Familiarise yourself with the privacy notice

tekijä: Tiia Marjaana Puputti Viimeisin muutos tiistai 29. kesäkuuta 2021, 15.31

You will find the necessary templates on the university website (e.g. privacy notice).

As a rule, research participants are always entitled to know about the processing of their personal data. Agree with them on the use and sharing of their details. This is done using a privacy notice and a consent form that supplements it.  If you are a member of a research group, you do not necessarily do this yourself. 

The privacy notice is a template where you explain to each participant, for instance, what information will be collected, why, what will be done with the information, and how the information will be protected. The privacy notice is sent to the participants and to JYU’s data protection officer.  The privacy notice is always required when personal data are processed. 

The reasons for processing personal data must be given.  In your research plan, you describe the research design and research objectives. You must be able to justify personal data processing based on them. 

  • The processing of personal data must be appropriate, planned and justified, and there must be a legal basis for processing the data (e.g. consent from participants or research carried out in the public interest). Source
  • It may be tempting to, for example, ask the participants as much background information as possible. However, you should collect only data that you really need to answer your research questions. 
  • Sometimes interviewees tell more than they are asked. Such extra information should be deleted from the data (minimisation of personal data processing). 

A legal basis is needed for processing personal data, and it is specified in the privacy notice. In university research, the basis for processing is usually research carried out in the public interest, in other words, the processing of personal data for scientific research.  The legal basis for processing can also be consent from the research participant, but such situations are uncommon. 

Watch the videos!

This video deals with the GDPR, the definition of personal data and the privacy notice, while also touching on anonymisation and pseudonymisation.

You will learn more about anonymisation and pseudonymisation on the next page. 
 

Consent forms 

Even when the legal basis for processing personal data is public interest, the participants are asked to give consent in order to have proof of so-called moral consent to participate in the study.

Video 2 is about research participant rights and consent.

Parents’ consent is needed for participants younger than 15 years.   

Example
What if I don’t intend to publish the personal data I receive? Is the privacy notice then needed? 
It is not important whether or not you publish the data. It matters that you process the data. 

 

Preliminary ethical review and impact assessment

 Ethical review before doing research on human participants 

You may need a preliminary ethical review for the harms and risks potentially caused to the research participants:  

In some situations, you may also need to make a data protection impact assessment (DPIA). 

Do not hesitate to ask JYU’s data protection officer for more information: tietosuoja@jyu.fi.