<!DOCTYPE html>

<html data-programme="Research Integrity" data-course="Managing and Recording Your Research">

	<head>
		<title>Data ownership, protection and sharing</title>
		<meta charset="UTF-8">
		<meta http-equiv="X-UA-Compatible" content="IE=edge">
		<meta name="viewport" content="width=device-width, initial-scale=1">

		<link rel="stylesheet" type="text/css" href="../css/project.min.css">
		<link id="basic-print" rel="stylesheet" type="text/css" href="../css/print.min.css" disabled>
		<link id="summary-print" rel="stylesheet" type="text/css" href="../css/print_interactive.min.css">
	<script type="text/javascript" src="../scripts_scorm_12/SCORM_12_APIWrapper.js"></script>
<script type="text/javascript" src="../scripts_scorm_12/courseFunctions.js"></script>
</head>

	<body onLoad="javascript:Initialize();" onUnload="javascript:Terminate();">
	  
		<div id="app" v-cloak>
			<base-container
				screen-id="cre_1_70"
				current-module = "Managing and Recording Your Research"
				page-title = "Data ownership, protection and sharing"
				screen-time = "5"
				screen-time-period = "mins">

				<page-container>

					<page-row>
						<page-content-main>
							
							<p>If you put time and effort into a project, you might think you should own and be able to do what you want with the results of your work. In practice, the ownership and use of the information you collect is not that simple. Before storing your data in preparation for publication, three additional responsibilities need to be considered: ownership, protection and sharing.</p>
							
							<h3>Ownership</h3>

							<interactive-text><p>Researchers collect information, but they do not necessarily own it. Research projects come with strings attached, particularly if there is funding involved. Even in the case of 'self-funded' or 'unfunded' studies, the contractual relationship between a researcher and their institution will dictate who owns the information. Who owns the research information you collect?</p></interactive-text>
							<accessible-text><p>Researchers collect information, but they do not necessarily own it. Research projects come with strings attached, particularly if there is funding involved. Even in the case of 'self-funded' or 'unfunded' studies, the contractual relationship between a researcher and their institution will dictate who owns the information. Who owns the research information you collect? Continue on to find out more.</p></accessible-text>
							
						</page-content-main>
					</page-row>
					
					<page-row>
						<page-content-main>

							<interactive-text>
								<img id="cre_1_70_img1" class="img-responsive" src="../images/page_images/course_specific/cre_1_70_img1.png" alt="" />
							</interactive-text>
							<!-- ACCESSIBLE BLOCK -->
							<accessible-block>
								<h4>Funders</h4>
								<p>The funder gives ownership to someone else (e.g. a research institution) or retains ownership.</p>
								<hr>
								<h4>Agreements</h4>
								<p>Agreements should be established before the project begins, and can be used to establish ownership of any information resulting from the project.</p>
								<hr>
								<h4>Institution</h4>
								<p>When research funds are granted to an institution (e.g. a university) and not an individual, the institution retains ownership of the information.</p>
							</accessible-block>

						</page-content-main>
					</page-row>
					
					<page-row>
						<page-content-main>
							
							<p>If your research is funded, it is probably owned by your institution or your funder. Similarly, if you are employed by a university you are probably operating under contractual obligations regarding the ownership of your research. If you are not sure who will own the data/information you collect, check with your institution's research office.</p>
							
							<h3>Protection</h3>

						</page-content-main>
					</page-row>

					<page-row>
						<page-content-main>
							
							<p>After clarifying who owns the data or information you collect, your next responsibility is to ensure it is adequately protected. For different reasons, some research information is sensitive and needs to be protected from unauthorised viewing and use.</p>
							<p>In May 2018, the European Union's General Data Protection Regulation (GDPR) came into force, and was translated into UK law through the Data Protection Act 2018 (DPA 2018) &ndash; for links to both, see the "Useful links" pod. GDPR and DPA 2018 govern the use of <glossary content="Data that can be used to identify a living person.">personal data</glossary> in the UK and are complemented by other legal considerations, such as common law. All of these measures have implications for researchers working with personal data, but this is not the only type of data that needs to be treated with caution. Being a responsible researcher requires you to factor in a range of considerations to ensure your data is adequately protected at all times (for a discussion of some of the key general concepts associated with data protection, see the first "Additional information" pod).</p>
						</page-content-main>

						<page-content-sidebar>

							<!-- ADDITIONAL INFORMATION START -->
							<pod variant="b" has-modal="true">
								<pod-heading>Additional information</pod-heading> <!-- pod title -->
								<pod-content></pod-content>
								<!-- pop-up pod content -->
								<pod-modal-heading>Additional information</pod-modal-heading>
								<pod-modal-content>
									<p>There are a number of different terms that can be used to describe data (particularly data about people) that is being protected. It is important to realise that each term has a specific meaning, and they cannot be used interchangeably.</p>
									<p><strong>Private:</strong> Information that an individual does not want to share freely.</p>
									<p><strong>Confidential:</strong> Information that has restrictions on sharing. For instance, sharing private health data within a clinical team for treatment purposes, but not sharing that data outside the clinical team, is an example of treating data confidentially.</p>
									<p><strong>Anonymous:</strong> Information that has all personal identifiers removed to ensure it is impossible to identify the original source. Note that this involves more than just removing names or ID numbers (since, for example, it is possible to identify a specific person by combining a date of birth with a postcode). Similarly, photographs of people's faces and full genome sequences are never anonymous.</p>
									<p><strong>Pseudo-anonymous (also called link-anonymous):</strong> Information where personal identifiers have been replaced with a code (often a participant number) and where the key to the code is held separately from the data. This technique is often used in 'blinded' trials or if researchers may want to identify participants at a later stage.</p>
									<p><strong>De-identified:</strong> Data where identifiers have been removed, rendering it either anonymous or link-anonymous.</p>
								</pod-modal-content>
							</pod>
							<!-- ADDITIONAL INFORMATION END -->

							<!-- USEFUL LINKS START -->
							<pod variant="a" has-modal="true">
								<pod-heading>Useful links</pod-heading> <!-- pod title -->
								<pod-content></pod-content>
								<!-- pop-up pod content -->
								<pod-modal-heading>Useful links</pod-modal-heading>
								<pod-modal-content>
									<hosted-link id="RI_INT_cre_1_70_1">
										<ul>
											<li><a href="https://gdpr-info.eu/" target="_blank">General Data Protection Regulation (GDPR)</a></li>
											<li><a href="http://www.legislation.gov.uk/ukpga/2018/12/contents/enacted" target="_blank">Data Protection Act 2018 (DPA)</a></li>
											<li><a href="https://www.ukri.org/files/about/policy/ukri-gdpr-faqs-pdf/" target="_blank">UKRI: GDPR and Research &ndash; An Overview for Researchers</a></li>
										</ul>
									</hosted-link>
								</pod-modal-content>
							</pod>
							<!-- USEFUL LINKS END -->

						</page-content-sidebar>
					</page-row>

					<page-row>
						<page-content-main>

							<instructional-text><p>To test your understanding of the considerations that you will need to keep in mind when using data as a researcher in the UK, work through the statements featured in the activity below. If you believe a statement to be true, select the "tick". If you believe a statement to be false, select the "cross". You will be presented with feedback, and can then proceed to the next statement.</p></instructional-text>
							
						</page-content-main>
					</page-row>

					<page-row>
						<page-content-main>

							<instructional-text-accessible><p>To test your understanding of the considerations that you will need to keep in mind when using data as a researcher in the UK, work through the statements featured in the next activity. Decide whether you believe each statement to be true or false before you continue on to the feedback. Then you can proceed to the next statement.</p></instructional-text-accessible>
							
							<!-- ACTIVITY START -->
							<checklist allow-restart="true" has-ticks-and-crosses="true">
								<check-item>
									<p>GDPR and DPA 2018 apply to fully anonymised data.</p>
									<check-tick-cross>
										<check-tick incorrect><strong>Incorrect.</strong> Anonymised data is not subject to data protection legislation. However, it should be kept in mind that if you collect personal data, the act of anonymising it would be considered as 'processing' the personal data, and GDPR and DPA 2018 would therefore apply up to the point the data is fully anonymised. Pseudo-anonymised data (i.e. data that has been coded in order to protect participants' information) is covered by GDPR and DPA 2018.</check-tick>
										<check-cross correct><strong>Correct.</strong> Anonymised data is not subject to data protection legislation. However, it should be kept in mind that if you collect personal data, the act of anonymising it would be considered as 'processing' the personal data, and GDPR and DPA 2018 would therefore apply up to the point the data is fully anonymised. Pseudo-anonymised data (i.e. data that has been coded in order to protect participants' information) is covered by GDPR and DPA 2018.</check-cross>
									</check-tick-cross>
								</check-item>
								<check-item>
									<p>GDPR and DPA 2018 stipulate that researchers must have a 'legal basis' in place prior to commencing work.</p>
									<check-tick-cross>
										<check-tick correct><strong>Correct.</strong> If you are planning to work with personal data you must identify a 'legal basis' for proceeding. Often this is simply gaining consent from participants (although there are stipulations for how consent is obtained, so you should still seek guidance), but there are occasions when an alternative legal basis needs to be established. The legal basis you plan to use for processing personal data dictates what actions you subsequently need to take. It is often worth seeking advice from your institution's data protection advisor on this issue.</check-tick>
										<check-cross incorrect><strong>Incorrect.</strong> If you are planning to work with personal data you must identify a 'legal basis' for proceeding. Often this is simply gaining consent from participants (although there are stipulations for how consent is obtained, so you should still seek guidance), but there are occasions when an alternative legal basis needs to be established. The legal basis you plan to use for processing personal data dictates what actions you subsequently need to take. It is often worth seeking advice from your institution's data protection advisor on this issue.</check-cross>
									</check-tick-cross>
								</check-item>
								<check-item>
									<p>Under most circumstances, researchers must adhere to the common law duty of confidentiality.</p>
									<check-tick-cross>
										<check-tick correct><strong>Correct.</strong> There is a common law 'duty of confidentiality', which essentially requires researchers to ensure that participants will/would not be surprised to find out how their personal data is being used. In most cases, this means that you should ensure that you do not disclose information without the consent of the participant. However, if you are working in healthcare research you may need to receive further advice/support (especially if participants are dead), as exemptions can sometimes apply (see the "Additional information" pod).</check-tick>
										<check-cross incorrect><strong>Incorrect.</strong> There is a common law 'duty of confidentiality', which essentially requires researchers to ensure that participants will/would not be surprised to find out how their personal data is being used. In most cases, this means that you should ensure that you do not disclose information without the consent of the participant. However, if you are working in healthcare research you may need to receive further advice/support (especially if participants are dead), as exemptions can sometimes apply (see the "Additional information" pod). </check-cross>
									</check-tick-cross>
								</check-item>
								<check-item>
									<p>It is the legal duty of every researcher to disclose personal data if evidence of criminality is discovered. </p>
									<check-tick-cross>
										<check-tick incorrect><strong>Incorrect.</strong> While you may feel a moral duty to report evidence of criminality, you seldom have a legal duty. It is, therefore, best to discuss this with a supervisor, and come up with a plan for what you would do in such a situation, prior to commencing your research if you have any reason to anticipate such disclosures. The only exception to this is if you hold a professional registration, warrant or commission (e.g. as a registered healthcare practitioner, police officer, military officer), or are in a 'regulated sector' as defined by the Proceeds of Crime Act 2002. In these situations, your role has legal reporting duties attached and you should put your professional legal duties first. </check-tick>
										<check-cross correct><strong>Correct.</strong> While you may feel a moral duty to report evidence of criminality, you seldom have a legal duty. It is, therefore, best to discuss this with a supervisor, and come up with a plan for what you would do in such a situation, prior to commencing your research if you have any reason to anticipate such disclosures. The only exception to this is if you hold a professional registration, warrant or commission (e.g. as a registered healthcare practitioner, police officer, military officer), or are in a 'regulated sector' as defined by the Proceeds of Crime Act 2002. In these situations, your role has legal reporting duties attached and you should put your professional legal duties first. </check-cross>
									</check-tick-cross>
								</check-item>
								<check-item>
									<p>Researchers who do not work with personal data can be less vigilant about seeking approval to access the data they require. </p>
									<check-tick-cross>
										<check-tick incorrect><strong>Incorrect.</strong> Some types of research may require access to data that could fall outside the classification of personal data; nonetheless, researchers in these areas may still be working with sensitive data (e.g. it could be commercially valuable, or defence related). Here, you must identify who is able to authorise access to the data you require and ensure you have the relevant permissions in place prior to proceeding. Research relating to terrorism or illegal organisations can be highly problematic, and there have been cases of researchers being arrested due to misinterpretations of the researcher's motivation by law enforcement authorities.</check-tick>
										<check-cross correct><strong>Correct.</strong> Some types of research may require access to data that could fall outside the classification of personal data; nonetheless, researchers in these areas may still be working with sensitive data (e.g. it could be commercially valuable, or defence related). Here, you must identify who is able to authorise access to the data you require and ensure you have the relevant permissions in place prior to proceeding. Research relating to terrorism or illegal organisations can be highly problematic, and there have been cases of researchers being arrested due to misinterpretations of the researcher's motivations by law enforcement authorities.</check-cross>
									</check-tick-cross>
								</check-item>
							</checklist>
							<!-- ACTIVITY END -->
							
							<p>Data protection law in the UK is constantly evolving and changing. If you plan to conduct work gathering data on individuals, it is well worth finding out as much as possible about how data protection and other  laws may impact your study. Your institution will be able to provide detailed guidance and training to help you ensure your research complies with all the relevant legislation.</p>
							
						</page-content-main>

						<page-content-sidebar>
							
							<!-- ADDITIONAL INFORMATION START -->
							<pod variant="b" has-modal="true">
								<pod-heading>Additional information</pod-heading> <!-- pod title -->
								<pod-content></pod-content>
								<!-- pop-up pod content -->
								<pod-modal-heading>Additional information</pod-modal-heading>
								<pod-modal-content>
									<hosted-link id="RI_INT_cre_1_70_2">
										<p>In the UK, a range of measures are in place to support the protection of personal data and patients' rights in relation to their private information.</p>
										<p><a href="https://ico.org.uk/" target="_blank">Information Commissioner's Office (ICO)</a>
										<br>In the UK, the ICO is the independent body set up to uphold information rights. All research institutions are registered with the ICO and should have a data protection officer responsible for fulfilling ICO requirements. </p>
										<p><a href="https://www.gov.uk/government/groups/uk-caldicott-guardian-council" target="_blank">Caldicott Guardian</a>
										<br>In 1997, a committee led by Dame Fiona Caldicott recommended that all NHS organisations appoint a senior official responsible for overseeing the handling and use of confidential patient information. If you are conducting research in the NHS, your local Caldicott Guardian (or, more commonly, their office) should be able to provide up-to-date advice regarding the use of patient data.</p>
										<p><a href="https://www.hra.nhs.uk/approvals-amendments/what-approvals-do-i-need/confidentiality-advisory-group/" target="_blank">Confidentiality Advisory Group (CAG)</a>
										<br>Researchers sometimes need to access large amounts of identifiable health data where seeking consent is impractical (for instance, when establishing/using disease registries). In order to allow such access, section 251 of the National Healthcare Act 2006 allows for the common law duty of confidentiality to be temporarily lifted subject to certain conditions, which are judged on a case-by-case basis by CAG.</p>
										<p><a href="https://www.hra.nhs.uk/" target="_blank">Health Research Authority</a>
										<br>The Health Research Authority oversees governance reviews, including issues relating to data protection, for all NHS-related research. Along with providing advice once applications are received, their <a href="https://www.hra.nhs.uk/planning-and-improving-research/policies-standards-legislation/data-protection-and-information-governance/" target="_blank">webpages</a> also contain up-to-date guidance on data protection and information governance.</p>
									</hosted-link>
								</pod-modal-content>
							</pod>
							<!-- ADDITIONAL INFORMATION END -->
							
						</page-content-sidebar>
					</page-row>
					
					<page-row>
						<page-content-main>

							<h3>Sharing</h3>
							
							<p>Any information that must be protected has, by implication, restrictions on sharing. Therefore, the types of information discussed above should not be shared without checking all relevant policies and agreements. There are three additional factors that prevent some research information from being shared:</p>
							
							<ul>
								<li><strong>Export controls:</strong> Government policies limit the sharing of research information with some foreign nationals</li>
								<li><strong>Sensitive information:</strong> Information can be potentially harmful (e.g. the location of endangered archaeological sites)</li>
								<li><strong>Data protection:</strong> All data (especially personal data) must be shared in accordance with data protection legislation.</li>
							</ul>
							
							<p>If your research materials and findings are not subject to any of the conditions above, you can follow the general rule:</p>
							
							<text-block><p><strong>General rule</strong> = Researchers are expected to share their findings with colleagues once they have established their priority through publication or some other process (such as a patent or copyright notice).</p></text-block>
							
							<h3>Summary</h3>
							
							<p>Research is a collective activity. Its advance depends on researchers collecting and sharing information. When required to do so, you must take steps to properly store and protect some types of information, and avoid sharing restricted information.</p>
							
						</page-content-main>
					</page-row>
					
				</page-container>
			</base-container>
		</div> <!-- END content wrapper -->
		
		<!-- scripts -->
		<script src="../js/vendor.min.js"></script>
		<script src="../js/vue-components.min.js"></script>
		<script>
			new Vue({
			  el: "#app",
			  data: {},
			  mounted: function () {
				var core = document.createElement('script');
				core.src = "../js/core.min.js";
				document.getElementsByTagName('head')[0].appendChild(core);

				var project = document.createElement('script');
				project.src = "../js/project.min.js";
				document.getElementsByTagName('head')[0].appendChild(project);
			  }
			});
		</script>

	</body>
</html>