If you are creating surveys that collect personal data then the BOS team strongly suggest that survey authors add a privacy statement to their surveys. You may also choose to add a privacy statement even if no personal data is being collected. The responsibility to add a privacy statement resides with the survey author.
A privacy statement need not be long and can easily form part of one of the first pages within your survey. The UK's Department for Constitutional Affairs (DCA) provides guidance on writing a privacy statement. The DCA recommend that a privacy statement contains the following:
- Who you are
- Why you need people's personal information
- What you will do with the information
- When you will dispose of the information
- How you will safeguard the information
- How people can check the information you hold on them
- How to get more information and how to complain
In terms of the BOS service itself, we provide information on data retention/security and other issues within the data protection section of this knowledgebase.
It should be stressed that the BOS account holder is the Data Controller and the data collected within a BOS account remains the property/responsibility of the institution or individual holding the account. Freedom of Information Act requests must be directed to those running the specific survey and not to the BOS service team.
