Access the add-on by clicking on the puzzle piece in the Google Forms menu bar.


 

Once opened, the add-on displays a side screen in the lower right corner of the form. We can identify 4 blocks of information:

Block A. Confirmation of personal data collection

Please remind that personal data is any information about an identified or identiable individual.

A form may seem anonymous (because it does not collect data that can directly identify a person, such as a name and surname, an email address or a passport number), but it is possible to identify people based on their answers (for example, if a form asked for age, the UPF department where they work and the town where they live, it would be easy to identify many people, even though no directly identifying information has been collected). In both cases, personal data is collected and the legislation requires the inclusion of a legal notice regarding its processing.

To remind us of this fact:

  • The add-on asks if the form is anonymous, that is, if it collects data that directly identifies people..
  • Should we answer NO, the add-on asks us if the answers will allow the participants to be identified, that is, if there is a possibility of indirect identification of people.
  • Only if the form is anonymous and the answers do not allow the participants to be identified can we consider that the form does not collect personal data, and therefore the informative footer about its processing will not be necessary.
  • If a form does not collect data from individuals, but data from institutions, historical data, statistics or other sources, it will not be processing personal data and the informative footer will not be necessary either.

  • If the form has been configured to collect the email address of the respondents or verified addresses, this collection already involves the processing of personal data and, therefore, the informative note is mandatory. In this case, the add-on does not ask the questions and displays an explanatory text

Block B. Collection of special categories of personal data

When special categories of personal data are collected, regulations require an additional consent. For this reason, the supplement asks if the form collects any data classified as special category of personal data.

If you check any of these types of data, the add-on will add the necessary express consent boxes to the form.

IMPORTANT: Given the limitations of the Google programming interface (API), it is not possible to configure a mandatory response to the consent boxes for the processing of special category data. However, it should be noted that special category data can only be processed if users have checked the express consent box.

(There are exceptions to the mandatory consent of individuals, but these are exceptional cases. Should you have any questions, please contact [email protected] ).

TIP: Once the plugin has added the consent box to the form, you can modify the text to make it more understandable for users. (E.g.: you can change the standard text "I give my consent ... for the processing of my health information." to "... to be asked about the medication I take.")

Block C. Sending personal data to other entities or abroad

Regulations also require additional consent in cases of:

  • Personal data transfers outside the geographical area of ​​application of the General Data Protection Regulation (GDPR), which is the European Economic Area and is made up of the 27 countries of the European Union, Norway, Iceland and Liechtenstein.

  • Persona data communications to organizations other than UPF (i.e.: entities pertaining to the UPF Group).

As in the previous block, if one of these situations is indicated, the add-on will add the necessary express consent boxes to the form, and data can only be communicated if the person responding to the form has authorized it.

IMPORTANT: Access to data by companies or entities so that provide services contracted by the University is not considered personal data communication. In these cases, the contract or service agreement must include privacy preservation clauses.

SUGGESTION: it is not possible to automatically add details about the communication of data that provide additional information to the user, such as which countries, which specific institutions, or for what reasons the communication of data is requested. It is advisable to specify the information by editing the consent texts once the add-on has been executed (i.e.: you can change the text "I give my consent ... for the communication of my data to third parties" to "... for the communication of my data to the collaborating entities in the organization of the congress").

Block D. Personal data processing activity identification

This section allows you to indicate which of the personal data processing operations carried out by the University will incorporate the data collected in the form.

Any personal data processing must be bound to a data processing activity declared by the University in the Register of Processing Activities (ROPA). Check the information on UPF's Register of Processing Activities if you have any question.

RAT



Data protection footnote generation

Once the treatment to which the data will be associated has been selected, we are ready to generate the informative legend for the form.

  Edit view Form view
Once 'Generate data protection clauses' is clicked...
... the add-on creates the express consent boxes and the informative clauses necessary for the form to comply with data protection legislation. These elements can be modified to adapt them to our specific needs or to make the information more understandable. For example, in our case:
  • we could change 
    ... for the processing of information about my health.
    bt 
    ... process my allergies by not recommending certain pets to me.
  • or we could change 
    ... for the communication of my data to third parties.
    per 
    ... for the communication of my data to animal adoption management entities.
When finished, the add-on sends an email with a summary of the changes made. The sender of the message is the user who executed the add-on.