The data must be collected with specific purposes, which must be clear and legitimate, and they can’t be later treated in an incompatible way with those purposes. Therefore data must be appropriate, relevant and limited to what is needed. Collect only the absolutely necessary data for your work.

Data must be keeped for a period not superior than the needed for its purpose. Therefore, delete all the data when you have finished your work.

If you have in mind placing the personal data in any kind of open platform that allows access to other researchers or third parties, you should communicate that to the people concerned.

There are different kinds of legitimization for the processing of personal data, but for the performance of an academic work, the only possible legitimacy is the consent of the data subject. This consent must be clear, specific and informed.

Consent is considered to be clear when it has been given by means of clear and affirmative manifestation. Tacit consent based on silence is not valid.

Consent is specific when it refers intelligibly to a specific treatment and is not given in an ambiguous context. 

And for consent to be informed, it is essential to provide informative legends at the time of data collection.

Records or means of proof that clearly demostrate that consent to the processing of personal data has been given must be retained. For example, collect and store consent forms.

The main information that should be given to the data subjects is the following one:

Responsible of the treatment: Name of the student. Address or phone number.

Purpose: Purpose of the treatment or treatments in which these data are going to be used. The data will be keeped until the deadline of data conservation.

Legitimation: Consent. It can be withdrawn in any moment.

Recipients (option 1): Your data will only be used for the completion of an academic work described at the Purpose, and data will not be given to third parties without your consent, unless there is a legal obligation for communication of data.

Recipients (option 2): Data will be treated for the completion of an academic work described at the Purpose and (write down other recipients of the data, for example companies that are collaborating and with whom we have an agreement of data exchange).

Rights: access to the data, rectification or erasure, right to data portability, opposition to the treatment and application and request to limit its use through sending an e-mail to the students’ address. If you consider that you rights have not been served right, you can submit a complaint to the Catalan Data Protection Authority.

Vulnerable groups:

Any person can become vulnerable when she/he is not capable to understand the scope of the consequences of the processing of his or her personal data: it is a classification that can vary depending on the context. For example, when we give consent to enable the geolocalization of our phone, we might not become aware that this information can be used to create marketing profiles - in this case, this person is becoming a vulnerable group.

The treatment is fair if the persons from whom we are gathering personal data clearly understand that their data is being gathered/used and it affects them, and they also know to what extent it will be treated.

Also we must be especially careful when we explain, with as much details as possible, the purpose of this data collection to those persons who, because of their special circumstances, they might not be aware of the consequences of the treatment of their personal data. We must as well explain carefully the informed consent paper to those persons that might have difficulties to understand or exercise their rights.

It is also needed to detail the possible risks to privacy and the right to honour that publishing those data may imply to the data subjects, especially those who are are part of traditionally discriminated groups.

In any case, we must maximize the safety measures.

Personal data must be exact, represent reality in a truthful way. We must adopt the reasonable restraints so those that are inexact can be deleted or rectified without delay.

In this sense, it can be specially difficult to modify data pulled directly from Internet, without direct contact to the data subject. Data published in official databases or the media will be presumed as correct, and they can be used in academic works following the instructions of the university.

When it comes to data collected directly from Internet, keep in mind that they can not be presumed as reliable, since everyone has access to them and they can be modified by a third party without consent of the data subject. In any case, in order to use them in an academic work, you will have to consider the terms and conditions of the website you are gathering them from. You will also have to consider the reasonable expectations that the data subjects had when they gave their personal data to the website. If the use that you are willing to make goes further than the terms and conditions of the website or the reasonable expectations of the data subjects, you must contact them and ask for consent to treat them.

The concept 'quality' of data implies that: 

1. Purpose limitation: you can only process data when you are entitled to do so and you have previously informed the data subject clearly about the purposes of the request, which must obviously be legitimate.                                                                                   
2. Data minimization: you can only process the data strictly necessary for your purposes, which means using as little data as possible. Avoid asking for all that data that is not strictly necessary for the elaboration of your work.                            
3. Accuracy: only accurate data should be processed, which means ensuring that it is kept up to date. Obviously, there is a presumption of veracity with respect to the data that the data subject provides directly to us, but in prolonged processing, these could change and lose their accuracy. This principle obliges us to delete data that we know to be obsolete.                                                
4. Limitation of the retention period: the data must be kept for the time strictly necessary to fulfill the purpose for which they were requested, in this case, the preparation of the academic work. Once this purpose has been fulfilled, the student must delete them. This obligation applies to both computerized and paper-based processing.

Data must be handled in a manner that guarantees their protection against the unauthorized or unlawful treatment. They should also be protected against loss, destruction or incidental damage by using the suitable technological or organisational measures.

The prospective consequences that data subjects may have if someone obtains unauthorized access to their data can be classified in several degrees of severity, depending on the likelihood to repair the resulting damages.

Mild consequences. A breach causes a slight damage to the concerned party that, even if it’s uncomfortable, can easily be repaired.

Major consequences. The damages derived from unauthorized access are significant and difficult to repair.

Enormous consequences. The result of this breach causes serious damages that are really difficult or even impossible to repair.

Since you are now responsible persons of the treatment of personal data, you have the duty to implement the appropriate technical and organisational measures. These will guarantee and demonstrate that this treatment is in line with the legislation. This last principle demands us to show that we are aware of what we are doing, and that we are diligent and proactive persons in charge of the data.

In order to guarantee an appropriate treatment of the personal data it is convenient to carry out a risk analysis before any data is collected. From this initial analysis we will determine the organisational and technological tools that we will need to protect the data, so we can respect the rights of the persons concerned.

When we determine this measures, we will have to keep in mind the technology that we have available, the cost of enforcing these measures, their nature, field, context and the purpose of the treatment, as well as the possible risks that the treatment entails to the rights and freedoms of the data subjects.

An example of a specific safety measure, we can outline the pseudonym procedure, even though we would rather recommend to make the data anonymous, when possible.

At the initial stage of the work, it is necessary to anticipate how the personal data will be managed during the study: the collection of data, its processing and storage, as well as the management that will be done of them when the work is finished. It may even be necessary to anticipate how the eventual disclosure of the results of the work will be managed, or to foresee a possible external audit of the results of the same.

The information given to interested parties at the beginning of the research, the means and purposes for which participants consent to the use of their personal data, will determine how and what you can do with them until the end of the work.