Privacy
About the privacy settings
On May 25, 2018, the General Data Protection Regulation (GDPR) came into force across Europe. The GDPR governs, in particular, how companies and public authorities process personal data. Its purpose is, on the one hand, to safeguard the protection of personal data within the European Union and, on the other, to guarantee the free movement of data within the European single market.
Every survey is set up differently and collects different data for different purposes. As a service provider, QUESTIONSTAR fundamentally has no influence over which data you, as the survey creator, collect in your surveys and how you process it. That's why responsibility for complying with the GDPR within your surveys falls within your remit. QUESTIONSTAR does, however, help you comply with the GDPR's provisions through its tools and settings.
In the «Privacy» tab of the «Survey Settings» view, you can determine how the personal data collected as part of your survey should be handled, in particular when data is exported:
Note: To ensure the protection of your respondents' privacy, the settings you make in this view cannot be undone. That's why, unlike elsewhere in the QUESTIONSTAR interface, they must be explicitly confirmed by clicking the “Apply Privacy Settings” button.
What is personal data? What needs to be considered?
Under European law and the German Federal Data Protection Act (BDSG), personal data is any information that relates, or can at least be related, to a natural person and thus allows conclusions to be drawn about their identity. This includes, in particular, name, address, email address and similar.
When is the collection of personal data permitted?
Under data protection law, the collection and processing of such data is fundamentally prohibited, unless:
- the data processing is permitted by law. This applies, for example, to employment records or occupational safety records.
- the data processing is necessary to fulfill a contract or to initiate a contract.
- there is a special interest that outweighs the data subject's interest in protecting their data. Such an interest can also be economic in nature. For example, it is argued that a retailer's economic interest in sending email advertising to its existing customers outweighs the protection of privacy.
- the data subject consents to their data being processed.
So if you collect personal data in your questionnaire, you may only do so when it is explicitly permitted by law, when you need this data to fulfill a contract, or when you have a justified special interest in collecting this data.
Consent to the storage or processing of personal data
In all other cases, you need consent from your respondents for the storage or processing of the data. However, under Art. 4 No. 11 GDPR, this consent must meet certain requirements. Specifically, it must have been given
- freely. You may not compel respondents to provide their data — especially not when it isn't necessary at all to fulfill the purpose. For example, if you'd like to raffle off a prize among your respondents as a thank-you for taking part in your survey, it's perfectly permissible to obtain consent to process the email address. This consent may not, however, be tied to the email address also being used for advertising purposes, since the latter is not necessary to fulfill the purpose (determining the winner).
- in an informed manner. This is only the case when the respondent is clearly informed why they should provide their data and what happens to the data.
- unambiguously. This means that the respondent must actively agree — for example, by clicking a checkbox or selecting the answer «I agree». Tacit consent, where the agreement is pre-selected so that the respondent has to click it away in order to object to consent, is not permitted.
- for one or more specific purposes only. General consent without naming specific purposes is invalid.
Even if all this sounds complicated, putting the legal requirements into practice in the questionnaire isn't that hard.
Examples of legally compliant consent to the storage and processing of data:
Separate storage of personal data
Even though it isn't explicitly required by law, data protection officers and works councils often insist that personal data be stored separately from respondents' remaining answers. You can accommodate this requirement by activating the «store personal data separately» setting.
In this case, respondents' answers are no longer contained in a single file when data is exported, but split into two files. You must export each of these files in a separate operation. The order of records in the two files is different, so that the link between records cannot be inferred from their position in the files. Each entry in these files does, however, contain a key (ID) that can be used to link and merge the entries of both files.
Note: To ensure the protection of your respondents' privacy, this setting cannot be undone. That's why, unlike elsewhere in the QUESTIONSTAR interface, it must be explicitly confirmed by clicking the «Apply Privacy Settings» button.
To activate the “store personal data separately” setting:
Check the «Store personal data separately» box.
Click the «Apply Privacy Settings» button. A dialog will then appear informing you that activating this setting cannot be undone.
- In this dialog, check the «apply forever» box.
- Click the «Apply» button.
Note: The legal separation requirement mandates that data collected for different purposes be processed separately. A survey generally collects data for one specific (research) purpose. In QUESTIONSTAR, the data of different surveys can only be analyzed and exported separately from one another. In this respect, the separation requirement is automatically fulfilled.
Anonymization of personal data
When personal data is stored separately, the answers are split into two files. Each entry in these files contains a key (ID) that links the entries of both files. In this way, the personal data can be merged afterwards with respondents' remaining answers.
The “anonymize IDs” setting means that the keys (ID) are not included in the exported files. Since the order of records in the two files is different and determined at random, a respondent's personal data can no longer be linked or merged with their remaining answers.
Note: When the “anonymize ID” setting is active, then to safeguard respondents' anonymity, reports and analyses are only displayed once 10 respondents have fully completed the questionnaire. Until then, a message reports that there is not enough data for the analyses.
Note: To ensure the protection of your respondents' privacy, this setting cannot be undone. That's why, unlike elsewhere in the QUESTIONSTAR interface, it must be explicitly confirmed by clicking the «Apply Privacy Settings» button.
To activate the “anonymize IDs” setting:
- Check the «store personal data separately» box — if you haven't already done so.
Check the «anonymize IDs» box.
Click the «Apply Privacy Settings» button. A dialog will then appear informing you that activating this setting cannot be undone.
- In this dialog, check the «apply forever» box.
- Click the «Apply» button.
Use European servers only.
The GDPR requires that personal data of EU citizens be stored exclusively on servers located in Europe when it is collected.
QUESTIONSTAR's survey servers (survey.questionstar.com) are located exclusively in Europe. That's why this setting is enabled by default and cannot be disabled.
How do you mark personal data?
Apart from the question of the type E-mail, QUESTIONSTAR has no way of determining whether a particular question in the questionnaire concerns personal data.
That's why it falls within the user's remit to mark personal data as such, so that the measures for protecting personal data described in this article take effect.
You can mark a personal question in the Question Settings as follows (steps 1 to 3):
You can recognize the questions marked as personal in the questionnaire by the fingerprint indicator in the question bar.
Note: Note that turning the “Private Data” toggle on and off is only possible up until the survey is first started. Once the survey has been started, it is no longer possible to deactivate the “Private Data” property. However, it is possible to mark additional questions as “Private Data”.
If, in an already started survey, you have accidentally marked a question as “Private Data”, there is only one way to correct the error: you must Copy Survey and make the correction in the copy before it starts.
Note: The answers to personal questions are only displayed in the analysis and raw data export once at least 10 fully completed questionnaires are available. Before that, display is not possible, since otherwise conclusions could be drawn about individual respondents.