Personally Identifiable Information Guidelines for Positly

For some kinds of research, you may find that you need to collect Personally Identifiable Information (PII) from participants. Positly requires that you adhere to the following strict guidelines for all studies conducted through Positly that collect PII:

1. You must select the checkbox marked “This study collects personally identifiable information” when setting up each run that collects PII.
2. You must only request PII that is strictly necessary for your research, explain its purpose to participants, and only use it for the purposes stated.
3. You must not require that participants enter  PII in order to complete the study or get paid. There must be a way they can proceed without entering the PII and get paid. See the section below called “You must not make PII a requirement for survey completion or participant compensation.” for a detailed explanation of the two allowed ways that this can be done.
4. If you are using Positly’s custom attributes feature, you must not pass PII in URLs as URL parameters.
5. You must follow all relevant laws for PII collection, use, and storage.

We’ll explain each of these points in detail below.

Firstly, what is PII?

Personally identifiable information is any data that can be used to identify an individual. This definition is quite broad, so at Positly, we differentiate between several types.

Positly considers the following to be PII:

• Full name
• Full date of birth
• Full home, school, or work address
• Email address
• Phone number
• Personal social media handles
• Photos, audio, video, or likenesses of real people
• Unique financial information, such as bank account number
• Unique government identifiers, such as license or passport number

What is not considered PII for Positly?

• Basic demographic descriptors like age, gender, sex, ethnicity, nationality, employment status, income level, education level, marital status, or family size
• First name only
• Year of birth only
• Home, work, or school location described with city, state/province, or country only
• Medical diagnoses or lists of symptoms
• Field of employment or education
• IP address
• A Positly ID or user ID from our Microtaskers or Panel Platforms (these are anonymous)

Please note that Positly’s definition of PII is narrower than that of some countries’ and states’ specific policies. For example, GDPR includes IP addresses as PII.

Remember, this is not an exhaustive list. If you are unsure whether Positly considers something to be PII, we are here to help. Please write us at hi@positly.com.

Positly’s PII Guidelines in Detail

1. If you are collecting PII, you must select the checkbox marked “This study will collect personally identifiable information” when setting up each run.

Selecting this checkbox affirms that your study and research practices adhere to these guidelines. This box does not affect the cost of a study or the compensation to participants.

2. You must only request PII when it is strictly necessary and explain its purpose to participants.

Participant PII should be carefully protected, and it should only be collected when truly necessary.

When you request PII from participants, you should clearly explain the purpose of their request and state that providing PII is optional while explaining why participants might want to give their PII.

For follow-up studies and longitudinal studies, email is likely the only necessary PII. In cases where participants may need to re-identify themselves over multiple sessions, we recommend you assign unique numbers to participants in lieu of submitting PII each time.

If you are using our Microtaskers platform, you can send messages, follow-up studies, and bonuses to participants directly through Positly without needing any participant contact information. However, this is not available on our Panel Participants platform.

3. You must not make PII a requirement for survey completion or participant compensation.

If a participant opens and completes a study, they should receive their base compensation (the compensation listed for the study) regardless of whether they submit PII. You may not screen out or otherwise prevent participants who do not provide PII from reaching their Positly completion link. Requests for PII must be optional and skippable in surveys. Furthermore, it should be clear to participants that providing PII is not a requirement for base compensation.

You are allowed to offer follow-up studies or extra compensation only to participants who provide PII. This is one of our recommended approaches to running longitudinal studies, and it is the only method that works with our Panel Participants platform, where recontacting is not possible through Positly.

For more information about running longitudinal studies that collect PII, please see our Guide to Running Longitudinal Studies.

So, how can I collect PII for my study in Positly?

1. Make sure you have checked the box labeled ‘This study will collect personally identifiable information’ when setting up your Run in Positly.
2. You then need to do one of the following:
   1. If the PII collection is required in your main activity, set up a screener study. Explain to the participants what PII you want to collect and the reason why. Ask for their consent to collect this information, explaining that providing the PII will be necessary to qualify for a study, and explain the details (e.g., amount of pay, expected duration) of that study. If they agree to provide PII, send them to the screen-in link. Otherwise, send them to the screen-out link. This ensures participants understand and agree to the PII collection.
   2. Or, alternatively, if you are able to make PII collection optional, go directly to your survey. Whenever a PII question is asked, very clearly state that participants do not have to fill it out. Make all such questions skippable. But it is not enough to simply make the question skippable. You must also explicitly state that this PII question is optional (do this every time you ask for PII).

4. You must not use PII in links or custom attributes for Positly.

Positly allows you to send and receive custom attributes through URL parameters. Information in URLs is not secure and should never include PII. This means that you must not use PII to create custom attributes in Positly.

5. You must follow all relevant laws for PII collection, use, and storage.

It is your responsibility to know and follow relevant laws. Many country or state policies apply to their citizens regardless of where you are based or where data is stored. Most academic and research institutions have additional internal policies. Please note that Positly cannot access and, therefore, does not store the PII of participants, even when you collect it.

For more information about worldwide data protection laws, please see:
UNCTAD Global Cyberlaw Tracker
GDPR Regulations (EU)

Please feel free to write us at hi@positly.com with any questions or concerns.

Helpful?

+1