Data privacy and GDPR

The General Data Protection Regulation (GDPR) is the European Union’s data protection and privacy law. It requires organisations that collect personal data to abide by a set of privacy and security standards.

We share information about GDPR and privacy in our standardised question bank - click below to access this and go to the explainer towards the end of the document.

In summary, however, there are some good practice principles to abide by when collecting data:

• Treat all data (even if it is collected anonymously) as if it were identifiable - follow GDPR good practice to avoid causing any harm to those you survey and being liable for any breach of legislation. Participants may give identifiable unknowingly and voluntarily.

• Use data collection platforms that are GDPR compliant with a server in the EU. Read the privacy statements of those data collection platforms that you use.

• Be respectful of the privacy of those we are surveying, and considering this from the very beginning of any planning.

• Be transparent. Be clear about why you are collecting the data, what you will do with it, where it is stored, and how long you will keep it for. 

• Be legitimate. Do not use the data for other purposes than those that you have specified. 

• Only send surveys to those who you have the right to contact. 

• Only collect the data you need to collect i.e. that you have a plan to use. 

• Give the respondent the opportunity to opt-out. For example, in our registration questions, completing demographic questions is not a requirement for participation.

• Be consistent and mindful about data management and storage.

Ethical principles and considerations

Nicole McNeilly has developed an ethics approach based on the UK’s Economic and Social Research Council’s (ESCR) research ethics guidance. She draws out six main principles and gives information relating to this in each project:

1. Measures will be taken to ensure the quality and integrity of the research. 

   1. E.g. how quality and objectivity will be ensured.

   2. E.g. how long data will be stored for.

2. Participants must give informed consent.

   1. E.g. that participants are fully informed of the purpose, methods and intended possible uses of the research, before agreeing to share their data.

   2. E.g. that data will not be shared with third parties.

3. The confidentiality and anonymity of research respondents will be respected. 

   1. E.g. how data will be collected, processed and reported on.

   2. E.g. no quotes will be attributed to specific individuals, unless they give express permission for the researcher to do so, and they have the opportunity to say no with no repercussions.

   3. E.g. how transcripts or notes from interviews or focus groups will be used or shared, why and how.

   4. E.g. if data are collected anonymously, including, for example, measures taken (e.g. to ensure that IP addresses are not collected).

4. Participants will participate in the research voluntarily.

   1. E.g. that all participation is voluntary and free from coercion.

   2. E.g. that all participants have the right to refuse participation.

   3. E.g. that participants can at any time request that their data are not used in the evaluation.

5. All measures will be taken to avoid harm to participants.

   1. E.g. how you will minimise risks including physical and emotional harm and risk of upset, as well as reputational damage, for participants.

6. The research will be independent and impartial.

   1. E.g. how conflicts of interest will be mitigated.

   2. E.g. if respondents will be paid.

   3. E.g. how the sample of those to be surveyed will be agreed.

Impact webinar

You might be interested in our event (in collaboration with Europeana’s Diversity and Inclusivity Cross-Team) on diversity data collection. Explore what we discussed and the resources we collated to help you collect better data that helps you improve the diversity of your work.