Transparency–Data protection privacy notice when using surveys under the Qatar Financial Center

written by: Karen Abi Younes

On September 30 2021, the QFC issued guidelines to be followed by QFC companies in relation to the data protection while conducting surveys. Such guidelines clarify the requirements of a privacy notice provided under the QFC Data Protection Regulations 2005 (the “Regulations”).

As a matter of fact, surveys are taking a big place in our life, especially in the life of our firms. Facing this booming in surveys, QFC decided to highlight the importance of the notice. In order to protect the respondents, with all the data processing, the firms conducting surveys must provide a transparent privacy notice to the respondents which ensures the respondents clearly understand who is processing their data and for what purpose it will be used.

This privacy notice must be written in a simple and easy way, and shall contain at a minimum, the following information:

• The identity of the data controller: The data controller is the entity that decided to create the survey and determines how the responses will be used, so it must be clearly stated.

   

• The purposes of the processing: The notice must include a statement on the purpose of the survey, as well as it needs to explain why certain pieces of personal data may be required.

   

• Data sharing with third parties: The notice must include the names or categories of third parties to whom personal data may be shared. It is also important to state the reason behind this step.

   

• Information on obligatory or voluntary information: If the survey requires respondents to provide their name or email address, the firm must state why this information is mandatory and what happens if they fail to provide it.

   

• Clarify your respondents’ rights: The firm must inform the respondents of their rights. For example, the right to access the data, or the right to use it.

   

•  Data used for marketing purposes: if the firm want to use any personal data, the latter must let the respondents know this.

QFC also recommended to include the following elements in the privacy notice to ensure compliance with international best practice:

• Security and retention of the data: To be fully transparent with respondents, it is a good practice to make a statement relating to the security you have in place, in order to protect their data and how long you plan to retain the data.

   

• Who can the respondent contact for more information: It is also recommended to provide respondents with contact details where they can get more information and where they can exercise their rights.

Additionally, QFC guidelines indicated some points to consider:

1. Consider having a consent page at the start of the survey;

    

2. Consider if any personal data should be captured or whether the survey should be anonymous;

    

3. If you want to contact a respondent about their survey and if you intend to reach out about business development opportunities, you should include this as an option;

    

4. If you are sharing the data with any third party listed in the notice, be sure you have clear data transfer agreements in place;

    

5. If you are collecting IP address, geolocation information or other metadata, be sure you have a clear purpose for doing so and declare it in the privacy notice; and

    

6. You should state for how long you will retain the data.