The Duke Libraries biennial user satisfaction survey is confidential but not anonymous. Library staff send an invitation to take the survey to a representative subset of all students (a sample) through direct emails. Library staff acquire the sample from Duke’s Institutional Research Office (IR). IR provides library staff with email addresses and names for students in the sample so we can send personalized emails inviting them to participate. IR also provides demographics fields such as school, academic class, and race so library staff can analyze aggregate survey data by demographic groups. The file provided by IR is stored on Duke’s secure drives and uploaded to Qualtrics Survey Software, which is licensed by Duke University. Survey responses within Qualtrics are associated with personal information while the survey is running for two reasons: (1) so that library staff can send reminder emails to students who have not yet completed the survey and (2) because library staff need the identifying information of those who have completed the survey in order to select a raffle winner. Only one library staff member is authorized to handle the personal data file provided to the Libraries by IR and to access this information in Qualtrics.
The Libraries also invite students who are not part of the sample to complete the survey. Students completing the survey in this way must authenticate their identity as a Duke-affiliate using Shibboleth, Duke’s SSO-authentication service. When they do so, their netID is recorded along with their responses. Only one library staff member is authorized to access this data in Qualtrics. When the survey closes, library staff use the netID to remove duplicate responses from students who took the survey more than once and send a list of netIDs to IR. IR provides the same demographics data for these respondents as it does for the students in the sample. Using demographics data, library staff then remove responses from staff and faculty who accidentally took the survey, creates a full list of students who completed the survey, and runs an algorithm to select a random winner for the raffle.
Once the raffle is complete, all unique identifiers other than the randomly-generated survey response ID are deleted both in Qualtrics and in any files on networked drives. Survey responses remain associated with demographics information like school and race, but not with identifiers such as name, netID, and email address.