Page 1: Privacy Notice

Understanding users’ attitudes towards image sharing on social media

School of Computer Science Ethics Reference:  CS-2019-R50 

Funded by: Horizon CDT PhD research project

Researchers contact details: Miss Ioanna Ntinou,

Purpose of the Research. Social media have a dominant role in people’s lives. Users’ share an astonishing amount of data on social media platforms, thus leaving a digital footprint capable of revealing sensitive information about them. Social media platforms have been shown to exploit this footprint by using technologies that track users’ behaviours and preferences. Inevitably, some users have expressed concerns about this use of their personal data and the maintenance of their privacy. Motivated by this, this study focuses on sharing of information through photographs. We are conducting a survey with members of the public that attempts to identify social media users’ behaviours and opinions with regards to uploading photos of themselves, friends and family.

Nature of participation. You are invited to take part in our survey. Your views and opinions will provide us with insights into common practices and routines when using images to interact on social media. You will be asked to answer an online questionnaire which should take no more than 20 to 30 minutes. The questionnaire will ask a series of questions about your privacy views, opinions and practices about social media.Taking part is entirely voluntary and you will have the opportunity to enter a prize draw of £100 shopping vouchers. The survey does not involve any particular risk but you must be aged over 18 to take part. There are no right or wrong answers but you should have experience of using at least one social media platform.

Use of your data. The data you provide will be only used for the team’s research purposes, and any project results will not identify you. Specifically, your survey answers will be anonymised and ID numbers will be allocated to those documents. This will ensure a system of tracing your research data, should you wish to withdraw from the study. The information we ask for will not contain any identifying information, however should you write something that makes you identifiable, this will be anonymised.

Participant consent forms and participant ID number records will be stored separately to the rest of the research documents.  All documents will be stored securely for seven years. The information gathered from your participation in this survey may also contribute towards future research, for example planning further studies. No contact details will be shared with any other parties. No personal data will be used in publications. If quoting from open-ended answers, pseudonyms will be used.

Procedure for withdrawal from the research. You may withdraw from the study at any time and do not have to give reasons for why you no longer want to take part. If you wish to withdraw please contact the researcher who gathered the data (Miss Ioanna Ntinou), quoting the response ID that was provided to you at the end of the survey. If you receive no response from the researcher please contact the School of Computer Science’s Ethics Committee. 

Contact details of the ethics committee. If you wish to file a complaint or exercise your rights you can contact the Ethics Committee at the following address:

Privacy notice

The University of Nottingham is committed to protecting your personal data and informing you of your rights in relation to that data. The University will process your personal data in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 and this privacy notice is issued in accordance with GDPR Articles 13 and 14.

The University of Nottingham, University Park, Nottingham, NG7 2RD is registered as a Data Controller under the Data Protection Act 1998 (registration No. Z5654762,

The University has appointed a Data Protection Officer (DPO). The DPO’s postal address is: Data Protection Officer, Legal Services, A5, Trent Building, University of Nottingham, University Park, Nottingham, NG7 2RD

The DPO can be emailed at

Why we collect your personal data. We collect personal data under the terms of the University’s Royal Charter in our capacity as a teaching and research body to advance education and learning. Specific purposes for data collection on this occasion are to investigate the behavior and attitudes of social media users towards uploading and sharing images of themselves and others.

The legal basis for processing your personal data under GDPR. Under the General Data Protection Regulation, the University must establish a legal basis for processing your personal data and communicate this to you. The legal basis for processing your personal data on this occasion is Article 6(1e) processing is necessary for the performance of a task carried out in the public interest.

How long we keep your data. The University may store your data for up to 25 years and for a period of no less than 7 years after the research project finishes. The researchers who gathered or processed the data may also store the data indefinitely and reuse it in future research.

Who we share your data with.Your data may be shared with researchers from other collaborating institutions and organisations who are involved in the research. Extracts of your data may be disclosed in published works that are posted online for use by the scientific community. Your data may also be stored indefinitely by members of the researcher team and/or be stored on external data  repositories (e.g., the UK Data Archive) and be further processed for archiving purposes in the public interest, or for historical, scientific or statistical purposes.

How we keep your data safe. We keep your data securely and put measures in place to safeguard it. These safeguards include anonymization of data and encryption of devices on which your data is stored. 

Your rights as a data subject. GDPR provides you, as a data subject, with a number of rights in relation to your personal data. Subject to some exemptions, you have the right to:

  • withdraw your consent at any time where that is the legal basis of our processing, and in such circumstances you are not obliged to provide personal data for our research.
  • object to automated decision-making, to contest the decision, and to obtain human intervention from the controller.
  • access (i.e., receive a copy of) your personal data that we are processing together with information about the purposes of processing, the categories of personal data concerned, recipients/categories of recipient, retention periods, safeguards for any overseas transfers, and information about your rights.
  • have inaccuracies in the personal data that we hold about you rectified and, depending on the purposes for which your data is processed, to have personal incomplete data completed
  • be forgotten, i.e., to have your personal data erased where it is no longer needed, you withdraw consent and there is no other legal basis for processing your personal data, or you object to the processing and there is no overriding legitimate ground for that processing. 
  • in certain circumstances, request that the processing of your personal data be restricted, e.g., pending verification where you are contesting its accuracy or you have objected to the processing.
  • obtain a copy of your personal data which you have provided to the University in a structured, commonly used electronic form (portability), and to object to certain processing activities such as processing based on the University’s or someone else’s legitimate interests, processing in the public interest or for direct marketing purposes. In the case of objections based on the latter, the University is obliged to cease processing.
  • complain to the Information Commissioner’s Office about the way we process your personal data.

If you require advice on exercising any of the above rights, please contact the University’s data protection team:


1. Taking part in the study                                                                        

a) I have read and understood the project information sheet or it has been read to me.

b) I consent voluntarily to be a participant in this study and understand that I can refuse to answer questions and I can withdraw from the study at any time, without having to give a reason.

c) I understand that taking part in the study requires me to provide data and that this will involve completing an online questionnaire.

2. Use of my data in the study                           

a) I understand that data which can identify me will not be shared beyond the project team.

b) I agree that the data provided by me may be used for the following purposes:

  • Presentation and discussion of the project and its results in research activities (e.g., in supervision sessions, project meetings, conferences).
  • Publications and reports describing the project and its results.
  • Dissemination of the project and its results, including publication of data  on web pages and databases.

3. Reuse of my data

a) I give permission for the data that I provide to be reused for the sole purposes of  future research and learning. 

b) I understand and agree that this may involve depositing my data in a data repository, which may be accessed by other researchers.

4. Security of my data

a) I understand that safeguards will be put in place to protect my identity and my data during the research, and if my data is kept for future use.

b) I confirm that a written copy of these safeguards has been given to me in the  University’s privacy notice, and that they have been described to me and are acceptable to me.

c) I understand that no computer system is completely secure and that there is a risk that a third party could obtain a copy of my data.

5. Copyright 

I give permission for data gathered during this project to be used, copied, excerpted,annotated, displayed and distributed for the purposes to which I have consented.

I have read and agree to the terms of  this survey: Required