We work with a range of industry-leading panels to source our respondents, all of whom are GDPR-compliant.
Every time we go to field for our research, we work with these panels to ensure we get representative samples in each country. Individuals who choose to accept this invitation then come through to the GlobalWebIndex survey, hosted by us. Once completed, they’re redirected back to the panel provider.
It’s these panel providers who have the direct relationship with the panelists, and who hold what was traditionally classified as Personally Identifiable Information (PII).
We never ask for, or receive, this information.
We do, however, collect details including IP address, and ask for permission to drop and read cookies on an individual’s browser.
This information allows us to synchronize survey responses with browsing behaviors on our clients’ website pages and accurately measure exposure to their advertising campaigns.
We also attach a unique identifier (in the form of a generic string of alphanumeric characters) to each panelist’s survey responses.
For years now, we’ve been transparent and upfront with our panelists about the fact that we want their permission to set, read and use cookies.
Additionally, we’ve always given real-world, easy-to-understand examples of how these cookies might be used to ensure panelists comprehend (and are comfortable with) this.
Under the GDPR, cookies, unique identifiers and IP addresses are now definitively (and correctly) counted as personal data, so we’ve worked extensively with our GDPR-specialist lawyers to ensure all of our processes are compliant.
Long ago, we made the decision to feature a cookie consent notice at the beginning of our survey, along with clear, digestible cookie and privacy notices, accessible via hyperlinks.
Across all these documents, we used normal-sized font and everyday language. We gave people the ability to opt-out, and we translated these notices into all of the 30+ languages our surveys are available in.
We did this to outline very clearly to consumers not only our request to drop cookies, but what we wanted to do with the information we collected from them, and how their survey responses or other technical information collected might be used.
Crucially, we have always asked people for their consent and agreement before allowing them to enter the survey itself. We didn’t feel relying on assumed consent, or consent by proxy, was a very transparent, respectful or ethical approach.
Our GDPR lawyers have termed our consent notices as 'remarkably transparent', and noted that our cookie and privacy notices are commendably consumer-friendly.
As such, we only needed to make minor tweaks to our consent screen to ensure it’s fully compliant with the GDPR. This revised version now appears at the start of every survey we run.
Under the GDPR, our respondents are classified as ‘data subjects’, while GlobalWebIndex is termed as both a ‘data processor’ and a ‘data controller’.
One of the best things about the GDPR is its clear definition of the relationship between subjects, processors and controllers. For the data subject, one of these rights is to know the lawful basis by which their data is being collected/processed.
In response to this, we’ve outlined very clearly our basis for collecting/using different types of information (survey responses, cookies, unique identifiers) and what they’re used for.
Most commonly, we process personal data because it's necessary for our legitimate interests (for example, to enable us to provide services to our customers, or for statistical purposes).
Where we rely on legitimate interests as our lawful basis for processing, we always check our interests are not overridden by the rights of the data subjects in question.
As the GDPR sets out clear guidelines about what counts as personal data, we’ve specified the different types of data we collect: Survey data, Technical data, Cookies, Identity data (i.e. unique identifiers).
Anything including ‘Identity data’ is treated by us as ‘personal data’. The data we collect from a respondent will comprise direct interactions (i.e. responses to questions asked) as well as automated technologies and interactions (i.e. information collected via cookies or similar technologies).
In the GlobalWebIndex platform, we’ve ensured the aggregated data be fully anonymized. By this, we mean the responses we collect and then publish in-platform are not connected to any form of personal data – whether a unique identifier, cookie or IP address.
Although this aggregated survey data was originally derived from personal data, in the form it is published it cannot directly or indirectly reveal someone’s identity, and hence it is not considered personal data.
Outside of the platform, personal data such as cookies, unique identifiers and IP address are retained only for as long as they are necessary for legitimate business interests.
For example, in our Core research we interview unique individuals each year – meaning the same person cannot take our survey more than once within a 12-month period.
That means we need the ability to identify individuals for up to a year after they take the survey, hence unique identifiers will be required during this period.
Within our survey, some questions cover areas which the GDPR deems to be a ‘special category’ when it comes to personal data.
We don’t ask all of these questions in all of our markets, but they relate to personal health, ethnicity/nationality, political views and sexual orientation.
To collect and process such personal data, we cite statistical purposes (i.e. inclusion of such results in our aggregated dataset) as our lawful basis.
We ensure all panels make their panelists aware that they may be asked about these categories of data when they sign up to a panel.
We also always give the respondent a ‘Prefer Not To Say’ option within such questions.
.png)
