Data protection in science and research
Data protection in science and research
Data protection for research projects
Document version: 1.2
Date: 8 January 2019
The following guide is intended to provide researchers with guidance on what must be taken into account when processing personal data in accordance with the General Data Protection Regulation (GDPR) and the Lower Saxony Data Protection Act (NDSG).
Under no circumstances does this guide replace advice from the Data Protection Officer or any other qualified person.
Please send any suggestions or feedback to dsuni@oul.de.
1. What is personal data?
Data protection is relevant only where personal data is processed. From a data protection perspective, anonymised (not: pseudonymised) data may be processed without any restrictions. But when does data constitute personal data?
Article 4(1) of the GDPR defines personal data as
“any information relating to an identified or identifiable natural person (hereinafter referred to as the ‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.
It is currently a matter of debate whether personal data is deemed to exist even if the data subject could only be identified at a cost that is disproportionate to the significance of the data (formerly known as ‘de facto anonymity’). However, the wording of the GDPR does not distinguish between the level of effort required, but considers it sufficient if the data subject can be identified (regardless of the effort involved). It therefore appears legally safer, for the time being, to assume that personal data is involved even in the aforementioned cases.
Personal data therefore includes, in particular:
- Pseudonymised data. This applies even if you do not know the pseudonymisation key, because it is held by a third party or because the data subject has created the pseudonym themselves.
- Interviews recorded in audio format (tape, MP3, .wav, etc.). A person’s voice is as unique as their fingerprint. There is currently no reliable method that alters a voice to such an extent that it can no longer be identified.
- Body fluids (saliva, blood, cerebrospinal fluid) and tissues (hair, skin, bone) due to the genomes they contain
- Information from very small groups of participants (<=5)
- Information when collected in conjunction with one or more unique identifying characteristics. Example: University students are asked, amongst other things, for their age. One of the participants states they are 102 years old. The combination of ‘student’ and ‘102 years old’ is likely to be rather rare amongst the respondents.
- Big data. The more data that is collected, the smaller the group of people to whom this information applies in combination. With large volumes of data, this group may narrow down to a single person, meaning that even in these cases – despite the data being collected anonymously – personal data is present.
2. Data minimisation, Part 1: Do you actually need to work with personal data, or is anonymised data sufficient?
In accordance with Article 5(1)(c) of the GDPR, personal data must
‘be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”)’;
The processing of personal data must therefore be reduced to the minimum necessary. Logically, the minimum processing of personal data is that which does not take place at all. As a first step, you should therefore check whether your research project can be carried out without compromise using anonymous data. Quote from the website of the State Data Protection Commissioner for Lower Saxony:
“Many research projects can be carried out without personal data, without compromising the scientific objectives in any way. The processing of personal data is only permissible if and to the extent that anonymised data is insufficient for the purpose of the project. It should therefore always be assessed whether a research project can be conducted using anonymised data.”
(https://www.lfd.niedersachsen.de/fortbildung_informationsmaterial/empfehlungen_recht/einwilligung/einwilligung-in-ein-medizinisches-forschungsprojekt-56135.html)
3. Data minimisation, Part 2: What personal data do you need?
If the processing of personal data is necessary to achieve your research objective, the second step is to assess exactly which data should be collected. Here, too, the principle of data minimisation applies, i.e. you may only collect the data necessary to achieve your research objective. During the design phase, you should therefore already consider which specific data fields you intend to process.
4. Retention periods: How long do you need personal data for?
The next important question you should ask yourself is how long the processing of personal data is necessary for your research project. As a general rule, personal data must be deleted or anonymised as soon as possible. With regard to individual data items, this may well result in different retention periods in each case.
Example: You plan to interview your participants over several sessions. You record the interviews in MP3 format (voice = personal data) and then transcribe them. Each participant is assigned a pseudonym so that you can link the individual interviews for each person. In principle, the recordings must be deleted once they have been transcribed and verified. The coding list, on the other hand, should in principle only be deleted once the interviews have been completed and you have linked the individual interviews.
5. Data Protection Impact Assessment and Data Protection Policy
Certain processing activities pose a particularly high risk to the rights and freedoms of data subjects. In such cases, the University is obliged to carry out a data protection impact assessment in accordance with Article 35 of the GDPR, in consultation with the Data Protection Officer. Where necessary, it may also be required to draw up a data protection policy. Further information can be found on the LfD Lower Saxony website at:
If you are unsure whether you require a data protection impact assessment or a data protection policy for your project, please contact the Data Protection Officer. Alternatively, the Data Protection Manager will be happy to answer any questions you may have regarding the necessity of a data protection impact assessment.
A sample template for a data protection policy can be found at:
A template for documenting a data protection policy can be found here.
6. The legal basis for processing
The processing of personal data is generally prohibited unless, in exceptional cases, it is permitted by a legal basis. In the field of research, two legal bases are available to you:
- the consent of the data subject (Article 6(1)(a) of the GDPR) and
- overriding scientific interest (Article 6(1)(e) in conjunction with Section 13 of the NDSG)
6.1. Consent (Article 6(1)(a) of the GDPR)
Consent is one of the two legal bases on which you may base the processing of personal data. Similar to consent to medical treatment, consent to the processing of personal data is only valid if the data subject has been informed in advance of the scope and implications of the processing (in this case, the right to informational self-determination rather than physical integrity). A key change introduced by Article 5(2) of the GDPR (known as the ‘accountability’ requirement) is that the controller must be able to demonstrate the data subject’s consent. Although consent may also be given verbally or through conclusive conduct, you should therefore either obtain consent in writing (see below) or, for example, in the case of online questionnaires or registration forms, design the process technically in such a way that respondents can only access the questionnaire once they have given their consent to the data processing.
A template for a GDPR-compliant declaration of consent can be found here.
Further information on consent can be found in the GDD Practical Guide to the GDPR XIII, which you can download free of charge via the following link:
www.gdd.de/downloads/praxishilfen/GDD-Praxishilfe_DS-GVO_13.pdf
Special case: Data collection in schools
Data collection in schools in Lower Saxony requires not only the consent of the pupils or teachers concerned but also authorisation from the relevant state school authority in accordance with the decree issued by the Ministry of Education and Cultural Affairs. If you have any questions regarding this procedure, you may contact the state education authorities in Lüneburg, Hanover, Braunschweig or Osnabrück directly.
6.2. Overriding scientific interest (Art. 6(1)(e) in conjunction with Section 13 NDSG)
Under Section 13(1), first sentence, of the NDSG, public bodies
“process personal data, including data within the meaning of Article 9(1) of the General Data Protection Regulation, for a specific scientific or historical research project, or transfer such data to other bodies for this purpose, provided that the nature and processing of the data suggest that no legitimate interest of the data subject precludes the processing of the data for the research project, or that the public interest in carrying out the research project outweighs the legitimate interest of the data subject.”
In essence, this involves balancing the scientific interest against the data subject’s interest in the non-processing of their personal data. If there is no legitimate interest in non-processing, or if the scientific interest prevails, the processing of personal data is permitted. The outcome of this balancing exercise and the reasoning behind it must be documented (Section 13(1), second sentence, NDSG). Furthermore, the data protection officer must be informed (Section 13(1), third sentence, NDSG).
Please note that the overriding scientific interest is likely to be subject to judicial review and that courts may, where appropriate, weigh up the interests differently from the researcher. In the author’s view, it is therefore more legally sound (and, incidentally, more courteous) to ask the data subjects for their consent.
Further information on Section 13 of the NDSG can be found on the website of the LfD Lower Saxony at:
www.lfd.niedersachsen.de/themen/forschung/datenschutz-und-forschung-56093.html
7. The record of processing activities, Article 30 of the GDPR
As a data controller, the University of Oldenburg is obliged under Article 30(1) of the GDPR to maintain records of all processing activities falling within its remit. These records describe in detail the processing activities and the measures taken to protect the personal data being processed. This obligation also applies to academic activities. The records are drawn up by the head of the respective research project (the so-called ‘process owner’) and forwarded to the Data Protection Management Officer. The Data Protection Management Officer provides advice on all matters relating to the record of processing activities. Further information and a template can be found at:
uol.de/dism/dsm/grundlagen/verfahrensbeschreibung
8. Information obligations, Articles 13 and 14 of the GDPR
Where personal data is collected from the data subject, the data subject must be informed at the time of collection in accordance with Article 13 of the GDPR. If, on the other hand, the data is collected from third parties (e.g. the Residents’ Registration Office, health insurance funds, hospitals, etc.), the data subjects must be informed in accordance with Article 14 of the GDPR within a reasonable deadline, but no later than one month after receipt of the data. For scientific purposes, the requirement to provide information under Article 14 of the GDPR may, under certain circumstances, be waived (but not that under Article 13 of the GDPR). If the requirement to provide information under Article 14 of the GDPR is to be waived, the relevant considerations must be documented. Before waiving the obligation to provide information under Article 14 of the GDPR, please contact the Data Protection Officer.
- Template letters for the information required under Articles 13 and 14 of the GDPR
9. In the event of an incident: reporting data breaches
As the data controller, the University is obliged to report data breaches to the Lower Saxony Data Protection Authority (LfD Niedersachsen) without delay and, where possible, within 72 hours of becoming aware of them.
Data breaches may include, for example:
- Sending an email with a large group of recipients in the ‘To:’ or ‘CC’ fields, without it being necessary for the other recipients to be able to see who else received the email apart from themselves.
- Loss of a laptop or USB stick containing personal data.
- Accidental shredding of documents containing personal data.
- In the event of a fire (through no fault of your own), data storage media and/or documents containing personal data are destroyed.
If you become aware of a data breach, please contact the data protection management officers immediately; their contact details can be found at
uol.de/DATA PROTECTION AND INFORMATION SECURITY UNIT
. They are responsible for reporting incidents to the LfD.
10. During and after the research project: Trust is good, control is better
During and after your research project, you must ensure that the measures you have described in the record of processing activities – in particular, compliance with retention periods – are actually implemented. Even the best measures are of no use if they exist only on paper.
11. Last but not least
Last but not least, I wish you every success with your research project!
Your Data Protection Officer