...

Förutom direkta personuppgifter överförs även indirekta personuppgifter såsom vilken organisation användaren tillhör och vilken identitetsutfärdare som har använts vid inloggningen. I kombination med ovanstående personuppgifter kan dessa användas för att unikt identifiera en person.

...

Rättelse av personuppgifter som överförs överförts i samband med inloggning gör du i den identitetsutfärdare som du använder för att logga in. Dessa uppgifter rättas i tjänsten vid första inloggningen efter att personuppgifterna är rättade i identitetsutfärdaren.

...

Personuppgiftsansvarig för behandlingen av personuppgifter är <organisation>, <land>. Har du frågor om hur personuppgifter används och hanteras inom tjänsten tag kontakt med <e-postadress till tjänsteföreträdare>.

Dataskyddsombud är <namn>, <organisation>, <kontaktinformation>. alternativt Kontaktuppgifter till <organisation> dataskyddsombud finns på på <URL till informationssida med kontaktuppgifter till dataskyddsombudet>.

...

Denna tjänst följer det internationella ramverket GÉANT Data Protection Code of Conduct (http://www.geant.net/uri/dataprotection-code-of-conduct/v1) för överföring av personuppgifter från identitetsutfärdare till tjänsten. Ramverket är avsett för tjänster i Sverige, EU och EES som används inom forskning och högre utbildning.

...

Template: Transfer of personal data to <name of the service>

...

when using federated login (Privacy Policy)

Description of <service name>

The name of the service must be the same as mdui:DisplayName in the service's registered metadata in SWAMID.Here, the service is described in a good way aimed at users. A core summary of a maximum of 160 characters of the service's description must be registered in mdui: Description in the service's registered metadata in SWAMID.

...

<Name of the service> is a service directed to towards <user group> from <examples of organizations>organisations>.

<Descriptive text about the service, approx. 1-2 pieces paragraphs of text>

...

Processing of personal data

Transfer of personal data

It is important to clearly describe exactly what which data is being transferred and its for what purpose. The information must be clear to the persons for whom the document is intended. The technical representation is used for troubleshooting and should be attribute names defined in the attribute's LDAP specification.

Personal data is are being transferred from the identity issuer provider (your login service) to the service to ensure that you as a user have access to your information in the service and to provide you with a user-friendly interface.

In connection with When logging in to this service, the following personal data is are requested from the identity issuer provider you use:

In addition to direct personal data, indirect personal data is are also transferred, such as which organization organisation the user belongs to and which identity issuer provider has been used when logging in. In combination with the above personal data, these can be used to uniquely identify a person.

Other processing of personal data

...

within the service

Here it must be described what which further processing of personal data and its purpose that takes place within the service and for which reason this is done, for example by entering of personal data from the user if the service has a local user profile which the user himself supplements with information that does not come from the identity issuerprovider. It is also about There should also be a description regarding personal data that comes from another source and is linked to the user in the service. Also keep Keep in mind that personal data stored in log files and elsewhere must be described.

...

Here it must be described which (if any) transfer of personal data takes place to third parties. Keep in mind that the entity category GÉANT Data Protection Code of Conduct v1.0 (http://www.geant.net/uri/dataprotection-code-of-conduct/v1) imposes severe restrictions on the regarding which personal data that may be transferred to third parties.

...

a. if mandated by the Service Provider for enabling access to its service on its behalf, or
b. if the third party is committed to the Code of Conduct or has undertaken similar duties considered sufficient under the data protection law applicable to the Service Provider or
c. if prior consent has been given by the End User;

...

Lawful basis

This section describes the legal basis under which the Data Protection Regulation (GDPR) lawful basis according to which the service processes personal data. The legal lawful basis is linked to the purpose of the proceedingsprocessing.

Keep in mind that the legal lawful basis for consent places very high demands on voluntariness and can therefore because of this very rarely be used for services that a person uses in their employment or in their studies.

Right

...

of access, right of rectification and right of erasure of personal data

Here, the user's rights according to the Data Protection Regulation (GDPR) must be described. Particularly important is access to personal data, correction rectification of personal data and deletion erasure of personal data.

For register extractsaccess, correction  rectification and deletion erasure of your personal data, contact the personal Personal data managercontroller.

Correction Rectification of personal data transferred in connection with login is that was transferred at the moment of login has to be done in the identity issuer provider that you use to log in. This information is corrected in the service at the moment of the first login after the personal information has been corrected in the identity issuerprovider.

...

Purging of personal data

Here is , a general description of the service's regulations on routines regarding automated cleaning purging of personal data, incl. how long these are saved when the personal data are stored after the user no longer uses the service, should be entered.

Personal data

...

controller

Here, contact routes for the person responsible for information to the personal data controller and its representative (the person within the organization organisation who is responsible / administrator for the service) are described. Contact routes information must also be specified to the organization's data protection officer. OrganizationDisplayName in the service's registered metadata in SWAMID must be the same as the organization name in this section.

The person responsible for personal Personal data controller for the processing of personal data is <organization><organisation>, <land><country>. If you have questions about how personal data is used and handled are processed within the service, please contact <e-mail address for service representatives>.

Data protection agents are officer is <name>, <organization><organisation>, <contact information>. alternatively Contact information for <organization> <organisation> data protection officer can be found at <URL to information page with contact information for the data protection officer>.

...

This service complies with the international framework GÉANT Data Protection Code of Conduct (http://www.geant.net/uri/dataprotection-code-of-conduct/v1) for the transfer of personal data from identity issuers providers to the service. The This framework is intended for services in Sweden, the EU and the EEA that are used in research and higher education.

Exempel på användning av denna mall

Nedan finns exempel på när mallarna på denna sida har använts.

• SWAMID Entity Category Release Check - Privacy Policy
• Överföring av personuppgifter till vid inloggning i Sunets Wiki and Jira
• Överföring av personuppgifter till Ladok i samband med federerad inloggning