Data minimisation

The GDPR places obligations on both: the ‘data controller’, which ‘alone, or jointly with others, determines the purposes and means ofthe processing of personal data’; and the ‘data processor’, which ‘processes personal data on behalf of the controller’.

It is your responsibility to ensure that your research complies withthe data protection laws in all the Member States in which your research data areprocessed, as well as the GDPR.33 See in particular Articles 9(4), 8 and 89(3) GDPR.

The increasing impact of these and other new technologieson our everyday lives and activity is reflected in the letter and spirit of the EU’s 2016 General DataProtection Regulation GDPR)

Ethics and data protection

This section concerns research involving goods, software and technologies covered bythe EU Export Control Regulation No 482/2009.

Pseudonymisation and anonymisation are not the same thing.‘Anonymised’ means that the data has been rendered anonymous in such away that the data subject can no longer be identified (and therefore is nolonger personal data and thus outside the scope of data protection law).‘Pseudonymised’ means to divide the data from its direct identifiers so thatlinkage to a person is only possible with additional information that is heldseparately. The additional information must be kept separately and securelyfrom processed data to ensure non-attribution.

Collecting personal data (e.g. on religion, sexual orientation, race, ethnicity,etc.) that is not essential to your research may expose you to allegations of‘hidden objectives’ or ‘mission creep’

Ethics issues checklist

1) Declarationconfirmingcompliance withthe laws of thecountry where thedata was collected.

name, anidentification number, location data, an online identifier or to one or morefactors specific to the physical, physiological, genetic, mental, economic,cultural or social identity of that natural person (art. 2(a) EU General DataProtection Regulation (GDPR).

Participants must be given an informed consent form and detailed information sheetsthat: are written in a language and in terms they can fully understand describe the aims, methods and implications of the research, the nature of theparticipation and any benefits, risks or discomfort that might ensue explicitly state that participation is voluntary and that anyone has the right torefuse to participate and to withdraw their participation, samples or data atany time — without any consequences state how biological samples and data will be collected, protected during theproject and either destroyed or reused subsequently state what procedures will be implemented in the event of unexpected orincidental findings (in particular, whether the participants have the right toknow, or not to know, about any such findings).

Does it involveinvasivetechniques (e.g.collection ofhuman cells ortissues, surgicalor medicalinterventions,invasive studieson the brain, TMSetc.)?

vulnerableindividuals orgroups?

Ethics issues checklist

How to complete your ethics self-assessment