Data protection and privacy: considerations for research

Personal data is any information relating to living persons who can be identified directly from the information in question; or may be identified from that information in combination with other information.

As well as the typical ‘identifiers’ such as name, email address etc. personal information also includes things like location data and online identifiers, e.g. IP addresses and cookie data.

Certain types of personal data, so called ‘special category’ information, are afforded extra protection by data protection legislation and require different ‘lawful bases for processing’ (see below) to other personal data. Special category is information that relates to the following:

• Race
• Ethnic origin
• Political views
• Religious or philosophical beliefs
• Trade union membership
• Genetic data
• Biometric data (for ID purposes)
• Health
• Sexual life, including sexual orientation

The processing (collection, storage, sharing, deletion, etc. of data) of personal data must consider the following:

• Lawfulness, fairness and transparency - Personal data must be processed according to one or more lawful bases. The use of the data should be in the reasonable expectations of the data subject and appropriate privacy information should be provided.
• Limitation of purpose - Data should only be processed for a lawful, specified purpose.
• Data minimisation - Personal data should be relevant and not excessive for the specified purpose.
• Data quality - Personal data shall be accurate and kept up to date.
• Storage limitation - Personal data shall only be retained for as long as necessary to fulfil the stated purpose or else in accordance with statutory provisions.
• Integrity and confidentiality (information security) - Appropriate technological and organisational controls shall be used to protect personal data.

The GDPR and the 2018 Data Protection Act require an appropriate lawful bases to process personal data. For the majority of research conducted at Brookes we expect the most appropriate lawful basis for processing to be the following

[GDPR Article 6 (1) e)] processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.

Data protection legislation requires data subjects (research participants) to be adequately informed about why they are providing personal information, how it will be used and who will the information be shared with. In most cases it will be most appropriate to ensure that participant information sheets contain the relevant information for data protection compliance, i.e:

• The name and contact details of the data controller (typically Oxford Brookes University)
• The purpose of the data collection
• What personal data is being collected
• Who (outside of Oxford Brookes) will personal data be shared with
• How long the data will be retained for
• What the research participants rights under GDPR / DPA 2018 are
• Whether or not processing involves automatic decision making or is used for profiling purposes
• The possible implications of not providing the data.

Informed consent guidance and the privacy notice template are available on the research ethics website.

Where special category data is being collected as part of the research we are required to put appropriate safeguards in place to protect the rights and freedoms of data subjects (research participants). Appropriate safeguards include:

• Assurance the research will not cause substantial damage or distress to the data subject (i.e. substantial physical harm, financial loss or psychological pain)
• Where appropriate, the study has research ethics approval.
• Technical and organisational safeguards are in place that ensure respect for the principle of data minimisation and ensure that exemptions to research participants’ rights are not exercised unless the rights are likely to render impossible or seriously impair the achievement of the purposes of the processing
• If processing special category personal data, this must be in the public interest (demonstrated over and above using ‘task in the public interest’ as the legal basis)

Personal data must only be processed for a lawful, specified (typically via a privacy notice or participant information sheet) and not further processed for incompatible purposes. Please note that as such, secondary processing (i.e. using personally-identifiable research data obtained in one study for another) is permitted but the research must be compatible with the purpose of the study under which personal data was obtained.

Further guidance on the use of personal data from previous studies should be sought from UREC or the appropriate Research Ethics Officer.

The revised data protection legislation requires data controllers such as Brookes to adopt a privacy by design approach and ensure that all projects involving the use of personal data consider the privacy of data subjects from the outset and not just as a ‘tick-box’ exercise for sign-off. Two main implications of this approach relevant to research are the use of pseudonymisation and privacy impact assessment.

Pseudonymisation is a procedure to replace personally identifiable fields in a dataset with one or more artificial identifiers. Analysis and research work is then carried out using the pseudonymised dataset with access to the original, personally identifiable dataset, highly restricted. Pseudonymisation should be used wherever possible unless it is necessary that researchers work with attributable data (e.g. for linking to other datasets).

Where research studies involve collection of large personally identifiable datasets or use privacy-intrusive technology (e.g. biometrics, bodyworn cameras,monitoring devices, etc) it may be necessary to complete a privacy impact assessment. There is a Brookes privacy impact assessment template (see here) which includes a list of screening questions at the beginning, the IT Services information management team will review these if needed to determine whether or not a comprehensive privacy impact assessment is required.

For further guidance on the use of personal data in research please contact UREC, your Department/Faculty Research Ethics Officer or the IT Services information management team (ext: 4354, info.sec@brookes.ac.uk).