“All data stays within Europe”

Privacy and data protection are high on the agenda at DUO-Onderwijs. At a time when data is becoming increasingly valuable and geopolitical developments increase risks, the research and consultancy firm consciously opts for transparency and security. Marjolein Nadorp explains how DUO-Onderwijs handles the sensitive information it collects every day.

To conduct proper research, DUO-Onderwijs works with personal data of parents, staff and students. This requires care. “People should be able to share their data with us with confidence,” says Marjolein Nadorp. “You don't want information to get into the wrong hands. And you want to be sure that what you enter cannot be traced back to you as a person.”

That privacy is important, DUO-Onderwijs has known for some time. But in recent years it has become even more urgent. “With everything that happens in the world, the relevance increases,” says Nadorp. “Previously, questions about data storage outside Europe, for example in the United States, were hardly ever asked,” Nadorp says. “That has changed now. Storing data outside the EEA carries risks that we simply don't want to take.”

DUO-Onderwijs only works with systems and suppliers whose data centres are in Europe and whose contracts stipulate that the data stays there. “We can say with certainty that data does not end up outside the EEA,” says Nadorp. This is for good reason: strict privacy rules, such as the AVG, apply within Europe. “You don't have that protection outside the EU in the same way,” she says. Also, DUO-Onderwijs does not collect more data than necessary and data is minimised, anonymised or pseudonymised as much as possible. “That way answers always remain separate from the person behind them,” she says.”

Even before an investigation starts, DUO-Onderwijs records in processing agreements which data will be processed, for what purpose, for what duration and which security measures apply. “These are conscious choices,” says Nadorp. “People need to know what happens to their data and be able to trust that we adhere to those agreements.”

Schools also regularly receive questions from parents and staff about privacy. DUO-Onderwijs tries to unburden them in this regard. “With every survey, we send an accompanying email with information on how we deal with privacy,” he says. Participants also receive a video in advance explaining how the research and consultancy firm handles data and the purpose of the survey. “Participants can contact us directly and schools may refer questions. This way, we address concerns without costing schools extra time,” Nadorp said.

DUO-Onderwijs follows the rules of conduct of D&IN, the industry association for data intelligence. These boil down to a few clear principles: collect only what is really needed, anonymise data as soon as possible, and never report on individual participants unless they explicitly consent. Extra caution applies to children's data. “We store those as little as possible,” says Nadorp. “And if it is really necessary, then only in the Netherlands.”

With ISO certification, DUO-Onderwijs goes a step further. This certification is not mandatory, but it does show that privacy and security are structurally well regulated. An independent party regularly checks compliance with agreements. “For schools and parents, this is an extra reassurance: with us, personal data is not only legally protected, but also demonstrably well secured.”

By deliberately putting privacy at the centre, DUO-Onderwijs enables research that gives schools insight and contributes to better education. “We do this not because the rules dictate it, but because trust is the basis of good research,” Nadorp concludes. “Only when people know their data is safe will they dare to participate and answer honestly.”

Marjolein Nadorp is deputy director at DUO-Onderwijs.