Video and Data Compliance in Germany
Oct 13, 2022
By way of introduction, my name is Nick Leon, I am the Director of Naked Eye Research, a video ethnographic research company based in the UK.
I am in the planning stages of a usability clinical trial study for a bioscience company that will be taking place at a hospital in Essen, Germany in early January.
The hospital has agreed that the bioscience company can run the study at their site with their staff. This will involve filming patients over a 48-hour period at the hospital and recording and analysing behaviour surrounding interacting with a portable device for patients when they present with severe headaches. The client is only interested in observing/analysing the key moments when the headaches present and the device is used.
I am getting in touch to ensure we meet the standards of individual privacy and data compliance in Germany e.g. recording, storing and sharing the data from the clinical observations in a complaint manner with the team who are based in another market for analysis.
I have read the ESOMAR data protection checklist from 2017. I am wondering what is the best way of going about this? I have found the information on Germany's data protection laws helpful but I am still not sure for example if we are allowed to see the participants faces to protect their identify?
If you could offer advice on where to find the correct information regarding collecting and processing data in Germany it would be much appreciated.
Nov 14, 2022
Thank you for submitting your query and sorry for the late response.
Please understand that we cannot give any consultancy concerning general laws. We would advise you to consult a lawyer concerning these topics.
Concerning the Professional Standards, you will find this on the ESOMAR website as "ICC/ESOMAR International Code on Market, Opinion and Social Research and Data Analytics. We advise you to read this carefully. Among others, Article 4 iii a) is relevant: "Researchers must ensure that participation is voluntary and based on information about the general purpose and nature of the research that is adequate and not misleading." Furthermore, Article 4 III 5 is relevant: "Researchers must respect the right of data subjects to refuse requests to participate in research." This means the patients have to be informed, and they have to give their consent to the research.
Concerning whether faces have to be blurred, article 3 is relevant: "Researchers must limit the collection and processing of personal data to those items that are relevant to the research." This means that this is necessary if it is possible to blur the faces.
Furthermore, you write you want to share the material with a team in another market. If the data are transferred outside the EU, Article 6h is relevant: "Researchers must take particular care to maintain the data protection rights of data subjects whose personal data is transferred from one jurisdiction to another. Such transfers must not be made without the consent of the data subject or other legally permissible grounds. In addition, researchers must take all reasonable steps to ensure that adequate security measures are observed and that the data protection principles of this Code are complied with."
We hope we can give you some helpful advice.
The Professional Standards Team