In this section:
- About Privacy Settings
- What is Personal Data? What Do You Need to Know about Personal Data Processing?
- Separate Storage of Personal Data
- Anonymization of Personal Data
- How to Mark Personal Data?
About Privacy Settings
Since May 25, 2018, the so-called General Data Protection Regulation (GDPR) has been effective throughout Europe. GDPR regulates various aspects related to personal data processing by companies and government agencies. Its main goal is, on the one hand, to ensure the protection of personal data in the European Union, and, on the other hand, to enable free transition of personal data in the unified European market.
Surveys are not the same as they may require different types of data for different purposes. In most cases, QUESTIONSTAR, as a service provider, bears no relation to the data you collect as part of your surveys and the methods you use to process this data. This means that your company will be solely responsible for making sure that all your surveys are completed in compliance with GDPR. But the tools and settings offered by QUESTIONSTAR can help you meet the GDPR requirements.
You can use the Privacy tab in the Survey Settings to define how the personal data collected for your survey will be processed, especially after export:
What is Personal Data? What Do You Need to Know about Personal Data Processing?
According to European legislation and the German Federal Data Protection Act (BDSG), personal data is all information that relates to a given individual or may allow to establish their identity. Personal data includes a person’s name, address, email, and so on.
When Is It Allowed to Collect Personal Data?
Pursuant to the Data Protection Act, the collection and processing of personal data is strictly prohibited in all cases,
except those explicitly permitted by the law. Data processing may be permitted for labor documents or health and safety records.
Data processing required for the signing and performance of an agreement.
Special interests of a data controller deemed to supersede the interests of the data subject (protection of their personal data). These interests can be of economic nature. For example, the commercial interests of a trader who uses emails to send out ads to their current customers are deemed more important than their customer’s privacy.
Situations when the data subject provides a consent for the processing of their personal data.
Therefore, you are not allowed to collect personal data in your survey unless this is expressly permitted by law, or you need it to fulfill your contractual obligations, or you have a reasonable special interest to gather such data.
Consent for Processing and Storage of Personal Data
In all other cases, you will need to obtain explicit consent of your data subjects before you can store or process their data. According to Article 4, Clause 11 of DSGVO, this consent must meet certain requirements:
It must be voluntary. You cannot force your respondents to share their data especially if this is not required for achieving your goals. For example, if you want to give a prize as a Thank You gift for taking part in your survey to some of your participants, getting a consent for processing their emails is quite acceptable. However, you cannot use the same email for advertising purposes since this usage is not a pre-requisite for achieving your goals (profits).
The data subject must have complete information before giving their consent. Your data subject must be duly informed as to why they should provide his data and how it will be used.
The consent should be explicit and unmistakable. This means that the data subject must be fully aware that they are giving their consent, for example, they may be requested to check a relevant box or select the I agree option. Tacit consent, when the data subject’s consent is assumed and they need to uncheck a box to deselect this option, is not allowed.
Consent should be granted for one or more specific purposes. You cannot ask your respondents to provide a general consent without mentioning the specific goals of data processing.
Separate Storage of Personal Data
This may be not expressly required by law, but privacy officers and expert consultants highly recommend making sure that personal data is kept separate from other responses provided by your data subjects. You can meet this requirement by checking the Save Private Data Separately option.
In this case, your respondents’ responses will be saved in two files instead of one when you try to export them. And each of these files needs to be exported separately. The entries in these files are organized differently, so the relationship between the entries and their position in the files cannot be easily traced. However, each entry contains a key (ID) which can be used to link and combine the entries in both files.
To enable this option:
- Check the box next to Save Private Data Separately.
2. Click Apply Privacy Settings (1). You will see a dialog box informing you that you won’t be able to disable this parameter.
- Check Apply Permanently in this dialog box (2).
- Click Apply once again (3).
Anonymization of Personal Data
In the case of separate personal data storage, all responses will be divided between two files. Each entry contains a key (ID) that can be used to link the entries in both files. This means that you can later combine personal data with other responses provided by data subjects.
When the Anonymize IDs setting is enabled, the key (ID) will not be included in the exported files. Since the entries in both files are organized differently (randomly), the subject’s personal data can no longer be linked or combined with their other responses.
To enable the Anonymize IDs option:
- Check the box Save Private Data Separately, if you haven’t done so already.
- Check the Anonymize IDs box.
Click Apply Privacy Settings. You will see a dialog box informing you that you won’t be able to disable this parameter.
Check Apply Permanently in this dialog box.
Click Apply once again.
Storing Your Data in Germany
According to Europe laws, the personal data of Europe citizens must be stored within the borders of Europe. QUESTIONSTAR possesses the capacities to store personal data on the territory of Europe.
Use Only German Servers parameter:
- This parameter is turned on by default and cannot be disabled.
How to Mark Personal Data?
The platform cannot determine whether or not a question in your survey has something to do with personal data, unless this is an email address.
This is why you must make sure to properly identify personal data to meet the requirements to personal data protection described in this article.
To mark a private question:
Go to Edit Survey, select a question, and click the gear icon, if necessary (in the upper right corner of the question box), to open the right properties pane.
Set the Private Question switch to On. This question will be marked as private. You can easily find such questions in the questionnaire − look for a fingerprint icon in the Survey Editor:
