Information duty

It is important that you always comply with the information duty when collecting personal data directly from data subjects (e.g. through questionnaires, personal interviews, etc.).

When collecting personal data indirectly, e.g., in register-based research or from social media, in some cases you need not comply with your information duty. You can do this if it is impossible to comply with the information duty, or if you assess that it would require a disproportionate effort.

When assessing whether notifying the data subjects would involve a disproportionate effort, you should balance:

• the data subject's interest in being made aware of the processing, and
• the difficulties in fulfilling the information duty.

In your assessment, you could focus on:

• the number of people
• the age of the personal data
• the compensatory measures, e.g., that you will publish on the research project website how you will process the personal data, and 
• the significance of the different interests (the interests of the data subject compared with research as an important matter of public interest) given the data being processed.
• how intrusive your processing of personal data is for the individual data subject.

If you come to the conclusion that meeting the information duty would involve a disproportionate effort, you must instead protect the rights of the data subjects in another way. You can do this by publishing information on how you will process the personal data, e.g. on the research project website or in a profile on social media. 

When complying with your information duty, you should be aware that there are specific requirements to the content of the information you have to provide to the data subject. You can use AU’s templates, which you will find above, to check what information you need to remember, or read below:

1) Who is responsible for the processing of personal data and how to get in touch with AU/you?

You must inform the data subject that it is AU (and possibly other data controllers), who are responsible for and process personal data. In addition, you should state who the responsible researcher is, and how to get in touch with AU, you and the Data protection officer.

2) Why do you process the personal data and what is the legal basis for your processing?

You must clearly state your purpose for processing the personal data. Therefore, you should consider whether you need to process the personal data for one or several purposes, e.g.,

• research
• teaching
• communication
• database for future research.

You may have several bases for processing (legal bases) if you process personal data for several purposes. From the example above, it could be that you are going to process the personal data for a research purpose based on the research authority, while your processing of personal data for an educational purpose is based on valid consent to data processing from the data subject under data protection law, etc. You must inform the data subject about the legal bases. If you base a processing of personal data on a valid consent to processing, remember to give information about the possibility to withdraw the consent.

3) Which personal data will be processed?

You must provide information about the types of personal data you are processing. You must also state where you have collected the personal data if you have collected it from others than the data subject (see indirect collection).

4) Will you share personal data with others?

if it is necessary for you to share personal data with others, you must, as a minimum, be able to provide information about the category of recipient (e.g., other research institutions). If you already know who you will be sharing with, you must state this.

If you need to share personal data with a recipient outside the EU/EEA or an international organisation, there are special obligations that you should be aware of. Here, it may be a good idea to look at AU's template for information duty.

5) How long is it necessary to process the personal data?

You must state how long you will process the personal data, including storage, but you do not have to be able to say a precise date. Here, it may be a good idea to look at AU's template for duty of disclosure LINK?????.  Or find more information about storing peronal data. 

6) Which rights does the data subject have and how can the data subject file a complaint?

When you process personal data the data subjects have some rights. It is important for the data subjects to know which rights to be able to exercise them. Therefore, you must inform the data subjects about their rights.

You should also state how the data subjects can file a compliant to the Data Protection Agency, Datatilsynet if they do not agree with the way you process their personal data.

There are also requirements for the way you provide the information. The information duty requires that you provide the information:

• in a concise, transparent, easy-to-understand and easy-to-read form
• in plain and simple language (see text example below)
• especially when information is specifically aimed at a child.

Provide the information in writing, or, if appropriate, electronically. If the data subject so requests, the data may be given orally, provided that the data subject's identity can be confirmed in some other way (e.g., presentation of an ID card).

Researchers come into contact with or receive information about data subjects (research participants, informants, subjects, etc.) in many different ways. For example:

• Recruitment via the internet
• Recruitment via a leaflet/brochure
• Meetings with the data subjects at their own premises (e.g., at school, at home, at a company, in hospital, etc.)
• Social media
• Extracts from registers

The way in which, as a researcher, you want to communicate with the data subjects (and thus comply with your information duty) can vary depending on whether you receive the data from the person in question or from others, the type of contact you use, your research method and habits, etc.

There are examples here of how you can comply with the information duty and integrate it into your other information material. Naturally, you will have to choose the way that makes the most sense and is most transparent for the data subjects in the specific situation.

• As a clickable direct link in connection with a questionnaire, where the participant cannot start answering the form until he/she has read and clicked the box.
• As an appendix to your project information for participants
• As a QR code that links directly to an AU website on which you have uploaded the information
• As part of the text in your information material. Note, however, that the text must be transparent. This means that you must avoid over-complicating information so that the data subject cannot see that it is about your processing of personal data.

MANGLER DER NOGET TEKST HER - JF DEN DANSKE TEKST???