Research Ethics & GDPR

This video outlines the key features of the General Data Protection Regulations, and how it influence the conduct of modern research.

LEARNING OBJECTIVES

1. Explain what GDPR is.
2. Understand how GDPR classifies data.
3. Be aware of how to appropriately store and process data under GDPR.

Video

Question 1

Before watching the video, consider this question. GDPR regulations note three kinds of data:

• Data
• Personal Data
• Sensitive Personal Data

Why do you think these legal regulations attribute some data to be more personal than others, and some data to be more sensitive than others? And why might these different types of data require different types of protection?

You can find answers after the video

The General Data Protection Regulations, or GDPR, are a set of European Union and UK rules that define how we collect, store and process human data. Abiding by these regulations, in order to protect rights like privacy, is an important component of any research plan. In this video, we introduce GDPR, and discuss some strategies for ensuring that you stay within permissable uses of data. You can follow along the video using the slides below. For questions and comments, contact hugh.rabagliati@ed.ac.uk.

Download the slides for this presentation here.

Solution

Under the jurisdiction of GDPR, any information collected about another human can be considered data. Personal Data dsecribes information that can be used to identify another individual. This could be a name, an address, a picture, a video, a voice recording, an online alias, or more. EEG data, for instance, can be identifying, and thus counts as personal data. Sensitive personal data is information that not only identifies an individual, but highlights special information about them that could potentially be harmful if made widely available. This include information such as racial or ethnic origin, political opinions, or religious beliefs, as well as genetic and biometric data.

These different types of data require different treatments because of the potential harm they could cause if made publicly available. Consider, if you put online an anonymised dataset of accuracy in a memory task, then there would be no perceivable risk to the research subjects. But if you included the research subjects’ personal information, then there is a risk that the research subjects’ privacy might be invaded. And if you included their ethnicity or political orientation as well, then there significant additional risks. Thus, the different types of data require different treatments.

Quiz

Question 2

Why is it important to store gathered personal data on University of Edinburgh servers?

Solution

University of Edinburgh servers have a high degree of security - if you password protect your data appropriately, then there should be little danger of personal data being accessed outside of your research team. In addition, University of Edinburgh servers are guaranteed to be hosted in GDPR-compliant locations. This is important, because moving personal data outside of a GDPR compliant location presents significant risks. By contrast, your personal storage accounts from private companies may not offer this guarantee.