Data collection for master's theses

Before you start your project, it is a good idea to consider whether it is absolutely necessary to collect identifiable data. If it is possible to avoid gathering personal data, you do not need to report the project to Sikt and there are no strict rules for protecting data. From Sikt:

"The processing is considered anonymous if it is not possible to identify individuals at any time during the data collection process." For health research projects: Note that even if the project is considered anonymous under the Personal Data Act and does not have to be reported to Sikt, it may still have to be reported to REK (Regional Ethics Committees). Read more on Sikt's page about Carrying out a project without processing personal data.

NB: Remember that voice on audio recordings counts as personal data.

All research and student projects that process personal data need to be reported to Sikt. You can check Sikt’s Notification Form for personal data webpage to help with this. Always remember to copy (CC) your supervisor on any correspondence with Sikt.

The form must be submitted no later than 30 days before data collection starts. After Sikt has assessed your master’s thesis, you can start collecting personal data.

Before personal data is collected, a data management plan (DMP) must be created. A DMP describes the data you will collect during a project, how this data will be stored and managed, and who will have access to it.

VID has a simple data management plan template for masters students.

Classification categories determine how data can be collected and stored. You and your supervisor must then consider which of these classification categories your data belongs to:

There is a final category called Strictly in Confidence (black data). This category includes the same type of information as Confidential (red), but where special considerations make it desirable to further protect the data. Black data cannot be used in master's projects.

Most importantly, you should:

1. Work on a computer that is secure. This means that the machine has password protection and antivirus programs.
2. Store your PC, audio recorder, camera, and other storage media securely. These should preferably be locked as long as they contain personal data.
3. Only use a mobile phone to record audio/video if it is equipped with an approved encryption application.
4. Not be connected to the internet while processing personal data and use an encrypted memory stick or encrypt files on your own PC as long as you process personal data.
5. Consider making use of VID's lending scheme for sound recorders.

As a student you are expected to treat personal data with care. The guidelines for the processing of personal data in research and student theses at VID Specialized University give detailed instructions on how to do this.

We recommend using the Research Data Management Guide to classify your data and assessing which of the four classification categories your data belong to. You can find a short overview here:

• Open or freely available (green data)
  • Information that may or should be available to the general public, with no special access restrictions
  • Example: A public website presenting an employee in a certain department in a certain company
• Restricted (yellow data)
  • Restricted data is information which is not open for everyone
  • All information which is not classified as "Open", "In confidence" or "Strictly in confidence"
  • Example: Unpublished research data that don’t contain certain types of personal data
• In confidence (red data)
  • Is used if individuals, public interests, partners, or VID Specialized University may be subject to harm if the information is exposed to third parties
  • Contains sensitive personal data (særlige kategorier) and has strict requirements for protection
  • Example: Sensitive personal data which includes information about a person's ethnic origin, political opinion, religion, philosophical belief, union membership, genetic information, biometric information for the purpose of uniquely identifying someone, health information, sexual relationships, sexual orientation, etc.
• Strictly in confidence (black data)
  • Example: Large amounts of sensitive personal data or data about people's health, research data and datasets of huge economic value

Next, you should check VID's guidelines for where you can store and process the data. You can find more information in VID's storage guide.

• In the data collection and storage guide you find an overview on if it is legal to store green, yellow, red and black data in the following places:
  • Your personal e-mail address and your VID e-mail address
  • Your personal computer or Mac
  • (Encrypted) memory sticks or (encrypted) external hard disks
    • Students which use red data need to save these on an encrypted unit or Educloud.
    • If you want to send large encrypted files that contain yellow and green data, you can use the service called FileSender. If you use encryption with 7zip, red data can also be sent.
      • ! Note you can not use the encryption which is built-in in Filesender since it is not approved.
  • Personal cloud service (for example DropBox or GoogleDrive and VID OneDrive)
  • Audiorecorders, Nettskjema-diktafon mobile app and Nettskjema
  • Zoom, Teams and Skype

How you are allowed to collect and store data from your master's project depends on sensitive it is.

Nettskjema

Nettskjema is a secure solution for data collection via the Internet. The service was developed by the University of Oslo and can be used for simple surveys, quizzes, or registration forms. You can use Nettskjema to create a questionnaire and the Nettskjema-diktafon app for audio recordings of for example interviews.

All students at VID can use Nettskjema by using their FEIDE-login and password. On UiO’s website you can find more information about Nettskjema and a link to log into Nettskjema with your Feide-user.

Audio recording interviews

VID has a number of audio recorders that students and staff can borrow for a limited period. The recording devices can be borrowed at the library at the various study sites. You can either approach a librarian at the service desk or contact your campus library. You can find more information on the library’s webpage explaining the borrowing of technical equipment.

Alternatively, you can use the Nettskjema-diktafon app which you can download on your smartphone. With the Nettskjema-diktafon app you can record audio on your smartphone and the recordings are sent to Nettskjema. The recording is immediately encrypted on your smartphone and for security reasons you cannot listen to the recordings in the mobile app. UiO, which has developed he app has written a guideline on using the Nettskjema-diktafon app.

If you want to be 100% sure that you have recorded the interview, we can recommend to use both an audio recorder and the Nettskjema-diktafon app.

Zoom can be used for digital interviews, but this must be done in a responsible manner in line with our guidelines for students using Zoom in research interviews (pdf). These guidelines state for example that you cannot use the free version or the web version of Zoom and that your equipment should be approved for processing red data.

Note ! You cannot use Skype or Microsoft Teams to record interviews.

More information about which tools you can use depending on your type of data can also be found on the Research Data Management guide.

REK (Regional Committees for Medical and Health Research Ethics) pre-approves research projects related to medicine and healthcare in accordance with the Health Research Act. Not all master's theses that are focused on medicine and health subjects must be approved by REK. If the purpose of the research project is to "acquire new knowledge about health and disease", you must send an application to the Regional Research Ethics Committee (REK) (Health Research Act, §4a).

If you and your supervisor are unsure whether your project should be submitted to REK, you should contact REK as described on their website. The REK secretariats offer guidance on the obligation to apply.

You can find more information on REK here: Prosedyrer knyttet til REK.

NB: that if you need to submit an application for your research project to REK, you must also submit an application form to Sikt.

There are a few things you should do when planning and starting your thesis, while writing and once your master’s thesis has been handed in. You can find an overview about how you should process personal data here:

When planning/starting the assignment:

I will

• write down the purpose of the use of the personal data - this is usually where the project description fits.
• create an exhaustive overview of the personal data I will collect and analyze in the assignment.
• assess and document that I have a valid legal basis for the use of the personal data that I will use in the project.
• report the project to Sikt (formerly NSD) for an assessment of privacy in the project no later than 30 days before I am to collect personal data in the project.
• prepare written information for the informants/respondents about their rights.

During the assignment writing:

I shall

• obtain and store all data/personal information in a secure manner, in accordance with VID's internal guidelines.
• ensure that I can answer questions from respondents/informants about the treatment of their data, and that I can delete data from and about them, if I am asked to do so.
• make sure that I only collect the data that the informants have consented to and that Sikt has been asked for permission to collect. In addition, the data must be used as outlined in the project description.

When the assignment is submitted:

I will

• decide which personal data about respondents or informants should be deleted and which should be kept after the end of the project (archived).
• ensure that all personal information about respondents or informants that is not to be kept after the end of the project is properly deleted.
• ensure that personal data to be kept after the end of the project is anonymised, for example by destroying the connection key for de-identified data.
• ensure that personal data that must be taken care of after the end of the project is properly stored in accordance with VID's routines.
• send a termination notification to Sikt.
• ensure that master's theses containing confidential information are classified in VID's knowledge archive: VID:Open. It is also possible to choose to postpone or refuse the electronic availability of the assignment.

• VID's Data Management Guide
• Guidelines for the Master's thesis at VID Specialized University (pdf in Norwegian)
• Supervision agreement for the Master's thesis (pdf in Norwegian)
• Front page templates for exams and papers (My page)
• Writing papers and theses and reference styles at VID
• Guidelines for the processing of personal data in research and student theses at VID