SURF DPIA flags 14 high risks in Qualtrics DesignXM
SURF has identified 14 high risks and one low risk in its Data Protection Impact Assessment (DPIA) on Qualtrics DesignXM, a market research and experience design platform.
Qualtrics DesignXM is an Experience Management (XM) platform that education and research institutions use to gather and analyse surveys.
14 high risks identified
The DPIA identifies 14 high risks and one low risk. In SURF’s assessment, several high risks link to limitations in transparency and control over personal data processing. The risks relate to the following:
- A data-agnostic approach to data processing: specifically, about Qualtrics’ role of data processor rather than data controller.
- Lack of proof of effective anonymisation processes.
- An incomplete overview of sub-processors.
- Loss of control and transparency relating to consent collection.
- Incomplete information about cookies.
- Shortcomings in providing complete Data Subject Access Requests (DSARs).
Detailed information regarding all the identified risks can be found in our DPIA report.
Dissenting opinion Qualtrics
Qualtrics does not share SURF's assessment of these risks. The assessment therefore records a difference in opinion between SURF and the vendor. Qualtrics provided its position in a separate document, referred to as ‘Oplegger’, which is included in the DPIA. We advise our members to take notice of the position stated by Qualtrics as this will enable shaping a complete view on the outcome of the DPIA.
What this means for our members
Given the unresolved high risks and the lack of a mitigation plan from Qualtrics, SURF, at this point in time, gives a negative advice to its members regarding the use of Qualtrics DesignXM on the basis of the setup reviewed in this umbrella DPIA. SURF advises its member institutions to proceed with caution. If Qualtrics decides to take steps towards implementing mitigating measures, SURF will re-evaluate the outcome of this DPIA based on any relevant new input.
SURF, acting on behalf of its members, has carried out this Qualtrics DPIA as an umbrella assessment. As controllers, institutions assess for themselves whether their use of the platform meets the requirements of the GDPR. Dutch educational and research institutions need to translate this outcome to their own specific situation and must decide themselves on their future use of Qualtrics services.
Read the full report
Read the full findings of the study in the DPIA.
Questions?
Please contact us via vendorcompliance@surf.nl.
(Sub)processors in the United States
SURF is especially alert to processing by vendors and their associated sub-vendors that are located in the US. For more information, see the previously prepared general information document on the use of US-based vendors.