Data Protection Statement
Privacy Notice for Research Study “Dreaming and Mind-Wandering”
You are participating in a scientific research study at the University of Turku. This privacy notice explains how your personal data will be processed in the research.
1. Data Controller
University of Turku
2. Data Protection Officer’s Contact Information
The data protection officer of the University of Turku can be reached by email at dpo@utu.fi and by phone +358294503009.
3. Description of Research and Personal Data Processing
The overall aim of the research study is to investigate whether emotional language use in dream and mind-wandering reports reflects levels of alexithymia and trait emotion regulation using questionnaires, dream logs, and mind-wandering logs. As part of the measures included in the study, no personal data will be collected besides gender, age, and race. Every participant will retrace a randomly generated Participant ID number which they will use when completing the questionnaires, dream logs, and mind-wandering logs. Participants’ IP addresses will not be collected/saved.
If the participants provide any names, places, or other information in their dream and/or mind-wandering reports that may potentially be used to identify them or other individuals, this information will be removed from the reports during the content analysis procedure. This ensures that the stored dream and mind-wandering reports will not contain any personal or sensitive data. Pseudonymized dream and mind-wandering reports will be stored in a password-protected file/folder on the university server. Data and research findings will be published in scientific journals in a way that ensures the anonymity of the participants.
Even though direct identifiers will be removed from the dataset, the latter contains several indirect identifiers: age, gender, racial background, relationship status, number of children, employment status, education status, questions regarding different aspects of well-being and mental health (e.g., peace of mind, depression, anxiety), questions regarding sleep quality and quantity, sleep medication used, as well as the frequency and content of nightmares, other dreams, and mind-wandering.
To promote open science, the collected data will be made freely available to the scientific community via the Open Science Framework (https://osf.io). These practices help ensure the transparency, openness, and responsibility of our research. Regarding dream and mind-wandering logs, only the ratings of dream content (i.e., ratings performed by the participants themselves as well as ratings of the reports performed by the researchers), but not the actual narrative reports provided by the participants, will be shared with other researchers.
4. Persons Involved in Personal Data Processing
Dr. Pilleriin Sikka, PhD, Postdoctoral Researcher
Supervisor of the Project
Department of Psychology and Speech-Language Pathology, University of Turku
pilsik@utu.fi
Nanna Strid, PhD student
Department of Psychology and Speech-Language Pathology, University of Turku
nanna.strid@utu.fi
Enyu Lin, PhD student
Department of Psychology and Speech-Language Pathology, University of Turku
enyu.e.lin@utu.fi
Dr. Jarno Tuominen, University teacher
Collaborator (involved in data collection, analysis, and write-up)
Department of Psychology and Speech-Language Pathology, University of Turku
jarno.tuominen@utu.fi
Prof. Antti Revonsuo, Professor of psychology
Supervisor of the Project
Department of Psychology and Speech-Language Pathology, University of Turku
revonsuo@utu.fi
Dr. David A. Preece, Lecturer in psychology
Collaborator
Curtin University, Curtin enAble Institute & School of Population Health, Australia
david.preece@curtin.edu.au
Dr. James J. Gross, Professor of psychology
Collaborator
Department of Psychology, Stanford University
gross@stanford.edu
Students/research assistants who may be involved in the content analysis of narrative reports as part of their thesis work.
5. Duration of Personal Data Processing
Pseudonymized dream and mind-wandering reports will be stored in a password-protected file/folder on the university server until ten years have passed since the end of the data collection.
6. Lawful Basis for Personal Data Processing
The processing of personal data is based on Article 6(1) of the GDPR:
☒ task carried out in the public interest:
☒ scientific or historical research or statistical purposes
☐ archiving of scientific or cultural heritage materials
☐ consent of the data subject
☐ compliance with a legal obligation to which the data controller is subject
☐ legitimate interests of the data controller or a third party
7. Personal Data Included in the Research
If the participants provide any names, places, or other information in their narrative reports that may potentially be used to identify them or other individuals, this information will be removed from the reports during the content analysis procedure. Even though direct identifiers will be removed from the dataset, the latter contains several indirect identifiers: age, gender, racial background, relationship status, number of children, employment status, education status, questions regarding different aspects of well-being and mental health (e.g., peace of mind, depression, anxiety), questions regarding sleep quality and quantity, sleep medication used, as well as the frequency and content of nightmares, other dreams, and mind-wandering.
8. Special Categories of Personal Data (Sensitive Personal Data)
The following personal data of special categories is processed in the research: race, information regarding sleep and mental health.
The processing of special categories of personal data is based on Article 9(2) of the GDPR:
☒ task carried out in the public interest:
☒ scientific or historical research or statistical purposes
☐ archiving of scientific or cultural heritage materials
☐ consent of the data subject
☐ compliance with a legal obligation to which the data controller is subject
9. Sources of Personal Data
Personal data will be given by the participants themselves when filling in the online questionnaire (age, gender, race). Participants may choose to provide personal data also in their dream and mind-wandering reports.
10. Personal Data Protection Measures
Personal data processed in information systems is protected in the following ways:
☒ user ID and password
☐ logging of use
☒ access control
☐ encryption
☐ two-factor authentication
☐ other, specify:
Processing of Direct Identifiers:
☐ The data is collected without direct identifiers
☒ Direct identifiers are removed during the analysis phase:
Direct identifiers that participants may provide in their dream and mind-wandering reports will be removed in the process of content analysis of dream reports.
☐ The data is analysed with direct identifiers because:
11. Transfer and Sharing of Personal Data with Third Parties
Personal data is transferred to the following recipients outside the data controller:
Collected dream and mind-wandering reports may be analysed at our partner universities: Prof. James J. Gross at Stanford University (USA) and Dr. David A. Preece at Curtin University, Australia
12. Transfer of Personal Data Outside the EU or EEA
Personal data is transferred to the following countries outside the European Union or the European Economic Area:
Collected dream and mind-wandering reports may be analysed at our partner universities: Prof. James J. Gross at Stanford University (USA) and Dr. David A. Preece at Curtin University, Australia
13. Processing of Personal Data After the Study Ends
☐ The research data is deleted
☒ The research data is retained to assess the reliability of the study results:
☒ without direct identifiers ☐ with identifiers
☒ The research data will be retained for compatible scientific research in the future in accordance
with the requirements of the GDPR:
☒ without direct identifiers ☐ with identifiers
The research data is retained on the Open Science Framework page (https://osf.io), or if recommended by the publisher of the study, into some other respective open data platform. The retention of the research data is based on Article 5(1)(b) and (e) of the GDPR. A new privacy notice will be sent to participants for the new use of the research data, unless the data controller can no longer identify the participants from the research data. A notification of the new study cannot be sent to the data subject if providing the information would be impossible or would involve a disproportionate effort or if it would seriously impair the achievement of the research purposes (Article 14(5)(b) of the GDPR).
14. Rights of the Data Subject and Exceptions to These Rights
For more information about your rights under the GDPR, contact the person mentioned in section 1.
Rights of the Data Subject
According to the Data Protection Regulation, the data subject has the right to:
• Access their data (Article 15)
• Rectify their data (Article 16)
• Erase their data and be forgotten (Article 17)
• Restrict the processing of their data (Article 18)
• Transfer their data from one controller to another (Article 20)
• Object to the processing of their data (Article 21)
• Not be subject to automated decision-making (Article 22)
However, the data subject cannot exercise all rights in all situations, depending on the legal basis for the processing of personal data.
Exceptions to Data Subject Rights
Data protection legislation allows for exceptions to data subject rights when personal data is processed for scientific research and exercising the rights would prevent or significantly hinder the achievement of the research purposes. The need to make exceptions to data subject rights is always assessed on a case-by-case basis.
In this privacy notice, it is likely necessary to make exceptions to the following data subject rights:
☐ Right to access data (Article 15)
☐ Right to rectify data (Article 16))
☐ Right to erase data and be forgotten (Article 17)
☐ Right to restrict data processing (Article 18)
☐ Right to object to data processing (Article 21)
If the processing of personal data in research does not require the identification of the data subject and the controller cannot identify the data subject, the rights to access, rectify, erase, restrict processing, notify, and transfer data do not apply unless the data subject provides additional information enabling reliable identification (Article 11).
Right to Complain
You have the right to lodge a complaint with the Data Protection Ombudsman if you believe that your personal data has been processed in breach of applicable data protection legislation.
Contact Information for the Data Protection Ombudsman:
Data Protection Ombudsman’s Office
Visiting address: Lintulahdenkuja 4, 00530 Helsinki
Postal address: PO Box 800, 00531 Helsinki
Switchboard: +358 29 566 6700
Email: tietosuoja(at)om.fi
