Privacy notice on sustainable water security and its governance
1. What is being investigated in this study and what is the purpose of processing personal data
This study looks at sustainable water security and its governance in Finland, Europe and globally. The study is linked to the GloWater research project (“Global connections and collaborative solutions for sustainable water security”; 2024-2030).
The study is carried out jointly by GloWater organisations and their staff, consisting of Aalto University School of Business (AaltoBIZ), Aalto University School of Engineering (AaltoENG), Finnish Environment Institute (Syke), Finnish Institute of International Affairs (FIIA) and the University of Eastern Finland (UEF) together with Kaskas Media Oy.
The key methods of the study include individual and group interviews and their recordings and notes; different kinds of events and meetings (online, hybrid and live) and the material and recordings produced in them; surveys (online and paper) as well as participatory observation of the relevant planning, policy and decisions processes. If needed, these are supplemented with clarifying discussions (email/phone/live) with relevant key-informants. Collected personal data constitute a key research source for the study.
Funding for this research comes from the Strategic Research Council of Finland (SRC) through GloWater project as well as from participating organisations.
2. What personal data is processed in the study
The following personal data will be collected in the study:
- Name, position and organisation
- Relevant contact information such as email and/or phone number
- Recordings (audio/video) of interviews, textual transcripts of the recordings, as well as the material produced and notes taken by the researchers during the interviews
- E-mail, phone or live conversations that may clarify the answers
- Survey responses
As part of the study, different kinds of events and meetings (online, hybrid and live) are also carried out. The personal data collected from the workshops consists of the following personal data:
- Name and organisation of participants
- Recording of the meetings discussion and its transcripts (audio and/or video)
- Notes and documents produced together (on paper or on electronic platforms)
- Researchers’ notes
This study does not process data belonging to special categories of personal data or other data that is particularly protected (see below).
Special, or sensitive, personal data
This study does not intentionally collect or process data belonging to the special categories of personal data or other data requiring special protection. However, considering the topic of the study, participants may voluntarily disclose information such as their political or personal opinions. Such disclosures are not explicitly requested and are provided solely at the participant’s choice. Sensitive data is removed at the transcription phase.
Personal data is collected from the following sources:
Personal data will be collected directly from the research participants through interviews, questionnaires and other discussions, as well as during events, workshops and meetings. In addition, information may be collected indirectly from openly available sources, such as organisations’ websites and other publicly accessible information on the internet.
3. Processing of necessary personal data and removal of the direct identifiers from the data
The study only processes information that is necessary for the purpose and implementation of the research.
The analysis of the study focuses on the text transcripts of the interviews and events/meetings, and the related video/audio recordings are used only when necessary to verify the accuracy of the transcription. The original recording is deleted when the transcription is complete and analyzed.
Textual research data is processed during the analysis phase in such a way that the respondents’ identity is not directly identifiable to the researchers. The respondents’ direct identifiers, such as name, are replaced in the transcripts for example with a random identifier (pseudonymization). This means that your personal information (name, title, and contact details) will be replaced with a study number before analysis. The personal information and the corresponding code key will be stored in a separate, secure file, apart from the research data: this information will be used only if necessary, for example, to check or complete the data.
If you disclose information from which your identity can be deduced (e.g. your workplace and position), such information will be pseudonymised at the transcription stage.
Before publishing the results, the data will be handled so that no individual participant can be identified. Your name or organisation will not be mentioned, although publications may, if relevant, refer to your role in general terms (e.g. expert, civil servant) and to your organisation at a general level (e.g. ministry, company, civil society organisation).
4. Legal basis for the processing of personal data
In accordance with the General Data Protection Regulation (EU 2016/679, GDPR), the processing of personal data is based on public interest for the purposes of conducting scientific research (Article 6(1)(e).
5. Sharing personal data
The personal data in this research study is processed by researchers and experts from participating organisations (AaltoBIZ, AaltoENG, FIIA, Syke, UEF, Kaskas Media) and their potential trusted partners.
With regard to the roles and responsibilities of the processing of personal data, all organisations act as joint controllers of the personal data. All rights and responsibilities between the parties are agreed in a separate Joint Controller Agreement JCA (‘yhteisrekisterinpitäjyys’).
Pseudonymised research data, such as interview transcripts, may be shared with external research collaborators of the participating organisations in case it is required in the implementation of joint research. Pseudonymised research data may also be disclosed to third party, such as in the peer review processes of scientific publications, or for other purposes necessary for the validation or publication of scientific research results. The project is highly collaborative and the Privacy Notice may be updated to include further external research collaborators to whom pseudonymized research data may be shared during the course of the project.
The collected pseudonymised research data can be used for follow-up research in the same discipline or for research in other disciplines that support the research. As part of possible follow-up research, research data may also be disclosed to other researchers from other universities or organizations than the aforementioned, if it is necessary for the implementation of the research.
6. International data transfers
The project is implemented by a set of Finnish organisations, who will collaborate with selected international partners in carrying out the research.
Pseudonymized data may be transferred to the project’s research partners in the EU. Pseudonymized data will only be transferred to the extent necessary to carry out the research project.
In addition, as part of the scientific publishing process, it might be necessary to transfer the data outside EU/EAA for publishers or peer reviewers for verification of research results, as such parties may be located outside EU/EAA area. However, it is exceptional that scientific publication process would require transferring data regarded as personal data.
7. Storage and protection of personal data
Protection of manual data: The paper data containing personal data collected in the study, such as consent forms, workshop participant lists and notes, will be stored in access-controlled facilities and in locked cabinets, accessible only to the responsible researchers.
Information processed in information systems: Your personal data is processed and preserved in secure IT systems, which are approved by participating organisations and suitable for personal data. Access to all computers and IT systems are protected by username and strong personal password. Access to IT systems containing personal data is technically restricted in a manner, that only researchers participating in the study and persons necessary for the implementation of the study have access to your personal data.
Where the data is archived
Research data containing personal data is stored by the research organisations during the study with restricted access so that access to the research data is only given to the parties named in this privacy notice. After the research is completed, and if participants have given their consent, the anonymised research data may be archived in an open data archive such as the Tampere Social Science Data Archive. The data will then be available to registered users for research, teaching, and study purposes.
8. Retention and deletion of personal data
Deletion during and after the examination
The collected research data can be used for further research in the same discipline or for research in other disciplines that support the research. Research data containing personal data will be deleted when five (5) years have passed since the last scientific publication for which the research data in question has been used.
9. Rights of the research participant
According to the General Data Protection Regulation (GDPR), a data subject has the right to:
- receive information on the processing of their personal data
- right to access the personal data collected and processed
- right to rectification of inaccurate personal data
- request that the processing of personal data be restricted
- object the processing of personal data
- right to erasure of personal data if the conditions of Article 17(1) of the Data Protection Regulation are met and processing is no longer necessary for archiving purposes in the public interest or for scientific research or statistical purposes in accordance with Article 89(1)
If the research purpose does not require, or no longer requires the identification of the data subject, the controller shall not be obliged to obtain further information so that the data or the data subject may be identified only for purposes to able the data subject to exercise his/her rights. If the controller is unable to link the data to a particular data subject, the data subject does not have the right to access or correct the personal data, object the processing, or delete the personal data. However, if the data subject provides additional information that allows their identification from the research data, the rights will not be restricted.
10. Contact details of the controller
The controller of this research study are the participating organisations as defined in the Joint Controller Agreement (AaltoBIZ, AaltoENG, FIIA, Finnish Environment Institute (Syke), UEF, Kaskas Media).
Person in charge of the study
Questions concerning the implementation of the study can be directed to the persons responsible for the study in participating organisations:
- AaltoBIZ: Associate professor Samuli Patala (samuli.patala@aalto.fi, + 358 50 4403450)
- AaltoENG: Associate professor) Marko Keskinen (marko.keskinen@aalto.fi, + 358 50 4714866)
- UPI: Research professor Antto Vihma (antto.vihma@fiia.fi; + 358 50 3724568)
- Syke: Principal researcher Suvi Sojamo (firstname.lastname@syke.fi, + 358 29 525 1049)
- UEF: Associate professor Miina Porkka (miina.porkka@uef.fi; + 358 50 472 7340)
- Kaskas Media: CEO Maria Ruuska (maria@kaskas.fi, + 358 40 7274119)
Data protection officer
If the research participant has questions or requests related to data protection or the processing of personal data, the research participant should contact either the responsible person of the relevant organisation or the Data Protection Officer of Aalto University: tel. +358 9 47001 (exchange), dpo@aalto.fi.
In this data request service, you can request the exercise of your rights under GDPR from Aalto University as the controller (aalto.fi)