1.   Scope of this Privacy Notice 

This Privacy Notice is intended to ensure that individuals whose data is processed as part of the MASC (Methods for Anonymisation in Sociotechnical Contexts) research project are provided with transparent information regarding the processing of their personal data. 

The purpose of the MASC research project is to create a tool to anonymise the data contained in survivors’ testimonies and other such text regarding complex societal problems (such as sexual violence and modern slavery), so that it will be impossible to identify any individuals.  

The data contained in such testimonies can be very useful in terms of better understanding, preventing, and responding to the issues they pertain to. However, where individuals are identifiable, given the highly sensitive nature of the data, ethical and legal risks arise, and therefore such data is often not shared between government and civil society organisations. To circumvent these risks the data must be anonymised before it can be shared, but at present, this brings several challenges. There is a restricted range of software options in the market for anonymising text. These solutions are not widely adopted due to various factors, such as limited user-friendliness, concerns regarding data protection and high licensing costs. As a result, the data is generally not shared, which subsequently prevents the development of data driven solutions to societal challenges. 

The MASC research project’s ultimate aim is to create a data anonymisation tool that could overcome these present challenges and enable effective data anonymisation. In doing so this would facilitate the increased sharing of anonymous data on sensitive topics to better inform decision making and resource allocation from actors involved in the sensibilisation, response to and/or prevention of important societal issues (e.g., decisions of charities and law enforcement etc.). 

2.   Who we are 

The following entities (also jointly referred to as “we” or “us”) are the joint data controllers of your personal data: 

• Trilateral Research Ltd is a UK limited liability Company. Trilateral Research is registered in England and Wales under company number 8698690 and have their registered office at One Knightsbridge Green, London, SW1X 7QA. Trilateral Research offers research services on thematic areas which represent societal challenges. 
• Everyone’s Invited is a UK registered charity which aims to tackle rape culture in UK education institutions located on Streathers Solicitors, Accurist House, 44 Baker Street, W1U 7AL.  

If you have any queries in relation to this Privacy Notice, please refer to the contact us section at the end of this notice. 

3.   What we do with your personal data 

We will process your data as part of the MASC research project only for the purpose of creating the data anonymisation tool and anonymising your data.  

In order to achieve this purpose Everyone’s invited will share with Trilateral Research a number of testimonies submitted on their website. These testimonies are intended to be submitted anonymously; however, they often contain residual personal data that can be used to indirectly identify individuals. Everyone’s Invited privacy policy for the original collection of testimonies is available here.  

Trilateral Research will develop a tool that uses natural language processing techniques to identify and remove any residual personal data contained in these testimonies, to ensure that such data cannot be used to reidentify individuals (and therefore that the data is truly anonymised).  

Once these testimonies have been anonymised by Trilateral Research, the anonymised testimonies will be shared back with Everyone’s invited so that these testimonies can be published on their website without the risk of individuals being re-identified. 

Everyone’s Invited will share with Trilateral Research the minimum number of testimonies that are necessary to develop the anonymisation tool. Upon finalisation of the tool, Trilateral Research will delete all data received.  

4.  The lawful bases for processing your personal data 

We process personal data on the following bases: 

Everyone’s Invited will share the testimonies with Trilateral Research on the basis of their legitimate interest in undertaking research with trusted parties (Art. 6(1)(f) UK GDPR).  

When the data provided contains special categories of personal data (e.g. data relating to health, ethnicity, sexual life, etc), this legitimate interest is further supported by the need to process the data for research purposes in the public interest (Art. 9(2)(j) UK GDPR). 

5.   Our responsibilities as joint data controllers 

The determination of our responsibilities as joint data controllers is set out and enforced in a dedicated agreement to ensure that compliance with the applicable data protection laws is enforced.  

Trilateral Research will be leading the technical development of the anonymisation tool and processing the personal data for this purpose, Trilateral Research is the organisation better placed to answer any requests you may have in regard to the processing activities explained in this Privacy Notice. 

Regardless of the above, you can exercise your data protection rights in respect of and against each of us (see section 9 for more information on these rights).  

6.   How we secure your personal data when we process it 

We implement and enforce technical and organisational security controls to protect personal data from unauthorised access, loss, misuse, alteration or destruction. This is achieved through a variety of measures, some of these are as follows:  

• Access to personal data is granted only on a need-to-know basis. 
• Access is to personal data is restricted by secure authentication methods. 
• Individuals with access to personal data are required to maintain the confidentiality of such information.  
• All user devices used to process data are configured to a secure baseline and have anti-malware software installed which is regularly updated. 
• Where data is shared, this will only be done with the data encrypted in transit using a currently secure encryption protocol.  
   

7.   Do we share personal data with third parties? 

For the processing of your data, we rely on the following third party suppliers:  

• Microsoft SharePoint – Software where data will be stored.  
• Amazon Web Services – infrastructure where data is hosted (namely S3 buckets).  

The location of the data centres used by these service providers are restricted to the UK and strong security controls are in place by both organisations. Both Microsoft and AWS hold ISO27001 certifications for the software and infrastructure utilised. 

8.   Do we transfer your personal data outside the European Economic Area? 

No, we will process your data only in EU and UK.  

9.   Your data protection rights  

Data protection legislation gives you certain rights over your personal data. Such rights are not absolute and whether you can exercise them will depend upon why we are processing your personal data. These rights are outlined below: 

• Right of access: You can ask us to verify whether we are processing personal data about you, and if so, to have access to a copy of such data. 
• Right to rectification: You can ask us to correct our records if you believe they contain incorrect or incomplete information about you. In certain circumstances we can refuse a request for rectification. 
• Right to erasure: You can ask us to erase your personal data when we no longer need it for the purpose it was originally collected. The right to erasure is not an absolute right and only applies in certain circumstances. 
• Right to restriction of processing: You can ask us to temporarily restrict our processing of your personal data in certain cases. 
• Right to data portability: In some circumstances, you can ask us to transmit your personal data (in a structured, commonly used, and machine-readable format) directly to another company. The right only applies to information you have provided to us, and under specific lawful bases. 
• Right to object: You can object to our processing of your personal data justified by our or a third party’s legitimate interests, on grounds relating to your particular situation. This right is not absolute, and we may keep processing your data if we can prove compelling legitimate grounds for doing so. 

If you wish to exercise your rights, please refer to the contact us section at the end of this document. 

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information, or to exercise any of your other rights. This helps us to ensure that personal data is not disclosed to any person who has no right to receive it. No fee is required to make an initial request unless your request is clearly unfounded or excessive. 

If you are not satisfied with the way that we have handled your request or if you wish to make a complaint about how we have processed your personal data, you can contact the UK Information Commissioner’s Office regarding any concerns you may have:  

10.  How long do we retain personal data? 

Trilateral Research will retain the testimonies for only as long as it is deemed necessary to develop and finalise the anonymisation tool. The anonymisation tool is planned to be finalised before February 2025. Following the expiry of the retention period, Trilateral Research will dispose of personal data in a secure manner. 
 

11.   Contact us 

Should you have any queries or concerns regarding your personal data, or wish to exercise any of your rights, then please contact us: 
 

We will respond to your queries within 30 days from when we receive them subject to receipt of any requested confirmation of your identity.