The UK General Data Protection Regulations (GDPR) are designed to improve the way organisations collect and store personal data. They also give members of the public control over how, to whom and for what purpose they disclose their data. The principles behind GDPR are perfectly reasonable - honesty and clarity about why you are collecting data, storing it securely etc. They are not a blanket ban on collecting personal information. Instead they are a way of ensuring you do it properly.
GDPR applies to personal data – information that would enable a particular individual to be identified. Personal data includes: names, telephone numbers, postal and email addresses. It also applies to data which, in combination, could be used to identify someone. For example if you collected: job title, income, age, gender, ethnicity, post-code and whether they have children under 16 living at home, it would be relatively easy to identify an individual.
It is however extremely unlikely that any Ingenious Grant Holder would ever need to collect that much personal data from their audiences. There are, however, some general guidelines you need to abide by when undertaking evaluation even if you are only collecting a minimal amount of personal data.
Only collect what you need
Follow the principles of ‘privacy by design’ and only collect data which is strictly necessary. Avoid collecting personal information such as names, email addresses unless you can be clear about what you intend to do with this data.
For instance, if you want to send a follow-up survey three weeks after an event - this would be a valid reason to collect names and email addresses. But you must confirm that participants understand why you are collecting this data, and they must give explicit permission for you to do so i.e. they must ‘opt-in’.
You should say something along the lines of:
‘We would like to find out if this event has had any long-term impact on the people who attended. Would you be willing to provide us with an email address so we can send you a short, anonymous survey in a few weeks’ time? We will only use your email address for this purpose. We will not be adding you to our mailing list, or sharing it with anyone else. We will delete your contact details once the survey has been completed’
When collecting postcodes, clearly state that this will only be used to assess the range of people taking part. Postcode information on its own is very unlikely to make an individual identifiable. And compared to other methods of assessing socio-economic status – such as the NS-SEC questions, collecting postcodes is far less intrusive. For more on this see Using postcodes to generate socio-economic profiles.
Seek permission
Always ask for permission when you:
- Want to conduct interviews – in person or via phone / video-link. Never assume people want to take part
- Take a picture, or make an audio/video recording of someone
If you are conducting research with people younger than 16, or with vulnerable adults, you must ensure that they understand what they are agreeing to; and you must also obtain the permission of a parent, carer, teacher or other responsible adult.
If you are undertaking observations (e.g. of people taking part in a workshop) place an easy to read sign in a prominent location. The sign should explain that researchers are observing people today and if anyone wants more information, to please ask a member of staff. Ensure that the researcher undertaking the observations is wearing an identity badge or lanyard. If anyone asks not to be included in the observation ensure that their wishes are complied with. For more on this see How to conduct observations
Informed consent
A key principle of the GDPR is that people must ‘opt-in’ rather than having to ‘opt-out’. When you recruit people to take part in interviews, focus groups or online discussions, they need to know:
- How you will use their data
- How much time it will take (and you must keep that promise)
- That they have the right to withdraw their consent at any time and ask you to dispose of any data you have collected
For a short interview or questionnaire that does not involve collecting any personal data, this can be covered in a brief introduction. If you are making audio or video recordings, you should explain how data will be used and what will be done with the recordings afterwards. Then with permission, begin the recording and simply ask the respondent to confirm they understand what you are doing, and that they have given their consent.
Incentives and payments
If you are asking people to give up a substantial amount of their time – 15 minutes or more – you should consider providing an incentive as recompense. Incentives should be scaled according to the amount of time you require.
People will generally not expect an incentive for completing questionnaire or short interview (i.e. less than 10 minutes). For significant time commitments, such as a focus group, participants need their travel costs reimbursed and be compensated for their time. Expect to allocate around £50-60 per person for a 90-minute focus group.
Never offer an incentive that requires people to spend money – for example a ‘50% off’ voucher. For more on this see When to provide incentives for people taking part in evaluation.
Using data
When you write an evaluation report, you must ensure that you represent the data you have collected accurately. For example you need to ensure that any quotes preserve the original meaning of the interviewee; and that numerical data is not presented in a misleading manner.
You must also honour the commitment you made to the research participants and not use the data for any other purposes. For example if you have audio or video recordings of interviews you must not use this data for publicity purposes, unless the interviewees gave explicit permission for you to do so.
Looking after data
You need to ensure that the personal data you collect is stored securely.
Access should be limited to those analysing the data by using secure passwords. Paper records should be stored in a locked filing cabinet or draw. Anti-malware software must be installed on your computers and regularly updated.
Once the analysis is complete, all data should be properly deleted / shredded. This is especially important for any contact details you have collected.
The UK General Data Protection Regulations (GDPR) are designed to improve the way organisations collect and store personal data. They also give members of the public control over how, to whom and for what purpose they disclose their data. The principles behind GDPR are perfectly reasonable - honesty and clarity about why you are collecting data, storing it securely etc. They are not a blanket ban on collecting personal information. Instead they are a way of ensuring you do it properly.
GDPR applies to personal data – information that would enable a particular individual to be identified. Personal data includes: names, telephone numbers, postal and email addresses. It also applies to data which, in combination, could be used to identify someone. For example if you collected: job title, income, age, gender, ethnicity, post-code and whether they have children under 16 living at home, it would be relatively easy to identify an individual.
It is however extremely unlikely that any Ingenious Grant Holder would ever need to collect that much personal data from their audiences. There are, however, some general guidelines you need to abide by when undertaking evaluation even if you are only collecting a minimal amount of personal data.