Blad met gegevens, foto Vladislav Bulatov

Handling research data with care

How do I deal with datasets that contain personal data?

Before the start of a research project, a researcher makes the decision to collect data him/herself or to use existing datasets or a combination of the two. This process, if applicable, takes place simultaneously with the application for the ethical review.

Paper-based or digital datasets

For academic research, paper-based or digital datasets that also contain traceable personal data are often used. This may includ

Public datasets

In addition, there are specific guidelines when using public datasets and web scraping is used collect personal data.

Tilburg University considers the data collected in the context of such reserach to be personal data. This policy choice has been made because patterns from such surveys may be traceable to individuals in the future.

Different forms of data sets

The list below is not exhaustive; other examples that are not mentioned are of course also covered by this policy.

Audio and video recordings

Audio and video recordings are regularly used in academic research. Sometimes these recordings can be made anonymous by blurring faces, or just filming hands, but this depends strongly on the purpose of the study.

Recordings can be used for presentations or publications, for example in education. It is important that the respondent is well-informed andhas given permission.

Informing and consenting respondents

Data subjects are clearly informed in advance on:

  • recordings being made, based on informed consent. 
  • the use of recordings for presentations and publications. For this purpose, data subjects will be asked to give specific permission.
Use of audio or video data

If audio or video recordings are used in academic research, it is important that sufficient personal data is collected to answer the question of the study.

However, only personal data that is necessary for the research may be collected.

Recording  research results must comply with the guidelines below.

  • Do not mention respondents bij anonymize later.
  • Do no't film faces if this is not necessary, but only hand movements for example.

In connection with integrity guidelines, it is important that it is possible to use the data to check who participated in the research. This can be done by pseudonymizing, in the form of a communication/connection file and the informed consent forms.

Please not that if a respondent's voice is recognizable, it can be traced back to a person and is thus not anonymized but only pseudonymized.
Interviews, observations, and experiments in labs

Researchers often make reports of interviews and observations. In some studies, experiments with test subjects are done in labs. Sometimes special personal data is measured, for instance taking someone's blood pressure to see if they are experiencing any stress.

Include as a few directly traceable personal data as possible, such as names.

Informing respondents and asking for their consent

Data subjects are clearly informed in advance, as a part of informed consent, about the purpose and manner of the academic study.

If prior information is not desirable because of the purpose of the study, the information provided for informed Consent may be of a general nature. For example, for research into ethnic discrimination.

However this information must be provided after the study has been completed as part of the debriefing.
Administrative handling

Occasionally, respondents or participants in labs are paid to participate in a survey.

In this case, personal data is processed for purpose of  payment and substantiation of the financial administration.

This constitutes processing of personal data. The process must therefore be recorded in the processing register by Finance & Control. The information does not need to be specified per study.
Interviews, observations,  and experiments in labs

If the academic research involves the case of interviews, and observations, it is important that recording and processing complies with the guideline below.

  • Do not state any names or other traceable personal data when recording an interview, an observation or a lab result.

In connection with integrity guidelines, it is important that it is possible to use the data to check who participated in study. This can be done by pseudonymizing, in the form of a communication/connection file and the informed consent forms.

Please note that additional security requirements apply to the processing of special personal data.
Eye tracking

Some scientific studies use eye-tracking to track eye movements. One example is a study on the way people look at websites.

Depending on the way in which this eye tracking is recorded, there may be an increased privacy risk for data subjects. This is the case with an iris scan because it can be used as a means of identification. As a result there is a high risk of identity fraud for the respondent.

Informing respondents and asking for their consent Data subjects are clearly informed in advance about the manner and purpose of the study as part of informed consent procedure.
Eye tracking

If eye tracking is used in academic study, it is important that: 

  • only eye movement is followed;
  • the iris is not photographed or scanned as this proses an increased privacy risk to the respondent.
Medical screening (MRI/EEG/ECG...)

A number of scientific studies make use of medical screening such as MRI, EEG and ECG. The results constitute special personal data, to which the following guidelines apply.

Informing respondents and asking for their consent Dtaa subjects are clearly informed in advance about the manner and purpose of the research by means of informed consent.
Medical screening (MRI/EEC/ECG...)

When medical data is used, special personal data is processed. This processing must comply with the guideline below:  

  • Do not mention any names or other traceable personal data when recording the MRI/ EEC or ECG.

In connection with integrity guidelines, however, it is important that the data can be used to veify who participated in the study.
This can be done by pseudonymizing, in the form of a communication/connection file and the informed consent forms.

Please note that when special personal data, additional are processed, additional security requirements apply.
Wearables

If wearables, such as a Fitbit, are used for an academic study, the following guidelines apply.

Informing  respondents and asking for their consent Data subjects are clearly informed in advance about the manner and purpose of the study as a part of the informed consent procedure.
Wearables

If wearables are used in academic study, the guideline below must be complied with.

  • Do not mention any names or other traceable personal data when recording the results of the wearables. 
  • In connection with integrity guidelines, however, it is important that the data can be used to verifiy who participated in the study. This can be done by pseudonymizing, in the form of a communication/connection file and the informed consent forms.

Please not that additional security requirements apply to the processing of special personal data.