Expert Advice Community

Guest

What is considered personal data for survey company

  Quote
Guest
Guest user Created:   Jun 23, 2021 Last commented:   Jun 29, 2021

What is considered personal data for survey company

We are a company that performs in-depth surveys. 
1. When we collect data on ethnicity (without collecting any other personal data), is this considered as personal data according to GDPR?
2. When we record session cookies, is this considered as personal data according to GDPR?
3. For some clients we do in-depth interviews, and we record either videos or images of the interviewees; we send those videos or images in aggregate form to the client (we send no other  personal data), and we do not keep track of which part of the video or which image displays which interviewee. If an interviewee wishes her personal data to be deleted, how is this to be executed on our client side if neither we nor they know which part of the video / which photo belongs to this interviewee?

0 0

Assign topic to the user

EU GDPR DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

EU GDPR DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

Expert
Alessandra Nisticò Jun 28, 2021

We are a company that performs in-depth surveys.When we collect data on ethnicity (without collecting any other personal data), is this considered as personal data according to GDPR?

Yes, it is a special category of personal data under Article 9 GDPR which requires some additional safeguards because it is potentially dangerous for data subject’s rights and freedom.

When we record session cookies, is this considered as personal data according to GDPR?

Yes, even session cookies that identify the data subject device are personal data under GDPR even though the data retention period ends with the session.

For some clients, we do in-depth interviews, and we record either videos or images of the interviewees; we send those videos or images in aggregate form to the client (we send no other personal data), and we do not keep track of which part of the video or which image displays which interviewee. If an interviewee wishes her personal data to be deleted, how is this to be executed on our client side if neither we nor they know which part of the video / which photo belongs to this interviewee?"

When dealing with videos, the best option is to let the data subject sign a release in order to make the interviewee renounce any claim on the video which will be transferred to the client without personal data. You will need to state it in the privacy notice that you give the data subject together with the release.

Here you can find more information about data subjects rights:

If you need to understand how to process consent under GDPR, you can consider enrolling in our free online training EU GDPR Foundations Course: https://training.advisera.com/course/eu-gdpr-foundations-course/

Quote
0 0
Guest
Guest user Jun 29, 2021

Thank you for this.  I am confused though.  I realize that ethnicity is a "special category" of "personal data" but if we don't collect any PII (name, email, IP address, etc) then how is the data subject to exercise their rights for the erasure of the data?   We have nothing to specifically identify the data record after the survey has been completed.

Quote
0 0

Comment as guest or Sign in

HTML tags are not allowed

Jun 23, 2021

Jun 29, 2021

Suggested Topics