UNIVERSITY OF HELSINKI DATA PROTECTION NOTICE
DATA PROTECTION NOTICE FOR
SCIENTIFIC RESEARCH
General Data Protection Regulation of the EU
Articles 12–14
Date: [20.1.2021]
Information on the processing of personal data in the research project entitled Sexual harassment and young people: meanings and intersectional negotiations in diversifying socio-cultural contexts
The research project entitled Sexual harassment and young people: meanings and intersectional negotiations in diversifying socio-cultural contexts involves processing of personal data. The purpose of this data protection notice is to provide information on the personal data to be processed, from where they are obtained and how they are used. Detailed information on the rights of data subjects will be provided at the end of this notice.
Your participation in the research project and provision of personal data are voluntary. If you do not wish to participate in the project or you wish to withdraw from it, you can do so without negative consequences.
1. Data Controller
University of Helsinki
Address: PO Box (Fabianinkatu 33), 00014 University of Helsinki, Finland
2. Contact person and principal investigator
Contact person in matters concerning the research project:
Name: Satu Venäläinen
Faculty/department/unit: Faculty of Social Sciences/social psychology
Address: : Unioninkatu 37/PL 54, 00014 Helsingin yliopisto
Phone: 050-4488621
Email: satu.venalainen@helsinki.fi
Principal investigator: Satu Venäläinen
3. Contact details of the data protection officer
You can contact the University of Helsinki data protection officer via email at tietosuoja@helsinki.fi.
4. Description of the research project and the purpose of processing personal data
The research project focuses on sexual and gender-based harassment among young people. The purpose of the research is to explore the meanings of sexual and gender-based harassment for young people, and how those meanings may vary among young people. The research is coordinated at the University of Helsinki.
The research materials used in the project include writings and interviews among young people. The interviews will be recorded with the participants’ permission.
The recorded interviews will be written into text form, so that all the information that could allow identifying the participant will be removed. The research materials will be stored safely in locked cabinets at the University and digitally, safeguarded with a username and a password. The principle investigator is responsible for safeguarding the participants’ personal data and the research materials throughout the project.
5. Personal data included in the research data:
The data collected for the research include writings and interview recordings. The following personal data will be collected from the participants: name (in the case of face-to-face interviews or workshops only), age and a description of their place of residence. Any possible sensitive personal data will be collected only if the participants disclose them in their writings or interviews. This information will not be connected to any information that would allow identifying the participants. The information that might allow identifying the participants will be stored separately from the anonymised research materials such as the written (i.e. transcribed) interviews.
6. Sources of personal data
Personal data is collected only on the basis of what the participants wish to disclose in interviews or their writings, no other sources are used for collecting it.
7. Sensitive personal data
The following special categories of personal data (i.e., sensitive data), as defined in Article 9 of the GDPR, will be processed in this research, but only if the participants themselves voluntarily disclose them in relation to the research topic:
X Racial or ethnic origin
Political opinions
Religious or philosophical beliefs
Trade union membership
Genetic data Biometric data for the purpose of uniquely identifying a natural person
Health
X Sex life or sexual orientation of a natural person
The processing of sensitive personal data is based on Article 9(2)(j) of the General Data Protection Regulation (processing is necessary for scientific research purposes), as well as Section 6, Subsection 1, Paragraph 7 of the Finnish Data Protection Act.
8. Lawful basis for processing personal data
Personal data are processed on the following basis (Article 6(1) of the GDPR):
X Task carried out in the public interest:
X Scientific or historical research purposes or statistical purposes
Archiving of research material and cultural heritage material
Consent by the research subject
Compliance with a legal obligation to which the controller is subject
Legitimate interests pursued by the controller or by a third party; Specify the legitimate interest:
If the processing of personal data is based on the research subject’s consent, he or she can withdraw that consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
9. Recipients of data
The data will not be transferred to any other people outside the research group at the University of Helsinki besides the employee who will transcribe the interviews into text form. The Transcriber will only handle the interview recordings without any other data or personal information, and they will sign a non-disclosure agreement.
10. Transfer of data to countries outside the European Economic Area
Data will not be transferred to countries outside the European Economic Area.
11. Automated decision-making
The research project involves no automated decision-making that has a significant effect on
data subjects.
12. Protection of personal data
Personal data included in the research dataset will be processed and kept protected so that only those who need the data can access them.
The data processed in data systems will be protected using the following:
X Username and password
X Registration/log of use
X Access control Encryption
Two-factor identification
Other, please specify:
Physical material (e.g., data in paper form or other tangible form) will be protected using the following: Storing in a locked cabinet in a locked room at the University of Helsinki.
Processing direct identifiers:
The controller collects the personal data without direct identifiers.
X Direct identifiers will be removed during the analysis stage and kept separate from the analysed research data.
The data will be analysed using direct identifiers, because (give grounds for preserving the direct identifiers):
13. Duration of the processing of personal data in this research project:
The research project has started on 1.8.2020, and it will last for approximately three years. The interview recordings will be archived at the University of Helsinki for 1,5 years after the project has ended. After that they will be destroyed. Any other materials that might allow identifying the participants will be destroyed when the research project ends.
14. Processing of personal data when the research project ends:
The research data will be deleted
X The research data will be kept for the purposes of validating or replicating the results of this research project:
X without identifiers identifiers included
X The research data will be kept for later, compatible scientific research in accordance with the requirements of the GDPR:
X without identifiers identifiers included
The storage of the research data is based on Article 5(1)(b) and (e) of the GDPR.
Before the data can be used for other research, the controller will ensure that the new use is compatible with the initial purpose in accordance with the requirements of the GDPR. Data subjects will receive a new data protection notice on the new use of the research data, unless the controller can no longer identify the subjects from the data.
In addition, the data subjects will not be informed of the new research if delivering this information to them is impossible or involves a disproportionate effort or renders impossible or seriously impairs the achievement of the research objectives (Article 14(5)(b) of the GDPR).
Where and for how long will the data be stored:
The interview recordings will be archived at the University of Helsinki for 1,5 years after the project has ended. After that they will be destroyed. Any other materials that might allow identifying the participants will be destroyed when the research project ends. The written anonymized interviews will be archived at the Finnish Social Science Data Archive permanently, and will be available for reuse with the permission of the PI. The research participants will be informed about the fact that the materials will be archived for reuse, and their consent is sought for this.
15. Rights of data subjects and derogations from those rights
The contact person in matters related to research subjects’ rights is the person stated in section 1 of this notice.
Rights of data subjects
Under the General Data Protection Regulation, data subjects have the following rights:
Right of access to their data
Right to rectification of their data
Right to the erasure of their data and to be forgotten
Right to the restriction of processing of their data
Right to data portability
Right to object to the processing of their data
Right not to be subject to automated decision-making
However, data subjects cannot exercise all their rights in all circumstances. The circumstances are affected by, for example, the legal basis for processing personal data.
Further information on the rights of data subjects in various circumstances can be found on the website of the Data Protection Ombudsman: https://tietosuoja.fi/en/what-rights-do-data-subjects-have-in-different-situations.
If data subjects cannot be identified
If the processing of personal data for research purposes does not require the identification of the data subject and if the controller is unable to identify the data subject, the right to access, rectify, erase and restrict the use of personal data, as well as any notification obligations and the right to data portability do not apply unless the data subject provides additional data enabling their identification (Article 11 of the GDPR).
Derogations from rights
The General Data Protection Regulation and the Finnish Data Protection Act enable derogations from certain rights of data subjects if personal data are processed for the purposes of scientific research and the rights are likely to render impossible or seriously impair the achievement of the research purposes.
The need for derogations from the rights of data subjects will always be assessed on a case-by-case basis.
Right to appeal
If you consider that the processing of your personal data has been carried out in breach of data protection laws, you have the right to appeal to the Office of the Data Protection Ombudsman.
Contact details:
Office of the Data Protection Ombudsman
Street address: Ratapihantie 9, 6th floor, 00520 Helsinki
Postal address: PO Box 800, 00521 Helsinki
Phone (switchboard): 029 56 66700
Fax: 029 56 66735
Email: tietosuoja(at)om.fi