 Riina Vuorikari |
Just a few quick remarks on this crucial point of Data privacy from the work that we've done in European Schoolnet. In this post I refer to the Privacy policy of LREforschools portal, to find the policy scroll down and click on "privacy policy". It's well hidden, right ;) First and foremost, the identification of data (e.g. what is gathered) will always need to be explained in the privacy policy. For example, in the LRE we say:
Second, the privacy statement says what is the purpose for gathering the data, under current EU and most national laws, one cannot gather data just for the purpose of gathering:
So in this case it's important to say "to improve teh LRE user experience" which can include a variety of thing, namely to create better ways to search and find resources (e.g. recommender systems, better ranking of results, social navigation). Thirdly, something is said about who can access this information:
Unfortunately, in this case it is not explicitely mentioned that the data could be used for research purposes by any third parties, so with a strict reading of the data, I could not give out the full dataset with usernames, personal info, stats, etc, say, to a university of XYZ to run some test for recommender algorithms. However, I should be able to use this data if anonymised (correctly), which is another tricky issue... and its own field of study... Just as a remind about how tricky it is, check the AOL search data scandal that kind of put a stop for sharing corporate data, let's hope only for a while. In my next post I will talk about another privacy statement that we have for another project (called eTwinning, more than 90 000 users) where we have been able to take these steps to secure the use of that data for research purposes. Some links: http:/ Final note: don't use any of this information before consulting your lawyer!
|
|
Riina Vuorikari |
Here is the privacy document of the other project, eTwinning, that I talked about: It's been in making for many months, because many stakeholders were involved (e.g. EAC Agency who owns the data (data controller), EUN who is the data processor, Commission's data privacy expert) Part 2 is important, it outlines what data is collected (2. What personal information do we collect, for what purpose and through which technical means?). We outline 3 areas:
Then, we outline who can access that data (3. Who has access to your information and to whom is it disclosed?). This is what we learned that we need to add to the privacy document which makes it possible to use the data for our research purposes:
What happens is that we make a separate contract with each project/researcher/student who uses that data. It outlines the purpose of the research and says that the data can be only used for that purpose, is not shared, etc. It's also important to us to know who does research on our data and that we can use that research to make things better! So, if anyone else wants to use the data to verify the research results, it is possible to make a new contract with them and make the dataset available. As for now, we only are getting started with this procedure, but I can imagine that doing this type of research contract can become rather standardised, a bit like this one that I looked at as an inspiration (Data Purchase and Use Agreement for Welfare, Children and Families: A Three-City Study). |
