GDPR What to do when personal data is processed, e.g. an e-mail list?
It is required to record the processing by filling in the inventory and to keep the document safe.
Page 1: Information on the controller, the department and the internal person in charge who completes the inventory, the data protection officer and the possible use of external parties (subcontractors, co-contractors or partners)
Page 2: The name of the processing operation and its purposes
Example
Name of the processing operation: Survey on XXXX
Purpose: Scientific research
Page 2: The date and description of the processing operation
Page 3: The basis of the processing
In order for a processing of personal data to be lawful, it must be based on at least one of the bases listed in the RGPD:
1) The consent of the person whose data is being processed
2) The existence of a contract
3) Compliance with a legal obligation
4) A task in the public interest or the exercise of official authority
5) The legitimate interests of the controller
Page 3 : The persons whose data are processed
Page 3: The personal data you are processing and how long it will be kept
Page 4: The recipients of the data and any transfers to a country outside the EU or to an international organisation
Page 5: Technical security measures
As a data controller, you must ensure that appropriate security measures are in place to prevent the loss, misuse or alteration of the data received.
Is it necessary to refer to laws?
The committee recalls that the law of 22 August 2002 relating to patients' rights and the law of 7 May 2004 relating to human experimentation only apply to projects submitted to the Cliniques Saint-Luc Hospital-Faculty Ethics Committee.
Drawing lots: how to proceed?
When the study foresees that participants will take part in a lottery or a draw, the following information will be communicated to them: the number of winners, the amount of the prize, the probability of winning.
Manipulation and self-esteem: Is it necessary? What questions should be asked?
In such studies, it is important to ensure that all measures are taken for the welfare of the participants. Any researcher considering a manipulation that might be deleterious to the dignity/wellbeing of participants is advised to consult and describe very carefully in their file their approach to debriefing and how this approach compares to conventional practices as described in this article: Miketta et al. (2019) 'Debriefed but Still Troubled? About the (In)Effectiveness of Postexperimental Debriefings After Ego Threat'
Who can participants turn to for possible complaints?
In the consent form, the information given to the participants regarding the submission of possible complaints is as follows: If you have any complaints, you can contact the professor in charge of the study and if the complaints are not resolved, privacy@uclouvain.be.
How can the anonymity of participants be preserved when their e-mails are collected for the payment of financial compensation or for the communication of the results of a study?
When financial compensation is granted, researchers need to temporarily record participants' emails. In order to preserve anonymity, the ethics committee recommends that a link be provided to allow participants to exit the questionnaire and leave their email outside of it. The same precautions apply when the results of the study are to be communicated to participants.
Online questionnaire: is consent and debriefing required?
A request for free and informed consent with an explanation of the study is required at the beginning of the questionnaire. The time needed to complete the questionnaire will be mentioned.
The commission recommends a written debriefing at the end of the questionnaire.
How should participant data be stored?
Participants' data should be stored securely. The OneDrive space or another server of the university is recommended.
Can young people give their consent without their parents' consent?
From the age of 16, parental consent is no longer required. Only the consent of the young people is required.
Have I forgotten anything?
- When the survey is conducted in schools or educational institutions, inform parents, pupils and students that it is not part of the learning curriculum.
- Like their parents, children are under no obligation to participate in a study. It is important to give them this information and to ask for their oral consent.
- Explain how the researcher will deal with children who are not included in a study.
- The consent form must clearly and easily explain the tasks to be performed, the time required to perform them, the financial compensation and the modalities in case of withdrawal from the study. For complaints, the contact person is the sponsor. The address "privacy@uclouvain.be" is only used in case of unresolved complaints. References to legal texts are not necessary.
- A test or experiment cannot be presented as something that can improve the situation of the participants because it is an ongoing research project with no established results.
- The fact that the data may be used by other researchers for other scientific purposes should be disclosed to participants in the consent form.