Responsible Thesis-Writing Process

Research that utilises interviews and surveys usually involves the processing of personal data at least in the form of indirect identifiers, which is why such research material must primarily be processed as confidential personal data material. For example, an interviewee’s voice, contact information and participation consent are regarded as personal data. In surveys, general background variables, such as age, gender, occupation and place of residence, constitute indirect identifiers that, when combined, may lead to the identification of a participant. Open answers may also produce data containing identifiers.

If you plan to conduct an interview or a survey for your thesis, start by discussing it with your supervisor and by familiarising yourself with the University of Vaasa Data Protection Statement and website on data protection (currently available only in Finnish). More information above under the heading Data Protection (GDPR).

Prepare a privacy notice for research participants and include at least the following information:

• Data controller: Usually the student acts as the data controller for the personal data collected for their thesis research, unless otherwise agreed.
• Purpose of processing personal data: e.g., the thesis. Briefly describe the aim of your thesis and how the collected personal data may contribute to answering the research questions.
• Legal basis for processing personal data: in the case of thesis studies conducted independently by students, the primary basis is consent. If a thesis is deemed to meet the criteria for a scientific research project (e.g., as part of a predesigned university project, or an article-based Master’s thesis seeking to produce a peer-reviewed article), as a rule, scientific research or compilation of statistics related to public interest constitutes the basis for processing.
• Personal data storing period and its determination: e.g., until the thesis has been accepted, estimated graduation time (mm/yyyy) or until the publications stated in the project’s publication plan have been published.
• If you plan to reuse the same data in a subsequent thesis:
  • Plan the reuse of personal data in connection with the previous thesis and also inform the participants of the reuse, or
  • Request new consent from the participants for the new purpose.

NB: For consent to be valid, it must be a informed, freely given, and unambiguous indication of the data subject's wishes.

• Conduct the interviews or survey in accordance with information security requirements.

• Prefer the tools provided by the University of Vaasa, such as Zoom or Webropol..

• Do not save recordings or survey responses in commercial cloud services!

• Select a storage solution suitable for storing personal data. If you use storage solutions provided by the university, familiarise yourself with the data processing guidelines. For example the University of Vaasa cloud service can be used for storing encrypted personal data.

• If you save the files on your own devices, ensure their protection.

• Minimise the amount of personal data:

  • Avoid processing direct identifiers, such as names.

  • Delete (anonymise) identification information or replace (pseudonymise) it with codes that only you can open, if needed.

  • Do not name files with information containing identifiers such as interviewee names.

• Store personal data material only for the necessary period stated in the privacy notice.

• Delete personal data material upon the expiration of the data storage period, for example by overwriting.

• If you need assistance with deleting confidential data, contact the University of Vaasa IT Services.

If you have a research subject’s consent for the reuse of data:

• Ensure the continued usability of the data by utilising file formats appropriate for long-term storage.
• Make regular backup copies of the data and choose a storage solution with automatic backup.
• Document all information related to the data in a versatile way (collection, processing, storing, content).