Hi,
I am researcher and launching in october a study of social network analysis.
My GDPR service would like we encrypt the data we collect.
However, my institution host the LimeSurvey V.3.28, and they are unable to tell me when it is planned to update LS.

It looks like it is impossible to encrypt data before LS v.4.

I am wondering whether I am right ? If yes, is there any alternative to encrypt the data in LS v.3 ?

Or at least, I'd like to collect participants name, and once collected, directly transform the participants name into a predefined anonymized ID from a correspondance table ?

Thank you very much for your insight,
Best,
Maxime 
 

You ask for something that exist in 5.X : update is the solution.

Else : why do you want to collect participant name ?

Thanks. Then my way is to convince the IT team or find an alternative.

We need to collect name to create a social network based on friendship (participants are asked to provide their friends name, and vice-versa).

Names are transformed into numerical codes that we use for analysis.

maxlui wrote:

We need to collect name to create a social network based on friendship (participants are asked to provide their friends name, and vice-versa).
 

Then  you have more issue than this one for GDPR …

And clearly : for GDPR : you MUST update to the LAST managed version : it's a security hole else. A security hole is for GDPR too.
When I say last version : I mean last, and update each time there is a security issue.

Each time you have a commit with [security] at github.com/LimeSurvey/LimeSurvey/commits/master/
You must update to the next version.

Yes, a lot of issue and we are doing our best to manage them!
Yes I push IT service to move forward...
I have options with private company GDPR compliant otherwise, which would be a pity to use private service while we would "just" require an update.
Best,

maxlui wrote:

I have options with private company GDPR compliant otherwise, which would be a pity to use private service while we would "just" require an update.
 

About private service and GDPR : it's not a warranty.
AEPD (Spain) does a lot of trial : www.aepd.es/en/press-and-communication/press-releases

In France : you can do what you want … CNIL will at best send you a letter telling you it's no good.

No surprise indeed.
These norms are hard to follow and I wonder how is it possible to clearly control company compliance, especially the one like Gogle, etc...
In the end, us, small researchers, get more and more overwhelmed, in part due to this new GDPR, while I wonder how much is it really useful for people... Just slowing even more down research.
Well, we are doing our best

ps: thanks for the clue regarding french CNIL

It's not so complex to respect GDPR.

“create a social network based on friendship” is clearly a risky business about personal data.

«Dis-moi qui tu fréquentes, je te dirais qui tu es.»

If you want to make money from personal data, it's only natural that this should be controlled.