What is personal data?
Personal data is information that contributes to identify you as an individual. One distinguishes between personal data and special categories (sensitive) of personal data.
Lånekassen is the data controller for personal data.
Lånekassen is responsible for the processing of personal data we receive or collect ourselves. This means that we are responsible for how the personal data is used, and that its use is in compliance with the Personal Data Act.
We have joint processing responsibilities with the Norwegian National Collection Agency (NCA) in matters that concern the collection of terminated loans and certain other matters where we have given the NCA tasks to carry out on Lånekassen’s behalf.
What is the purpose of Lånekassen’s processing of personal data?
We process personal data such that we can manage the education support scheme in compliance with the Student Financial Aid Act and associated regulations. This includes
- processing applications for educational support
- that the conditions for providing educational support are met
- demanding repayment of loans
- collecting terminated loans
- contributing to ensuring that the appeals committee and The Parliamentary Ombud has the correct information, such that they may process appeals
- using personal data as a basis for developing services and rules
- using personal data in connection with statutory tasks such as budget, accounts, statistics and reporting to authorities
- disclosing personal data to the authorities of other countries for control purposes
- disclosing personal data to other public authorities who have a legal basis for collection
- offering correct and relevant information on the educational support schemes
- analysing information on the use of lanekassen.no and Dine sider in order to provide easy to use, fast and correct services
The processing of personal data includes collection, registration, analysis, organisation and disclosure. In some cases, we may use artificial intelligence for some processing.
Today, we only use machine learning to analyze and evaluate our support schemes.
What is Lånekassens basis for processing personal data?
Lånekassen must process personal data in order to process applications for support and follow up repayment of student loans. Without personal data we cannot link the application or customer relationship to an actual person. We have legal authority in the Student Financial Aid Act including regulations for all processing of personal data, and this also includes processing of special categories of personal data and punishable offences.
The Student Financial Aid Actt Act gives us the right and obligation to collect personal data on you, if you, or someone you have a family relationship with, supports or is supported by, applies for educational support from Lånekassen. Lånekassen is entitled to collect information on academic results and student status for all pupils and students in Norway.
This is necessary in order for Lånekassen to perform the tasks we are assigned, and which we are obliged to perform under the law.
In the regulations relating to Lånekassen’s access to collect data, you will find details on which data we can collect and from whom.
In certain situations you consent to Lånekassen collecting personal data on you.
Which personal data is used in processing?
Lånekassen uses only the personal data on you that is necessary for the purpose, in other words only the data we need to perform our duties. These may include e.g. name, address, place of study, income and family relations. Sometimes we also process special categories of (sensitive) data or other confidential data when required for correct case processing.
We are currently drawing up a summary of which personal data that is used in different contexts, and this summary will be published as soon as it is completed.
Where is the personal data retrieved from?
Personal data comes either from you as a customer or from other public and private entities that Lånekassen collaborates with.
When you submit an application to Lånekassen, phone us, send us an e-mail or contact us in other ways, you submit personal data. This is voluntary, but Lånekassen cannot process our application without this data.
Lånekassen also retrieves personal data from other public and private entities. These include the Norwegian Tax Administration, the National Registry, the Norwegian Mapping Authority, Vigo, DIFI, Nav, UDI, child welfare services, the Armed Forces’ personnel and conscription centre, the Norwegian Universities and Colleges Admission Service, public and private educational institutions and the county municipalities.
Can Lånekassen disclose the personal data to others?
Your personal data can be disclosed to other public agencies that have a legal basis to use the data in their case processing. Among these are the Norwegian National Collection Agency, Nav, the tax administration, Helfo, Husbanken and the Nordic student loan schemes.
Your personal data may also be disclosed to other agencies and research institutions for research purposes. In such cases, Lånekassen will ensure that the processing of personal data takes place in accordance with the necessary privacy guarantees. If data cannot be disclosed in anonymised form, we will ensure that the information is subject to confidentiality on the part of the recipient.
We do not disclose your personal data to others than those who have a legal basis, unless you have authorised or consented to this.
For how long is the personal data stored?
Personal data that is used in the processing of your right to educational support is not deleted, because we require the data for many years to ensure correct case processing. Even though your student loan is repaid, Lånekassen still requires information on your customer relationship, as you may apply for support at a later date.
Lånekassen is subject to the Archive Act and is therefore required to archive documents that are a part of case processing. Your personal data may also be used for historic, scientific and statistical purposes. Lånekassen is entitled to do this, insofar that the public interest in storage far outweighs the disadvantages to you.
Personal data we collect, but don’t use in case processing, is deleted. For example, Lånekassen receives the exam results for all students in Norway, but the results for students who are not customers of Lånekassen are deleted.
Which rights do you have as a customer?
Your rights follow from the Personal Data Act.
You have
- the right to information on how Lånekassen uses your personal data
- the right to Lånekassen deleting data on you that is no longer required for the purpose. In most cases however, the data is necessary for Lånekassen for many years
- the right to correct your own personal data that is incomplete or incorrect
- the right to appeal Lånekassen’s processing of your personal data
- the right to withdraw consent at any time
- the right to appeal to the Norwegian Data Protection Authority
- the right to access to the data Lånekassen has on you
- the right to a copy of the personal data that is processed
- the right to restriction of processing that concerns yourself
- the right to retrieve your own personal data (data portability)
Lånekassen can make exceptions from these rights:
- the right to restriction of processing that concerns yourself
- the right to retrieve your own personal data (data portability)
Lånekassen can make exceptions because we exercise a public assignment, or processing is necessary to perform a task in the public’s interest, cf. the General Data Protection Regulation article 18 no. 2.
To see which personal data we have registered on you, you may log on to Dine sider. There you may also request access.
If you wish to exercise any of the other rights mentioned above, you may contact Lånekassen. If you ask Lånekassen for access or other rights related to the processing of personal data, you are entitled to a response no later than one month after submitting the request. If we are unable to provide a response within one month, you will receive a tentative response before the original deadline with information on the cause of the delay. In such cases the deadline may be extended by two months.
Automated processing
Lånekassen processes most applications on educational support automatically based on the personal data we have, and the rules regarding educational support. This means that we often can process applications for educational support in a matter of minutes. You can not refuse automated case processing, but if you disagree with the decision, you may appeal, and in this event your case will be processed manually.
Read more about how automatic processing of applications is carried out.
Is your personal data secure with Lånekassen?
In order to protect personal data, we take a comprehensive approach to information security.
Lånekassen therefore works in several ways to protect your rights and data:
- Employees - we take a targeted approach to ensure knowledge, attitudes and awareness and thus reduce human vulnerability factors.
- Technology – we work to ensure that our systems are robust in the face of external cyber threats and to reduce vulnerabilities that arise through interaction with third parties and through the employees’ use of the system.
- Organizational – we work to ensure that responsibility is clear, that risk management becomes a part of Lånekassen’s operations, and that procedures and guidelines for secure information management are developed.
Cookies at lanekassen.no
Lånekassen collects data on its users using cookies at lanekassen.no, Dine sider, data.lanekassen.no, Foreldresigneringsportalen and Arbeidsflaten for lærestedene.
To analyze the information we collect, we use Siteimprove.
Read more about Lånekassen’s use of cookies.
Contact information for Lånekassen
If you wish to contact Lånekassen, you must use our regular customer service channels.
The telephone number to Lånekassens customer centre is +47 21 49 60 00. You may also send us an e-mail when logged on to Dine sider, or send a letter to
Lånekassen
P. O. Box 450 Alnabru
0614 Oslo
In the interest of your privacy, you must not send certain personal data by e-mail. This is termed special categories of personal data, and may for example include information on your health.
Contact information for the Data Protection Officer at Lånekassen
Lånekassen has a Data Protection Officer who safeguards the privacy interests of both Lånekassen’s customers and employees. The arrangement is facilitated and managed by the Norwegian Data Protection Authority. The Data Protection Officer can provide advice and guidance if you have general questions concerning Lånekassen’s processing of personal data, or concerning protection of the data we have registered on you as a customer.
e-mail: personvernombud@lanekassen.no
post:
Personvernombudet
Lånekassen
P. O. Box 191
0510 Oslo