GDPR FAQ - Market Research Society

Quoted on this wiki

Every place a page here uses this source, in the order the words come in it.

1. Anonymization is information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information “if you could at any point use any reasonably available means to re-identify the individuals to which the data refers, that data will not have been effectively anonymised but will have merely been pseudonymised.” Q: If an end-client is using ‘legitimate interest’ in order to supply us with their customer leads, and they have documented research as a legitimate interest in there are there any additional steps that we need to take in order to use this data?

   In Prospect data anonymization

2. Q: A customer has complained that we used a personalised link for an online survey that identifies them. They seemed to think that we shouldn’t be doing this post GDPR. “GDPR does not prevent the processing of personal data but ensures that it is carried out lawfully, fairly and transparently.” Q: As a sole trader, working as an independent freelance researcher (often collecting personal data for participant interview recruitment, recording interviews and transcripts). GDPR compliance is daunting. What do you recommend as the best starting point?

   In GDPR and ePrivacy

3. Q: If an end-client is using ‘legitimate interest’ in order to supply us with their customer leads, and they have documented research as a legitimate interest in there are there any additional steps that we need to take in order to use this data? “Also useful to have an audit document that records privacy policy details, conduct of Legitimate Impact Assessment (LIA) by client etc to use as a demonstrable record of lawfulness.” Q1: The client that is commissioning the research wants to remain anonymous. When we ask the participant’s consent to take part, is it sufficient to include extra text that clearly communicates that we cannot reveal the client name?

   In Legitimate interest assessment

4. Q: A customer has complained that we used a personalised link for an online survey that identifies them. They seemed to think that we shouldn’t be doing this post GDPR. “Appropriate information provided to the participant including the privacy policy should make it clear how the personal data will be used, retained and destroyed” Q: As a sole trader, working as an independent freelance researcher (often collecting personal data for participant interview recruitment, recording interviews and transcripts). GDPR compliance is daunting. What do you recommend as the best starting point?

   In Prospecting transparency notices

Quotes are verbatim and belong to their publishers. Where a quote has been translated, the original wording is kept below it.