The principles of GDPR applies whether you are in a regular classroom or utilizing different learning technologies to teach online. If the data is acceptable to use in a classroom, they are typically also acceptable to use online. Only remember to utilize the learning technologies recommended by CDUL, since these are approved in accordance to the GDPR-regulations and IT-security. 

THESE SYSTEMS ARE ONLY APPROVED TO PROCESS REGULAR PERSONAL DATA. THEY ARE NOT APPROVED TO PROCESS SENSITIVE PERSONAL DATA. WHAT DOES THIS MEAN?

Personal data is relevant information according to the GDPR-rules. Usage of personal information is when you let personal information be a part of your lectures. Either because you talk about people directly or because you use them in cases and examples. If you use completely fictional persons or cases it is – obviously – unproblematic. But if you use real life persons you must be aware of the following: 

REGULAR PERSONAL DATA, GDPR-SAFE: 

Names, addresses, e-mail, and phone number 
Occupation, education, age, and marital status 
Pictures or videos of everyday situations where the person is not in focus 

CONFIDENTIAL OR SENSITIVE PERSONAL DATA, NOT GDPR-SAFE: 

Health, religion, sexuality, political persuasion, unions and similar 
Crimes and misdemeanours or personal issues 
Social security number (CPR) 
Pictures or videos revealing something private 

According to the GDPR it is legal to utilize completely anonymous data. It does, however, require that neither you, the person in question, or others can uncover the person´s identity. You must remove name and identity where possible, but it is not always enough to live up to the rules of anonymizing. 

EXAMPLES ON NOT ANONYMIZED DATA ACCORDING TO GDPR: 
During a lecture, you are describing a case containing an interview from person X. The interview has quotes about person X´s troublesome fight with cancer. The data stems from your own research data, which still contains the interview and where person X is named. 

Even though you have deleted the raw data, the quotes are so specific, that X or her next of kin will be able to recognize them, if they participated in the lecture. 

In both cases the data will be pseudo-anonymized, and this is not secure enough. 

The rules of GDPR is that you can only use these personal data if the person themselves have published the information. For example, you can mention or link to an open profile on social media or in a news story, and still abide the rules of GDPR.