Clarifications multi-wave survey

Question

Dear all,

I would need to ask clarifications about multi-wave survey. I would like to conduct a multi-wave survey with self-recruited respondents, and I read the instructions available on the User guide.

What is not clear to me is if it is possible to conduct the multi-wave survey with the standard server and the online AVV or not…

In fact, according to your explanation if the only personal data that I am collecting is an email address, then you say that:

The Standard server www.soscisurvey.de is only designed to process personal address data (list of contacts for mailings and separately collected contact data). No personal data may be collected in the questionnaire on this server.
So, my case might fall in this category, given that only contact details need to be processed.

However, given that I need to link the first wave answers of a given subject to his second wave answers I must choose the Pseudonymous privacy mode that allows the “Relation of data records from multi survey waves”.

What I don’t understand is if the Pseudonymous privacy mode is also supported if I use the standard server and the simple signing of the online AVV.
Thank you very much for your attention.

Answer 1

That is a question that you'll have to clarify with your university's data protection officer. Usually, pseudonymous data is considered personal data, under the GDPR. If you DPO follows that position, than you're working with personal data (responses), and therefore need a printed DPA (AVV) and you have to run your survey on s2survey.net

What I don’t understand is if the Pseudonymous privacy mode is also supported if I use the standard server and the simple signing of the online AVV.

SoSci Survey will not technically block the feature, because there are valid applications. However, it is your responsibility to use the software features in compliance with the GDPR.

Comments

Thank you very much for your answer!

I am indeed still waiting for the answer of the DPO of my university, but I guess she will follow the usual position that you explained.  

I would like to ask you one further clarification question. When you say that "SoSci Survey will not technically block the feature, because there are valid applications" that means that if i try just to test the multi-wave survey I should be able to do that by opening a project on Main Server www.soscisurvey.de?  I ask this because would like to have all the technical things ready as soon as possible, before opening a project on the Pro-Server.

Thanks!

---

Yes, you can (technically) do everything on the standard server like on the pro-server. Before you can work with address lists, the server will ask you to sign the online DPA (AVV). This was introduced to save users from the situation that they have no DPA when they upload email adresses (person data in most cases, not always) and violate the GDPR, just because they did not know better.

---

Dear all,

My DPO gave me some further clarification but also asked some questions after I gave her the documentation for the online DPA and the DPA associated with the pro server. In particular she asked:


1) Is there an English translation of the online DPA?
2) What is the main difference between the online DPA and the DPA associated with the pro-server?
3) In case I can (hopefully) proceed with the survey on your platform my DPO would also require to fill a GDPR Screening questionnaire. I presume this would be subject to a fee and conditional on buying a license on the pro server?

Thank you very much!

---

> 1) Is there an English translation of the online DPA?

That's a good question. Might be that it has never be uploaded to SoSci Survey.

> 2) What is the main difference between the online DPA and the DPA associated with the pro-server?

Die online DPA limits the categories of processed data to contact data that is stored separately from the other data. That is: Adress data (opt-in or uploaded) and contact data collected with the respective question type.

The technical background is that these data is stored in separate databases, and is not part of the regular 12-month-backup.

The DPA for the pro-server allows any type of data that you specify in the online form. So, as soon as the regular answers in your questionnaire are person-related, you'll need the pro-server.

> my DPO would also require to fill a GDPR Screening questionnaire.

Usually, most answers to such a questionnaire are available from the website and the technical appendix in the DPA. If there are questions beyond what is publicly available, we shall add the answers on our website.

---

Thank you again for your further clarifications!

The DPO of my Univeristy had a remark on the DPA for the pro-server: namely about the Categories of data subjects to be processed
 • Employees of the client
• Suppliers of the client
Which is specified in Annex 1.

This does not reflect our data subjects.

I see that on the template before Annex 1 there is also written "Specimen – please enter the appropriate data on s2survey.net/DSGVO/". Are the categories of data subjects something that is amended after entering the appropriate data on s2survey.net/DSGVO/ ?

I have read that  "changes can only be made in very well-founded exceptional cases and only for a fee. In general, we only conclude a DPA on the basis of our contract template. Other contracts can only be signed after legal review and approval. The costs incurred for this (approx. 2,500 to 5,000 €, depending on the scope and questions to be clarified) are borne by the client." on https://www.soscisurvey.de/help/doku.php/en:general:dsgvo

Thank you!

---

> The DPO of my Univeristy had a remark on the DPA for the pro-server ...

The PDF is just a sample (which should be clear from the respective notes in the PDF). You (or your DPO) will define the categories yourself in https://s2survey.net/DSGVO

> I have read that  "changes can only be made in very well-founded exceptional cases

This refers to the other text that is not marked as sample data.