
Research clinic: Data Matching
We have been approached by a credit agency offering additional data on our respondents to enhance information we have collected in the course of a research project. Is this acceptable under the MRS Code of Conduct and the Data Protection Act 1998?
Assuming that the credit agency has the informed consent of the individuals on their database for their data to be used in this way, this can be done by entering a written data processing agreement. Under the agreement the researcher would be the data controller and the credit agency the data processor. The researcher could then instruct the credit agency to append to individual respondent research data, information held by the credit agency. Note that there is no transfer of data to a third party in this situation (a data processor is not a third party) so the researcher does not have to obtain the informed consent of respondents to enhance the data in this way.
Can I combine research data with information from a client database?
Data can only be processed in this way in accordance with the rights of data subjects as defined by the Data Protection Act 1998 and the research rules defined in the MRS Code of Conduct. In a research context one of the rights is the right to remain anonymous. In such case a client could not be designated as a data processor as this would breach this right. Additionally, clients may be unable to transfer their data to a researcher due to specific commitments made to their customers (as in the Banking Code, for example).
However, it may be possible for both parties (researcher and client) to instruct a single data processor to match the two data sets and produce an aggregated model to be provided to both data controllers, which would not contain any information about identifiable respondents or customers as the case may be. Alternatively the researcher could match the data and provide the aggregated model.
|