Qualitative Research and the Data Protection Act 1998

Citation

Beck, J. (2002), "Qualitative Research and the Data Protection Act 1998", Qualitative Market Research, Vol. 5 No. 1. https://doi.org/10.1108/qmr.2002.21605aaf.001

Qualitative Research and the Data Protection Act 1998

Qualitative Research and the Data Protection Act 1998

Introduction

The Data Protection Act 1998 is the UK's response to an EU Data Protection Directive designed to protect individual rights in the collection, processing and transferring of personal data. Similar responses are being produced all over Europe and they vary in severity from the relatively relaxed regimes proposed in Ireland and Sweden to the tough stance being taken by Italy and Greece.

The UK Act (the DPA) takes a minimalist approach and came fully into force on 23 October 2001. Like the Human Rights Act and market research codes of conduct, the DPA is principles-based and therefore open to interpretation. That interpretation is ultimately the responsibility of the Information Commission but has been influenced by direct and detailed discussions between the Commission and a market research industry taskforce in which the MRS (Market Research Society) and AQR (Association of Qualitative Research) were represented.

What we now have is an Act that underpins and gives weight to our codes of conduct and, as Information Commissioner, Elizabeth France said at the Market Research Society's Research 2001 Conference, "The Data Protection Act does not stop you sharing processed information, it doesn't stop you disclosing it. It doesn't stop you using it outside the exemption for research but it makes you do it in a way that respects individuals … ".

What the Act contains

The 1998 Act covers all data collection or processing that is in any sense organised – by electronic or other means – and this includes personal data recorded on audio or video-tape, so UK data protection is now extended to all research methodologies – quantitative and qualitative. Most qualitative researchers and recruiters will need to notify with (or register) with the Information Commission as they will be "controlling" personal data.

There are eight data protection principles enshrined in the Act that can be broadly summarised as:

1. 1.

   Personal data must be processed fairly and lawfully.

2. 2.

   Personal data can only be used for the specified and lawful purposes for which they were collected. (The specified purpose principle means that data cannot be processed after collection for any other purpose than that for which informed consent was given. So for example, qualitative tapes cannot be passed to clients unless specific consent was obtained for that at the time of the research.)

3. 3.

   Personal data shall be adequate, relevant and not excessive.

4. 4.

   Personal data shall be accurate and kept up to date.

5. 5.

   Personal data must not be kept beyond fulfilling the purpose for which they were collected. (This should mean an end to hanging on to old tapes and recruitment questionnaires!).

6. 6.

   Personal data shall be processed in accordance with the rights of data subjects.

7. 7.

   Personal data must be kept secure.

8. 8.

   Personal data shall not be transferred outside the EEA unless adequate protections are in place. (This is something that international researchers or researchers working on behalf of international clients need to be aware of. The EEA is assumed to have adequate protection but many territories do not.)

For market researchers, the guiding construct underpinning the 1998 Act is that of informed consent and this has two key components:

1. 1.

   Transparency. Ensuring individuals have a very clear and unambiguous understanding of the purpose(s) of collecting the data and how it will be used.

2. 2.

   Consent. At the time that the data is collected, individuals must give their consent to their data being collected, and also at that time, have the opportunity to opt out of any subsequent uses of the data.

What the Act means for qualitative research

The Act does carry new implications for every stage of qualitative research – from recruitment to handling primary data. It establishes respondents' rights as paramount and will require some changes to the way we do things. These will be reflected in revised MRS qualitative guidelines, covering the following.

Ensuring emotional wellbeing

1. 1.

   At recruitment, respondents must be told (either verbally or through invitation):

2. 2.
   • •

     the subject of the discussion;

   • •

     that it is for market research purposes;

   • •

     how long the session will last;

   • •

     if it is to take place in viewing facilities;

   • •

     if it is to be audio- or video-recorded.

3. 3.

   They should also be told:

4. 4.
   • •

     if the session is likely to be viewed;

   • •

     that they have a right to withdraw and withhold.

5. 5.

   When the topic is judged to be sensitive, the subject must be explicitly communicated and the content of the discussion should be disclosed.

6. 6.

   During interviewing, researchers must obtain:

7. 7.
   • •

     permission to record the session;

   • •

     explicit permission to release the data to a third party, with the purpose and other details clearly stated.

Primary data

The DPA is based on the right of respondents to know how their personal data will be used. Researchers have a responsibility to inform respondents accordingly and to ensure that the data will only be used in the way that respondents have been told it will be used. This has significant implications for the way qualitative researchers (and their clients) handle primary data.

Primary qualitative data include recruitment questionnaires, audio tapes, video tapes, transcripts (where individuals may be recognised by their turn of phrase and the universe might be small), hand-written notes containing personal data, projective material, attendance lists/signature lists, etc.

1. 1.

   Respondents must give their informed consent in writing at some time during the research for any primary data to be handed to a third party. They must be told:

2. 2.
   • •

     explicitly to whom the data will be passed;

   • •

     who will see them;

   • •

     what they will be used for.

3. 3.

   Respondents must also give consent where data are to leave the country and must be told where they will be going. Researchers must ensure that any country to which personal data are transferred has adequate data protection measures in place. This is particularly important outside the EEA where countries have weak data protection regimes. For example, data (including tapes and recruitment questionnaires) cannot be transferred to the USA unless:

4. 4.
   • •

     data protection is safeguarded in the contract between client and researcher;

   • •

     the US organisation involved has signed up to a Safe Harbour agreement; or

   • •

     all respondents have given explicit written consent for the transfer to take place.

5. 5.

   Getting full consent, during the research, is important because it is difficult (and potentially unlawful) to get permissions changed after the research has been completed.

6. 6.

   Primary data collected in a market research project can only ever be used for market research purposes.

7. 7.

   Primary data must be labelled with appropriate restrictions when handed over to a third party.

8. 8.

   Researchers must ensure that the recipients, viewers, readers and listeners of the primary data are aware of the requirements of the DPA.

In order to comply with the new Act, qualitative researchers need to take some practical steps, including:

• •

  identifying someone responsible for data protection policy;

• •

  notifying with the Commission and making sure that notification is as comprehensive as possible;

• •

  reviewing all information supplied to respondents on paper or verbally – including invitations, introductions, consent forms, data release forms etc. – to make sure that they meet all the requirements for transparency and consent;

• •

  reviewing contracts and terms of business to make sure that researcher and client roles, responsibilities and access to primary data are specified;

• •

  ensuring that everyone involved – employees, suppliers, clients, etc. – knows what their data protection responsibilities are;

• •

  checking and improving data security.

A consultative draft containing these and more detailed guidance on issues like recruitment, observation of qualitative research, client anonymity and observational research is available from the Market Research Society or on the Code page of www.mrs.org.uk. There you will also find downloadable copies of The Data Protection Act 1998 and Market Research: Guidance for MRS Members. This also contains advice on notification.

This is a further step towards improving the professionalism of the UK qualitative research industry and the increasing emphasis on research by informed consent can only benefit the quality and authority of qualitative work.

Jennie BeckChair of the MRS Professional Standards Committee, Beck Consultancy, Muswell Hill, London Jennie.beck@virgin.net