Frequently asked questions about the protection of students’ personal data

Can I use non-university environments (such as Google Drive) with students?

Teaching environments managed by the university (located in the university server or use licenses purchased by the university), must be used in teaching (see https://www.ut.ee/et/oppimine/e-ope/oppejoule/tarkvarad). In addition to Moodle, the Institute of Computer Science and the Institute of Mathematics and Statistics also use a wiki to create e-courses, see https://courses.cs.ut.ee and https://courses.ms.ut.ee.

Rules for using non-university environments:

• When using non-university learning environments, it is necessary to determine at  first whether the environment is located in the territory of the EU and meet GDPR requirements. If the these conditions are not met, it is necessary to contact the Senior Specialist of Data Protection for consultation. 
• If it is necessary to use certain non-university learning environments to pass the subject, then the university’s e-mail address (@ ut.ee) must be used when creating an account. If the student does not agree with the use of non-university environments, he/she must be offered alternative technical solutions.
• In order to use students ‘personal e-mail in learning environments, students must be asked for written consent or opportunities must be created for the learner to join the environment himself/herself(for example, not to take students’ personal e-mail addresses from SIS and create a Facebook group).
• Non-university environments may be used without permission of students if it is not necessary to create user accounts to use these environments (eg Padlet web board, Mentimeter, etc.) and if no personal data is processed in the environment. 

When using non-university environments, students must be asked for permission to process their personal data in the respective environment.

As a teacher, can I use my non-university e-mail address (e.g. gmail.com) to interact with students or let them submit assignments?

It is recommended to use the Moodle learning environment as a priority for communicating with learners and other teaching-related activities. If it is necessary to communicate by e-mail, the lecturer must use the ut.ee e-mail address. The use of e-mail addresses outside the university for communicating with students and submitting assignments is not permitted from the point of view of personal data protection. If a student sends a letter from his / her e-mail address outside the university to the teacher’s ut.ee e-mail address, the teacher can send a reply letter to that same e-mail address outside the university.

Can I share study results’ Excel file with all study group members?

Students may not be provided with data on learning outcomes (grades, points) that show the results of fellow learners. It is not good practice to do this even if the names of the learners have been replaced with for exapmle the data of matrix numbers, because in other contexts the matrix numbers may be distributed together with the names, in which case the persons would be identifiable by the matrix numbers.

Moodle course gradebook must be used to report learning results (students only see their own grades), submit the grades in SIS as an intermediate or final grade, or notify the student privately by e-mail using the ut.ee e-mail address.

Do learners see each other’s learning results in the Moodle course gradebook?

In the Moodle course gradebook, each student only sees their own results. Thus, it is the best way to report grades privately to learners while protecting personal data.

How long can I keep students in a Moodle course?

The teacher can decide how long he / she wants to keep students in the course, but it is recommended to clear the course from the students and their activities at the end of the semester, unless otherwise agreed. In the case of continuing education courses, it is recommended to remove learners and delete their activities no later than 6 months after the end of the training. This is necessary because in July, we will delete from the Moodle database the accounts of continuing learners who are not associated with any Moodle course and who have not logged in to Moodle for 365 days. The courses must be emptied, otherwise the data of the old learners will remain in the Moodle database unjustifiably.

Is there an obligation to remove learners from Moodle courses and delete their activities at the end of the semester?

According to the Moodle Terms of Use (https://moodle.ut.ee/utpolicy.php, clause 4.2), lecturers have the right to clear the course from students and their activities after the end of the course. Resetting courses at the end of the semester is strongly recommended.

It is definitely necessary to empty the Moodle course from learners if the course has not been used for two years. Keeping old study groups on the courses prevents the deletion of old expired user accounts in Moodle, as the deletion of accounts takes place once a year in the summer and the accounts whose owner is not associated with any course and has not logged in to Moodle in 365 days are deleted.

Can I share BBB, Zoom or Teams webinar recordings with the next study group?

If the recording contains recognizable personal data of the students (name, video image), the recording may be shared with members of the same study group, but the recording may not be shared with the next study group. The recording may only be shared with the next study group if all the students in the recording have given their written permission. If the learner has given permission for the recording to be shared, but later wishes to revoke that permission, he or she has this right and can request that the sharing of the recording be suspended. When presenting the students’ homework to others, the students’ personal data (personal e-mail, home address, etc.) should not be visible in the recording.

PS! If a Moodle course is reset, the default reset settings will not delete the BBB recordings. So make sure you choose to delete the recordings of the BBB sessions when you reset the course, delete the recordings manually later if necessary or hide them from the students in the next study group.

If you start using a course workgroup with a new study group in MS Teams, make sure that the new study group does not have access to the old study group’s personal data in the workgroup (including webinar recordings that may be in workgroup files in SharePoint or Stream).

If my Moodle course has an integration with MS Teams, what should I keep in mind when I start using the MS Teams team with a new study group?

If you start using a course workgroup with a new study group in MS Teams, make sure that the new study group does not have access to the personal data of the old study group in the workgroup.

If the MS Teams team has personal conversations or files from previous students (including access to video session recordings containing personal data from previous students), you, as the owner of the MS Teams team, have an obligation to delete personal data, unless otherwise agreed with the previous learners. You can delete the data of the previous study group manually (in case of a conversation, each post must be deleted separately) or if there is a lot of content to delete, inform us (eope@ut.ee) and we will remove the e-course and Teams integration. As a result, all contents (channels, chats, files, workgroup with members) of the MS Teams team will be deleted. If we create the integration again, a new workgroup will be created for the course in MS Teams, clear from the contents of the previous study group.

Can I track and record student’s exam performance?

See the exam and test video recording FAQ: https://wiki.ut.ee/pages/viewpage.action?pageId=101221107

How long can I keep video recordings of the exam?

Unless otherwise agreed in written form, the video recording may be kept only for study-related purposes and until the end of the semester. Recordings must be deleted at the end of the semester.

Can I check a student’s confidential written paper with Ouriginal’s plagiarism detection software?

Written papers uploaded to the Ouriginal database will remain there. These papers are in turn used as a source against which other uploaded works are compared. Ouriginal does not have a work publishing environment and uploaded works are not searchable in the database. Uploaded written papers will only be shown to other users if there is an overlap with parts of that inquiry.

So you can check students’ confidential works in Ouriginal, but if you want, ask the administrator to delete the confidential file from Ouriginal. If deletion is necessary, please contact eope@ut.ee and the request for deletion must come from the lecturer whose recipient address was used to upload the work to Ouriginal. Requests submitted by learners will not be accepted.

The learner does not want other users of Ouriginal to be able to download his/her work from Ouriginal. What should I suggest the learner do?

If the author does not want to keep his work indexed in Ouriginal, he has the option to exempt the document from the indexed database. Encourage students to do this. To do this, follow the instructions in the letter sent by Ouriginal after submitting the work. At the same time, the work will still remain in the Ouriginal database, and in the future the uploaded works will be compared with this work as well, but only the overlapping parts will be displayed and the work cannot be viewed and downloaded in its entirety.