Contents

• Introduction
• The importance of anonymisation in research practice
• How can Re-identification happen?
• Key terminology
• How best to think about anonymisation
• The role of anonymisation in data protection
• How do you do anonymisation
• A framework for doing anonymisation
• Knowledge Check
• Summary
• Further support

Introduction

It is fair to say that anonymisation is a complex topic. There are three key points to bear in mind as you work your way through this post, they are:

1. Anonymisation is a process which essentially renders personal data non-personal;

2. To render personal data non-personal, you will need to assess and manage re-identification risk;

3. To assess and manage re-identification risk, you will need to consider the relationship between data and the environment in which they exist.

In this post we look at: why anonymisation should be considered at the study planning stage, key terminology, perspectives on anonymisation and, introduce a framework for doing anonymisation.

^Back to contents

The importance of anonymisation in research practice

Anonymisation is a process that allows research data to be shared and or published safely and responsibly.

You may think that setting out your approach to data sharing and publication and in particular anonymisation (to support these activities) is, at the study planning and set-up phase, a bit early, it isn’t. This is because all research activities need to be transparent in order to be considered fair, and in turn not to impact on what it is you plan to do during your study and beyond. Let us consider this further; anonymisation is a form of data processing (because you are rendering personal data non-personal) and as such your plans around this activity need to be transparent. How you do this in practice, is to include details (in your public facing documents) on what data you plan to share and publish and on how you will manage data confidentiality.

The landscape in which you as researchers will publish and share data is complex. There is an increasing amount of large and linked datasets being created about people. Couple with this, technological advances enable data to be exploited in new and previously unimagined ways. When you also consider that anonymisation is itself a complex process, it is not surprising that there have been a number of high profile cases of re-identification of confidential datasets. Cases of re-identification of confidential datasets often involved data that was considered to be anonymised being ‘de-anonymised’, and confidential information being revealed. We will look at two examples in the next section.

^Back to contents

How can Re-identification happen?

It is worth noting that the re-identification problem [i.e. the re-identification of persons within a confidential dataset] is not new.

One of the most well-known cases of re-identification was of a US Governor by Latanya Sweeny in 1996. Let us consider this case:

Re-identification of US Governor by Latanya Sweeny in 1996

In the mid-nineties The Massachusetts Group Insurance Commission (GIC) released for research purposes a (supposedly) anonymised hospital insurance dataset of all hospital visits by state employees. The GIC removed obvious identifiers such as name, address and social security number. At the time of its publication, the Governor of Massachusetts came out in support of the published dataset, reassuring the public that patient privacy was protected.

Latanya Sweeny, then a Computer Science graduate student, set out to demonstrate that re-identification was possible in this (supposedly) anonymised hospital insurance dataset. She was not primarily interested in the information revealed (of course the revealing of information might well be a motivation of a would-be data intruder). Sweeny was able to re-identify the Governor of Massachusetts in the dataset; she knew the area he lived in and she had publicly available information i.e. a voter registration file (she purchased for $20) and media reports of the Governor being hospitalised after a collapse at a rally. Given the auxiliary information she had — she was able to match on date of birth, gender and zip code. Sweeny sent the Governor’s health record from the dataset to his office, not surprisingly this led to changes in the privacy law in the US.

Although this case is over twenty years old, it is still pertinent today as the core issue remains the same.

When determining whether data are anonymised or not, you need to take account of:

• the data to be released or shared,
• the (release /share) environment, including what other data might exist in the environment,
• who is able to access that data and what — if any — governance and infrastructure controls and restriction are in placed to manage data access and reuse.

Demonstration attacks, such as the one carried out by Sweeny, have in more recent years led to some to argue that anonymisation is a failed tool. For example, Ohm (2010)¹ argued that ‘data could be useful or anonymous, but not both’. This position has been widely contested, with critics pointing out that incidences of re-identification (from demonstration attacks) arise because anonymisation is poorly applied rather than because anonymisation is an ineffective tool in protecting data confidentiality.

The re-identification of the Governor of Massachusetts by Sweeny is a case in point of poorly applied anonymisation; where too little attention was given to the interaction between the data and the publication environment.

To help you start thinking about anonymisation consider the question below and the example. You may wish to revisit your answer once you have worked through this post and look at whether your decision changed and if so why?

Can you publicly release this dataset?

A media streaming service called ‘AB’ want to release a movie rating dataset. The dataset contains 100 million movie ratings based on the views of half million of its subscribers. In the dataset are the following variables:

1. A subscriber ID (uniquely generated by AB)

2. Movie titles and year of release

3. Date and time on which the subscriber rated the movie

The short answer is no. This example is based on a real world data release and subsequent demonstration attack of re-identification.

Let us take a look at what happened:

In 2006, Netflix publicly released a (supposedly anonymised) version of their movie rating dataset for the purpose of improving its movie recommendation algorithm. Netflix planned to crowd source the problem — whoever came up with the best solution to improve the algorithm would win $1 million dollars.

University of Texas Computer Science researchers Arvind Narayanan and Vitaly Shmatikov, showed that the dataset was not sufficiently anonymised for public release. They were able to re-identify a sub-sample of people in the Netflix dataset by cross matching it with another publicly available dataset, namely the Internet Movie Database (IMDb), linking on movie ratings and time stamps.

Importantly IMDb also contained at least some contributor names along with their movie rating and time of posting.

^Back to contents

Key terminology

The terminology associated with anonymisation can be confusing. Different terms may be used i.e. ‘anonymisation’, ‘de-identification’ and ‘pseudonymisation’. In order to apply the terminology appropriately, the first thing you need to know is how personal data is defined in data protection law.

Data protection law is underpinned by a bipartite model of data: meaning data is classed as either personal data or not (personal data), there are no in-betweens.

Anonymisation

If data is not personal data, it is classed as anonymous information. The legislation has little to say about anonymous information other than, it is:

1. Information that does not relate to (or no longer relates to) an identified or identifiable natural person.
2. Out of scope of the legislation.

To learn more about anonymous information then, we need to understand what it means for persons to be ‘identified’ and ‘identifiable’ and this requires that we examine the definition of personal data. UK GDPR defines personal data as

“any information relating to an identified or identifiable natural person …; an identifiable natural person is one who can be identified, directly or indirectly, ” (article 4(1))

The part of the definition of interest to this discussion is in bold, that an identified person is one that can be identified from data either:

a) directly or b) indirectly

We shall return to this point as we describe how the terms de-identification, pseudonymisation and anonymisation are understood in the UK and Europe. Referring to the above as condition a) and condition b).

De-identification

The term de-identification has been used variously to describe the replacement or masking of direct identifiers such as name, address and unique (common) reference numbers.

The term ‘de-identification’ applied in this way addresses no more than condition a), that is, the risk of identification arising directly from data

Pseudonymisation

When GDPR (2016) came into effect in May 2018 it introduced a new term to data protection legislation, that of, pseudonymisation which is defined as:

‘… the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person’, (Article 4(5)).

Pseudonymisation, as you can see from the definition, is a process not dis-similar to the description given of de-identification, in that it addresses no more than condition a) the risk of identification arising directly from data. Since it would only require a look-up table or details of the encryption algorithm to break the protection. Note the sentence in the definition of pseudonymisation, to paraphrase, pseudonymisation is the processing of personal data where identification is not possibly directly from the data.

The important point to take away from this is that within the framework of GDPR, data that has undergone the process of pseudonymisation is considered personal data.

The process of anonymisation, in contrast to pseudonymisation, should address both conditions a) and b), i.e. the risk of identification arising directly and indirectly from data. The replacement or masking of direct identifiers is necessary, but rarely sufficient on its own for anonymisation.

^Back to contents

How best to think about anonymisation

Although anonymisation has privacy implications it is not primarily concerned with privacy but with keeping data confidential. Within the field of data confidentiality, anonymisation is closely tied with a particular type (of anonymisation) which you may be familiar with, called Statistical Disclosure Control (SDC).

SDC covers the integrated processes of disclosure risk assessment, risk management and data utility. SDC is however just one aspect of anonymisation. Anonymisation is much broader than a set of technical processes for managing risk, it should include along with it technical processes, integrated legal, governance and ethics processes.

A common error when thinking about anonymisation has been the tendency to focus on a fixed end state of the data as ‘anonymised’. This has tended to lead to:

1. The use of success terms such as ‘truly anonymised’ (which should be avoided) and,

2. Muddled thinking about what it means to produce ‘anonymised data’, resulting in:

• An almost exclusive focus on the properties of the data whereas in reality whether data are anonymised or not is a function of both the data and their environment.
• Discussions about the relationship between anonymisation and its companion concept risk, and in particular an over optimistic assumption that ‘anonymised’ means that there is zero risk of an individual being re-identified within a dataset.
• The assumption that one’s work is done once the anonymisation process is complete and the end state is produced, which in turn promotes a counterproductive mentality of ‘release-and-forget’.

So how should you think about anonymisation? Let’s consider the first point made in the introduction.

‘Anonymisation is a process (for rendering personal data non-personal)’. More precisely it’s a process of risk management that requires dynamic decision- making.

This is because in a data flow, where data moves from one environment to another, the classification of the data as either personal data or anonymous information may change. In other words data considered anonymised in one particular environment may not be anonymised in a different environment.

The classification of data may change depending on the level of re-identification risk associated with it, this is tied not just to the data but who is looking at the data and the environment in which the data exists.

The question you need to ask yourself when thinking about sharing or publishing data is ‘Are these data anonymised for persons X in environment Y?’.

^Back to contents

The role of anonymisation in data protection

There is an ongoing discussion on the role of anonymisation in data protection about whether or not it ought to be able to provide an ‘absolute assurance’ of data confidentiality. There are two camps of thought on this, they are:

1. The absolute approach, which is underpinned by a belief that there should be zero risk of re-identification in an (anonymised) confidential dataset.
2. The risk based approach, which is underpinned by a belief that there is an inherent risk of re-identification in all useful data.

Now you may think that zero risk of re-identification ought to be the data protection standard that is met. However, anonymisation is not just about data protection. It is a process inseparable from its purpose to enable the sharing and dissemination of useful data.

Thus data utility (how useful the data is for the user) is another important consideration here, because there is little point in sharing data that has little or no utility for its intended audience. Low utility data may still contain a risk of identification but without a good justification for sharing it. If we accept that confidential data that is also useful carries with it an inherent risk of re-identification, the role of the data custodian then becomes one of ensuring that the risk is negligible.

We can think of the ‘anonymised’ concept in ‘anonymised data’ in the same way we think of the ‘reinforced’ concept in ‘reinforced concrete’. We do not expect reinforced concrete to be indestructible, but we do expect that a structure made out of the stuff will have a negligible risk of collapsing (Elliot, Mackey and O’Hara, 2016).

A risk based approach to anonymisation is implemented in practice by National Statistical Institutes around the world. For example, the UK’s Office for National Statistics carries out an enormous amount of work in the area of scenario modelling, statistical disclosure risk assessment and management, in order to provide useful confidential census data in varying formats to a wide range of audiences. This is also a position supported by the UK’s Information Commissioner’s Office, as described in its 2012 Code of Practice on Anonymisation:

‘The DPA does not require anonymisation to be completely risk free, you must be able to mitigate the risk of identification until it is remote. If the risk of identification is reasonably likely the information should be regarded as personal data, these tests have been confirmed in binding case law from the High Court’ (2012:6).”

^Back to contents

How do you do anonymisation?

The two most common approaches to doing anonymisation are: data centric anonymisation and functional anonymisation. We will now look at each of these in turn.

Data centric anonymisation

Data centric anonymisation is the approach most commonly taken. It essentially views re-identification risk as originating from and contained within the data to be released. It is an approach that asks: ‘how risky is the data to be shared or published’? What this means in practice is that re-identification risk is assessed and managed largely by taking account of the data only. Little or no attention is given to other wider and key considerations such as how, or why, a re-identification might happen, or what skills, knowledge, or other data a person would require to ensure their attempt was a success. Risk doesn’t arise from data per se but from the interaction between data and its environment (including who is looking at it). The data centric approach undoubtedly underpinned the release of the hospital insurance dataset by GIC that led to the re-identification of Governor, and to the Netflix case.

Functional anonymisation

Functional anonymisation (FA) is a more recent approach to doing anonymisation. FA essentially shifts the focus from data to a focus on the relationship between data and the environment in which it exists to assess and manage re-identification risk. It is an approach that shifts the question of ‘how risky is the data’ to a question of ‘how risky is the proposed share or publication given the data and the share/publication environment’.

So what do we mean by the term ‘data environment’?

The data environment is best imagined as being made up of four component features (Mackey & Elliot 2013; Elliot & Mackey 2014):

• Other data: any information that could potentially be linked to the data in question thereby enabling re-identification. There are four key types of other data: personal knowledge, publicly available sources, restricted access data sources, and other similar data releases.
• Agents: those people and entities capable of acting on the data and interacting with it along any point in a data flow.
• Presence or absence of Governance Processes: processes that essential inform the who and how of access to data. They includes formal governance e.g. data access controls, licensing arrangements and policies which prescribe and proscribe agents’ interactions and behaviour through norms and practices.
• Presence or absence of Infrastructure: i.e. the set of interconnecting structures (physical, technical) and processes (organisational, managerial) that frame and shape the data environment.

In practice, thinking about the relationship between data and the component features of the data environment can help you to assess risk and in turn mitigate it.

To illustrate, let us consider two simple examples — one where data is published in an open environment (internet) and one where data is shared in a controlled and restricted environment (Trusted Research Environment).

Open environment: publication on the internet

An open environment such as publication on the internet, we can imagine is configured in the following way:

• In terms of agents that could potentially access the published data, the pool is anyone in the world with access to the internet;
• In terms of other data, it is all other data that co-exist on the internet as well as data that co-exist off-line that could potentially be linked to the data to be published;
• In terms of governance processes and infrastructure, there is likely to be a near total absence of both components in respect to restrictions or controls on the who and how of access.

In an open environment then, to manage risk and achieve functional anonymisation, you will need to restrict, quite considerably, the data to be released. Even aggregate data such as tables and graphs can be potentially disclosive.

For information on how to ensure your research outputs intended for publication are not disclosive please see: Bond et al, Guidelines for the checking of output based on microdata research and Griffiths et al, July 2019, Handbook on Statistical Disclosure Control (SDC) for Outputs.

Secure environment: Trusted Research Environment

A secure environment such as a Trusted Research Environment (TRE) is typically configured in the following way:

• In terms of agents who can have access to the data –typically TRE’s operate an application and approvals process to vet both researcher and the project (i.e. intended use of the data) and require the researcher to complete Researcher Accreditation Training and sign a Terms and Conditions of Access Agreement;
• In terms of what other data could be linked with the data in the TRE — typically TRE’s operate strict protocols on what can be brought into and out of the TRE, including such as prohibiting mobile phones and pen and paper being brought in and checking statistical results (intended to be brought out) to ensure that they are non-disclosive;
• In terms of governance processes and infrastructure — TRE’s operate under strict IT security protocols and may also operate secure physical facilitates. This may include a secure locked facility, monitoring of people entering and leaving the facility, secure IT infrastructure monitoring access to data and prohibiting the movement of data within the data store without explicit permissions.

In a secure controlled environment then, risk is being tightly managed and mitigated. It may be possible to class the data shared (even detail data) as functionally anonymised for the researcher. For more information on this please see Elliot et al 2016, 2020, Mourby et al 2018.

^Back to contents

A Framework for doing anonymisation

To support well thought out anonymisation the UK Anonymisation Network (UKAN) published the Anonymisation Decision Making Framework (ADF) book in 2016 and most recently a new edition in the form of a European Practitioner’s Guide. It is a practical guide to GDPR-Complaint anonymisation that provides more operational advice than most other publications.

The ADF is primarily intended to support practitioners to anonymise with confidence. It comes with tools and templates to capture and evaluate different use cases.

The ADF is underpinned by four core principles:

1. Comprehensiveness Principle: You cannot decide whether or not data are safe to share/release by looking at the data alone, but you still need to look at the data. This principle encapsulates the data situation approach where risk is seen as arising from the interaction between data, people, other data, governance processes and infrastructure. You do also need to know your data — which means being able to identify the critical properties of your data and to assess how they might affect risk. This will feed into decisions about how much data to share or release, with whom and how.

2. Utility Principle: Anonymisation is a process to produce safe data but it only makes sense if what you are producing is safe useful data. Anonymisation is not just about data protection but also data utility.

3. Realistic Risk Principle: Zero risk is not a realistic possibility if you are to produce useful data. This is fundamental. Functional anonymisation is about risk management. Accepting that there is a residual risk in all useful data inevitably puts you in the realms of balancing risk and utility. However, the trade-off of individual and societal benefits against individual and societal risks is the stuff of modern life.

4. Proportionality Principle: The measures you put in place to manage risk should be proportional to that risk and its likely impact. Following the realistic risk principle, the existence of risk is not necessarily a reason for withholding access to data. However, a mature understanding of that risk will enable you to make proportionate decisions about the data, who should have access and under what conditions.

The ADF comprises of three core anonymisation activities and 10 component features, they are:

Activity 1: Data situation audit

This is essentially a framing tool for understanding your data situation. The audit will help you effectively assess and manage risk. There are 6 components associated with this anonymisation activity, they are:

1. Describe/capture the presenting problem

• A top level description of what you are trying to achieve or do.

2. Sketch the data flow and determine your responsibilities

• This will enable you to visualise the outline of your data situation and identify your responsibilities within it.

3. Map the properties of the data environment(s) [DE]

• Once the data flow is sketched you can map on the four components of the environment(s) i.e. other data, agents, governance and infrastructure.

4. Describe and map the data

• Once you’ve you mapped the properties of your DE, you need to describe the data within each environment across a range of parameters i.e. data structure, data type, variable type, population, dataset properties etc.

5. Engage with stakeholders

• This is crucial to trustworthy data stewardship

6. Evaluate the data situation

• An evaluation of 1–5, will inform whether you can proceed to share /publish the data or whether you need to assess risk in more detail and put further controls on that risk.

Activity 2: Risk analysis control

Once you have completed an evaluation of your data situation (component 6) you will be in a position to be able to decide whether further risk assessment and control is necessary. How to go about assessing risk and implementing control methods are detailed in component 7. Risk assessment and control should usually be an iterative, not linear, process. You may need the advice of an expert at this stage.

7. Select and implement the processes you will use to assess and control disclosure risk.

Activity 3: Impact management

Impact management is about making plans to manage an adverse event if in the rare event one should happen. There are three components associated with this anonymisation activity, they are:

8. Maintain stakeholders’ trust.

9. Plan what to do if things go wrong.
• Residual risk means that an adverse event could happen so it is important to have in place a crisis management policy.

10. Monitor the Data Situation.
• Risk is neither exactly calculated nor constant. You should produce and implement a policy for monitoring the risk and consider adjusting the data situation if it changes significantly.

^Back to contents

Knowledge check

Let’s take a look at what you have learned. Try the questions below to see if you have remembered the key points from this post. If you struggle with any of the questions go back and check that section of this post again.

^Back to contents

Summary

In this resource we explored how anonymisation and pseudonymisation applies to the management, sharing and publication of research data.

If you haven’t already we would recommend you take a look at the ‘Managing and sharing data from human participants’ post series which explores similar topics from an ethics perspective.

Other posts related to this topic are included in the further support section below.

^Back to contents

Further Support

• Find out how the data protection principles apply to research
• Research with human participants: your responsibilities under UK GDPR
• Data Protection considerations
• Participant engagement and consent
• My Research Essentials webpages

^Back to contents

Thank you to our contributors

This resource was written by Dr Elaine Mackey working in partnership with My Research Essentials. The material in the post is based on the work of UKAN, with acknowledgement to Professor Mark Elliot and Dr Kieron O’Hara.

^Back to contents

References

1. 1. Barth-Jones, D. (2012). The identification of Governor William Weld’s medical information: a critical re-examination of health data identification risks and privacy protections, then and now. https://fpf.org/wp-content/uploads/The-Re-identification-of-Governor-Welds-Medical-Information-Daniel-Barth-Jones.pdf
2. Bond, S (ONS), Brandt, M (Destatis), de Wolf, P (CBS). Guidelines for the checking of output based on microdata research, which builds on 2009 ESSNET Guidelines
3. Elliot, M., Mackey, E., O’Hara, K. (2020). ‘The Anonymisation Decision-making Framework: European Practitioners’ Guide’. UKAN Publication.
4. Elliot, M., Mackey, E., O’Hara, K. and Tudor, C. (2016) ‘The Anonymisation Decision-making Framework’. UKAN Publication.
5. Elliot, M. and Mackey, E. (2014). ‘The Social Data Environment’ in O’Hara, K., David, S.L., de Roure, D. and Nguyen, C. M-H. (eds) Digital Enlightment Yearbook.
6. Griffiths, E., Greci, C., Kotrotsios, Y., Parker, S., Scott, J., Welpton, R., Wolters, A. and Woods, C. July 2019. Handbook on Statistical Disclosure Control (SDC) for Outputs
7. Mackey, E. and Elliot, M. (2013) ‘Understanding the Data Environment’, XRDS, 20(1); 37–39
8. Mourby, M., Mackey, E., Elliot, M., Gowans, H., Wallace. S., Bell. J., Smith. H., Aidinlis, S. and Kaye, J. (2018) ‘Anonymous, Pseudonymous or Both? Implications of the GDPR for Administrative Data’, Computer Law and Security Review
9. Ohm, P. (2010) Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization, 57 UCLA L. Rev. 1701, 1717–23. (2010).
10. UK Information Commissioner’s Office’s (ICO) Anonymisation: managing data protection risk Code of Practice. https://ico.org.uk/media/1061/anonymisation-code.pdf

^Back to contents

Anonymisation and pseudonymisation of research data was originally published in My Research Essentials on Medium, where people are continuing the conversation by highlighting and responding to this story.

Contents

• Introduction
• Key areas of data security
• Storing research data securely
• Sharing research data securely
• Disposing of research data securely
• Summary
• Further support

Introduction

The security of research data is essential to protect against data loss, unauthorised access and change, disclosure and ensure compliance with institutional, funder, data provider and legislative requirements.

In this post we will look at what you need to consider from collecting and storing your data through to sharing and disposing of data appropriately.

^ Back to contents

Key areas of data security

Data security is important to protect highly restricted or sensitive information, for example where personal data, intellectual property, commercial interests, or national security is involved. This is commonly referred to as ‘special category data’.

Security of special category data

You can find out more about what special category data is and your responsibilities in the resource ‘Find out how the data protection principles apply to research’.

Whilst adopting a proportionate risk based approach, the entire lifecycle of the research information needs to be considered, from creation to destruction. Minimum controls for highly restricted information to remain secure include:

• authenticated access
• 2-factor authentication
• user access controls with regular review
• encryption
• up-to-date anti-virus and firewall protection
• accessing using a UoM managed device
• identified and guaranteed the location of the information

A good example of special category data is if you intend to capture audio, video or images of participants. Still and moving images and sound recordings featuring identifiable individuals contain the personal data of the participants. This means they must be processed in accordance with data protection laws. Taking recordings of participants for research projects is the standard operating procedure for secure handling of recordings and transcriptions.

Physical and network security

Physical security, network security and the security of computer systems and files each need to be considered to ensure the protection of information and prevent unauthorised access, changes, disclosure or destruction of information.

The Information Governance Office provides a review service which will be necessary if you are processing personal data and need to carry out a Data Privacy Impact Assessment (DPIA). You are likely to need to carry out a DPIA if you are using new technologies and/or cloud based solutions, if your research data leaves the European Economic Area (EEA), or if The University of Manchester does not provide you with the required tools.

^ Back to contents

Storing research data securely

When choosing storage options you need to consider:

• Where, when and how the data will be backed up?
• Is the data stored securely?
• Who can access it and how?
• How will you archive your data at the end of your project?
• Is your chosen storage solution appropriate for the type of data and your requirements?

Storing personal data

You should not keep ‘Person Identifying Information’ (PII) indefinitely and should aim to anonymise it as soon as possible or follow the retention as prescribed by your funders, data providers or in line with University Records Retention Schedule.

You should, make sure you have processes for secure deletion of the data, both paper and electronic. Retention does not mean you archive after the retention period has been reached. At the end of the retention period you will need to securely delete the person identifying information.

Data storage solutions

All data must be stored and handled in a manner appropriate to its security classification, and the master copy of all digitally held information, regardless of its security classification, must be stored on University-approved systems.

If you intend to capture audio, video or images of participants, these must be stored as described in the Taking recordings of participants for research projects to ensure compliance with data protection laws.

To safeguard your data, we recommend using storage systems provided by the University, such as the Research Data Storage (RDS) Service, Data Safe Haven etc.

Please note: University-provided Dropbox Business accounts must only be used for sharing information, not long-term storage. Your P Drive should be avoided as information is not accessible to others in your absence.

More detailed guidance and a summary table of digital storage and collaboration options are available on our Storage and Collaboration page and the University Library Research Services pages.

^ Back to contents

Collaborating and sharing research data

There are further requirements and considerations where you are collaborating and sharing research data with colleagues, we will look at these below:

Principal Investigator

A Principal Investigator (PI) should identify the UoM research data management storage solution for their projects, and document details in their data management plan. The PI should communicate these procedures to all group members. The procedures should ensure that the PI is able to access all data produced by the research group and must meet all applicable security requirements.

Sharing and transferring digital research data

There are circumstances, such as fieldwork, where portable devices and media (e.g. laptops, hard drives, DVDs) may be necessary to temporarily store or transfer data. Where such exceptions exist, data should be moved as soon as possible to University-approved systems.

In addition, the University’s Standard Operating Procedure for Information Security Classification, Ownership and Secure Information Handling specifies that:

• All information must be stored and handled in a manner appropriate to its security classification, and the master copy of all digitally held information, regardless of its security classification, must be stored on University‐approved systems.
• Temporary storage of Highly Restricted or Restricted information outside of the University‐approved systems require the file, device or media to be encrypted and the device or media to be kept physically secure at all times.
• Highly Restricted information must always be encrypted, including data on University systems and with third‐party/cloud service providers.

To find out more about different storage and collaboration options and their characteristics, download the Digital storage and collaboration options guide from our webpages.

^ Back to contents

Disposing of research data securely

At the end of your research project you may be required to dispose of data and equipment following a suitable methodology. However you cannot simply delete the data to destroy it.

For example: When you delete a file from a hard drive, it is likely to still be retrievable (even after emptying the recycle bin). Even reformatting a hard drive is not sufficient. Files need to be overwritten multiple times with random data for best chances of removal. The only sure way to ensure data is irretrievable is to physically destroy the drive using an approved secure destruction tool.

Data providers usually require evidence and assurance that the data has been disposed of irretrievably. There are tools such as Blancco which can be used in such cases. With regards to the RDS service, The University of Manchester have worked with 3rd party data providers to provide alternatives for more complex storage solution which ensures:

• A process is brought together as a standard operating procedure.
• Data is irrecoverable.
• Destruction of data is evidence-based.
• Hardware is destroyed in-house at end of life.
• Destruction is certified by Research IT and linked to the standard operating procedure.

Providing evidence of disposal

Third party data providers will often ask for evidence of data disposal/destruction. This must be written up on a form normally provided by the third party, describing what, how and by who, with a signature of a witness in IT.

The evidence and completed form should be forwarded to the third party data provider, and a return email of acceptance of the approach and destruction requested. This should be stored safely in case of an external audit.

^ Back to contents

Summary

In this post we have introduced you to the key considerations and your responsibilities when storing, sharing and disposing of research data to ensure it stays secure.

For further support and guidance on digital data solutions you can contact Research IT. Information Governance also provide support and guidance on data protection, records management, information security and a risk review service.

Take a look at our further support section below to find links to other learning resources in this series.

^ Back to contents

Further support

Take a look at these related resources:

• Research with human participants: your responsibilities under UK GDPR
• Data Protection considerations
• Participant engagement and consent
• Find out how the data protection principles apply to research

Key webpages and contacts:

• Managing research data (The University of Manchester Library)
• University of Manchester guidance on cybersecurity
• University of Manchester Data Protection website
• IGO pages on Staffnet
• Research Ethics website
• My Research Essentials webpages

^ Back to contents

Thank you to our contributors

This resource was created in partnership with University of Manchester’s Research IT, specifically Mary Mcderby who wrote and advised on the content.

^ Back to contents

Keeping your research data secure was originally published in My Research Essentials on Medium, where people are continuing the conversation by highlighting and responding to this story.

Contents

• Introduction
• Does your research involve personal data?
• The six principles of data protection
• The rights of a data subject
• What are the rules for transferring personal data around the world?
• What do I need to consider as a researcher?
• Summary
• Further support

Introduction

The UK General Data Protection Regulation (UK GDPR) is a UK law which came into effect on 1 January 2021. It sets out the key principles, rights and obligations for most processing of personal data in the UK. It is based on the EU GDPR (General Data Protection Regulation (EU) 2016/679) which applied in the UK before that date, with some changes to make it work more effectively in a UK context.

The Data Protection Act 2018 sets out the framework for data protection law in the UK. It updates and replaces the Data Protection Act 1998, and came into effect on 25 May 2018. It was amended on 1 January 2021 by regulations under the European Union (Withdrawal) Act 2018, to reflect the UK’s status outside the EU. It sits alongside and supplements the UK GDPR.

The legislation concerns the processing (e.g. acquiring, holding, using) of information about individuals (‘personal data’).

The aim of data protection law is to balance the rights of individuals to privacy, with the legitimate interests of organisations to process personal data. UK GDPR gives extensive rights to individuals about whom The University of Manchester holds information.

It does not mean that researchers can’t obtain and use personal data but it does impose legal controls and restrictions that must be adhered to. There are six data protection principles that set out the requirements for handling personal data plus a requirement to demonstrate accountability. We will explore these later in this post.

In the UK the Information Commissioner’s Office (ICO) upholds information rights and oversees the legislation. Breaches of the UK GDPR may result in investigations by the ICO, potentially leading to significant fines, civil or criminal liability, adverse publicity and could damage your reputation as a researcher. You must also consider the impact that a breach might have on participants, causing them distress or embarrassment. A serious breach could ultimately lead to public distrust and a reluctance to participate in future studies.

UK GDPR is not designed to impede research; considering data protection isn’t an additional burden, much of it is common sense and consistent with applying normal research ethics principles.

^ Back to contents

Does your research involve personal data?

Defining personal data

The definition of personal data is deliberately broad; any information relating to a living person (the ‘data subject’).

A living person is one who can be identified, directly (from the data itself) or indirectly (from the combination of the data with other available data), by reference to an identifier such as a:

• Name
• Identification number
• Location data
• Online identifier.

Or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that living person.

UK GDPR does not apply to anonymous data: However researchers should consider whether or not an individual can be identified even after the usual identifiers have been removed.

Processing personal data

There are additional considerations when it comes to the processing of personal data. ‘Processing’ covers the majority of what a researcher might do with personal data, for example:

• Organising, adapting or altering it.
• Retrieving, consulting or analysing it.
• Disclosing, publishing, disseminating or otherwise making it available.
• Deleting or destroying it.

Special category data

Certain types of personal data are considered to be particularly sensitive and or could be used in a discriminatory way. These data types have been given specific protection within the UK GDPR; they include:

· personal data revealing racial or ethnic origin;

· personal data revealing political opinions;

· personal data revealing religious or philosophical beliefs;

· personal data revealing trade union membership;

· genetic data;

· biometric data (where used for identification purposes);

· data concerning health;

· data concerning a person’s sex life; and

· data concerning a person’s sexual orientation.

Special category information must be processed with additional safeguards in place. We also discuss special category data in this post.

^ Back to contents

The six principles of Data Protection

Researchers must process all personal data in accordance with the following principles.

Personal data must:

1. Be processed lawfully, fairly and in a transparent manner; (lawful, fair and transparent).
2. Be collected only for specified, explicit and legitimate purposes, and not be further processed in any manner incompatible with those; (purpose limitation).
3. Be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed; (data minimisation).
4. Be accurate and, where necessary, kept up-to-date; (accuracy).
5. Not be kept as identifiable data for longer than necessary for the purposes concerned; (storage limitation).
6. Be processed securely (integrity and confidentiality).

You can find out more on how each of these principles applies to your research in this post.

^ Back to contents

The rights of the data subject

Individuals have extensive rights under the UK GDPR, which they may exercise by submitting requests to the data controller processing their data. Data subjects have the following rights: the right of access, rectification, erasure (often referred to as the right to be forgotten), objection, restriction of processing, data portability and rights relating to marketing and profiling.

These rights apply differently to different forms of processing and certain rights may not apply at all in certain circumstances. Research is one such area where there are derogations (exemptions) to the data subject rights.

Exemptions under the Data Protection Act 2018

Research and Archiving

GDPR allows for the following rights to be limited within a research context:

• the right of access,
• the right to rectification,
• the right to restrict processing,
• the right to data portability,
• the right to object.

However there is no blanket exemption. Exempting or limiting those rights is possible only if they would;

• prevent or seriously impair the research activity in question (scientific or historical research purposes or statistical purposes) and only if certain safeguards apply, such as measures to ensure there is data minimisation.

In addition, the exemption and the exceptions only apply:

• if the processing is not likely to cause substantial damage or substantial distress to an individual;
• if the processing is not used for measures or decisions about particular individuals, except for approved medical research;
• if the research results are not made available in a way that identifies individuals.

These additional requirements are set out in section 19, and the exemption at Schedule 2, Part 6 of the Data Protection Act 2018.

Reporting a Data Breach

Compliance with the UK GDPR is a legal requirement; breaches of data protection law may result in investigations, significant fines, adverse publicity, and civil or criminal liability.

A breach leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed. If you think personal data has fallen into the wrong hands or has been lost you must report it immediately.

Organisations have a statutory deadline of 72 hours to report serious breaches to the Information Commissioners Office.

To report a data breach contact the Information Governance Office immediately by emailing: infosec@listserv.manchester.ac.uk

What are the rules for transferring personal data around the world?

The EU GDPR primarily applies to controllers and processors located in the European Economic Area (the EEA). This is comprised of the EU states plus Norway, Liechtenstein and Iceland. The UK now has its own version of the GDPR.

Because individuals risk losing the protection of the GDPR if their personal data is transferred to a country with a lower standard of data protection law, both the EU and UK GDPR seek to restrict these transfers unless certain measures or safeguards are in place.

The measures or safeguards most commonly used can be split into four types:

1. Transferring personal data to an approved ‘adequate’ country
2. Standard contractual clauses
3. Ad-hoc transfers of personal data
4. Binding Corporate Rules

Seek advice from the Contracts Office, the Procurement team or the Information Governance Office if your research involves the transfer personal data outside of the UK.

Privacy Shield

This safeguard operated until Summer 2020. It placed requirements on US companies certified by the scheme to protect personal data and provides for redress mechanisms for individuals and replaced another previous safeguard for the same kind of transfers, called Safe Harbour. The US government Department of Commerce oversaw certification under the scheme. It allowed transfers to be made to US companies that were members of the Privacy Shield scheme. The European Court of Justice ruled that Privacy Shield was invalid in a July 2020 judgement. This ruling, the so-called Schrems II judgement, stated that personal data can no longer be transferred to a US based company under the framework and no new contracts can be entered into that seek to rely on it.

It is likely that the Standard Contractual Clauses will now need to be used for most of these transfers. Because of the Schrems II judgement we must now seek some additional assurance that the other party is able to comply with the SCCs (there is a specific clause relating to the US and another for data importers based in other countries) before we agree to them.

Seek advice from the Contracts Office, the Procurement team or the Information Governance Office if your research involved the transfer personal data to the US or another non-adequate country.

Location of researcher

For research work at University of Manchester, it does not matter if the research project is taking place in a country outside the UK or EEA, the UK GDPR will apply irrespective of where the data processing is taking place if The University is processing personal data or is the data controller. Local laws may also apply.

^ Back to contents

What do I need to consider as a researcher?

Data Management Plan

The Data Management Plan outlines how a research project will manage data both during the research and after the project is completed. You are asked to add in detail (proportionate to the nature of your research) about what personal data will be collected, processed and stored.

High risk processing assessments

If your research is likely to involve high risk processing the relevant researcher or PI may need to complete a research assessment which may ultimately lead to a full Data Protection Impact Assessment being carried out. This will be done in consultation with the Information Governance Office. For more information as to what constitutes ‘high risk’ processing read the following ICO guidance and examples.

Contracts

If your research involves sharing personal data with another organisation (ie not just the anonymised outcomes) a contract must be in place. Contact the contracts office for advice.

This will involve agreeing who the ‘data controller’ is and where necessary, who the ‘data processor’ is. In most cases The University will be the controller but this will be assessed by the legal advisors and the Information Governance Office.

Participant Information Sheets

Ensure that your participant information sheet and consent forms include sufficient information to meet the UK GDPR requirement of transparency. You can find out more about Participant Information Sheets in this post.

Anonymisation and Pseudonymisation

UK GDPR does not apply to anonymous data, however researchers should consider whether or not an individual can be identified even after the usual identifiers have been removed. If data can be combined from different sources it may allow a person to be identified — whether by the research team or by another person. Note that the process of anonymising personal data is covered by UK GDPR.

Pseudonymisation is a method of disguising the identities of individuals to whom information relates. It may involve removing a common identifier and using a pseudonym (e.g. a randomly allocated number), enabling data to be collected about the same individual without recording their identity. Pseudonymising data can be useful in research as a method of applying a safeguard to protect personal data. You can find out more in this post.

^ Back to contents

Knowledge Check

Let’s take a look at what you have learned. Try the questions below to see if you have remembered the key points from this post. If you struggle with any of the questions go back and check that section of this post again.

^ Back to contents

Summary

In this resource we explored Data Protection Law and how it applies to research with human participants.

If you haven't already we would recommend you take a look at the ‘Managing and sharing data from human participants’ post series which explores similar topics from an ethics perspective. In particular the post ‘Data protection considerations’, both of these are linked from the further support section below.

^ Back to contents

Further support

Take a look at these related resources:

• Research with human participants: your responsibilities under UK GDPR
• Data Protection considerations
• Participant engagement and consent
• My Research Essentials webpages

Key webpages and contacts:

• University of Manchester Data Protection website.
• IGO pages on Staffnet.
• Research Ethics website

^ Back to contents

Thank you to our contributors

These resources were created in partnership with University of Manchester’s Information Governance team. Special thanks to Liz Skae, Alex Daybank and Laurence Malbeaux who wrote and advised on the content.

^ Back to contents

Find out how the data protection principles apply to research was originally published in My Research Essentials on Medium, where people are continuing the conversation by highlighting and responding to this story.

Contents

• Introduction
• The six principles of Data Protection
• Lawful, fair and transparent processing
• Legitimate and limited purpose
• Data minimisation
• Accurate and up to date
• Storage limitation
• Integrity and confidentiality
• Summary
• Further support

Introduction

The UK General Data Protection Regulation along with the Data Protection Act 2018 concerns the collection of, holding, processing and using of information about individuals or more (‘personal data’).

The legislation balances the individual’s right to privacy with the legitimate interests of organisations wanting to process their personal data. UK GDPR gives extensive rights to individuals. When undertaking research with human participants it is important you understand what responsibilities you have in relation to how you collect, process and use your participants’ data.

Breaches of the UK GDPR may result in investigations by the Information Commissioners Office (ICO), potentially leading to significant fines, civil or criminal liability, adverse publicity and could damage your reputation as a researcher.

^ Back to contents

The six principles of Data Protection

Researchers must process all personal data in accordance with the following principles.

Personal data must:

1. Be processed lawfully, fairly and in a transparent manner; (Lawful, fair and transparent).
2. Be collected only for specified, explicit and legitimate purposes, and not be further processed in any manner incompatible with those; (Legitimate and limited purpose).
3. Be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed; (Data minimisation).
4. Be accurate and, where necessary, kept up-to-date; (Accurate and up to date).
5. Not be kept as identifiable data for longer than necessary for the purposes concerned; (Storage limitation).
6. Be processed securely (Integrity and confidentiality).

In the remainder of this post we will explore each principle in more detail.

^ Back to contents

1. Lawful, fair and transparent processing

This is an overriding objective of UK GDPR and when sufficiently met, it will help to ensure you meet the requirements for the other principles.

The processing of personal data must have a lawful basis (a legally acceptable reason for processing the data). There are six legal bases specified in the UK GDPR; the three that are important to understand from a research perspective are outlined below.

Research being a ‘Public interest task’ covers the majority of The University’s research work and likely be the most common legal basis for processing. It applies where the processing is necessary for the performance of a task carried out in the public interest. As a result, personal data can be processed without consent.

Consent as one of UK GDPR’s lawful bases for legally processing personal data is different to, and should not be confused with, consent that researchers usually seek from people to participate in a project. The need to seek consent from participants in research in order to satisfy ethical considerations is necessary, but it is separate from the requirement under the UK GDPR. You can learn more about participant consent in this post.

UK GDPR sets a very high standard for valid consent and it may be difficult to rely on consent as your basis for processing. Consent can be withdrawn by participants at any time, so if a research participant exercised this right, the research team would need to stop processing that individual’s data. The University would therefore, not usually recommend that researchers rely on consent as their lawful basis for processing.

As a public authority, The University cannot rely on legitimate interests for any processing it does to perform its public interest tasks. However, legitimate interests may be the appropriate legal basis where it is difficult to demonstrate that the research is necessary to meet a public interest. For example, because it is funded by a private company and is commercial in nature.

When processing special categories of data, for example personal data about health, ethnicity, political opinions, religious beliefs, etc., you must meet an additional legal basis for processing. In these cases, the most likely condition for researchers will be that such processing is ‘necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with safeguards’.

The fairness and transparency requirements give control to participants; they have greater awareness of how their data is being used and can object if they wish. ‘Fair’ processing requires researchers to consider how their use of personal data affects the interests of the individual concerned; if it’s likely to cause them detriment, you must consider whether it is justified.

When you are collecting personal data from individuals you must be clear, open and transparent with those individuals, by explaining what you intend to do with their data. For research this information is most often provided to data subjects in the form of a privacy notice or participant information sheet. Transparency information must be concise, easy to understand and easy to find.

Good research transparency should help participants understand that data is commonly linked with other data sources, kept for a long time, reused to address important research questions and how their interests are protected.

Privacy Notices for research participants (full version and a simplified version are available on the Ethics website). Links to them are also provided in the Participant Information Sheet templates.

You’ll need to choose the relevant one depending on the type of research you are doing.

^ Back to contents

2. Legitimate and limited purpose

This principle explains that personal data shall be collected only for specified, explicit and legitimate purposes, and not further processed in a manner incompatible with those purposes. Where you have obtained personal data for a specified purpose, you should not then be allowed to use it for other purposes (i.e., ‘further processing’) that are incompatible with that original purpose.

However, the UK GDPR states that the further processing of data for research purposes will be considered compatible with the original purpose for which the data was collected. In addition data collected for a non-research purpose may be reused for research purposes provided the necessary information is provided to the data subjects, and to do so before the further processing takes place.

^ Back to contents

3. Data Minimisation

This principle outlines the need for personal data collection to be adequate, relevant and limited to what is necessary for the intended purpose for which it is processed, i.e., collect only what you need to fulfil your research purpose.

This principle does not just apply to the amount of data you collect but who has access to it. This could apply to all aspects of the research work, e.g. consider whether all members of a research team and collaborators need access to the full data set, can anonymisation or pseudonymisation be utilised before sharing. Take a look at this post ‘Data protection considerations’ for further information.

^ Back to contents

4. Accurate and up to date

If data is not kept up to date and inaccuracies amended, it may no longer be relevant. However, the purpose of some research projects might be to create a point in time archive, where updating would defeat the purpose. In this case researchers do not need to keep the personal data up-to-date.

^ Back to contents

5. Storage limitation

This principle refers to not keeping personal data for longer than necessary for the purposes concerned. The UK GDPR does not specify how long personal data should be held for, although a specific retention period may be required by a research funder or sponsor, or as a result of regulatory or policy considerations. If this is the case, ensure it is included in your Data Management Plan. In all cases the research participants should be told about the likely retention period. The University of Manchester Records Retention Schedule can be accessed here.

^ Back to contents

6. Integrity and Confidentiality

Personal data must be processed securely; information security breaches may cause serious harm or distress to individuals, cause embarrassment or be highly inconvenient. Individuals are entitled to be protected from all forms of security breach which requires researchers to ensure they are using appropriate ‘technical and organisational measures’ to gather, process and store personal data.

Depending on the nature of the research and associated risks, researchers should consider the technology to be used and liaise with Research IT and or Information Governance teams as appropriate.

^ Back to contents

Summary

In this post we explored the six Data Protection principles for dealing with personal data and your responsibilities as a researcher to adhere to UK GDPR.

If you haven't already we recommend you also take the time at look at this post: ‘Data Protection law: Handling research data from human participants’ which explores the wider context of UK Data Protection law in relation to research.

Several posts related to this topic are linked in the further support section below.

^ Back to contents

Further support

Resources

• Find out how the data protection principles apply to research
• Participant engagement and consent
• Data Protection considerations
• My Research Essentials webpages

Key webpages and contacts

• University of Manchester Data Protection website
• IGO pages on Staffnet
• Research Ethics website
• Research Data Managment - University of Manchester Library

^ Back to contents

Thank you to our contributors

These resources were created in partnership with University of Manchester’s Information Governance team. Special thanks to Liz Skae, Alex Daybank and Laurence Malbeaux who wrote and advised on the content.

^ Back to contents

Research with human participants: your responsibilities under UK GDPR was originally published in My Research Essentials on Medium, where people are continuing the conversation by highlighting and responding to this story.

Introduction

The University of Manchester’s Our Future vision is to transform our research environment in ways that support open and responsible practices. As an early signatory of the San Francisco Declaration on Research Assessment (DORA), the University is committed to supporting the Wellcome Institute’s 2021 Open Access Policy requirement for demonstrable implementation of responsible metrics principles.

Part of this involves The University of Manchester Library leading a project to advocate for and support the implementation of DORA and other responsible metrics principles throughout the University. A big part of this work will be improving training and guidance on the responsible use of metrics in research assessment. In this post we will introduce you to how we will do this and would welcome your feedback and thoughts.

What can you expect?

We are planning to develop training materials in a modular way, creating and sharing individual resources as soon as they are ready. This will also allow us to get feedback from you on what training and materials you would like.

We are hoping what we create will help increase your awareness of the need for responsible use of research metrics, and the support available to you via the Library.

We would love to hear from researchers so we can collaborate and share knowledge in what we create. This will help us refine ideas and provide what you need in the best format for you. We will share details of how you can get in touch at the end of this post.

The real-world impact of responsible research metrics

The concept of ‘responsible research metrics’ might not be familiar even for researchers familiar with research metrics. At first it might not seem to be particularly significant or potentially problematic. However, irresponsible use of research metrics can negatively affect researcher’s careers and lives. There’s evidence that suggest researchers from minority groups tend to be most affected from inappropriate use of metrics.

To help address this we are aiming to highlight the real-world impact of irresponsible use of research metrics by creating a video interview with an academic colleague who has undertaken research into biases in academia and research publication.

Role-based training & materials

We will be developing resources which are tailored to roles and career stage. For example a junior researcher, an Early Career Researcher or Postgraduate Research Student is likely to have a different level of knowledge than a more established or senior researcher, a department lead, or a lab owner. As well as making materials relevant to what different people are using them for such as those using research metrics in research assessment, recruitment, promotion or for their own career development.

Format of materials

We’re hoping to develop instructional materials for these audiences, available openly online. These are likely to take the form of blog posts like this one. Content of the resources so far plans to focus on the following elements :

• What are research metrics?
• How are these used? (specific to context of role(s))
• How should these be used responsibly?
• What are the consequences of irresponsible use?

We will use feedback and engagement data for these resources to inform future development of resources and whether an interactive online module may be useful.

What next?

We intend to begin work on the video interview we mentioned earlier covering the ‘why’ of research metrics very shortly.

If you have any feedback or thoughts you can get in touch with us via email researchmetrics@manchester.ac.uk.

Developing training and guidance to support responsible use of research metrics was originally published in My Research Essentials on Medium, where people are continuing the conversation by highlighting and responding to this story.

Introduction

Many people associate the words ‘research ethics’ with red tape and think of it as just another tick box exercise that they have to complete in order to begin their research.

However the concept of research ethics first came to the forefront of people’s minds because of the Nuremburg trials and the horrendous atrocities that were committed on innocent human beings. After the trials, the Declaration of Helsinki was drafted. It outlines the basic ethical principles that researchers must adhere to when conducting their studies. Put simply it is protection and respect for other people, something that we should all be thinking about when designing and conducting our studies.

If you automatically tend to associate research ethics with burdensome requirements, you need to change focus and remember why these principles are important: to keep people safe.

The University of Manchester fully supports the creativity and ingenuity of our research community but we also take the safety, rights, well-being and confidentiality of our research participants extremely seriously.

To support this, we have a wealth of guidance information available to help you meet the balance between methodologically sound yet ground breaking research that is safe, well managed and committed to the protection of those who take part.

Take a look at each of the posts in this series which explore the ways in which you can ensure your study is designed and conducted in a way that also supports this balance and ultimately leads to good quality research.

Links to each resource

Throughout the resources there will be case studies where we will ask you to reflect upon what you know and what you have learnt. We highly recommend you read through each of these posts in order to get a good understanding of the topic. Click the links below to access each post:

• Recruitment of research participants
• Participant Information Sheets
• Obtaining informed consent
• Research with children and young people
• Research with additional considerations
• Data Protection considerations

Frequently Asked Questions

Further detailed information on all of the topics that are covered in this series are available on the Research Ethics website and via the Frequently Asked Questions document. If after reading these resources you still have specific queries related to your research study, we would encourage you to first speak with your supervisor or Ethics Signatory.

The central ethics team are also available to assist with complex ethical queries from supervisors or Ethics Signatories.

Thank you to our contributors

These resources were created in partnership with University of Manchester’s Research governance, ethics and integrity team. Special thanks to Genevieve Pridham, Research Ethics Manager who wrote and advised on the content.

^ Back to top

Participant engagement and consent was originally published in My Research Essentials on Medium, where people are continuing the conversation by highlighting and responding to this story.

Contents

• Introduction
• Approaching participants
• Using Gatekeepers
• Recruitment materials
• Summary
• Further Support

Introduction

An essential part of any research study that involves human participants is recruiting individuals to take part. These may be members of the general public or those with specific attributes that you’re interested in, such as being members of a particular organization, within a particular age group or those with specific medical conditions.

^ Back to contents

Approaching participants

No matter who your participants are you need to think about how to advertise your study so you gain sufficient interest whilst also ensuring that you’re not intrusive or aggressive in your approach.

Your approach should be inviting but you must ensure that potential participants don’t feel pressured or obligated to take part. Some common methods for approaching potential participants include the use of:

• Posters
• Telephone or Video calls
• Letters
• Social media posts

It is important to be aware some methods can be more intrusive than others. It’s always best, if possible, to approach potential participants indirectly rather than directly.

Using posters, flyers, leaflets or social media adverts are all excellent ways to gain interest without people feeling pressured into taking part. Other good methods include using emails or letters addressed to either large groups (distribution lists) or publicly available contact details. A fuller list of methods organised by how intrusive they are can be found here.

Using Gatekeepers

Gatekeepers might be another option that could help facilitate your recruitment strategy. Gatekeepers, as the terms suggests, act as a channel for conveying information for a large group of potential participants and sometimes you may need to seek their permission before you’re able to access a specific group.

For example:

This might be a professional organization where you’d like to speak with the employees. It’s likely that you’ll need permission from a manager or even CEO before you could approach these individuals.

Gatekeepers are not only able to provide access to an otherwise difficult to reach group, but they can also help with your recruitment strategy by circulating details of the study to the group on your behalf.

There are of course other potential methods for recruitment that involve contacting people directly through telephone calls, video call, instant messaging, chat groups or even in person. However, many times these are considered to be ‘cold calling’ techniques as the potential participant is often caught off guard by the invitation and may not feel as though they can decline. For this reason, it is advisable to choose a less intrusive method of approaching participants so they have both time and space to consider your invitation and decide if they wish to take part.

A word of caution if using gatekeepers

One must be aware of the possible power dynamic that may exist in organisations and make efforts to mitigate this and ensure that possible participants are free to choose if they would like to take part.

For example, if the gatekeeper is a manager who agrees to circulate the information to those they directly line manage, the employees may feel obligated to take part to either be viewed in a more favourable light or out of fear for possible repercussions for not taking part.

To help mitigate this, it is recommended that the person who circulates the information is impartial and that the message which is circulated re-iterates that participants are free to make their own decision, without any possible negative repercussions should they decline.

^ Back to contents

Recruitment materials

When approaching your potential participants, you should use recruitment materials (also known as advertisements) to explain the purpose of your study as well as what’s involved and any specific requirements.

Recruitment materials may include items such as posters, flyers, leaflets, social media text, letters, emails or videos. They should strike a balance between capturing someone’s attention, and ensuring they are not overly coercive or promise unrealistic benefits. Materials should also be short and to the point, you will have an opportunity to provide more detailed information at a later date.

The essential elements of a good advertisement include:

What the study is about:

Describe in general terms what your study is investigating, such as: ‘ The study is about the correlation between blue light emissions from hand held devices (e.g. mobile phones) and a lack of quality sleep.’

What will participants be asked to do:

Specify any tasks that the participants will be asked to do during the study, such as: ‘You will be asked to take part in a one time, 1 hour long Zoom interview about your views on mobile phone usage and the quality of your sleep. You will also be asked to complete a diary for 7 days prior to the interview about mobile phone usage and your sleep patterns.’

What are the inclusion or exclusion criteria:

Clarify any specific attributes the participants must have or activities they must do in order to take part, such as: ‘You must use a mobile phone daily.’

How can participants contact the researcher:

Provide contact details such as an email address or telephone number so those interested in taking part can contact you. You may also choose to use a QR code that can be read by one’s smartphone that takes them to your website or automatically populates an email. For example, ‘You can contact the researcher by email: sleep@manchester.ac.uk; or by phoning 0161–777–7777’.

Monetary amounts are not permitted:

You may clarify that one will be compensated for their time or entered into a prize draw but you must not include details of how much as this is deemed to be coercive. For example ‘You will be compensated £20 for your time’ is deemed to be potentially coercive. Instead this should be written as ‘you will be compensated for your time’ and the specific amount included in other study documentation.

^ Back to contents

Knowledge check

Let’s take a look at what you have learned. Read the case study below and choose an option from the multiple choice question below it. You may choose more than one option.

Case study example:

‘You’re conducting a research study about the impact of the COVID pandemic on the parents or guardians of school aged children.

As your child also attends school, you’re part of a WhatsApp group with all the other parents or guardians from your child’s class. Some of the parents or guardians you know and others you’ve never met before. As you already have their numbers, you’d like to send the advertisement to the group to see if anyone would be interested in taking part.

Part of this message would ask that if anyone is interested that they send an email to your generic research email address as opposed to replying in the group chat.

You would also make it clear that they are under no obligation to reply to the group text.’

^ Back to contents

Summary

In this post we explored how you might approach and recruit participants to your study.

Once potential participants respond to your advertisement and express an interest in taking part, you need to provide them with more specific information about what the study involves. This is done through the use of a participant information sheet.

Take a look at our post about Participant Information Sheets next or go back to the full list of posts in this series.

^ Back to contents

Further support

• Participant information sheets
• Obtaining informed consent
• Research with children
• Research with additional considerations
• Data Protection considerations
• Participant engagement and consent
• My Research Essentials webpages

^ Back to contents

Recruitment of research participants was originally published in My Research Essentials on Medium, where people are continuing the conversation by highlighting and responding to this story.

Contents

• Introduction
• Providing information after initial contact
• Components of a good PIS
• Constructing your PIS
• Summary
• Further support

Introduction

This post is part of a series covering ethical issues relating to researcher participation and consent, the full series is linked at the end of this post and we recommend you read the full series in order.

In this post we will be looking at providing potential participants with more detailed information about the study so they can decide if they wish to take part.

^ Back to contents

Providing information after initial contact

Once potential participants respond to your advertisement and express an interest in taking part, you need to provide them with more specific information about what the study involves. This is done through the use of a participant information sheet (PIS).

A good PIS is comprehensive, yet concise and written in lay language that members of the general public will be able to easily understand. You want to avoid participants needing to read a lengthy, complex document as this may result in them losing interest, and hindering recruitment to your study.

If detailed, supplementary information needs to be made available to participants, such as the Research Privacy Notice, you can provide a hyperlink to the relevant digital document or have paper copies available upon request.

The PIS serves an important purpose as it’s your opportunity to outline your research and specifically what you’d like the participant to do. Potential participants then need to have the opportunity to consider this information before deciding whether or not they want to take part. For this reason, the PIS should be given to participants at least 24 hours before any activities are due to begin (e.g. interviews).

^ Back to contents

Components of a good PIS

In order to ensure that the Participant Information Sheet has all of the essential information needed for the participant to make an informed decision about participating, it should include the following key sections:

1. About the Research

• Who will conduct the study?
• What is the purpose of the research or what does it hope to highlight or achieve?

2. What would my involvement be?

• What will the participant be asked to do?
• How long will it take?
• Is participation a one off event or part of a series?
• Will they be compensated for their time?
• What happens if they change their mind part way through?

3. Data protection and confidentiality

• What data will be collected about the participant?
• What is the legal basis for processing this data?
• What are the rights of the participant in relation to their data?
• Will their participation be confidential or will data be shared with others?
• What happens if something is revealed during the study that means the researcher needs to alert another person or group of people or provide support via charities or other organisations?

The last question in the list is often one of the most difficult to plan for.

For example:

‘If you’re conducting interviews with members of the general public about their experiences during the COVID pandemic lockdown and they express concerns about their current state of mental health and well-being, you may need to provide them with support via mental health charities or encourage them to speak with their GP.

If they become very upset during the interview, you may need to call a family member or friend to come and meet with them or contact another professional organization for additional support.’

Another example involves disclosures and needing to report these to the relevant organisation or authority.

For example:

If during the course of an interview a participant reveals child safeguarding concerns, you must report these following the University’s Child Protection Policy and note this requirement in the PIS.

4. What if I have a complaint?

• Contact details of the supervisor or first point of contact.
• Contact details of the Research Governance, Ethics and Integrity Team (if not satisfied with response from first point of contact).
• Contact details of the Data Protection Office and Information Commissioner’s Office (if complaint is in relation to UK GDPR).

5. Researcher contact details

• Should be the telephone number and or email address of the student.

6. Version number and date

• Version numbers and dates should appear in the header, footer or just below the title of all supporting documents and is required under UK GDPR.

7. Ethics committee and reference number

• The name of the ethics committee that granted approval (if applicable) and the reference number of your study

8. Additional sections that may be applicable

• Will the research project be published?
• Is the research project being funded?
• Disclosure and Barring Service (DBS) Check

Constructing your PIS

Having all of these essential sections will help to ensure that your participants have detailed information about your research and can therefore make an informed decision about whether or not they want to take part.

Some other useful advice to remember when constructing your PIS is:

• Always use a UK GDPR compliant template, which can be downloaded from the research ethics website.
• Ensure that any other essential sections are also included. For example, if working with children or young people you should also include the section relating to a DBS check.
• If any information in the template is not relevant to your study (e.g. if you’re not planning on sharing data with others) then ensure it is removed to avoid potential confusion.
• The template contains words in red that need to be changed to the specifics for your study. It also contains guidance notes (e.g. in the header) that should be removed in your final version.
• Ensure you update the footer with a correct version number and date for your document. This will help to ensure that your participants are receiving the most up to date version, should you choose to make changes in future.
• Ensure you write the PIS in lay language. You should also consider the average reading age of your potential participants as you may need to simplify this further. For example if you are planning on recruiting those with significant learning difficulties or those recovering from a stroke, you may wish to consider presenting your PIS in a more simplified format and even using pictures.
• You may need to have different PIS documents if you are recruiting more than one group of participants (e.g. teachers and parents)

Summary

In this post we explored best practice for providing information to participants after they express an interest in taking part in your research study. We recommend you now look at the next post in this series ‘Obtaining Informed Consent’. Further support posts linked below or go back to the full list of posts in this series here.

^ Back to contents

Further support

• Obtaining Informed Consent
• Research with Children
• Research with Additional Considerations
• Data Protection Considerations
• Recruitment of research participants
• Participant engagement and consent
• My Research Essentials webpages

^ Back to contents

Participant Information Sheets was originally published in My Research Essentials on Medium, where people are continuing the conversation by highlighting and responding to this story.

Contents

• Introduction
• Written vs verbal consent
• One off versus ongoing consent
• Components of a good consent form
• Summary
• Further support

Introduction

Once your participants have had the opportunity to review the information in your Participant Information Sheet (PIS), they may decide to take part in your study. This agreement to take part is known as informed consent and must be recorded by the researcher.

There are a number of different ways of recording consent, depending on the type of study being conducted and the specific groups of individuals who are taking part.

The main types of informed consent are:

1. Written consent

Written consent is provided by signing or marking (e.g. thumbprint) a written consent form.

2. Verbal consent

Verbal consent is provided by asking the participant a series of questions (through the use of a consent script) and recording their verbal agreement to each statement. The recording can be done either by audio recording or through the use of detailed field notes. If field notes are used, you must include the participant’s name, the date on which consent is being taken and the specific statements they are agreeing to.

3. Implied consent

Implied consent is provided by ticking a box at the beginning of a questionnaire or survey in order to verify consent. In some cases, more than one tick box may be required if there are specific inclusion or exclusion criteria that you need to verify for your study (i.e. the participant being over 18 years of age, from a specific background or the user of a specific service) Please note that a full participant information sheet must still appear before the tick box.

However, there are cases where it is not possible to seek informed consent from participants such as when using publicly available data sets from Twitter or performing large scale observational studies in public spaces (e.g. parks).

In these cases, although informed consent will not be taken, it’s important to consider how you will protect the confidentiality of participants. If conducting observational studies you should produce an information sheet and have this available in case you are approached by a member of the public.

^ Back to contents

Knowledge check

Lets take a look at what you have learned. Read the case study below and choose an option from the multiple choice questionnaire below it. You may choose more than one option.

‘You want to conduct a research study about the use of illegal stimulants by various types of students and want to distribute an electronic questionnaire to find out why students take these substances and specifically how they purchase them. Given the subject matter, you feel that the best way to recruit participants would be to post your advertisement on Reddit, as accounts on this platform are anonymous and the identity of the participants would be protected. Your advertisement includes a brief summary of your research as well as a link to the questionnaire’.

^ Back to contents

Written versus verbal consent

Depending on the study you’re undertaking and the specific group of participants you hope to recruit, you may need to decide whether written or verbal consent is more appropriate.

Written consent is the preferred method of the ethics committees as it assures a standardized written record of specifically what the participant agreed to. This method uses a standard template of initialled or checked boxes that correspond to specific statements which may be compulsory in order to take part in the research or optional.

Compulsory: ‘I agree to take part in the study.’

Optional: ‘I agree that my anonymized data may be shared with other researchers at the University of Manchester.’

It is recommended that you ensure all optional statements are last to avoid any potential confusion.

Verbal consent may be appropriate for studies conducted with vulnerable groups or those who require that the information is read out to them. For example, if your research focused on the lived experiences of undocumented migrants in Manchester, the participants may be leery of signing any official document. In this case, it may be more appropriate to take verbal consent. If using this method, you can adapt the template for the written consent form into a consent script where you read aloud each statement and then ask the participant to agree.

^ Back to contents

One off versus ongoing consent

Another important consideration regarding informed consent is how many times you should seek it. For most studies, consent is sought and confirmed once at the beginning of the study and before any data collection takes place.

However, if your research study involves multiple visits, follow-up interviews or you’re involving vulnerable groups, you may choose to seek ongoing consent.

Ongoing consent is the re-affirmation that a participant is still happy to take part in your study. It can be given before each research activity (e.g. an interview or focus group) or can be incorporated as part of a longitudinal study.

Should you choose to take ongoing consent for your research, you’ll need to consider at which time points this should be done, how it will be recorded and what you will do if you are unable to contact the participant or they wish to withdraw from the study.

^ Back to contents

Components of a good consent form

When constructing your consent form (or script for seeking verbal consent), it’s important to include statements that outline any specific requirements of the study as well as any optional requests that you want participants to consider agreeing to.

Some examples of statements that outline specific requirements might include:

• ‘I confirm that I have read the attached information sheet (Version 2, Date 20/8/2020) for the above study and have had the opportunity to consider the information and ask questions and had these answered satisfactorily’.
• ‘I agree to the interviews being audio recorded’.
• ‘I agree that any data collected may be published in anonymous form in academic books, reports or journals’.
• ‘I understand that there may be instances where during the course of the interview information is revealed which means that the researchers will be obliged to break confidentiality; and this has been explained in more detail in the information sheet’.
• ‘I agree to take part in this study’.

Some examples of statements that include optional requests might include:

• ‘I agree that any anonymised data collected may be shared with researchers at other institutions’.
• ‘I agree that the researchers may contact me in future about other research projects’.
• ‘I agree that the researchers may retain my contact details in order to provide me with a summary of the findings for this study’.

^ Back to contents

Important tips to remember

Ensuring you have outlined all the specific requirements of participation as well as any optional requests will help your participants understand exactly what they are or are not agreeing to. To support this, please ensure you ask the participant to complete two copies of the consent form, one for you as the researcher and one for the participant to keep.

When constructing your consent form try to remember this best practice advice:

✓ Always use a UK GDPR compliant template, which can be downloaded from the research ethics website.

✓ Any points that are essential to participation in the study should be listed first with any optional points grouped together at the end. For additional clarity consider separating optional points into a new table.

✓ Remove any statements which are not relevant to your study to avoid confusion. For example if you’re not planning on sharing data with others.

✓ The template provided on the research ethics website contains words in red that need to be changed or deleted to match the specifics for your study. It also contains guidance notes (e.g. in the header) that should be removed from your final consent form.

✓ Update the footer with a correct version number and date for your form. This will help to ensure that your participants are receiving the most up to date version, should you choose to make changes in future.

✓ Number statements chronologically.

^ Back to contents

Knowledge check

Let’s take a look at what you have learned. Read the case study below and choose an option from the multiple choice question below it. You may choose more than one option.

‘You want to conduct a research study that learns about the Jedi religion, how followers became involved and what types of fundamental teachings are learnt and disseminated.

To do this, you want to conduct focus groups with participants, audio record the discussions and use direct quotes. You’d also like to take photographs of the groups for your Twitter feed and blog, where you’ll include some of the quotes and also a summary of the project. In order to gain access to the group, you’re going to seek permission from religious leaders’.

Tip: If you are unsure what gatekeepers are, take a look at this post; ‘Recruitment of research participants’.

^ Back to contents

Summary

In this post we explored best practice and considerations for obtaining informed consent including types of consent and constructing a written consent form. However, if your research is with children or vulnerable groups, there are additional considerations. We recommend you take a look at these posts next, they are linked from the further support section below.

Take a look at our further support posts linked below or go back to the full list of posts in this series here.

^ Back to contents

Further support

• Research with children
• Research with additional considerations
• Data Protection considerations
• Participant information sheets
• Recruitment of research participants
• Participant engagement and consent
• My Research Essentials webpages

^ Back to contents

Obtaining Informed Consent was originally published in My Research Essentials on Medium, where people are continuing the conversation by highlighting and responding to this story.

Contents

• Introduction
• Obtaining parental consent
• Types of parental consent
• Information sheets for children and young people
• Summary
• Further support

Introduction

Consent is the agreement to take part that is provided by your participant. If your participant is aged 16 years or older, we use the term consent but if they are under the age of 16 years we would use the term assent to describe this agreement.

The possible methods for obtaining assent from a person under the age of 16 are the same as those used for obtaining consent: written, verbal or implied. However, the templates to help you draft assent forms/scripts use simpler language and often contain suggestions of pictures or other images to support understanding.

The method for obtaining assent will also differ depending on the age of the child. For example, a child of 4 years wouldn’t be able to read and understand an information sheet so verbal would be the preferred method for obtaining assent. Just as for recording consent, you must ensure that you document all instances of verbal assent appropriately in case of future query or concern.

^ Back to contents

Obtaining parental consent

When you are planning to recruit children and young people under the age of 16, you must not only consider how you will obtain assent from those individuals but also how you will obtain consent from their parents/guardians to take part.

In most cases, assent from a child is not sufficient for them to be able to take part in a research study and you must also obtain parental/guardian consent. To do this, researchers will often liaise with the school/nursery/organization where the children are being recruited from for assistance with contacting parents/guardians. In this capacity, the school/nursery/organization is acting as a gatekeeper and will usually distribute study materials directly to parents.

It is recommended that information should be distributed to parents/guardians by at least two different methods to ensure the information is received. These may include:

• Information placed into the child’s backpack
• Emails/newsletters
• Text messages or messages on social media
• Information handed out by teachers directly to parents at the school gates

^ Back to contents

Types of parental consent

Obtaining consent from parents/guardians can take place in two different ways but there are specific University requirements and stipulations to these methods.

The first way is called opt-in which means that the parents/guardians receive detailed information about the study and then sign a consent form or indicate agreement verbally to the researcher. This is the preferred method of the University ethics committees as it ensures there is no discrepancy between the parent’s/guardian’s understanding of what their child will be asked to do and what will realistically occur during the research.

For ethical purposes, opt-in consent is also required for the following types of studies:

• Those involving invasive procedures (e.g. dental exams)
• Those using audio/video recordings or photographs
• Those which will likely result in the child becoming distressed or upset

The other method for obtaining parental/guardian consent is called opt-out. In this method, detailed information about the study is sent to parents/guardians along with an opt-out form that has a specified deadline for completion. The opt-out form is an opportunity for the parent/guardian to indicate that they are not happy for their child to take part in the research. Should the parent/guardian complete this form and return it to the researcher, the child will not be able to take part in the research. However, if no form is received by the researcher it is assumed that the parent/guardian is happy for their child to take part.

For ethical purposes, opt-out consent is only permitted for low risk studies where parents/guardians receive the detailed study information by at least 2 different methods. The opt-out consent method involves a level of assumption, so as a researcher, you must ensure you have a plan of what you will do should a parent/guardian contact you to complain that they did not receive the study information and are not happy about the fact that their child took part.

^ Back to contents

Information sheets for children and young people

Depending on the age of the child, an information sheet may be appropriate in order to help the child understand what they are being asked to do and what will happen to the information that they share with the researcher.

The information sheet should include simple language that is easy to understand, and if appropriate include pictures or figures for further clarification.

However you must be cautious not to overly simplify the sheet for older children as this may interpreted as patronizing and result in the child not wanting to take part.

If the child is aged 13 years or over you must also ensure that the information relating to GDPR is included. For ease, simple wording that relays this information has been included as part of the information sheet template.

^ Back to contents

Summary

In this post we have explored what considerations there are for obtaining assent if your research is with children. There may be different best practice advice where for example your research is with vulnerable groups. We recommend you read this post next.

Alternatively go back to our ‘Managing and sharing data from human participants’ post and explore all the posts in this series.

^ Back to contents

Further support

• Research with Additional Considerations
• Data Protection Considerations
• Recruitment of research participants
• Participant information sheets
• Obtaining informed consent
• Participant engagement and consent
• My Research Essentials webpages

^ Back to contents

Research with Children and young people was originally published in My Research Essentials on Medium, where people are continuing the conversation by highlighting and responding to this story.