5 Getting ready for the launch
Before launching a survey, survey administrators need to revise the privacy settings. The following section goes into some details regarding the response tracking and anonymization features of LimeSurvey.
The survey administrator that is responsible for choosing the adequate privacy settings and protecting the gathered data.
5.1 Controlling data privacy and response tracking
Responses are “anonymous” if one cannot deduce the identity of the person who has contributed a submission to the questionnaire.
LimeSurvey offers different options to store and track information about survey respondents. Adjusting the level of “anonymization” has implications not only for the protection of personal data in the unlikely event of a data breach but also for managing invitations, sending reminders, the possibility to stop and resume a submission or for cancelling a submission and deleting the associated data.
Before delving into the details, it is important to note that these confidentiality settings concern primarily the management of participant data by the survey administrator. LimeSurvey by default does not store any personal identifiers in the result table of the survey. Unless you explicitly ask for an email address, name or ID number of a respondent, the result data set does not contain direct, personal identifiers. The GEAM questionnaire does not ask for any such personal identifiers.
At the same time, LimeSurvey offers the possibility to store certain meta-information with each submission such as the Internet address of the computer used, the data and time of the submission or the URL referrer used to access the survey. In some cases, this meta-information can be used by the survey administrator to identify respondents. The identification might be justified in case a respondent requests the deletion of their data from the result table.
The confidentiality settings are controlled via three specific sections: the “Settings > Participant Settings”, the “Settings > Notification & data” and “Settings > Publication & access”.
Since the combinations of the attributes in each section can be quite complex, we introduce three possible scenarios which simplify the confidentiality settings for a given survey in “strict”, “moderate” and “comfort”. Other configurations are possible.
5.1.1 Strict privacy protection
Under this setting, the “anonymization” feature of LimeSurvey is activated. LimeSurvey will not store any meta-information with survey responses, including the IP address of the computer used, the date and time of the submission or the URL referrer.
Nevertheless, respondents can interrupt the survey any moment by clicking “Resume later” at the top of each survey page and come back at a later point in time for final submission. Respondents can also “Exit and clear” a submission any time before the final submission. However, in contrast to the “Moderate privacy protection” mode (see below), submission progress is not tracked automatically: in case the browser crashes or a user leaves the survey page by accident, all data is lost. In this case, users will not be able to resume their earlier submission. Accessing the survey after a browser has crashed, will create a new response entry in the result table (while leaving the previous entry incomplete).
Once a submission has been completed by pressing the “Submit” button on the last page of the survey, the submission process is considered complete and any linkage to the person responding is lost. There is no way that the identity of a respondent can be linked to an entry in the result table, neither by the respondent themselves nor by the survey administrator.
A cookie is set by LimeSurvey in order to prevent a second submission from the same browser.
Use this settings for short questionnaires where privacy protection is paramount.
In order to use the “strict privacy” settings, adjust the specified options within the corresponding sections as show below:
Click “Settings > Participant settings”:
Click “Settings > Notification & data”:
Click “Settings > Publication & access”:
5.1.2 Moderate privacy setting (default GEAM)
This configuration uses a token-based response tracking. It is used as the default setting for the GEAM questionnaire. LimeSurvey stores certain meta-information with each submission which makes the submission process more reliable and easy for respondents while offering additional insights to the survey administrator regarding the response tracking.
Under this configuration, “anonymized” responses are turned off and the “IP address”, “Date stamp” and “URL referrer” are stored with each submission.
A unique identifier (token) is used to track the progress of a respondent’s submission. In case the browser crashes or the browser window is accidentally closed, respondents can come back to the survey and resume where they left off – even without explicitly saving their data manually with the “Resume later” button. The data entered into the questions is stored as the user advances from one section to the next. Closing the browser window and re-entering the survey via the survey link will open the questionnaire on the last page (or section) visited.
Once a submission has been finalized, respondents can restart the survey. This might be useful in case different respondents use the same browser (renewed submissions can be prevent by activating the “set cookie” option). As long as respondents have not finalized their submission they can “Exit and clear” their survey data anytime. Once a submission has been finalized (submitted), their data can be deleted from the result matrix in exceptional circumstances, that is, if a respondent is able to provide the IP address and time stamp of their submission. In case this information yields a unique entry in the result matrix, the survey administrator can delete it.
Use this configuration for longer surveys and data that does not require very strict anonymisation.
In order to use the “moderate privacy” settings, adjust the specified options within the corresponding sections as show below:
Click “Settings > Participant settings”:
Click “Settings > Notification & data”:
Click “Settings > Pubication & access”:
5.1.3 Comfort privacy setting
For this privacy setting, LimeSurvey will create a “participant table” which offers a precise control over participants. It requires that the survey administrator has access to a database of names and emails of potential respondents. Once the “participant table” has been uploaded to LimeSurvey, it exists as a separate table in addition to the response table of the survey. When downloading survey results, none of the information stored in the participant table will be available in the result table. However, survey administrators can associate participant information and responses at the level of the web interface of LimeSurvey in case the “Settings > Participants settings > Anonymized responses” has been deactivated. In case “Anonymized responses” is “Off”, survey administrators can jump from the survey participant tracking to the actual response. In case “Anonymized responses” is “On” such linkage is deactivated.
Survey respondents can be either uploaded with a CSV file or created “on the fly” by allowing respondents to register their contact details before entering the first page of the questionnaire. Upon registering, the system will send out an invitation email containing the unique URL for their submission.
The advantage of creating a participant table is that personalized invitations and reminders can be send out which usually increments the overall response rate to the survey substantially. Instructions on how to create a “participant table” can be found in the online manual:
A unique identifier (token) is used to track the progress of a respondent’s submission. In case the browser crashes or the browser window is closed, respondents can come back to the survey and resume where they left off – even without explicitly saving their data manually with the “Resume later” button. The data entered into the questions is stored as the user advances from one section to the next. Closing the browser window and re-entering the survey via the survey link will open the questionnaire on the last page (or section) visited.
Respondents can return and edit or delete their submission any time, even after their final submission. After a survey has been closed, respondents can request the deletion of their data by writing to the survey administrator. The email address from which the request is send has to match the entry in the participant database.
Use participant tables when contact details are available, response tracking is important and the questionnaire is rather long but does not contain privacy sensitive information.
In order to use the “comfort privacy” settings, first a “participant table” needs to be created by switching to a “closed-access mode”.
Furthermore, you need to adjust the specified options within the corresponding sections as show below. Selected options resemble the moderate privacy settings (default) as described in the previous section. However, token-related options are not active and used.
Click “Settings > Participant settings”:
Click “Settings > Notification & data”:
Click “Settings > Publication & access”:
5.2 Explanation of individual settings
As a complement to the explanations already given in the LimeSurvey manual.
Participant settings:
Anonymized. Concerns storage of meta-information with each survey entry. If turn “on”, this overwrites the submission start and completion dates with a generic time 1980-01-91 in order to avoid potential matching of server log entries with survey submission. In case a participant table has been created and “Anonymized” is off, survey administrators can jump from response tracking to the submitted data for each participant in the online LimeSurvey interface. If “Anonymized” is activated, this is not longer possible.
Enable token-based response persistence. If enabled, concerns mainly an automatic “interrupt and resume later” functionality. Tokens are used to store persistent data for an ongoing submission. In case a browser crashes or a browser window is accidentally closed, respondents can resume their submission where they left off. This persistence functionality works independent from the “anonymization” feature turned “on” or “off”.
Allow multiple responses or update responses with one token. In case tokens are stored permanently in a participant database, respondents can access their submission data after it has been submitted. A personalized (token-based) URL has to exist in order for respondents to be able to access (and delete) their data after finalizing a submission. In order for this attribute to have any effect, a particpant table needs to be created.
Publication & access
- Set cookie to prevent repeated participation. This feature works independently from the token-based persistence tracking. It is a good choice when “Anonymization” is activated and token-based persistence turned off. Respondents are then prevented from submitting their data twice. This might be a problem in case an interviewer needs to fills out several questionnaire for respondents from the same device.