What is personal data?
Personal date refers to any information that can be linked to you as an individual. One distinguishes between personal data and special categories (sensitive) of personal data. Special categories of personal data require additional protection.
Lånekassen is the data controller for personal data.
Lånekassen is responsible for the processing of personal data we receive or collect ourselves. This means that we are responsible for how the personal data is used, and that its use is in compliance with the Personal Data Act.
We have joint processing responsibilities with the Norwegian National Collection Agency (NCA) in matters that concern the collection of terminated loans and certain other matters where we have given the NCA tasks to carry out on Lånekassen’s behalf.
What is the purpose of Lånekassen’s processing of personal data?
At Lånekassen we manage student funding schemes. We provide grants and loans for education in Norway and abroad, and administer the repayment of student loans. This is a public mission assigned to us by the legislature. To carry out our tasks, we need personal data for various purposes. We process personal data in order to:
- process applications for educational support
- controle that the conditions for providing educational support are met
- demand repayment of loans
- collect terminated loans
- contribute to ensuring that the appeals committee and The Parliamentary Ombud has the correct information, such that they may process appeals
- use personal data as a basis for developing services and rules
- use personal data in connection with statutory tasks such as budget, accounts, statistics and reporting to authorities
- disclose personal data to the authorities of other countries for control purposes
- disclose personal data to other public authorities who have a legal basis for collection
- offer correct and relevant information on the educational support schemes
- analyse information on the use of lanekassen.no and Dine sider in order to provide easy to use, fast and correct services
- use personal data to develop and test our IT systems when this cannot be done using fictious or anonymous data
- disclose personal data for statistical purposes or research purposes.
We process data about you by:
- collecting it, then registering, storing and, processing it in our systems
- using it in manual and automatic decision-making processes
- analysing it and generating statistics
- disclosing it to other authorities or research institutions
In some cases, Lånekassen uses artificial intelligence as part of the processing. You can read more about our use of machine learning here.
What is Lånekassens basis for processing personal data?
Lånekassen must process personal data in order to process applications for support and follow up repayment of student loans. Without personal data we cannot link the application or customer relationship to an actual person. All our processing of personal data requires a legal basis, known as the legal basis for processing. Since Lånekassen is a public authority with tasks assigned to us under the Student Financial Aid Act and its regulations, many of our data processing activities will fall under the legal basis for processing “necessary for the performance of a task carried out in the public interest or in the exercise of official authority” as outlined in the General Data Protection Regulation (GDPR).
The Student Financial Aid Act grants us the right and obligation to collect personal data about you if you, or someone you are related to by family ties, someone you support, or someone who supports you, applies for educational support through Lånekassen. Lånekassen has the right to collect information about academic results and student status for all pupils and students in Norway. This is necessary for Lånekassen to carry out the tasks we have been assigned and are required to perform under the law.
Some processing activities have a different legal basis, such as when we ask for consent to conduct certain types of user surveys and when we use cookies on our website.
Which personal data is used in processing?
Lånekassen uses only the personal data on you that is necessary for the purpose, in other words only the data we need to perform our duties. These may include e.g. name, address, place of study, income and family relations. Sometimes we also process special categories of (sensitive) data or other confidential data when required for correct case processing.
We are currently drawing up a summary of which personal data that is used in different contexts, and this summary will be published as soon as it is completed.
Where is the personal data retrieved from?
Personal data comes either from you as a customer or from other public and private entities that Lånekassen collaborates with.
When you submit an application to Lånekassen, phone us, send us an e-mail or contact us in other ways, you submit personal data.
Lånekassen retrieves information from the Norwegian Tax Administration (the National Registry, the a-ordning, the tax basis, the Account and Addressing Register) NAV (State Register of Employers and Employees), Digdir (Common Contact Register), the Norwegian Mapping Authority, UDI, and IMDI.
Lånekassen also retrieves personal data from other public and private entities. These include the Norwegian Tax Administration, the National Registry, the Norwegian Mapping Authority, Vigo, DIFI, Nav, UDI, child welfare services, the Armed Forces’ personnel and conscription centre, the Norwegian Universities and Colleges Admission Service, public and private educational institutions and the county municipalities.
Can Lånekassen disclose the personal data to others?
Your personal data can be disclosed to other public agencies that have a legal basis to use the data in their case processing. Among these are the Norwegian National Collection Agency, Nav, the tax administration, Helfo, Husbanken and the Nordic student loan schemes.
Your personal data may also be disclosed to other agencies and research institutions for research purposes. In such cases, Lånekassen will ensure that the processing of personal data takes place in accordance with the necessary privacy guarantees. If data cannot be disclosed in anonymised form, we will ensure that the information is subject to confidentiality on the part of the recipient.
We do not disclose your personal data to others than those who have a legal basis, unless you have authorised or consented to this.
For how long is the personal data stored?
As a public agency, Lånekassen has a legal obligation under the Archive Act to retain information about you, even after our case processing has been completed. Personal data that we are not required to retain will be deleted when they are no longer necessary for the purposes for which they were processed.
Which rights do you have as a customer?
Your rights follow from the Personal Data Act.
You have
- the right to information on how Lånekassen uses your personal data
- the right to Lånekassen deleting data on you that is no longer required for the purpose. In most cases however, the data is necessary for Lånekassen for many years
- the right to correct your own personal data that is incomplete or incorrect
- the right to appeal Lånekassen’s processing of your personal data
- the right to withdraw consent at any time
- the right to appeal to the Norwegian Data Protection Authority
- the right to access to the data Lånekassen has on you
- the right to a copy of the personal data that is processed
- the right to restriction of processing that concerns yourself
- the right to retrieve your own personal data (data portability)
Lånekassen can make exceptions from these rights:
- the right to restriction of processing that concerns yourself
- the right to retrieve your own personal data (data portability)
Lånekassen can make exceptions because we exercise a public assignment, or processing is necessary to perform a task in the public’s interest, cf. the General Data Protection Regulation article 18 no. 2.
To see which personal data we have registered on you, you may log on to Dine sider. There you may also request access.
If you wish to exercise any of the other rights mentioned above, you may contact Lånekassen. If you ask Lånekassen for access or other rights related to the processing of personal data, you are entitled to a response no later than one month after submitting the request. If we are unable to provide a response within one month, you will receive a tentative response before the original deadline with information on the cause of the delay. In such cases the deadline may be extended by two months.
Automated processing
Lånekassen processes most applications on educational support automatically based on the personal data we have, and the rules regarding educational support. This means that we often can process applications for educational support in a matter of minutes. You can not refuse automated case processing, but if you disagree with the decision, you may appeal, and in this event your case will be processed manually.
Read more about how automatic processing of applications is carried out.
Is your personal data secure with Lånekassen?
At Lånekassen, we continuously work to protect your personal data and other confidential information by taking a comprehensive approach to information security. This means that we consider:
- Employees: Maintaining knowledge and awareness to reduce human vulnerabilities.
- Technology: Securing our IT-systems to make them robust against cyber threats and vulnerabilities that arise through interactions with third parties.
- Organization: Assigning responsibility, integrating risk management, and developing procedures for secure information management.
Work on information security is ongoing and entails regularly reviewing various factors such as risk exposure, available technology, changes in organizational needs, or legal requirements. The goal is to ensure Lånkassen’s services operate within an acceptable risk level, comply with the regulatory framework, and that established security measures are effective in preventing threats to your data and rights.
Cookies at lanekassen.no
Lånekassen uses cookies in our online services to improve your user experience and for statistical purposes. Cookies are small text files that are placed on your device when you load a webpage.
Contact information for Lånekassen
If you wish to contact Lånekassen, you must use our regular customer service channels.
The telephone number to Lånekassens customer centre is +47 21 49 60 00. You may also send us an e-mail when logged on to Dine sider, or send a letter to
Lånekassen
P. O. Box 450 Alnabru
0614 Oslo
In the interest of your privacy, you must not send certain personal data by e-mail. This is termed special categories of personal data, and may for example include information on your health.
Contact information for the Data Protection Officer at Lånekassen
Lånekassen has a Data Protection Officer who safeguards the privacy interests of both Lånekassen’s customers and employees. The arrangement is facilitated and managed by the Norwegian Data Protection Authority. The Data Protection Officer can provide advice and guidance if you have general questions concerning Lånekassen’s processing of personal data, or concerning protection of the data we have registered on you as a customer.
e-mail: personvernombud@lanekassen.no
post:
Personvernombudet
Lånekassen
P. O. Box 191
0510 Oslo