The National Institute for Public Health and the Environment (RIVM) uses personal data. The general privacy statement of RIVM outlines why RIVM uses personal data and explains why RIVM is allowed to do so. This privacy statement on social science research is supplementary to the general privacy statement.
This privacy statement outlines:
- How we use personal data for social science research;
- Whose personal data we use for this purpose;
- Your rights if we use your personal data for this purpose.
This privacy statement may be relevant to you, since you are taking part in one of our studies. This statement provides a general overview. You can find more information in the information letter from the study that you are in.
What is the purpose for which we use personal data?
RIVM is working towards a healthy population and a sustainable, safe and healthy living environment.
One of our tasks is conducting research. Our studies focus on:
- Preventing and controlling infectious diseases
- Good healthcare and healthy lifestyles
- A clean, healthy and safe living environment
The exact purpose of a specific study is explained in the information letter that you receive or on an information page provided online. The answers that you give to our questions are used for our research, for example by comparing them to the answers that other participants gave. We may also see how we can use your opinion and the opinions of others to improve our approach or communication about it.
We regularly write about our studies, for example in a scientific article or in a report on our website. We always ensure that these publications do not contain any information that can be traced back to you or to your answers as a participant in the study.
What types of personal data do we use?
An item of personal data is information that is about a person or information that can be traced back to a person. Examples of personal data include a home address, phone number or e-mail address.
Some personal data is extra sensitive because its use can have a significant impact on a person’s life, such as information about a person’s race, religion or health. These special categories of personal data have stricter legal protections.
Various personal data may be used for social science research. Exactly which types will depend on the study. Examples include contact details (such as an e-mail address), age, gender and region. You may be asked about your opinion or behaviour, how you perceive or deal with something, how you arrive at a decision, or what you know about a topic. Sometimes you may be asked about health data (such as whether you are vaccinated). The study may also focus on specific groups, for example people with a migration background.
We always do our best to use only as much personal data as we need to achieve the purpose of the study.
Our studies do not require knowing who gave which answers. That is why we always delete data that can be traced back to participants as soon as we can. For example, if we record an interview, we could make a transcript of the interview without any names, and then delete the audio recording. Traceable data that we are required to retain, such as completed registration forms or contact details for participants, are stored separately from our research data. This means that participants cannot be linked to their answers.
Whose personal data do we use?
For social science research, we often need information about people. We collect that information through interviews, group discussions, or surveys. We recruit participants in various ways, for example through panels, advertisements or visits to locations. We invite interested individuals to take part in our study. If you took part in a study in the past and stated that we could contact you again for further research, we may invite you again. If you sign up on your own initiative, we will use your contact details to communicate with you about the study, for example by sending you an interview invitation or a survey.
How do we obtain the personal data?
The personal data we use for the study is given to us by study participants. It is often provided directly. Sometimes the data is collected by different organisations, such as a panel agency.
What does the law say about the use of personal data?
The General Data Protection Regulation (GDPR) says that organisations can only use personal data if they have a valid ‘ground’ for doing so.
The GDPR lists six legal bases for processing personal data:
- consent from the person concerned
- performance of a contract
- legal obligation
- vital interest of the person concerned or other people
- public interest (exercise of official authority)
- legitimate interest
RIVM only uses personal data if the law says we can.
RIVM is legally mandated to conduct research on topics related to public health and the environment. Almost all our social science research is related to that task, which means that fulfilling a task in the public interest is the legal base for using personal data.
Sometimes we do research using personal data for different reasons than public interest. In that case, the information letter explains what that means for you.
Taking part in a study is always voluntary. If you are taking part in a study, we need your ‘informed consent’ to register your participation. This means that we may only collect data if:
- we have given you enough information about the study, and;
- you give your consent to take part in the study.
How long do we retain the personal data?
Our standard practice is to retain non-traceable data from social science research until 10 years after the end of the study. The participant registration forms are then stored for another 10 years. We delete other data as soon as possible, for example immediately after the end of the study. If a specific study uses a different data retention period, we will state that in the information letter. In any case, we do not retain personal data for longer than necessary for the purposes described in the information letter.
Whom do we share the personal data with?
In some cases, RIVM may want or need to share personal data with others. When sharing personal data with other organisations, RIVM exercises all due care and is compliant with the rules of the GDPR.
In principle, we do not share any traceable personal data with other organisations in the context of conducting social science research. In some studies, we do share some traceable data, for example if we are working with a hospital or Municipal Public Health Service (GGD). In that case, the information letter that we send explains which organisations we share data with, and why.
Use of your data for other research
Sometimes data from a completed study may be interesting for new studies. If the new study is for comparable purposes, we may re-use data. We make sure that any such data cannot be traced directly to individuals. We never re-use data for purposes that are not closely related to the original study.
Your rights
Under the GDPR, you have a number of rights. This privacy statement outlines your rights when your personal data is used for social science research. It also explains how you can send a GDPR request to exercise your rights.
You have the right to know what data we have about you, so you are allowed to view your own data. If we have incorrect information about you, you can ask us to change it. You can also object to the use of your personal data if you have specific reasons for objecting.
In addition, you can always stop your participation in a study. In that case, you can ask us to stop using your data, or to delete your data.
We will try to fulfil your request wherever we can, but it is not always possible. For example, if we have already used your research data or survey responses to answer all or part of the research question, we cannot delete that data. Similarly, we cannot erase the articles or reports that we wrote about the outcomes of the study. Moreover, we are often unable to trace specific data back to you.
The information letter for each study includes a designated person that you can contact. If you are unable to reach them, or if you have general questions, you can consult the general privacy statement of RIVM.
Any questions?
After reading the privacy statement, do you still have questions about how personal data is used at RIVM? You may find the answer in the general privacy statement of RIVM.
If you have any questions about this privacy statement, or think that RIVM is not respecting this statement, please send an email to: avg-rivm@rivm.nl.
Would you like to file a complaint?
If you have complaints about how we use your personal data, there are various ways to share them. First, you can contact the researcher designated in the information letter. You can also file a complaint with:
- RIVM. The RIVM website offers more information about the complaints procedure and how to file a written complaint.
- The Data Protection Officer (DPO) of the Ministry of Health, Welfare and Sport (VWS), by sending an e-mail to: FG-VWS@minvws.nl.
- the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority. This is the independent supervisory authority in the Netherlands that monitors protection of personal data. The AP website also offers extensive information about privacy in English.
Our privacy statements may be subject to change
Laws and regulations about privacy change regularly. For that reason, this privacy statement about social science research and the general privacy statement may be subject to change.
We recommend that you read these privacy statements again from time to time, so you know how we are using your personal data.