Privacy statement for participants in scientific research 

Introduction

This privacy statement is specifically intended for people whose personal data are processed in the context of scientific research  by the Netherlands Institute for the Study of Crime and Law Enforcement (NSCR). The NSCR is part of the Foundation for Dutch Scientific Research Institutes (NWO-I). The NSCR may conduct scientific research in collaboration with other research partners, such as Universities. The NSCR aims to handle personal data of everyone participating in scientific research in a careful manner. The privacy rules from the General Data Protection Regulation (GDPR) are crucial.

In this privacy statement we describe who we are, how and for what purposes we process your personal data, how you can exercise your privacy rights and any other information that may be relevant. We try to make the information in this statement as clear and readable as possible. If you have any questions about the processing of your personal data after reading this privacy statement, please contact us using the contact details at the bottom of this privacy statement.

If your personal data are being processed within a study, you may have already received information about this. In this privacy statement you will find more extensive (background) information on certain aspects of the processing in the study.

Who is responsible?

In most cases, the NSCR is responsible for processing personal data in the context of scientific research. This means that the NSCR determines the purpose of the processing and the means for this processing. By this we mean that the NSCR determines what purpose the research serves and in what way the research is conducted, for example interviews or surveys. The NSCR may also conduct a particular research in cooperation with a research partner, think for example Universities or other research institutions.

For what purposes are personal data processed?

The NSCR processes your personal data to answer specific research questions. These questions contribute to realizing the goals of the research. The NSCR conducts research in the field of crime and law enforcement. More information about the purpose of a specific research can be found in the information letter or introductory information that accompanies the research.

The NSCR may also process and retain your name and signature to show that you have given consent (for yourself or your child) to participate in a specific study. We must retain this consent to show that you have given permission for your personal data (or that of your child) to be processed as part of this research.

Sometimes the NSCR processes your contact information to contact or maintain contact with you for a particular study.

What personal data about you does the NSCR process?

The NSCR conducts research in the field of crime and law enforcement. Which personal data we process depends on the specific research. Would you like to know which of your personal data are processed in the context of a particular study? If so, please consult the information letter or introductory information associated with the study in question, or contact the researcher when stated.

Since the NSCR conducts research in the area of crime and law enforcement, there are many types of personal data that we often process for investigations, namely:

Name

We process your name when necessary to contact you. When it is not necessary within the research we do not process names.

Contact details

We process your contact information when we wish to maintain contact with you during an investigation.

Demographic data

For example, age, place of residence or education we process to contextualize and better understand the survey data.

Research data

We process this data to conduct research and answer the research questions within a study. This includes, for example, data from questionnaires or interviews.

Special data

The research data may contain special categories of data such as health data. We process these data only when necessary to answer a specific research question. As far as possible, this data is non-reducible to a person.

Data on crime or criminal offenses

The research data may include data on crime or criminal offenses since that is the focus for the research we are conducting. We process this data only when necessary to answer a specific research question. As far as possible, this data is non-reducible to an individual.

On what basis may NSCR process your personal data

Only when there is a good reason and basis may we process personal data. The GDPR describes several legal bases. The scientific research carried out by the NSCR can be based on one of the following bases.

Consent

For many studies, we ask for your prior consent to process your or your child’s personal data. You then give consent for specific processing of personal data, for example participation in a survey, the reuse of your data or the use of visual material.

Legitimate interest

Sometimes we process your personal data because we have a legitimate interest in conducting the specific research. We must demonstrate that there is a legitimate interest for the research. Before we start, we weigh the rights, freedoms and interests of you as a participant against the interests of the research. The research is only started the interests of the research outweigh the potential infringement on the rights, freedoms and interests of the participants.

General interest

When a law indicates that (specific) research must be done and the NSCR conducts this research, whether or not with a research partner, there is a public interest.

The NSCR may process special categories of data or crime or criminal data for research purposes. When this is the case, we often ask for your (explicit) consent to process these types personal data. When the research serves a public interest and it is impossible or requires disproportionate effort to ask your consent, we are exempt from asking for consent. In such cases we ensure that personal privacy is not unduly violated.

How long does the NSCR keep your personal data?

The NSCR retains personal data as long as necessary to achieve the (research) purpose. Research data, which are often not directly traceable to individuals, are kept for at least ten years after publication about the research. We do this to ensure that the research is verifiable until ten years after the research. No more personal data is ever kept than is necessary for this purpose.

Any further information on how long the NSCR keeps your personal data can be found in the information letter or introductory information that accompanies the study.

Contact information will be kept as long as necessary to contact you. Once the data is no longer needed, it is deleted. Finally, a consent form is deleted as soon as the personal data is deleted or anonymized.

Will your personal information be shared by the NSCR?

Only employees of the NSCR, where it is necessary in the context of the research, have access to your personal data. So only a limited group of researchers. It may happen that the NSCR collaborates with a research partner or other research partners. Then we will exchange personal data with them. For this, clear agreements are made to ensure compliance with the rules of the GDPR.

It may happen that the NSCR asks other organizations, commissioned by the NSCR, to process personal data. We call these ‘processors’. The NSCR makes clear agreements with them to ensure that these processors handle the personal data confidentially and carefully in a processing agreement.

In addition to processors, there are other parties with whom we may share personal data. We do this only when permitted or required by law. These include government agencies (for example, police or regulators, to comply with the law).

We may share personal data with organizations in countries outside the European Economic Area. We mention this in the information letter or introductory information that accompanies the study.

How can you exercise your privacy rights?

You have several rights under the GDPR with respect to personal data we process about you. These rights are known as data subjects’ rights. However, within scientific research there are exceptions to certain data subjects’ rights, this is explained below.

If you have consented to the processing of your personal data, you may also withdraw that consent. In other cases, you have the right to object to the processing.

Right to information

When you participate a study, you often receive advance information about the study. This allows you to decide for yourself whether you want to participate. Participation is always voluntary and based on the relevant information provided, which we call “informed consent’’.

In many research projects, you will receive an information letter from the researcher. The information letter contains details about the specific project. If you have direct contact with the researcher, you can always ask questions of this researcher. In online research, you often receive an invitation with information.

Right of access

Normally, you have the right to access your personal data that NSCR processes. For organizations conducting scientific research, sometimes different rules apply than for other organizations. Therefore, the NSCR may exclude the right of access.

Right of rectification

Normally, you have the right to correct (or have corrected) personal data that is incorrect. For organizations conducting scientific research, sometimes different rules apply than for other organizations. Therefore, the NSCR may exclude the right to rectification.

Right to data erasure

Normally, you have the right to ask an organization to delete your personal data. Different rules sometimes apply to organizations conducting scientific research than to other organizations. Therefore, the NSCR may exclude the right to data deletion if it jeopardizes research.

Right to data portability

The right to data portability means that the data you have given to an organization can be transferred to another organization whenever you want. This right is intended to prevent you from being tied to a specific service just because you have entered a lot of data there (think of a streaming service, for example). In the context of scientific research, this right usually has little relevance.

Right to restriction of processing

Normally, you have the right to restrict the processing of your data. Different rules sometimes apply to organizations conducting scientific research than to other organizations. Therefore, the NSCR may exclude the right to restriction.

Right to object

When we conduct research and process your personal data based on a general or legitimate interest, you can object to the processing of your personal data. This is done on the basis of your specific situation. When you object, the NSCR will decide whether the processing of your personal data has to be stopped.

You may exercise the aforementioned rights by sending a request to privacy@nscr.nl . As indicated, the NSCR may exclude certain rights and therefore not comply with your request. We assess this on a request-by-request basis and will inform you why we cannot comply with your request. When you make a request, we want to be sure that it is you. To verify your identity, we will therefore ask you some additional questions. We will respond to  your request as soon as possible, but at the latest within one month.

How does NSCR secure your personal information?

The NSCR handles your personal data confidentially. We have taken appropriate technical and organizational measures to ensure that your personal data are properly secured.

Technical measures

To properly protect your personal data, the NSCR uses appropriate security technologies. For example, we encrypt and pseudonymize personal data as much as possible. Only researchers directly involved in the research are allowed to view personal data.  The NSCR has an ISO27001 certification for the storage of (personal) data in our Secure Analytics Lab. This certification is a standard for securing data, with which the NSCR has set up a good system to secure data. This means that this environment is secure both technically and in terms of processes. For example, the environment is not approachable via the internet and there are strict procedures to access the data.

Organizational measures

Measures have also been taken within the NSCR to ensure that your data are not only properly secured technically, but that the chances of human error and misuse are also minimized. For example, in most research projects we work with research protocols, we enter into contracts with external parties, and we ensure that internal and external employees are bound to confidentiality and have a certificate of conduct (VOG).

Where can you file a complaint?

You may file a complaint with the Data Protection Authority if you are dissatisfied with NSCR’s processing of your personal data. In addition, you may also contact the Data Protection Officer to ask a question or file a complaint. You can do this at fg@nwo.nl

Contact

If you have any questions about our processing of personal data that are not beat answered in this privacy statement, please contact us at privacy@nscr.nl

Version

This privacy statement may change over time. The most recent version of this privacy statement can be found on the NSCR website. This privacy statement is effective as of May 2025. The last changes to this privacy statement were made on May 7, 2025.