Setting up a new dataset with respondents
In the case of academic research you can set up a new dataset by collecting data from respondents or by combining two existing datasets (public or otherwise).
A dataset can take the form of a file, but other forms such as video and audio recordings, interviews, score forms, eye-tracking etc. also fall under this definition. These respondents can be recruited themselves, for example by a call for participation or from a test subject pool.
|
Respondents |
For respondents, it is important that they participate voluntarily and that they are well informed in advance about the research with regard to the protection of personal data, among other things. This should be done by means of an Informed consent form. If the baisis for processing is consent or Special Personal Data are processed, additonal requirements apply. |
| Data minimalisation |
If Personally Identifiable Information is necessary for academic research:
|
| Security |
If Personal Data is used for research purposes, it must be processed in an aadequately secured manner. |
| Obligation to inform |
Respondents have a right to information and need to be well informed. |
| Registration | Research should be recorded in a processing register |
Establishing lawfulness and purpose limitation
If personal data are processed in a scientific research, the so-called legitimacy and purpose limitation must first be established. After this, the so-called material requirements must be taken into account in order to ensure that personal data are handled with care.
Lawfullness
- Do we have a legal basis for processing?
Target binding
- What do we want to do?
Materiele vereisten
- Do we handle Personal Data with care?
Processing base new datasets
Direct from respondents
Processing basis is generally the consent of the person concerned. In exceptional situations, however, one of the processing bases listed below may also apply:
- Necessary for task of general interest
- Necessary for legitimate interest: a balance must be made between the interests of the scientific research and the privacy interests of the Respondent.
For more explanation of the various processing principles we refer to the Privacy & Processing of Personal Data Policy.
If and when such an exception applies, this should be well documented and motivated by the researcher in the Survey questionnaire. If necessary, Data Representative can advise on this.
It is necessary that the interests of the respondents are properly safeguarded in the research design and management / security of Personal Data. See the requirements at the various points of the research life cycle.
Example:
- In certain forms of medical research for the benefit of public health, there may be a processing task in the public interest.
Not VIA Involved party
Processing basis for academic research in which a new dataset is set up in which research data is collected without obtaining it directly from respondents is: Justified interest.
In this case, the research data are collected on the basis of information made public by Respondent itself.
Example:
- Setting up a new dataset using webscraping.
Special persona data
According to the GDPR, special personal data may only be processed under strict conditions. In the case of scientific research, the ban on processing special personal data may be lifted subject to certain conditions.
Consent is required for the use of new datasets with special personal data (informed consent): Respondent must give explicit permission on the Informed Consent form for the processing of the Special Personal Data.
Target binding
The second requirement is that there must be purpose limitation: there must be a well-defined, clearly defined purpose.
The purpose of the Processing of Personal Data is: To carry out scientific research as referred to in the Higher Education and Scientific Research Act and the Code of Conduct for Scientific Practice (specify Purpose of Research).