for fulfilling the purpose, necessary to fulfill the purpose, and proportional concerning the privacy implications for the students. The University of Oslo shall not force students to be recorded without prior information about this.
If it is not necessary to ensure the students’ rights, and the obligations of the university, a recording should in principle not take place.
Consent for recording
If the legal basis for a recording is consent, then everyone who is part of the recording must give their individual consent. The consent must be voluntary. If a student or staff “must” consent in order to participate in the teaching activities, then the consent will not be considered voluntary. In case of failure to collect consent, or if one or several participants do not consent to a recording, recording shall not take place. See definition of consent for different scenarios, form for consent, and practical information for handling consent forms.
Consent must be obtained in such a way that ensures it can be stored and easily accessible for verification.
When recording multiple times, and the purpose and the participants are the same, e.g. lecture series and series of courses, a consent obtained from the participants may apply to all of the recordings.
The use of consent for compulsory courses
If it is necessary to make a recording in compulsory courses or lectures, the legal basis shall not be consent. This is due to the fact, that the consent cannot be considered voluntary. The legal basis for the recording must be national law, or the recording must be limited to only include the lecturer.
It must be assessed whether the university’s need to record is strictly necessary in order to ensure the purpose with the education. This entails that the recording need to be suitable for fulfilling the purpose, necessary to fulfill the purpose, and proportional concerning the privacy implications for the students. The University of Oslo shall not force students to be recorded without prior information about this.
If it is not necessary to ensure the students’ rights, and the obligations of the university, than a recording shall in general not take place.
Legitimate interests
The University of Oslo may have a legitimate interest in recording an event that is not a teaching event. This interest must outweigh the interests of the right to privacy of those who appear on the recording.
It is important in this balance test, that the speakers have been given the opportunity to consider in advance if he/she has any objections to the recording.
When using legitimate interest as a legal basis, the one responsible for the recording must inform what those legitimate interests are in addition to the other information listed in section 2.B in this routine
If people are informed and still show up and participate, then it is allowed to record the event. There is also no consent that can be withdrawn.
Performance of a contract
In some instances the University of Oslo may, on the basis of the employee contract or managerial prerogative, decide that employees shall record the lectures/courses. For instance, in some courses where recording is a prerequisite for participation, or in instances where the employee must teach the class online. In these instances, the performance of the employee contract will be the legal basis for the recording. It is necessary that this is discussed and agreed upon with the employee in advance of the teaching/course.
If the University of Oslo enters into a contract with an external speaker or other type of contributor, any recording activity must become part of the contract, so that the speaker is informed and has taken this into account when entering into the contract with the University of Oslo.