Different forms are needed for producing almost all thesis. Four of them are discussed in this text:
- Participant Information template
- Participant Consent template
- Privacy policy form
- Research permit form.
You can find these forms in the Student Guide under Studies > Thesis > ”Other Forms Needed for Your Thesis”. Save all the forms you use in your thesis in Wihi, with the exception of the Participant Consent forms. Keep the Participant Consents on file yourself for one year from the date on which your thesis is approved and then destroy them. Make sure that they are both stored and destroyed securely.
Participant Information and Participant Consent templates
When your research subjects are humans, you must inform them of what you are doing. Based on the information they receive, they can make an independent decision on whether or not they agree to participate in your project. This decision must be expressed clearly, and whether the answer is yes or no, it must be respected. The Participant Consent form is used to request consent for three different matters: participation in the research itself, processing of personal data, and possible further use of the data as described in the Participant Information form.
The Participant Information and Participant Consent templates are intended to be customised. You should add information that is relevant to your thesis to the forms and delete the instruction texts and, in the Participant Information template, the sections that are not relevant to your thesis. To allow the participant sufficient time to consider participation, it is important to inform them before requesting their consent. This is why separate templates are provided. For example, you can edit the Participant Information template to write a message that you send to the subject when you ask them to participate in the study. Once they have agreed to participate, you can send them the form you produced based on the Participant Consent template as well as the Privacy policy form.
The subject confirms their consent either by signing the form or by email. If they use an email message, save the entire email response, ensuring that the sender’s email address is displayed. Also make sure that the email response has come from a personal email address that can be unambiguously linked to the person in question and that the response indicates exactly what they consent to. Consequently, you should instruct the respondent to copy the text of the form to the reply message.
Privacy policy form
The Privacy policy form is related to the General Data Protection Regulation of the European Union (GDPR). Under the GDPR, all personal data files must have a privacy policy that describes the principles for processing the data in question. Personal data are generated surprisingly easily. For example, the Participant Consent form described above, which shows the name of the person participating in the study, contains personal data. An audio or video recording of an interview and its transcript can also be used to identify a person, which means that it is personal data. Datasets gathered with research methods can be anonymised or pseudonymised. Pseudonymisation means that the interviewee’s name is, for example, replaced with a code, such as ‘interviewee 1’. When anonymising the data, you must be absolutely certain that identifying factors have been permanently and irreversibly removed from the dataset.
Consequently, you must always fill in the Privacy policy form when an interviewee’s voice or image is recorded, or other direct or indirect identifiers making it possible to identify an individual are generated. Indirect identifiers mean that an individual can be identified based on such factors as age, gender, place of residence, details of the interview content or a combination of these factors. For more information on a personal data file and the cases in which one is generated, visit “What is personal data?” – Office of the Data Protection Ombudsman website.
When you have such documents and files in your possession, even momentarily, you become a controller and must fill in the Privacy policy form. The form describes in detail all information related to the collection, processing and destruction of data containing direct or indirect personal data. Include in this form information on all files created while working on your thesis, such as consent forms, recordings and transcripts.
Relationship between the forms
You can think of the Participant Information and Participant Consent templates and Privacy policy form as a kind of trio: The Participant Information template is used to inform the research subject of the purpose of the study, allowing them to know what they consent to when they sign the consent form. The Participant Consent form complete with the subject’s data contains personal data, which is why this alone crosses the threshold for filling in the Privacy policy form. The Privacy policy must further be consistent with the way in which the processing of the dataset is described in the Participant Information template.
It is likely that you have collected information during your previous studies by conducting interviews, making observations or carrying out surveys. In those cases, the forms described here were not needed, because studying is regarded as activities for household use for which the forms are not required. Nonetheless, it is important to also take special care and follow ethical guidelines when processing such datasets. The thesis differs from your previous learning assignments in that the status of the thesis is a public document. This is why it is subject to a different permit process than your previous exercises.
Research permit form
If your research focuses on an organisation, you may need a separate permit from this organisation to research it. Check this well in advance before starting the work. Organisations that require such permits usually already have a ready-made form for this purpose, which you should use. The research permit form in the Student Guide is intended for situations where the research subjects are Humak students or staff.
Slightly different process is followed for surveys
The templates and forms described above are used particularly in situations where you interview or observe people. However, informing the respondents and obtaining unambiguous consent are also essential in surveys. Information is provided in the introductory statement of the survey (cover letter), and a separate section is added to the form where the respondent specifically expresses their wish to participate in the survey.
If direct or indirect personal data are requested in the survey, a privacy statement using the Privacy policy form is also needed. You can add the Privacy policy to the introductory statement, for example by embedding a link to it in the form. If personal data are requested, the form must also contain a separate mandatory box which the respondent ticks to give their consent to the processing of their personal data under the conditions set out in the Privacy policy.
Checklist:
- Apply for a research permit (only where needed).
- Complete the Privacy policy form.
- Inform the research subject using the Participant Information template.
- Ask for the subject’s consent using the Participant Consent template.
- Save these documents in Wihi, with the exception of the Participant Consent form. Keep the subject’s consent forms securely in your possession and destroy them one year after the date on which your thesis was approved.
If you are unsure about which forms and templates you need in your thesis, contact your thesis supervisor.
Example 1:
Your thesis is about developing e-learning at educational institution X. To this end, you would like to find out about the experiences of the students at the educational institution of this. You conduct an extensive anonymous survey and also interview some students. Complete these steps:
- Obtain a research permit from the organisation in question. Save it in Wihi.
- Make sure that the survey produces genuinely anonymous data in which the respondents cannot be identified even indirectly based on their responses.
- Provide information about the survey in the cover letter. You will not be collecting personal data, which is why you do not need the Privacy policy. Add to the survey a mandatory box which the respondent ticks to express their willingness to participate in the survey.
- Fill in the Privacy policy form for interviews. Save it in Wihi.
- Inform the interviewees using the text you have edited based on the Participant Information template. Save the information text in Wihi.
- Ask the interviewees to give their consent using the form you edited based on the Participant Consent template. Keep the Participant Consent forms securely in your possession and destroy them one year after the date on which your thesis was approved.
- Process the datasets as described in your information texts. Store the datasets securely. The software systems offered by Humak are secure, which is why you should use them.
- Destroy the recordings and transcripts as well as any other files containing personal data on your computer and/or in a cloud service appropriately after the thesis has been evaluated. Also destroy the survey responses. If you intend to request rectification for the grade awarded for your thesis, only destroy these files after the rectification process has been concluded.
Example 2:
Your thesis is about developing the service process of actor X. To this end, you want to know what people think about the current service. You do legwork in the service and ask customers about their experiences of using the service and also ask them for development proposals. You have prepared a questionnaire, and you record each customer’s answers on a separate form yourself. You also write down the answers given by the customers to freely worded sections in your own words. You do not save anything, and you do not ask or write down anything that contains direct or indirect personal data. Complete these steps:
- Find out from the commissioner if you need a research permit, and get one if necessary. Save it in Wihi.
- Inform the interviewee about the purpose of the development work and data processing. Even verbal information is enough, but also have written information ready that you can show them if necessary.
- Ask the interviewee to give their consent to the interview. Requesting and giving the consent orally is enough.
- Make sure that what you write down on the forms does not contain direct or indirect personal data.
- Process the data as described in your information texts.
- Destroy the forms appropriately once your thesis has been completed.
The reason for the differences in the information and consent procedures in these examples is that in the latter example, nothing is recorded, and the interviewer writes down the answers in their own words. The key is that nothing is written down in such detail that the interviewee could be identified. This also means that no personal data file is generated. Providing information and giving the consent orally are sufficient for such short interviews in which a form is used and which are anonymous from start to finish (direct or indirect personal data are not asked for or recorded at any stage). In longer interviews, however, which typically should be recorded and transcribed verbatim, you must always inform the interviewee and ask for their consent in writing.