Audio file processing in research

The Dictaphone App

OsloMet recommends using the Nettskjema-dictaphone app, made by UiO.

• Information and guides to using the app (student.oslomet.no). This guide applies to both students and researchers at OsloMet.

• The app is approved for bachelor and master thesis use and can deliver small amounts of red data to Nettskjema only.

• For bigger projects that collects sensitive (red) data, data must be delivered to TSD.

• Downloading personal information is not allowed on a private computer.

You must be aware of how you manage recording equipment. Do not leave it out of your control, lock the office where it is stored, do not lend it to unauthorised persons etc.

Units that are connected to the internet, e.g. mobile phones and tablets, must never be used to record audio. We recommend using a dictaphone, (for example, the Olympus DM-720 and Sony PX4700, 4GB additional memory card is sufficient). Now it is also possible to download a mobile app "Diktafon" that you can use as a voice recorder for interview / audio data. 

Data is encrypted on mobile phone and sent directly to "Nettskjema (nettskjema.no)"(NB! "Diktafon" must not be used when transferring sensitive personal data only to "Nettskjema"). After transmission, there are no remaining data on the phone. The mobile app "Diktafon" can also be used for the recording of sensitive personal data, but it is assumed that data is delivered to TSD.

Alternatively, an android telephone can be used as a dictaphone on the condition that all forms of communication other than USB are disabled.

In many projects, NSD recommends instructing interviewees not to provide information that could increase the possibilities of recognition such as place names and institutions the interviewee is affiliated to. This should only be provided if it is necessary for the data material.

A recorder can be used for several projects at the same time if it is used by one person only. However, it is recommended that recordings are transferred to an encrypted unit (memory stick, external hard disk) or that the interview is transcribed as quickly as possible, so that the recording can be deleted from the dictaphone.

See downloading encryption software.

Memory cards or the disk in the sound recording equipment can usually not be encrypted.

If a recorder is used by several persons at the same time, it should only be used for one project. The recordings must be transferred to an encrypted unit and deleted from the dictaphone as soon as possible after recording. If the dictaphone is to be used in new projects, new memory sticks must be used. Old memory sticks are destroyed.

The recorder must be stored in a lockable cabinet when not in use, see Storage of audio files below. Other encrypted storage units must also be stored in lockable cabinets.

Audio files with a medium/high degree of sensitivity must not be edited or stored on computers connected to the internet unless they have been anonymised according to the instructions above.

Audio files can be edited on stationary computers and laptops that are either permanently or temporarily disconnected from the internet. "Temporarily disconnected" means that the wireless network connection is turned off or the internet cable has been pulled out. If a audio file is temporarily stored on a computer, you must ensure that it is completely deleted before you connect to the internet.

"Permanently disconnected" means that it is not possible to connect the computer to the internet. Whether you should use a computer that is permanently or temporarily disconnected depends on how sensitive the material is. 

You must ensure that no unauthorised persons are present in the room in which the editing takes place.

Deletion of audio files at the end of a project. Audio recordings are taken to IT Support (BIT) to ensure that they are completely deleted.

Data transferred to a memory card/memory stick cannot be definitely deleted. At the end of a project, these devices must therefore be destroyed, unless they are to be used by the exact same person(s).

Memory cards/memory sticks are handed in to itservicedesk@oslomet.no for destruction.

• See the data security guidelines on deletion and destruction
• If long-term storage of audio recordings is desirable for the purpose of conducting follow-up studies (research purposes), you must apply for approval from NSD and REK.
• If audio recordings are to be used for other purposes after the end of the project, e.g. in teaching, you must apply to the Data Protection Authority

Audio files should be stored on an encrypted memory stick or an encrypted external hard disk. The devices should be stored in a locked archive or a cabinet with controlled access. If the cabinet is in a room that is in general use, it is recommended that a safe or a cabinet with two doors is used to make it difficult to break into it. If the cabinet is stored in a room that is not in general use, an ordinary lockable cabinet may be sufficient.

• See the data security guidelines on storing, sending, sharing and deleting .
• If the raw material is important, the cabinet must be fireproof and have smoke detectors and fire extinguishing equipment/a sprinkler system in the same room in order to ensure verifiability.
• If audio recordings are stored in the office during working hours, you must lock the door when you leave it, see the data security guidelines on physical securing of OsloMets premises.
• There should be a procedure for storing keys/key cards for doors and cabinets.
• You should record when, who and for which purpose each time you handle the audio recordings.
• Alternatively, audio files can be stored on Service for sensitive data (TSD 2.0) (uio.no). Contact fou-teknisk@oslomet.no for more information.

If it is desirable to store the data for the future, audio files may be stored by NSD. They provide a description of how the data should be prepared for archiving with, among other things, a list of preferred file formats and the relevant documentation to be enclosed, what is to be filled in and signed, and how the data should be transferred. 

Instruction video, audio and video recordings in the healthcare sector (ehelse.no, in Norwegian).

The anonymisation of audio means that all the vocal characteristics on the recordings are removed. This can be done in the following manner:

After recording, the original audio is transferred from a voice recorder to a voice processing computer that is not connected to the internet. The audio recordings are run through a voice changer that de-identifies the voices. The audio may then be transferred to a mobile disk etc. for further processing on a computer, regardless of whether it is connected to the internet or not. Although the voice has been changed, the content of what is said can still make the person identifiable. You must therefore consider what is being said aw well.

 You should not use this method if the material is to be transcribed, and pauses, accents etc. is determinant for the interpretation of the material.

1. Inquiry from the Faculty of Health Sciences regarding the storage of data from dictaphone

Contact head engineer, Stig Muren at fou-teknisk@oslomet.no.

Clarifications

• No sensitive information

• Interview mapping the need for increased competence

• All respondents have signed the statement of consent

• Project initiated by external partner and respondents

• Project participants: name of the three participating institutions

• These will not be interacting on the data (data may be stored separately).

• Duration; 1 h 25 min.

Managing the data

• Save files in the encrypted folder (VeraCrypt) saved on the H: \ - directory.

• Files can be transferred by copying the encrypted file over to a memory stick

• No one will be able to read the files without knowing the password

Follow-up

Agreed meeting for transmission and encryption with R&D IT. The meeting also includes installation of software, training of users, creating encrypted folders, transferring files and deletion from the dictaphone.

2. Questions about the storage of audio files

The researcher has sent a message to NSD: audio recordings are registered on another device. Data is transferred to the company's storage directory and transcribed.

NSD writes in a recommendation that the data is assumed to be managed in accordance with the organisation’s policy.

Clarifications

• No data is sensitive according to the Personal Data Act.

• Interview of people talking about activities and tasks

• Interviews are personally identifiable on the basis of voice, but the content is not perceived as sensitive neither according to the Personal Data Act nor on the basis of "general understanding".

• The user has used a private recorder: Olympus WS853 (Digital Voice Recorder), with an external memory card.

• The data is stored in an encrypted memory stick. (The program BitLocker was used to encrypt the entire USB stick)

Researcher asks for advice

• How should the data be treated

• Whether access from home is possible

• Whether it is a problem that the router at home is not password protected. (There is a small security risk when using a home router compared to using a "foreign" router).

Assessment/recommendation

• No sensitive data or other personal information that involves special requirements for security

• The user secures data better than required (he/she has read on websites and familiarised themselves with the encryption software, BitLocker and 7zip)

• Data can be stored on the usual home directory H: \, but since the user is familiar with the use of encrypted memory sticks, it is recommended that he/she continues using this.

• For backup, data can be stored on H: \ - and since the user also is familiar with 7zip, it is recommended that the stored data is encrypted.