Data protection. Theses shall observe the General Data Protection Regulation (GDPR) of the European Union and the Finnish Data Protection Act. If you process personal data in your thesis, it is important to make sure that the data is protected throughout the process. The thesis preparation form also considers data protection-related matters. However, consider beforehand if the collection of identity attributes or confidential or ethically dubious data it is essential and necessary for your thesis.
If you still collect personal data, it will constitute a personal data file, which requires the creation of a Privacy Policy. SeAMK’s template for a Privacy Policy for research is found on SeAMK’s intranet. A Privacy Policy allows you to describe to the participants in the study how personal data is processed in your thesis. Save the Privacy Policy in the same place together with the other material related to your thesis. When necessary, show or deliver the Privacy Policy to the participant in the study.
Personal data is data that allows to recognize a person directly or indirectly, combining data. A person may be recognized, e.g., based on their name, identity number, or another feature distinctive of them. In such a case, the collection, keeping, processing, possible transfer, removal, and destruction of personal data shall be planned beforehand and described in the Privacy Policy. For further information, see the website of the Data Protection Ombudsman’s Office.
The processing of personal data requires a legal basis for processing personal data. The GDPR includes six principles based on which the processing of personal data is possible. In practice, in scientific research, the basis for processing personal data is virtually always the participant’s consent or scientific research of public interest.
Data pertaining to special categories of personal data, i.e., sensitive personal data, shall be protected with particular care, because its processing may involve considerable risks. As a rule, the collection of sensitive personal data is forbidden, unless the participant in the study consents to it in writing. Even if the basis for processing data is scientific research, you can also ask the participant for their written consent for the processing of other than sensitive personal data. For further information about the collection of sensitive data, see the website of the Data Protection Ombudsman’s Office.