ESRI Privacy Notice for Research
The Institute’s core function is to undertake economic and social research to advance evidence-based policymaking in these areas. As part of this process, we may undertake primary data collection to generate representative data to provide insights into economic and social processes and outcomes.
The personal data we process for research purposes is as follows:
- Quantitative data collected by, or on behalf of, the ESRI. Generally, these are data collected through surveys or behavioural experiments. The direct identifiers such as a name, email address, or other contact detail are personal data. These will be stored separately and linked to the main dataset through an assigned ID (also referred to as pseudonymised data). While there is a link to the identifier, the main dataset will also be considered personal data. If the main dataset is highly disaggregated and it is reasonably possible to identify someone (e.g. through combination of variables), this will also then be classed as personal.
- Qualitative data collected by the ESRI or by others and used by the ESRI. Typically, the data collection methods are face-to-face interviews and focus groups, often with taping and subsequent transcription.
The Institute also accesses or processes data from other agencies. Generally, these will have come from an official national or European statistical or other public sector agency. It is unlikely these data ever contain identifiers, if it is the case that they do, they are handled strictly in accordance with the terms and conditions of the data provider.
Legislation: The Data Protection laws being referred to in this notice are the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA). The GDPR is the European-level regulation and the DPA the national-level. Both were enacted in May 2018, superseding previous legislation.
Personal data: means information that identifies a person. It can include a name, an identification number, location data, an online identifier or one or more factors specific to an individual’s physical, physiological, genetic, mental, economic, cultural or social identity.
Special categories of personal data: mean data revealing a person’s racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, data concerning a person’s health, sex life or sexual orientation.
Under data protection legislation, an organisation must have a legal grounds (called a ‘lawful basis’) to process personal data. There are a set number of valid grounds prescribed in the GDPR for both standard personal data and special category data, and our processing of your personal data must be underpinned by at least one of these conditions.
When the ESRI is carrying out research, our legal grounds are as follows:
Personal: Article 6.(1).f. Legitimate Interests
Our Legitimate Interest is to carry out research to inform public policy and wider society. Underpinning our research analyses are high-quality, representative and detailed data sources. To this end we will frequently carry out social and economic surveys that require processing of personal data.
Special Category: Article 9.(2).(j). Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1)
Our core function is to carry out scientific and statistical research, subject to the highest standards of academic rigour and integrity.
In most cases, we do not need to retain direct identifiers long-term and once the specific research project is complete, data are anonymised by deleting identifiers/removing any link to them. The anonymised dataset will be retained for the benefit of research and statistical analyses. It will not be possible to identify any individual from these datasets.
Sometimes direct identifiers/contact details will be retained for follow-up studies (called longitudinal). This allows us to analyse evolving trends and causal impacts over time. This is particularly aimed at informing economic and social policies whereby adequate policy interventions can be used to address a range of socioeconomic problems. In this case retention will be for as long as the study is ongoing.
When the ESRI accesses data from other agencies, use and retention will be according to the terms and conditions of that agency.
Any personal data submitted as part of research studies will only be accessed by the researchers working on the particular study, strictly on a need-to-know basis.
The only circumstances where it may be shared would be if a study is being undertaken is in collaboration with another research institute. If this is the case, you will be informed at the outset through an Information Sheet/Consent Form or a specific Privacy Notice.
On occasion, to collect data and administer surveys, we may use third party market research companies or online survey platforms. Where this is the case you will be informed, and we will have specific data processing agreements in place where required.
As standard business practice, data may be hosted or backed-up with third-party service providers. These providers will not access your data and we have data protection agreements in place ensuring appropriate safeguards are in place.
We have a range of organisational and technical protocols in place to ensure we are protecting your rights and are complying fully with our statutory obligations. These include:
Data Protection Policy, Data Breach procedures, dedicated Data Protection Officer, completed Legitimate Interests Assessment, stringent IT access control, stringent building security, staff briefing & awareness sessions on data protection.
Access to your data is restricted only to our researchers who are working directly on the project.
Any queries or requests can be sent to DataProtection@esri.ie. See our main Privacy Page here for more information on data subject rights.