Data Protection-Compliant Collection of Contact Information and Matching for Qualitative Interviews

Question

Hey everyone,

We are about to start a study using SoSci Survey and have a specific requirement regarding participant consent for a follow-up qualitative interview. At the end of our survey, we would like to:

• Ask participants for their willingness to take part in a qualitative interview (e.g., a Yes/No question).

• Collect participants' email addresses to contact them for the interview.
  Data protection and participant privacy are of utmost importance to us.

Therefore, we would like to store the email addresses separately from the survey responses while ensuring that we can later match the qualitative interview data with the survey data.

My questions are:

1. Does SoSci Survey provide a feature to generate an anonymous code that can be stored both with the survey responses and alongside the email address, enabling us to match the two later?
2. How can we ensure that email addresses are stored securely and separately from the survey data within the platform?
3. Is this approach considered a best practice for balancing data protection with the need for matching, and do you have recommendations or examples for implementing this setup effectively?

Thank you for your support! I look forward to your guidance on how to implement this process in an efficient manner.

Best regards

Answer 1

Does SoSci Survey provide a feature to generate an anonymous code that can be stored both with the survey responses and alongside the email address, enabling us to match the two later?

SoSci Survey provides such a feature with the Opt-In question type. It will store a person ID in the dataset and with the address record, unless you set the "anonymous" privacy mode.

However, as soons as you store a code that allows you to match the answers and the email addresses, you have person-related data, according to the GDPR. Pseudonymous data is often regarded as personal data.

A different option would be to store a (random) code only with the data and ask the respondents to write down that code. That will, however, only work if you so the matching after doing the qualitative interviews.

If you need the data to select the email adresses, you will have to live with personal dat. That means meeting all the GDPR rules.

How can we ensure that email addresses are stored securely and separately from the survey data within the platform?

The separate collection of contact data allowes for that - however it ensures true separation, i.e., you won't be able to match.

balancing data protection with the need for matching

There a broad variety of balancing, as shown above. The best practive depends on a lot of details. The main point however is: As soon as matching is possible, you'll have to go the long way, anyway (GDPR, DPA, pro server, information obligations, documentation, ...).