11.12.2018

Personal data about students

Student and Academic Services, Privacy notice.

For what purposes do we process personal data and what are the legal grounds for processing?

Organising teaching and carrying out administrative tasks require that the university processes personal data about its students.

Personal data about students is processed in conjunction with the following tasks: maintaining personal data and contact information about students, maintaining study rights, managing students registered for studies and examinations, organising teaching and examinations, organising entrance examinations and placement tests, evaluating and registering study performance, guiding and examining thesis work, providing academic guidance and counselling, granting certificates and transcripts related to studies and studying and granting degree certificates.

Personal data is also processed when a student applies for a change in their study rights (e.g. changing the degree programme, major subject or branch of study; applying for or registering a branch of study; waiving the right to complete a degree) or when a student applies for a right to study optional studies or a separate right to study. Furthermore, crediting previous studies, processing notifications to extend the study period and applications for an extension, processing requests for rectification related to studies and taking disciplinary action require that personal data is processed.

Various electronic learning and examination environments are used during studies, in which personal data and information about study performance are saved. In addition, personal data about students is saved in the plagiarism identification system used by the university.

Students can make service requests using online forms (e.g. order a transcript of studies or a study certificate, ask about studies and training), and personal data is processed when processing these requests. Feedback can also be collected from students using online forms.

Personal data about students can be used in notifications and communication material related to studying and studies (e.g. sending public invitations, notifications related to teaching), in statistics and in the development of teaching. In addition, the university can process personal data for scientific research in order to enable the safety of students and other members of the university community and the physical and information security of the study environment.

The right of the university as the data controller to process personal data about students is based on:

  • compliance with statutory obligations (article 6.1(c) of the EU General Data Protection Regulation (GDPR), Universities Act (558/200), Universities Decree (115/1998), Government Decree on University Degrees (794/2004) and the Degree Regulations of the University of Jyväskylä)
  • a duty related to public interests or the exercise of public power (article 6.1(e) of the GDPR)
  • an agreement or consent in certain situations (articles 6.1(a) and 6.1(b) of the GDPR)
  • The university as the data controller has the right to process specific personal data groups when processing is necessary for a reason related to public interests (article 9.1(g) of the GDPR) or with the explicit consent of data subjects (article 9.1(a) of the GDPR).

Data is processed as required in the Act on the Openness of Government Activities (621/1999) and the data protection legislation. Data is partly confidential (section 24), such as account numbers, medical certificates (absences during the first year, medical records appended to applications for an extension) and decisions on special personal arrangements.

What type of personal data do we process and for how long?

Personal and study data about students is processed in different data systems of the university and manually (e.g. faculties). Data about students is partly supplemented during studies (e.g. adding grades to the student register). Personal data is processed and stored in accordance with the archiving plan of the University of Jyväskylä (future data control plan).

We process the following data:

  • Personal data is stored permanently in the student register: Student number, national student number, home town, gender, nationality, native language, study language, language when using services, permissions related to the disclosure of data, payment obligation, restriction on personal data, personal identity code, names. Data is obtained from the Studyinfo service or from students through online or paper forms, apart from permissions related to the disclosure of data that are obtained from the OILI service or from students through online or paper forms. The student number is generated in the student register of the University of Jyväskylä and the national student number is obtained from the Studyinfo service.
  • Contact information is obtained from the Studyinfo service or from students through online or paper forms. Contact information is retained in the student register until further notice. However, it can only be used for six months after the end of the right to study (e.g. sending public invitations). Students must keep their contact information up to date during their studies.
  • Data about study rights is stored permanently in the student register:
    • o Right to a degree programme: targeted degree, faculty, major subject and/or degree/training programme and/or branch of study, validity and status of the right to study, study period, obligation to pay a tuition fee, studies subject to a fee and information about fees paid.
    • o Right to attend optional studies, separate study rights: object of the study right (subject, studies or study period), organisation, validity and right to a degree programme and home university, depending on the type of study right.
    • o Study rights of degree students at the open university and studies completed at the open university and transferred to the student register at the student's request.
  • Registrations for each academic year and payment data are stored permanently in the student register: Registration date, period for which the registration was made, registration status, information about paid student union membership fees and information about paid re-registration fees.
  • Data about study performance is stored permanently in the student register: Name and code of course, scope of studies, completion date, grade, course type, teacher, institution in which credited studies were completed, studies in which the course is included.
  • Data about completed degrees is stored permanently in the student register: Degree name, degree approval date, major subject or degree programme, training programme, branch of study, scope of degree.
  • Registrations to examinations made using a paper form or examination envelope are stored in faculties or separate departments for six months, and electronic registrations to examinations are stored in the study information system for at least six months. The principles of retaining data will be standardised in 2018.
  • Registrations to courses and information about students accepted for courses are stored permanently in the study information system.
  • Personal study plans are stored in the study information system at least throughout the validity of the study right. The principles of retaining data will be standardised in 2018.
  • Guidance documents for postgraduate students are stored in faculties until the end of the academic year, during which the postgraduate degree is completed.
  • Examination responses and other written performance are stored in paper format in faculties and separate departments for six months or in electronic format in electronic learning and examination environments for at least six months. The principles of retaining data will be standardised in 2018.
  • Bachelor's theses are stored in electronic format in the thesis publication system or in paper format in faculties for five years. Master's theses are stored permanently in electronic format in the thesis publication system or in paper format in faculties and the university's central archives.
  • Orders of study certificates and transcripts of studies placed using an online form and notifications of changes of address or name are stored for as long as is required in order to process them.
  • Applications for crediting previous studies and decisions on credited studies made using an online form are stored permanently in faculties and separate departments. Applications, on the basis of which no previous studies were credited, are stored in faculties and separate departments for five years.
  • Applications for separate study rights, rights to study optional studies and flexible study rights (JOO) made using an online or paper form are stored in faculties and separate departments for two years.
  • Notifications of absence during the first academic year after being admitted made using a paper form are stored in application services for two years.
  • Change applications and notifications regarding study rights made using an online or paper form (change of degree programme, major subject or branch of study, an application for or notification of a branch of study, an application for a Master's degree, transfer to studies under a degree programme) are stored in faculties for ten years and decisions on them are stored permanently.
  • Notifications of an extended study period made using an online or paper form are stored in central student and academic services for ten years.
  • Applications for an extended study period made using an online or paper form are stored in faculties for ten years.
  • Notifications of waived rights to complete a degree made using a paper form are stored permanently in central student and academic services.
  • Degree applications made in electronic format are stored in the study information system and those made using a paper form are stored in faculties for 50 years.
  • Archival copies of degree certificates and their attachments (transcript of studies and Diploma Supplement) are stored permanently in faculties.
  • Documents related to disciplinary action taken against students are stored in the registry office for ten years.
  • Feedback on studies collected through the feedback system is stored in the feedback system and feedback collected using online or paper forms is stored in faculties and separate departments for as long as is necessary for processing. Summaries and samples of feedback queries as well as questions are stored permanently.
  • Students who responded to feedback collected from Bachelors can take part in an allotment of prizes using an online form for which the name and email address of each student is required. This data is stored for as long as is necessary for processing.
  • Data about students related to the implementation and evaluation of teaching and collected by the teacher is stored in faculties and separate departments for as long as is necessary for processing.
  • Change application and rectification requirements related to student selections, study performance, theses and crediting, as well as decisions and statements on them, are stored in the registry office for ten years.
  • The name, email address, username and home organisation of students, any contact information saved by students, and examination responses and other written performance saved by students are saved in electronic learning and examination environments. Personal data about students is stored in electronic learning and examination environments at least throughout the validity of the study right. Examination responses and other written performance are stored in electronic learning and examination environments for at least six months. The principles of retaining data will be standardised in 2018.
  • The name and email address of each student and documents sent by students, which can be saved permanently in the reference database with each student's consent, are saved in the plagiarism identification system, in which written study documents, reports and theses are saved in electronic and text format. Analysis reports are stored in the system for 25 months.

Who can access your personal data?

Personal data can be accessed by individuals who carry out administrative tasks related to studies. Administrative tasks related to studies are mainly carried out in the Student and Academic Services of the University of Jyväskylä and, in some cases, in faculties and separate departments. The teaching staff of faculties and separate departments process personal data about students when carrying out their work-related tasks (teaching and student guidance). In addition, personal data can be accessed by employees of the IT services of the University of Jyväskylä who develop and maintain study information systems.

Within the university, data is transferred:

  • To the customer information system of the university library, since the majority of students are also customers of the library. The library also offers studies to students.
  • To the data warehouse of the University of Jyväskylä, since the university must send data concerning the evaluation and development of teaching and research, statistics and other monitoring and guidance data to the Ministry of Education and Culture as defined by the ministry (section 51 of the Universities Act, 558/2009). Universities must evaluate their teaching, research and artistic activities and their impact (section 87 of the Universities Act). Personal data defined in this notice is transferred to the data warehouse of the University of Jyväskylä.

Personal data is disclosed to the following:

  • The national Virta data warehouse for universities of the Ministry of Education and Culture (section 51 of the Universities Act; data about study rights, registrations and completed degrees and studies). From Virta, data is made available to the national student selection register and shared student selection services of universities and to the Ministry of Education and Culture (Act 1058/1998).
  • In addition, data is disclosed to Statistics Finland (Statistics Act 280/2004), the Finnish Student Health Service (Primary Health Care Act 66/1972), the Social Insurance Institution of Finland (section 41 of the Act on Financial Aid for Students 65/1994), LUMA research project, international services of the Finnish National Agency for Education (data about student mobility), student monitoring surveys and statistical and research use through Virta.
  • For scientific or historical research or statistics on the basis of a separate request for data, during which it is verified that the recipient has the right to process data.
  • To contractual universities on the basis of agreements between national universities (e.g. JOO agreement).
  • To the Student Union of the University of Jyväskylä for its member and election registers.
  • To the customer information system of the library of the University of Jyväskylä, the alumni register of the University of Jyväskylä and/or employers for employment or training offers, with the consent of each student.

Is your personal data transferred outside the EU/EEA and how is data protected during transfers?

No personal data is transferred outside the EU/EEA.

Withdrawing consent

You can, at any time, withdraw your consent to transferring your personal data to the customer information system of the library of the University of Jyväskylä, the alumni register of the University of Jyväskylä and/or employers for employment or training offers. Withdrawing consent is easy: send an email to kirjaamo@jyu.fi. Withdrawing consent has no impact on any processing carried out before you withdrew your consent.

What rights do you have as a data subject?

You have the following rights as a data subject:

  • Right to access your data
  • Right to have any incorrect data rectified (remember to keep your contact information up to date)
  • Right to have your data erased (right to be forgotten) in certain situations
  • Right to restrict processing in certain situations
  • Right to have the unit responsible for the register notifying the party to which data is disclosed of your personal data being rectified or erased or of processing being restricted
  • Right to object to processing in certain situations, such as in direct marketing
  • Right to have your data transferred from one system to another in certain situations
  • Right not to be subject to a decision that is based merely on automated processing, such as profiling, and that has legal impact on you or that has a similar significant impact on you
  • Right to obtain information about any information security breaches resulting in a high risk
  • Right to file a complaint with the supervisory authority

If you have any questions about your rights, please contact the data protection officer of the University of Jyväskylä or the contact person in register-related matters.

How can you exercise your rights?

The University of Jyväskylä has general guidelines on how data subjects can exercise their rights.

General description of technical and organisational protection

The University of Jyväskylä, as the data controller, uses proper technical and organisational means to protect personal data against unauthorised or unlawful processing or the destruction or loss of personal data.

Contact information

Data controller

The University of Jyväskylä acts as the data controller regarding personal data about students.

Data stored in the student register and central student and academic services

Data stored in faculties and separate departments

  • Faculty of Humanities and Social Sciences: Maija Pöyhönen, head of study affairs, maija.t.poyhonen@jyu.fi, tel. +358 40 805 3076
  • Faculty of Information Technology: Eija Hatanpää, head of study affairs, eija.hatanpaa@jyu.fi, tel. +358 50 361 0988
  • Faculty of Education and Psychology: Riitta Kesonen, head of study affairs, riitta.kesonen@edu.jyu.fi, tel. +358 50 441 3690
  • Faculty of Sport and Health Sciences: Päivi Saari, head of study affairs, paivi.e.saari@jyu.fi, tel. +358 40 805 3396
  • Faculty of Mathematics and Science: Marja Korhonen, head of study affairs, marja.e.korhonen@jyu.fi, tel. +358 40 770 7777
  • Jyväskylä University School of Business and Economics: Niina Simanainen, head of study affairs, niina.j.simanainen@jyu.fi, tel. +358 40 805 3134
  • Centre for Applied Language Studies: Ulla Lautiainen, head of study affairs, ulla.lautiainen@jyu.fi, tel. +358 400 248 069

International student mobility management system

Guidance documents for postgraduate students

Plagiarism identification system

Electronic learning and examination environments, study information system

Feedback system

Registry office

Data protection officer at the University of Jyväskylä

 

This privacy notice was published and sent to data subjects starting from 25 May 2018.