How do I deal with datasets that contain personal data?
Before the start of a research project, a researcher makes the decision to collect data him/herself or to use existing datasets or a combination of the two. This process, if applicable, takes place simultaneously with the application for the ethical review.
Paper-based or digital datasets
For academic research, paper-based or digital datasets that also contain traceable personal data are often used. This may includ
Setting up a new dataset with respondents
In the case of academic research you can set up a new dataset by collecting data from respondents or by combining two existing datasets (public or otherwise).
Reuse of already collected datasets (secondary use)
In academic research, it often happens that data collected for research is reused in a new study. This is referred to as secondary use, for which the GDPR has included specific regulations.
In addition, there are specific guidelines when using public datasets and web scraping is used collect personal data.
Tilburg University considers the data collected in the context of such reserach to be personal data. This policy choice has been made because patterns from such surveys may be traceable to individuals in the future.
Different forms of data sets
The list below is not exhaustive; other examples that are not mentioned are of course also covered by this policy.
Audio and video recordings
Audio and video recordings are regularly used in academic research. Sometimes these recordings can be made anonymous by blurring faces, or just filming hands, but this depends strongly on the purpose of the study.
Recordings can be used for presentations or publications, for example in education. It is important that the respondent is well-informed andhas given permission.
|Informing and consenting respondents||
Data subjects are clearly informed in advance on:
|Use of audio or video data||
If audio or video recordings are used in academic research, it is important that sufficient personal data is collected to answer the question of the study.
However, only personal data that is necessary for the research may be collected.
Recording research results must comply with the guidelines below.
In connection with integrity guidelines, it is important that it is possible to use the data to check who participated in the research. This can be done by pseudonymizing, in the form of a communication/connection file and the informed consent forms.
Please not that if a respondent's voice is recognizable, it can be traced back to a person and is thus not anonymized but only pseudonymized.
Interviews, observations, and experiments in labs
Researchers often make reports of interviews and observations. In some studies, experiments with test subjects are done in labs. Sometimes special personal data is measured, for instance taking someone's blood pressure to see if they are experiencing any stress.
Include as a few directly traceable personal data as possible, such as names.
|Informing respondents and asking for their consent||
Data subjects are clearly informed in advance, as a part of informed consent, about the purpose and manner of the academic study.
If prior information is not desirable because of the purpose of the study, the information provided for informed Consent may be of a general nature. For example, for research into ethnic discrimination.
However this information must be provided after the study has been completed as part of the debriefing.
Occasionally, respondents or participants in labs are paid to participate in a survey.
In this case, personal data is processed for purpose of payment and substantiation of the financial administration.
This constitutes processing of personal data. The process must therefore be recorded in the processing register by Finance & Control. The information does not need to be specified per study.
|Interviews, observations, and experiments in labs||
If the academic research involves the case of interviews, and observations, it is important that recording and processing complies with the guideline below.
In connection with integrity guidelines, it is important that it is possible to use the data to check who participated in study. This can be done by pseudonymizing, in the form of a communication/connection file and the informed consent forms.
Please note that additional security requirements apply to the processing of special personal data.
Some scientific studies use eye-tracking to track eye movements. One example is a study on the way people look at websites.
Depending on the way in which this eye tracking is recorded, there may be an increased privacy risk for data subjects. This is the case with an iris scan because it can be used as a means of identification. As a result there is a high risk of identity fraud for the respondent.
|Informing respondents and asking for their consent||Data subjects are clearly informed in advance about the manner and purpose of the study as part of informed consent procedure.|
If eye tracking is used in academic study, it is important that:
Medical screening (MRI/EEG/ECG...)
A number of scientific studies make use of medical screening such as MRI, EEG and ECG. The results constitute special personal data, to which the following guidelines apply.
|Informing respondents and asking for their consent||Dtaa subjects are clearly informed in advance about the manner and purpose of the research by means of informed consent.|
|Medical screening (MRI/EEC/ECG...)||
When medical data is used, special personal data is processed. This processing must comply with the guideline below:
In connection with integrity guidelines, however, it is important that the data can be used to veify who participated in the study.
Please note that when special personal data, additional are processed, additional security requirements apply.
If wearables, such as a Fitbit, are used for an academic study, the following guidelines apply.
|Informing respondents and asking for their consent||Data subjects are clearly informed in advance about the manner and purpose of the study as a part of the informed consent procedure.|
If wearables are used in academic study, the guideline below must be complied with.
Please not that additional security requirements apply to the processing of special personal data.