[LINK] survey confidentiality boilerplate

[Roger Clarke]

At 11:11 +1100 1/3/07, Eric Scheid wrote:
>I'm helping someone put together an online survey, and we want to explain
>that all responses will be kept confidential and that no privacy invasive
>questions are included in the survey ... does someone have some boilerplate
>text they could point me to, just in case we've forgotten to mention
>something?

There's something badly missing here.  Boilerplate text that creates 
a pretence that privacy is protected is of no use to mankind.

What you really want is a set of guidelines on how to design a survey 
process in such a manner that it:
-   is compliant with privacy law (dreadful though it is, it does exist)
-   provides actual protections for privacy
-   communicates the facts clearly to the people invited to participate
-   is available for inspection by regulatory bodies

The word 'confidential' is essentially meaningless.  Explanations are 
necessary about all handling practices (collection, storage, 
analysis, use, disclosure), and about what identifying information is 
collected and how it is used.  (IP-address needs to be treated as 
identifying information, because it can easily become so).

And it's not as simple as "no privacy invasive questions are included 
in the survey".  That judgement is made by the person being asked the 
questions, not the designer of the survey.  So the statement 
envisaged cannot be made.  A possibility in the same area which could 
be used (provided that it's true) is 'The designers believe that the 
questions are not privacy-sensitive, and the respondent may decline 
to answer any question that they have concerns about'.

The Market Research Society (or whatever it's called these days) has 
a set of Guidelines.  They're quite inadequate, and far less decent 
than the ones I wrote for them in 1976.  (No, I'm not kidding.  I was 
a - then youthful - Research Officer for the NSW Privacy Committee. 
I drafted them, we negotiated, I revised them, the MRS adopted them).

There are also guidelines issued by the NH&MRC in relation to health 
care research.  I'm not all that fired up about *them* either, 
because they reflect the researcher's view above all else;  but at 
least they're guidelines - in this case with legislative force.

-- 
Roger Clarke                  http://www.anu.edu.au/people/Roger.Clarke/

Xamax Consultancy Pty Ltd      78 Sidaway St, Chapman ACT 2611 AUSTRALIA
                    Tel: +61 2 6288 1472, and 6288 6916
mailto:Roger.Clarke at xamax.com.au                http://www.xamax.com.au/

Visiting Professor in Info Science & Eng  Australian National University
Visiting Professor in the eCommerce Program      University of Hong Kong
Visiting Professor in the Cyberspace Law & Policy Centre      Uni of NSW