PRIVACY NOTICE FOR SCIENTIFIC RESEARCH PARTICIPANTS
EU GENERAL DATA PROTECTION REGULATION, ART. 12-14
DATE: 28.9.2020

Information for Research Participants

You are taking part in a scientific study organized by INTERACT research unit, University of Oulu. This notice describes how your personal data will be processed in the study.

Participation in the study is voluntary. There will be no negative consequences for you if you choose not to participate in the study or if you withdraw from the study. However, if you withdraw from the study, data collected prior to your withdrawal may still be used in the study. For more information on your rights and how you can affect the processing of your personal data, please see section 14 of this notice.

1. Data Controller

University of Oulu

  • Address: PL 8000, 90014 Oulun yliopisto (Pentti Kaiteran katu 1, Linnanmaa)

Contact person in matters concerning the research:

  • Name: Professor Netta Iivari, the director responsible for the research
  • Address: University of Oulu, INTERACT Research Unit
  • Tel: 0294 480 000
  • E-mail: netta.iivari@oulu.fi

2. Description of the study and the purposes of processing personal data

Our research unit conducts transdisciplinary research with diverse users to study the meaning and the possibilities of digitalization in people’s everyday lives, valuing and in the best case involving users. For this purpose, we gather different types of research material not only from the people themselves (with surveys, interviews, etc.) but also during different research events (for example group work, workshops, etc.). In addition, project funder may require gathering personal information, usually for statistical purposes. We do research not only in the university facilities but also in the field, in the context of people’s everyday lives, for instance, in schools and workplaces. The central research material that will result in these studies are text, photographic, audio and video material and possibly also log data of the use of different digital devices and applications. Research material resulted through using different methods can be combined during the analysis phase. For each project, a separate description of the project’s details (such as name, nature and duration of the study, during which the research material is acquired) and the parties and their responsibilities in research collaboration is provided.

3. Contact details of the Data Protection Officer

You can contact the Data Protection Officer of the University at dpo@oulu.fi

4. Principal investigator or responsible research group

Researchers of INTERACT Research Unit, Faculty of Information Technology and Electrical Engineering, University of Oulu.

5. Lawful basis of processing

The material gathered in research projects is processed and archived as it is for long-term use for the research unit’s research and teaching purposes. The information is archived in the INTERACT research unit’s facilities and with its devices. Personal data is processed on the following basis, which is based on Article 6(1) of the General Data Protection Regulation:

  • participant’s consent
  • compliance with a legal obligation to which the controller is subject
  • performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

6. Sensitive personal data

No sensitive personal data will be processed in the study.

7. Personal data included in the research materials

The central research material that will result during the research are text, photographic, audio, and video material and files. Research material resulting from using different methods can be combined during the analysis phase. Participants are asked personal data, such as name, gender, organization, contact information, and signature also in connection with the research consent. The actual research material is not combined with the personal data given in the research consent.

8. Sources of personal data

The personal data is collected from the persons themselves with the research consent form. In addition, while participating in the study, the persons will produce material themselves while working in the study or when the persons participate in the research events. Digital devices and applications may be used for research purposes during the study. They will produce log data.

9. Transfer and disclosure of the personal data to third parties

The research material (text, photograph, audio, video, log files) may be processed and analyzed by, along with the INTERACT research unit, the research partners mentioned in the research description. Moreover, students doing their theses may process the information under the supervision of the above-mentioned parties. The information may be disclosed to the funder as well.

10. Transfer or disclosure of personal data to countries outside the EU/European Economic Area

No transfer.

11. Automated decisions

No automated decisions are made.

12. Safeguards to protect the personal data

The data is confidential.

Protection of manual material: Manual material will be stored in a locked filing cabinet in INTERACT Research Unit’s facilities. The filing cabinet is used by limited number of people.

The following personal data will not be processed in IT systems:

  • username
  • password
  • logging
  • access control

Processing of direct identifiers:

  • Direct identifiers will be removed in the analysis phase whenever possible.
  • Part of the material to be analyzed includes also direct identifiers. Reason: Using fully anonymized video and photographic data in research regarding understanding human action is not meaningful.

13. Processing of personal data after the completion of the study

The research material will be archived

  • without identifiers whenever possible
  • with identifiers (video, audio, and photographic material, because voice and picture are identifiers).

Where will the material be archived and for how long:

  • The material is archived by INTERACT Research Unit, University of Oulu in the university facilities and data archives for an undefined period, as the research unit does long-term research on the topic.
  • Material-specific needs for storing are evaluated systematically yearly.

14. Your rights as a data subject, and exceptions to these rights

The contact person in matters concerning the rights of the participant is the person mentioned in section 1 of this notice.

Withdrawing consent (GDPR Article 7)

You have the right to withdraw your consent, provided that the processing of the personal data is based on consent. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

Right of access (GDPR Article 15)

You have the right to obtain information on whether or not personal data concerning you are being processed in the project, as well as the data being processed. You can also request a copy of the personal data undergoing processing.

Right to rectification (GDPR Article 16)

If there are inaccuracies or errors in your personal data undergoing processing, you have the right to request their rectification or supplementation.

Right to erasure (GDPR Article 17)

You have the right to request the erasure of your personal data on the following grounds:

  • The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
  • You withdraw the consent on which the processing was based, and there are no other legal grounds for the processing.
  • You object to the processing (the right to object is described below), and there are no justified grounds for the processing.
  • The personal data have been unlawfully processed, or
  • The personal data must be erased to comply with a legal obligation in Union or Member State law to which the controller is subject.

The right to erasure does not apply if the erasure of data renders impossible or seriously impairs the achievement of the objectives of the processing in scientific research.

Right to restriction of processing (GDPR Article 18)

You have the right to restrict the processing of your personal data on the following grounds:

  • You contest the accuracy of the personal data, whereupon the processing will be restricted for a period enabling the University to verify their accuracy.
  • The processing is unlawful and you oppose the erasure of the personal data, requesting the restriction of their use instead.
  • The University no longer needs the personal data for the purposes of the processing, but you need them for the establishment, exercise or defence of legal claims.
  • You have objected to processing (see details below) pending verification of whether the legitimate grounds of the controller override those of the data subject.

Right to data portability (GDPR Article 20)

You have the right to request to receive the personal data you have submitted to the University in a structured, commonly used and machine-readable format and have the right to transmit these data to another controller without hindrance from the University, provided that the processing is based on consent or a contract, and the processing is carried out by automated means.

When exercising your right to data portability, you have the right to have your personal data transmitted from one controller to another, where technically feasible.

Right to object (GDPR Article 21)

You have the right to object to processing your personal data, provided that the processing is based on the public interest or legitimate interests. The University will no longer have the right to process your personal data unless it can demonstrate compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subject, or unless it is necessary for the establishment, exercise or defence of legal claims. The University can continue processing your personal data also when necessary for the performance of a task carried out for reasons of the public interest.

Derogating from rights

In certain individual cases, derogations from the rights described above in this section “Your rights as a data subject”, and exceptions to these rights may be made on the basis of the GDPR and the Finnish Data Protection Act, insofar as the rights render impossible or seriously impair the achievement of scientific or historical research purposes or statistical purposes. The need for derogations will always be assessed on a case-by-case basis.

15. Right to lodge a complaint

You have the right to lodge a complaint with the Data Protection Ombudsman’s Office if you think your personal data has been processed in violation of applicable data protection laws. Contact details:

Data Protection Ombudsman’s Office (Tietosuojavaltuutetun toimisto)

  • Address: Ratapihantie 9, 6th floor, 00520 Helsinki
  • Postal address: B.O. Box 800, 00521 Helsinki
  • Tel. (switchboard): 029 56 66700
  • Fax: 029 56 66735
  • E-mail: tietosuoja(at)om.fi