Article
GDPR FAQ - Market Research Society
mrs.org.uk
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
Q: If an end-client is using ‘legitimate interest’ in order to supply us with their customer leads, and they have documented research as a legitimate interest in there are there any additional steps that we need to take in order to use this data? “Also useful to have an audit document that records privacy policy details, conduct of Legitimate Impact Assessment (LIA) by client etc to use as a demonstrable record of lawfulness.” Q1: The client that is commissioning the research wants to remain anonymous. When we ask the participant’s consent to take part, is it sufficient to include extra text that clearly communicates that we cannot reveal the client name?
Q1: We have approved WhatsApp as a form of direct communication with participants where we feel it will benefit the research/methodology. Where we use WhatsApp, we ensure we have the appropriate consent and deletion protocol etc. We are now considering running a WhatsApp groups with participants. This will mean participants will be able to see each other profiles and telephone numbers. Is this within the GDPR rules as long as we get their consent at recruitment? “Researchers that decide to use WhatsApp in their projects must do so in compliance with GDPR and the conditions set by Facebook.” Q2: Sharing of voice recordings with the auditor & our client: We are currently in the process of being audited on our end to end processes around collecting interviews and providing scores with one of our clients. The audit is being carried out by a third party. As part of the audit we are being asked to share recordings of interviews that have been conducted over the phone. We inform participants that the call will be recorded and get consent from them to continue the survey. The current wording that we have in the survey introduction relating to the call recording is: “All calls are being recorded for training and quality purposes - is it ok to continue?”
Anonymization is information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information “if you could at any point use any reasonably available means to re-identify the individuals to which the data refers, that data will not have been effectively anonymised but will have merely been pseudonymised.” Q: If an end-client is using ‘legitimate interest’ in order to supply us with their customer leads, and they have documented research as a legitimate interest in there are there any additional steps that we need to take in order to use this data?
Q: A customer has complained that we used a personalised link for an online survey that identifies them. They seemed to think that we shouldn’t be doing this post GDPR. “Appropriate information provided to the participant including the privacy policy should make it clear how the personal data will be used, retained and destroyed” Q: As a sole trader, working as an independent freelance researcher (often collecting personal data for participant interview recruitment, recording interviews and transcripts). GDPR compliance is daunting. What do you recommend as the best starting point?
Q: For the longest time I have always assumed that it was not OK for us to simply build a list of e-mail addresses found online by doing desk research and then e-mailing them some information about a survey we’re running. However, I now have a client that wants to follow just this approach and I can’t seem to find any backing for my view. Is it OK for us to publicly-available e-mails and send survey invitations to highly-targeted potential participants? “Yes, you may use publically available information in this way, as per GDPR you will still need to establish your legal processing ground and inform the participants where you found their data if they ask.” Q: We are holding to filmed recordings of focus groups. How long is a company entitled to keep someone’s data for?