The processing of personal data is permitted only when it is absolutely necessary for the thesis and when there is a legal basis for it. Minimise the amount of personal data, do not collect it unnecessarily or as a precaution. Carefully consider what personal data is compulsory for the thesis accomplishment, because it establishes the grounds for collecting personal data. Personal data can be collected only for a specific, named and legal purpose. Evaluate the usefulness and usability of the collected data in the future.
If the data including personal information is considered usable for follow-up or other types of further research, request for its use separately in the informed consent from the (registered) participants. If the informed consent does not include the permission for the processing of the personal data after the thesis is completed, it may prevent further research.
Personal data applies to 1) all information that enable the direct identification of a person and 2) data which enable the identification of a person indirectly if the data can be associated with other information. (For example, a person cannot usually be identified based on his or her profession. However, indirect identification is possible if the person’s profession can be associated with a specific workplace and with the information that in that workplace and there is only one person with that profession.)
Privacy statement
If you are collecting and processing personal data for your thesis, you must make a privacy statement. A privacy statement should be written even if you do not collect direct personal identifiers and the risk of identifying a person indirectly is very low. Use Karelia's online form to create the statement. The form will guide you through the drafting of the privacy statement. Answer the questions on the form, such as what personal data you plan to process, how and for what purposes.. Once you have completed and submitted the form, you will receive a completed privacy notice by email. Keep the privacy notice, and you can, if necessary, demonstrate that you have complied with data protection legislation.
Consent
The processing of personal data requires a processing basis in accordance with data protection legislation, which in the case of theses is most commonly consent.
You must be able to prove that consent has been given. Consents may be collected in writing or electronically, but always in a way that requires an active action by the person giving consent. Use this consent form template.
Further information
Further information on personal data protection can be found in the Data Management Guidelines of the Finnish Social Science Data Archive and in Chapter IV, Sections 1 and 2 of the EU Regulation 2016/679.
Personal data must always be processed carefully, and unnecessary copying and printing must be avoided. When saving personal data or other information containing personal data to USB sticks, special care and Karelia UAS instructions on privacy and data protection must be observed. To collect data that includes personal information, use only programs or systems that are approved of or recommended by Karelia UAS. If, however, you print data including personal information, pay special attention to its storage so that it will not become available to outsiders under any circumstance.
Karelia UAS Data Protection Officer:
Karelia UAS Data Protection Officer, Tikkarinne 9, 80200 Joensuu, Finland tel. +358 50 525 0623, email: tietosuoja@karelia.fi.
Further information:
Example 1 : Interviews
In your thesis, you will carry out a risk analysis for a small local garage. You will collect data by interviewing the garage staff.
- Fill in the thesis privacy statement. Describe the processing of personal data in relation to the interviews with the garage staff.
- Obtain written consent from the workshop staff to be interviewed using the consent form. Inform them of the purpose of the interview using the privacy statement (attach the statement to the consent form).
- Store the data collected during the interviews securely on the systems provided by Karelia (e.g. not on your own usb-stick).
- When the thesis has been evaluated, dispose of all the data you have collected in a secure manner. If you need help in destroying the data, please contact Karelia's helpdesk.
Example 2: Survey and interview
In your thesis, you will produce a first aid guide on ankle injuries in badminton. As background material, you will conduct an anonymous survey of members of a local badminton club. Among the respondents, you will draw a gift card to a local sports centre. You will also interview the club president on the topic.
- Complete the privacy statement for the thesis. Describe the processing of personal data of the interview and the participants of the prize draw.
- Find out if you need a research permit from your local badminton club.
- Ensure that your survey is truly anonymous. Do not ask for background information that could identify an individual respondent.
- Carry out a lottery on a separate form so that the participants in the lottery cannot be linked to the answers given in the survey.
- Attach your completed privacy statement to your survey. Inform respondents in the questionnaire cover letter that the questionnaire itself is anonymous and that the answers to the prize draw cannot be linked to the questionnaire.
- Obtain written informed consent from the interviewee using the consent form.
- Store survey and interview data securely on systems provided by Karelia (e.g. not on your own usb-stick). Personal data related to the draw must be deleted immediately after the draw is completed.
-- When the thesis has been evaluated, dispose of all the data you have collected in a secure manner. If you need help in destroying the data, please contact Karelia's helpdesk.