Learning patterns/Privacy considerations for surveys

A learning pattern forsurvey

Learning Pattern Library

Privacy considerations for surveys

problemSurveys are great tools for collecting data, but caution should be taken when asking people for their information

solutionThis learning pattern outlines some tips about privacy considerations when doing surveys

creator• EGalvez (WMF)

created on19:17, 19 December 2016 (UTC)

status:DRAFT

Introduction

Surveys are a powerful tool that can shed useful light on how people use the Wikimedia projects. This page provides some general suggestions for conducting them. These are not legal recommendations based upon the laws of any particular country. They are tips to help surveys run smoothly, and to encourage transparency, so that survey-takers may understand your goals and practices. If you have a WMF-granted Qualtrics account, please note that your surveys will have to follow certain requirements; contact surveys@wikimedia.org for more information or with questions.

You should be aware that most countries have various laws about privacy and data protection, which may apply to the survey you are planning, depending upon factors such as your location, the type of information you intend to collect, how, and from whom. Please note that the Wikimedia Foundation legal team is unable to represent individual users (for more information, see our disclaimer). You should consult with local counsel in order to ensure that you understand these laws and how they may apply to you, your participants, and the data you collect. Your local chapter may have suggestions to help you find counsel.

General information

• Transparency: When WMF conducts a survey, it provides participants with a privacy statement, explaining the purpose of the survey, what information we are collecting, how long we will retain it, how we will use and share it, and if we will publish it. Even where this is not required by law, it is good practice to inform survey-takers how you will handle the information gathered during the survey. You should consult local laws to determine whether there are specific requirements for your privacy statement.

• Third-party services: You may choose to use a third-party service to conduct your survey. You can review their Terms of Use and Privacy Policy to understand how they will handle participants’ information. Inform participants that you are using a third-party service, and provide them with links to the service’s Terms of Use and Privacy Policy. That way, potential survey-takers can also understand how the service will use their information.

• In the past, Wikimedians have used third parties with policies that are generally protective of user privacy to conduct surveys. This includes Qualtrics, allourideas, and Google Forms. If you have questions about using these or other services, contact surveys@wikimedia.org.

• Links from the Wikimedia projects: If your survey can be reached from links on the Wikimedia projects (for example, if it is promoted with banners), inform survey-takers that the Wikimedia Foundation is not administering the survey or collecting the survey data.

Contests, giveaways, and sweepstakes

• Always consult local counsel: You may be considering putting on a contest, giveaway, or sweepstakes in connection with your survey. However, these promotional tools are heavily regulated, and laws differ from location to location. Consult local legal counsel before you run a contest, giveaway, or sweepstakes associated with your survey.

• No links from projects: Due to these complex and varying laws, surveys that involve a contest, giveaway, or sweepstakes should not be linked from the Wikimedia projects.

Privacy considerations

• Privacy is important: Anonymity and privacy are important in the Wikimedia movement. The Wikimedia Foundation’s own Privacy Policy states that we will never sell personal information. In designing and administering your survey, consider survey-takers’ expectations of how their private information will be treated.

• Personal Information: Some types of information are considered “Personal Information”, and require special handling under the law. The WMF Privacy Policy considers “Personal Information” to be otherwise nonpublic information that could be used to identify an individual, including: name, address, phone number, email address, password, identification number on government-issued ID, IP address, user-agent information, and credit card number. However, this is our organizational definition; the legal definition of “Personal Information”, and the types of information that fit into the category, vary from country to country.

• Sensitive Information: Additionally, some types of information are legally designated “Sensitive Information”. The WMF Privacy Policy considers certain information to be Sensitive when it is associated with Personal Information that could link it to an individual. This includes date of birth, gender, sexual orientation, racial or ethnic origins, marital or familial status, medical conditions or disabilities, political affiliation, and religion. Again, this is our organizational definition; the legal definition of Sensitive Information, and the types of information that fit into the category, vary from country to country. Laws in some countries may require Sensitive Information to be handled with particular care, so consult local counsel if you plan to collect information that may be considered Sensitive.

• Avoid collecting Personal Information: We strongly encourage you not to collect Personal or Sensitive Information, which may require special handling due to applicable laws. Be aware that even if your survey doesn’t ask for personal information, survey-takers may supply it in free-text answer boxes. If you have free-text boxes in your survey, you may want to remind them not to do so. Before starting a survey that deliberately collects personal information, consult local counsel.

See also