The law states that we can only process your personal data if the processing meets one of the conditions of processing in Article 6 GDPR. If we are processing special category data (i.e. personal data which relates to your ethnicity, sex life or sexual orientation, health or disability, biometric or genetic data, religious or philosophical beliefs, political opinions or trade union membership), our activities also have to meet one of the conditions in Article 9 GDPR. Under the data protection legislation we need to explain the legal basis for holding your data, i.e. which of these conditions apply.
In general, where we are collecting and processing your personal data for the purposes of an academic research project the following conditions apply:
Article 6.1(e) of the GDPR, i.e. our processing is necessary for the performance of a task carried out in the public interest. Research is a task that BU performs in the public interest, as part of our core function as a university;
Article 9.2(j) of the GDPR, i.e. our processing is necessary for research purposes or statistical purposes (this condition applies as long as we are applying appropriate protections to keep your data secure and safeguard your interests: these are described above).
Consent is not generally the legal basis under the data protection legislation for use of your personal information for research. This is because we can only rely on your consent as the basis for processing data if we would always be able to act on a withdrawal of consent, by removing your data from our research project and outputs. Often we would not be able to do this in the context of a research project, as this could affect the validity and integrity of the research process and/or the outputs from the research.
We do ask for your consent to your active participation in the research, and you can withdraw this consent at any time. For example, if we have asked you to take part in interviews, complete a questionnaire or undergo observation you can pull out of these activities at any point. This consent to participation in the study does not mean that we are relying on your consent as the legal basis to the on-going use of your information through the course of the project and in the research outputs. If possible, where you withdraw from participation in this way we will also withdraw your data from the research project, but this will depend on the stage we have reached in the project and how your data has been used. We will not be able to withdraw all of your data from the study if this will have an adverse impact on the integrity and validity of the research. Even if we withdraw from the study your data that has been collected or generated within the research project, we will usually need to retain copies of your data within the project governance documentation (e.g. records of consent forms and possibly some communications with you).
However you may be asked for consent for specific uses of your information as follows:
- If we need to access information in your medical records for the purposes of the research, the law of confidentiality states that we can only do this with your consent. Once you have given consent, our on-going use of this information is covered by the conditions in the data protection legislation as described above;
- If we intend to use your personal data in our research outputs in an identifiable way, we will only do this if you specifically consent. For example, we will ask for your consent to include your photo or your name in any research reports or other outputs, and for inclusion of any film footage of you in any film to be produced as an output of the research. You can withdraw this consent at any time prior to publication or broadcast. Any refusal or withdrawal of this consent will not affect the on-going legal basis for the use of your information for the research itself, which is covered by the other conditions in the data protection legislation as described above.
The BU researchers will ask you to sign a participation agreement. This will set out any consents that are being requested for specific uses of your information, and it will also ask you to confirm that you have been given access to this Notice.