Privacy Policy

Executive summary

The structure:

Recital and summary of main points.

1. Definitions
2. Ultimate responsible party
3. Administrator
4. Affiliated research party
5. Aim and content of the Nurses Survey Pool
6. Operation of the database
7. Processing data
8. Respondent rights
9. Duration of the database
10. Complaint procedure
11. Final provisions

Appendix 1 Mandatory measures for the security of the database

Appendix 2 Employees who have access to part A of the database

Appendix 3 Parties that have access to part B of the database

 

Executive summary

The regulations distinguish three main parties with access to the database:

1. ‘controller’ with access to part A, the personal data (and not to the research data);
2. ‘administrator’ with access to part B, the research data (and not to the personal data);
3. ‘affiliated research party’ with access to part B, the research data (and not the personal data).

The structure:

ESNO is the party responsible for the content and compliance with the regulations as laid down in this document. This is referred to in the document as ‘the controller’. PANAXEA is mainly involved in the day-to-day care of the Survey Pool (‘administrator’ in this document).

The link between part A and Part B is a unique identifier (participant number). The datafile containing the linked personal information and unique identifier is stored protected in the data system of ESNO and cannot be accessed by PANAXEA or affiliated research parties.

ESNO is responsible for approving affiliated research parties to join the Nurses Survey Pool and/or approving the research they plan including access to data collected via the Nurses Survey Pool.

Affiliated research parties are eligible to join the Nurses Survey Pool in a research capacity only if they: 1. are or were registered at a national nursing regulatory body and 2. are affiliated with a university or academy, and research topics related to healthcare and/or nursing.

Furthermore, a distinction is made between ‘data subjects’, whose data are in the database, and ‘members’ (or ‘participants’), whose data are in the database and who are actively participating in survey research. These members can withdraw their membership at any given time without giving any reason. The controller, through the administrator, ensures that a granted request is executed within four weeks. Since members commit themselves to filling out at least 3 survey(s) a year, ESNO can also terminate memberships after long term non-response.

Each survey informs participants of the purpose of research performed with their data and informs them that their given consent also applies to reuse of data for secondary data analysis.

 

Recital and summary of main points

The European Specialist Nurses organisation, hereafter called “ESNO”, taking into consideration that,

• a database, hereinafter referred to as the ‘Nurses Survey Pool’, has been set up in March 2023;
• ESNO’s intended goal with the Nurses Survey Pool is to gather from participants (by which is meant specialist nurses) opinions and knowledge about their profession and healthcare systems, and also to measure expectations and experiences with their profession to inform its policy making;
• ESNO receives subsidies regarding the Nurses Survey Pool from sponsors. The sponsors of ESNO can be found at https://www.esno.org/page13.html;
• designated ESNO (‘controller’) employees have access to the communication data part of the database (the personal data) in order to maintain the necessary contacts with the participants;
• designated employees of PANAXEA (‘administrator’) have access to another part of the database (the survey data) in order to answer research questions in the context of the aforementioned objective of the Nurses Survey Pool;
• with the data from the database, research can also be carried out for and/or in collaboration with affiliated research parties;
• with the data from the database, research can also be carried out for third parties;
• the provisions regarding the Nurses Survey Pool database and processing of data are included in this privacy regulation;
• also taking into account that it is considered of utmost importance by ESNO to carefully regulate the privacy aspects of the use of the database;
• it is considered important, partly in connection with the provisions of the General Data Protection Regulation (GDPR), to establish the conditions under which personal data may be processed in the database for the benefit of the Nurses Survey Pool;
• ESNO acts in accordance with the provisions of the Code of Conduct for Health Research of the Federation of Medical Scientific Associations (FMWV);
• has established database privacy regulations for the purpose of the Nurses Survey Pool. These can be read on the following pages of this document.

 

1. Definitions

In this privacy policy, the following definitions apply:

1.1 Database

The structured whole of the data of the data subjects, referred to in Art. 6.1 of this privacy policy.

1.2 Personal Data

Any data about an identifiable or identified natural person.

1.3 Processing of personal data

Any operation or set of operations relating to personal data or a set of personal data, whether or not performed by automated processes, such as collecting, recording, organizing, structuring, storing, updating or modifying, retrieving, consulting, using, providing by means of forwarding, distributing or otherwise making available, aligning or combining, blocking, erasing or destroying data.

1.4 ESNO

The European Specialist Nurses Organisation (ESNO) is a non-profit membership organisation that focusses on enhancing the capacity and capability of specialist nurses to deliver high quality healthcare in Europe. ESNO is registered under the Dutch law.

1.5 ESNO Nurses Survey Pool

The activities arising from the purpose of the database, as defined in Art. 5 of this privacy policy.

1.6 Responsible party

The legal entity that determines the purposes and means of the processing of personal data in the database.

1.7 Data subject

The person whose data is included in the database.

1.8 Participant/member

Those who, in accordance with Art. 5.2 of this privacy policy, participates in the Nurses Survey Pool.

1.9 Third party

A natural or legal person, public authority, agency, or body that is not entitled to process data from the various parts of the database in accordance with this privacy policy or is not a data subject.

1.10 Research party affiliated with the Nurses Survey Pool (‘affiliated research party’)

A natural or legal person, public authority, agency, or body other than the data subject, the controller, or the processor. It is an entity who, under the direct authority of the controller or processor, is authorised to process data from the database.

1.11 The law

Meaning the EU General Data Protection Regulation (EUGDPR). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals regarding the Processing of Personal Data and on the free movement of such data and repealing Directive 95/46/EC.

1.12 Communication data

Data concerning the name, first names, initials, title, gender, date of birth, country of work and e-mail address of the participant required for communication. These are considered personal data.

 

2. Ultimate responsible party

2.1 Ultimate responsible party

ESNO is the ultimate responsible party responsible for- and designated employees are controller of- the database as described in Art. 6.

2.2 Duties and Responsibilities

ESNO is responsible for the obligations that arise from this privacy regulation and the law. Further, as controller ESNO is responsible the proper functioning of the database.

2.3 Unforeseen circumstances

In cases not covered by these privacy regulations, ESNO decides with due observance of the law and any other applicable legal provisions in accordance with the intention of these privacy regulations. This will be done in consultation with a Data Protection Officer appointed by ESNO.

 

3. Administrator

PANAXEA is responsible for the day-to-day care of the database. This task is performed under the responsibility of controller. Administrator is not part of the organization of controller.

 

4. Affiliated research party

Persons and/or organisations can apply to be an affiliated research party if they 1. are or were registered at a national nursing regulatory body and 2. are affiliated with a university or academy and are doing research in the field of healthcare and/or the nursing profession.

The competencies of said party include conducting research through the Nurses Survey Pool, within the scope of nurses research and in the context of ethical research practices.

 

5. Aim and content of the Nurses Survey Pool

5.1 Aim

• The Nurses Survey Pool aims provide up-to-date data on specialist nurse related themes. Part of this data will be used for scientific research, either performed under direct assignment of ESNO or under initiative of affiliated research partners.
• Further, the Nurses Survey Pool aims to gather data on specialist nurses’ opinions, preferences, expectations, and knowledge to inform policy making by ESNO.

5.2 Participants/members

Members are individuals that willingly signed up for the Nurses Survey Pool. Said members can unsubscribe as a participant of the Nurses Survey Pool at any time they please, with or without statement of reason(s).

5.3 Recruitment of participants/members

Participants are recruited by ESNO.

5.4 Contents of the database

The database contains:
a. communication data;
b. data provided by the participants in the Nurses Survey Pool in response to the questions submitted to them.

5.5 Data Subjects

Data subjects are (ex-)members of the Nurses Survey Pool whose data is in part B of the data base.

 

6. Operation of the database

6.1 General

The database is divided into two parts:

• part A contains the communication data of members including name, e-mail address, and research registration number;
• part B contains separate files in which the research registration number of the participant and the results of the questions asked to them are recorded separately for each questionnaire. These files never contain data that can be traced directly to individuals.

6.2 Purpose of part A

Part A will only be used to contact participants by e-mail for a questionnaire, a newsletter or for other aspects of the Nurses Survey Pool that require direct contact with the participant. Part A is also used if participants themselves contact ESNO to report changes, such as temporarily not responding at the request of the participant or withdrawing as a participant.

6.3 Purpose of the individual files covered by part B

Files that fall under part B are intended to store the answers to the questions submitted to participants and to be able to answer scientific research questions.

6.4 Prohibition of linking part A to part B

It is not allowed to link part A with part B. To this end, two different parties are responsible for part A and part B respectively.

6.5 Data protection and security

The controller will ensure that appropriate technical and organizational measures are taken to protect the data against loss or against any form of unlawful processing. These measures guarantee, considering the state of the art and the costs of implementation, an appropriate level of security in view of the risks involved in the processing and the nature of the data to be protected.

7. Processing data

7.1 From data from the files in part A

With due observance of the provisions of Art. 6, communication data from Part A can only be processed by designated ESNO employees. The qualifications of these ESNO employees are described in more detail in Appendix 2.

7.2 From data from the files in part B

PANAXEA discusses sharing of anonymised data with affiliated research parties and third parties associated with the Nurses Survey Pool together with members of the ESNO supervisory board.
The results of analyses performed on data from the database may only consist of data that can never be traced back to an individual. After the analyses have been carried out, designated employees check again whether the results comply with the privacy regulations as laid down in this document. The employees who have access to and are authorized to process the data of part B are specified in appendix 3 of this document.

7.3 Processing initiative

Processing as referred to in Art. 7.2 can take place:

• at the initiative of specified ESNO employees;
• at the initiative of specified PANAXEA employees;
• at the initiative of affiliated research parties;
• at the initiative of third parties.

In the case of third parties/research parties, ESNO assesses whether the intended processing meets the principles laid down in these privacy regulations, the scientific merit and whether the interests of the Nurses Survey Pool can be harmed by making the requested data available.

7.4 Export of data outside the organization of the controller

The processing of data from part B as referred to in Art. 7.2 produces a secondary file with research data. Such a file can only be accessed by third party organizations if:

1. that organization is approved by ESNO;
2. that organization has the password to access said secondary data file; and
3. if the file does not contain any personal data, unless the participant has been informed about this and has given explicit permission on that basis (see also art. 6.1).

The agreement with this organization stipulates, among other things, the conditions that apply to the use of the research data.

7.5 Register of Data Processing

The controller keeps a record of data processing as referred to in Art. 7.1 and 7.2 and of providing a secondary file to third parties as referred to in art. 7.4.

 

8. Respondent rights

8.1 Right to information
ESNO provides accessible information to (potential) members about membership of the Nurses Survey Pool and the associated privacy regulations (as described in this document). Members and data subjects must be clearly and properly informed in advance about the use of (personal) data processed in the context of research. This must be done by means of:

• informed consent; and
• privacy statement on the website of ESNO.

Secondary data analysis:

• There is provision for analysis of secondary data (not containing personal information) in the original consent form of a given study;
• in case of reuse of an existing dataset, the outcomes and eventual results of the processed data will be publicized on the ESNO Nurses Survey Pool website retrospectively.

8.2 Right of inspection
Members or data subjects may at any time inspect the (personal) data collected concerning them. At the written request of a data subject or their legal representative, they shall be provided with an overview (as far as technically possible) of the data contained about them in part A or part B of the database.

8.3 Right of rectification
Members may at any time access the personal data collected concerning them. At the request of a participant or former participant, their personal data that are included in this database will be corrected or supplemented.

8.4 Right to restriction
Members or data subjects have the right to limit the processing of personal data, e.g., pending the outcome of an objection. Restriction means that personal data will be marked and may not be processed during this period.

8.5 Right of objection
Members may indicate that they do not (or no longer) want their data to be processed and have the right to ask for removal of personal data. After a written request from a member or their legal representative, this will be complied with as soon as possible, and within four weeks. After removing personal data from part A, only research data remains (part B). The retention of the research data (part B) is necessary to be able to justify previous results of research with the database for the Nurses Survey Pool, if necessary.

8.6 Right to withdrawal

Members can withdraw their membership by informing ESNO and will receive confirmation of this. ESNO can also discontinue participation due to long-term non-response. Members will receive confirmation of this as well. If a member withdraws from the Nurses Survey Pool or is considered withdrawn, their data will be removed from Part A. The data subject can hereafter no longer be contacted and is no longer considered a participant in the Nurses Survey Pool.

8.7 Method of settling requests as referred to in this paragraph

A request as referred to in art. 8.2, 8.3, 8.4, 8.5 or 8.6 is made to the administrator. Members or data subjects will be notified within 4 weeks of the extent to which the request will be complied with. A refusal will be reasoned. The controller, through the administrator, ensures that a granted request is executed as soon as possible.

 

9. Duration of the database

The database is maintained for the duration of the Nurses Survey Pool. ESNO will decide on the possible conversion of the database afterwards. Conversion means combining the individual datapoints into a file of aggregated data so said individual datapoints may be deleted.

 

10. Complaint procedure

10.1 General

Data subjects can submit a complaint for non-compliance with the provisions of this privacy policy. This can be done via a form made accessible on the ESNO Nurses Survey Pool website.

10.2 Complaints Committee

A complaints committee has been set up to deal with complaints about the activities of the Nurses Survey Pool. The complaints committee consists of the members of the ESNO board.

10.3 Handling the complaint

The complaints committee applies the complaints procedure that has been drawn up. The complaints procedure contains provisions on the way in which the complainant and the person or organization (part) to which the complaint relates are heard and the terms within which a complaint will be handled.

11. Final provisions

11.1 Attachments

The numbered attachments form an integral part of this privacy policy.

11.2 Change of the privacy regulations

This privacy policy can be changed by ESNO. The change will be made public to the members of the ESNO Nurses Survey Pool program committee and ESNO Nurses Survey Pool members. The provisions of the previous sentence do not apply to changes of a minor nature in the appendices and in the privacy regulations.

11.3 Enactment

These privacy regulations have been adopted by ESNO and come into effect on May 2023.

The regulations were last amended May 2023.

Appendix 1 Mandatory measures for the security of the database

This appendix forms one whole with the privacy regulations of the Nurses Survey Pool. The measures taken by the controller to secure the database concern the following:

1. Access to and processing of data from the database is only permitted to those employees of ESNO who have been designated for this purpose (see appendices 2 and 3) and who have declared in writing that they will never act in violation of the right to privacy of the people involved in the panel.
2. Data files to affiliated research parties and third parties may only be sent with electronic security.
3. Part A of the database is kept within the infrastructure of the controller on an appropriate medium secured by a ‘password’, which is only known to the persons designated by the controller in charge of accessing the data. Part B of the database is kept in a secure environment which is accessible only to the parties designated by ESNO and the administrator in charge of processing the data (see appendix 3).
4. A copy of the database is kept in a safe outside the data controller’s premises. It also applies to the copy that it is stored on a suitable medium, protected by a password.

Appendix 2 Employees who have access to part A of the database

This appendix, ex article 7.1 of the privacy regulations, forms one whole with the privacy regulations of the Nurses Survey Pool. The employees designated by the controller who have access to and are authorized to process data of the communication file (part A) are only ESNO staff assigned to input and process data in Part A of the Nurses Survey Pool.

Said employees only then have access and are only authorized to process data from part A, after they have declared in writing that they will never act in violation of the right to privacy of the persons involved in the Nurses Survey Pool.

Appendix 3 Parties that have access to part B of the database

This appendix, ex article 7.2 of the privacy regulations, forms a whole with the privacy regulations of the ESNO Nurses Survey Pool. The employees designated by the controller who have access to and are authorized to process the data of part B are:

1. researchers from PANAXEA appointed to carry out the Nurses Survey Pool (determined in agreement with ESNO);
2. affiliated research parties, approved by the controller to access research data in part B of the Nurses Survey Pool.
3. Designated members of the ESNO Advisory and Consultancy committee, appointed to monitor the survey research conducted by PANAXEA. These members explicitly have no access to part A of the database;