2. Description of Data Subjects
The aim here is to describe who are the people behind the personal data that your project intends to process – the data subject in GDPR terms. Are you working with a single or multiple groups of people? How are they and how are you selecting/approaching them? How many people are involved?
For projects where there are several separate processing steps, you may be working with different groups of data subjects which need to be described separately. In the example presented below (and also used in step 1), interviews, focus groups and GPS tracking are targeting one group of individuals – women from low-income settlements – while the second set of interviews target a different group of individuals – experts in the transport sector.
Therefore, for each identified group of participants (or conversely, for each identified activity described in step 1), please describe the following:
Definition: Who are the individuals in your target group – are they research subjects, are they UU employees or students, are they website visitors or conference attendees? How are they further defined – are they residents of a specific area, or students of a specific faculty? What is the inclusion/exclusion criteria? For example, if you are sending a survey on employment satisfaction to Geosciences employees, data subject definition could be UU employees working at the Faculty of Geosciences who agree to complete the survey.
You should indicate if you are planning to use data from children or other (potentially) vulnerable people.
Vulnerability in this context refers to individuals whose circumstances may restrict their ability to freely consent or object to the processing of their personal data, or to understand its implications by having diminished decision capacity.
Most obviously, children are regarded as vulnerable to the processing of their personal data since they may be less able to understand how their data is being used, anticipate how this might affect them, and protect themselves against any unwanted consequences. This can also be true of other vulnerable sections of the population, such as elderly people, or those with certain disabilities.
As individuals considered vulnerable are often incapable of granting valid consent, another lawful basis should be considered.
Targeting: You need to describe how you are planning to approach/recruit individuals. For example, if your population are all employees working at the Faculty of Geosciences, you may be planning on target them by announcing your survey in the faculty newsletter.
Snowball sampling is a recruitment technique in which research participants are asked to assist researchers in identifying other potential subjects. Contact with additional research subjects may be initiated by researchers (“cold calling”) using information provided by current research participants. Alternatively, contact may be initiated by research subjects – researchers may ask current research subjects to pass information about the study to other potential subjects, so that they can contact the researcher if they are interested.
Researcher-controlled contacting may be a more effective recruitment approach, but it also takes away individuals’ control of the process – they may have no control nor awareness over the sharing of their contact info with researchers, nor the decision to be approached by them.
Data subject-controlled contacting does give appropriate control of the process to potential participants, but it may be less effective, as people cannot always be depended upon to initiate contact (even with good intentions, they may forget to make contact, become busy, etc.).
Which approach to use depends on the specific context, the reasonable expectations of people to be cold called, and the sensitivity of the subject matter of the project. Are there any potential risks involved? It the topic sensitive or difficult for them? Would they be expected to agree to participate, because the project’s outcome is of interest to them, or may bring them benefits individually or as a group? What are their expectations, would they be surprised when they get contacted? – For example, research article authors are not expected to be surprised to be contacted with requests related to their publications. Are there any potential power imbalances that could render data subject’s consent invalid? Unjustifiable pressures can occur when persons in positions of authority or commanding influence exert undue pressure to participate on potential participants – What if a highly respected individual in the community (say a local elected official, teacher, member of the clergy, or tribal elder) provided the name of a potential contact? When the nominee is contacted, the person might be inappropriately pressured to participate in the project because of the stature of the nominator.
In short, data subjects should be the ones who decide to initiate contact with researchers, unless the nature and context of the process indicates that researcher-initiated contact is compatible with data subject’s reasonable expectations and interests.
The same criteria can be applied to the targeting of potential research subjects using contact information scrapped from other (public) sources. Data subject’s reasonable expectations and interests will tell whether this is a legitimate approach – Experts can expect to be contacted for their expertise, and people posting their opinions on social media can be expected to be contacted by researchers with questions about those opinions.
Data subject’s reasonable expectations are also key on deciding whether directly approaching individuals is appropriate. Researchers approaching people on the street should ensure that data subjects have real choice to accept or refuse to participate and are not coerced with negative consequences, and should also consider the ‘unwritten rules’, to ensure this action is not considered intrusive of their private sphere – There are public spaces where people do not expect to be disturbed by researchers.
Number: You need to describe how many individuals are you planning on targeting, and how many responses you expect to collect. For example, if your data subject population (all employees working at the Faculty of Geosciences) consist of about 800 employees and you can reasonably expect a 25% response rate, that means you are targeting all 800 individuals and expect to collect data from about 200 of them. It should be clear that the project is targeting the minimum amount of data subjects that is required to achieve the project’s goals. Once data collection has started, be sure to keep this continuously updated, so it reports accurate data subject number information.
Nature of the relationship between data subjects and controllers: Can the nature of the relationship between participants and the project controllers lead to a ‘power imbalance’? A power imbalance arises when the controller is in a position of power over the data subject. An imbalance of power is critical in determining if consent can be legitimately used as a lawful basis for the processing – because if individuals might feel they have to give their consent, their consent will not be considered as freely given. For example, when both data subjects and controllers are members of the same organization, a potential imbalance of power must be presumed
This example continues the example used in step 1.
We have two distinct groups of data subjects, women who are the focus of our observations, and the transport stakeholders in Dhaka, Bangladesh.
Group 1: Individuals who participate in these activities: 1) Interviews, 2) focus groups and 3) GPS tracking of women from low-income settlements, as described in step 1.
- definition: research subjects are women from low-income settlements (who live in precarious living conditions such as slums) such as domestic workers, nannies, housekeepers, NGO (nongovernmental organization) programme working in tailoring salons. All participants are over the age of 18 years. In-depth interviews, focus-groups, and GPS tracking are conducted from this same pool of participants.
- targeting: Women participants are purposively selected from the neighborhood population by using gatekeepers, snowballing technique, formal and informal networks.
- number: A total of 40-45 in-depth interviews are planned to be conducted. From this pool, 20 –25 participants are expected to be selected for focus group discussions, and 10 are selected for GPS tracking.
Group 2: individuals who participate in 4) interviews with transport stakeholders.
- definition: research subjects are experts in the transport sector, such as urban planners, transport policy makers, local government authorities and municipality representatives, and transport companies.
- targeting: To reach out to key experts for stakeholder interviews, researchers leverage the local networks of project partners (BIGD and BRAC) and ask for referrals and contact information (emails) from their organizational database. A mix of stakeholders pertaining to various ranks in urban planning, transport authorities, local implementation agencies and NGOs are expected to be selected.
- number: A total of 10-12 stakeholders are planned to be interviewed.
Nature of the relationship between data subjects and controllers: No previous relationship exists between participants and researchers
In this example, it is clear that it is initially describing the project’s expectations (A total of 40-45 in-depth interviews are planned to be conducted). Once the activities are started, these descriptions are expected to be updated accordingly to reflect current processing situations (from A total of 13 in-depth interviews have been conducted, and 30 more are still planned, and once all interviews are completed, A total of 42 in-depth interviews have been conducted.)
Previous: Description of the Project’s Purpose | Next: Description of the Categories and Purposes of Personal Data
- Description of the Project’s Purpose
- Description of Data Subjects
- Description of the Categories and Purposes of Personal Data
- Description of the Processing of Personal Data
- Description of Information Provided to Data Subjects
- Description of How Data Subjects Can Exercise Their Data Subject Rights
- Description of Lawful Basis for Processing
- Description of Measures to Ensure Compliance By Processors and/or Joint Controllers
- Description of Planned Transfers of Personal Data to Other Countries Outside the EU
- Obtaining, Consulting, and Dealing with Data Subjects’ Views of the Processing
- Preliminary Risk Assessment