Information Handling Research Student Induction Day

GDPR - Data Protection Act 2018 A new Data Protection Act came into force on May 25th 2018, and is designed to modernise laws that protect the personal information of individuals. It builds upon previous legislation to give us greater control over our data and provides new rights like the right to be informed and the right to be forgotten. It also extends the powers of the Information Commissioner's Office. It requires us to demonstrate (and document) we have considered privacy risks. It also strengthens the requirement for us to have appropriate organisational and technical controls to protect privacy.

Are you a data controller or processor? means a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be processed. “data processor” in relation to personal data, means any person (other than an employee of the data controller) who processes the data on behalf of the data controller. “processing” in relation to information or data means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including: a) organisation, adaptation or alteration of the information or data, b) retrieval, consultation or use of the information or data, c) disclosure of the information or data by transmission, dissemination or otherwise making available, or d) alignment, combination, blocking, erasure or destruction of the information or data. Joint Controller

What is personal and special category data? Name The following categories of personal data are more private than others for self evident reasons. Race or ethnic origin Political opinions Religious beliefs Trade union membership Health Sexual orientation Genetic data Biometric data Criminal history Address or Location Online identity Personnel profile Income

Why is it relevant to research? Potentially collect and re-use personal data Lawful basis for processing Necessary for a task carried out in the public interest Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes Safeguards Data Minimisation De-identification: Anonymization and Pseudonymisation Collecting special category data requires obtaining and recording informed consent.

Thinking ahead about the data flow Data Collection Data Collection Data Input / Capture Data Storage Data Safeguarding Data Analysis Data Archiving ? Right to be informed Obtaining consent Data sharing agreements Device encryption Data in transit Data deletion Not outside the EU Approved by City Appropriate access controls Protect privacy Mitigate risk of re-identification Open data sets Secure tools and analysis protocols Controlled access and data sharing Archive period (10 years ?) Use of Figshare Record of information assets

How we hope to help Develop a listing of typical information handling hazards and mitigation strategies. Work with Research and Enterprise to build data protection by design into the existing processes. Help route researchers to the right resources to ensure appropriate technical controls are in place.