Anonymous or not anonymous

[Meldrew]

Hi.

 

An organisation has sent us 2 surveys, one for staff, one for students about sport. They ask for the school name, DOB and job role (for staff) and tutor group (for students). Critically, they also ask for ethnicity (a special category of data). In my view it is not anonymous as there is enough information to identify someone, but the organisation insists it is not as no name is asked for and they are therefore compliant.

 

Views would be appreciated.

 

Many thanks,

 

Meldrew.

[Ditto]

I'd say not anonymous and non-compliant. I'd asked for what legitimate purpose they are collecting that data. I'd also suggest doing a full DPIA.

[GrumbleDook]

Hi.

 

An organisation has sent us 2 surveys, one for staff, one for students about sport. They ask for the school name, DOB and job role (for staff) and tutor group (for students). Critically, they also ask for ethnicity (a special category of data). In my view it is not anonymous as there is enough information to identify someone, but the organisation insists it is not as no name is asked for and they are therefore compliant.

 

Views would be appreciated.

 

Many thanks,

 

Meldrew.

 

How on earth would anyone consider this as anonymous?

 

Is this general research or something specific the school has commissioned?

 

If the request is for research purposes then there should be a clear outline of how data will be processed, any future sharing, etc. It may be that the analysis is done on an anonmyous basis (i.e. the team working on it has no idea what school that data set is from or the name of individuals, but other relevant details of age and linked group as what is used within the analysis. If this is research being done for the benefit of the wider education community, then the university leading the research will give guidance on how you allow this data to be shared. There needs to be a data sharing agreement in place and there needs to be an agreed lawful basis. Transparency would require sharing what is happening with staff, pupils and parents ... depending on the lawful basis used you may end up using Consent or if using a different lawful basis then you need to check how you are allowing the right to object.

 

If this is school commissioned work, then a Data Processing Agreement will set out the terms. Forward sharing of data is something to look at here and this might be where they agree to anonymise (if forward sharing is allowed).

 

If in doubt, approach British Education Research Agency for guidance on how research agencies should work with you.

 

[edit - the presumption that you are doing a DPIA either way is a given]

Edited April 26, 2019 by GrumbleDook

[Meldrew]

How on earth would anyone consider this as anonymous?

 

Is this general research or something specific the school has commissioned?

 

If the request is for research purposes then there should be a clear outline of how data will be processed, any future sharing, etc. It may be that the analysis is done on an anonmyous basis (i.e. the team working on it has no idea what school that data set is from or the name of individuals, but other relevant details of age and linked group as what is used within the analysis. If this is research being done for the benefit of the wider education community, then the university leading the research will give guidance on how you allow this data to be shared. There needs to be a data sharing agreement in place and there needs to be an agreed lawful basis. Transparency would require sharing what is happening with staff, pupils and parents ... depending on the lawful basis used you may end up using Consent or if using a different lawful basis then you need to check how you are allowing the right to object.

 

If this is school commissioned work, then a Data Processing Agreement will set out the terms. Forward sharing of data is something to look at here and this might be where they agree to anonymise (if forward sharing is allowed).

 

If in doubt, approach British Education Research Agency for guidance on how research agencies should work with you.

 

[edit - the presumption that you are doing a DPIA either way is a given]

 

This is general research. It was sent to the head of PE here, who sent it out to all students and staff without checking with me first (as per our GDPR policy) because 'it had to go out in a rush' - grr!

 

The privacy policy they provided when I queried them is:

 

https://www.shu.ac.uk/about-this-website/privacy-policy/privacy-notices/privacy-notice-for-research

 

It states there will be an information sheet, which I've not seen and when the survey loads there isn't any GDPR information at all.

 

Meldrew

[GrumbleDook]

And breathe and relax ....

 

Do you mind if I share this example with others about buggered up comms are when doing things like this?

 

The UNi are acting as Data Controllers, and from the looks of it as sole Data Controllers (no mention of others involved in the gathering0 ... and you are just promoting taking part in the research. If everyone is *told* that they have to do it then Consent is not the lawful basis.

Before the survey is filled in, all of the subjects should have had chance to see the Privacy Notice you linked to and the information sheet.

At this point I would strongly advise you to speak to your DPO and talk to the ICO helpline.

[Ditto]

Perhaps there should be compulsory DPA/GDPR awareness courses for such individuals - a bit like speed awareness courses for illegal driving.