Research Data Management: Sensitive Data & Data Protection (GDPR)

The Information Security team have developed a RAG data classification tool. Contact the Information Security team for more guidance; send an email to serviceline@soton.ac.uk marked for the attention of InfoSec.

Raw data containing personal information should be stored on University servers that require a login in with a University username and password rather than held locally on laptops or other devices. Therefore raw data should only be stored on the Research Filestore.

Local copies of data should only be held on laptops or other devices after the raw data has been processed to remove personal identifiers.

Data can be encrypted using various software. Contact the Information Security team for more guidance; send an email to serviceline@soton.ac.uk marked for the attention of InfoSec.

See the Research Data Management: Sensitive Data guide for more information.

The Library can advise on drafting Data Management Plans and have advice on the RDM webpages. You can contact them on researchdata@soton.ac.uk. Your Faculty Business Relationship Manager can help you with storage requirements for your project, and iSolutions Information Security team gives advice on how best to encrypt data.

Any personal data you hold on paper must be held securely in locked cabinets in lockable rooms. If possible, scan the paper copies and save them securely on the University network, and destroy the paper originals.

If you work in a shared office, do not leave papers containing personal data on your desk when stepping away from your desk, even if you are just popping to the loo. Either dispose in the confidential waste or lock them away in your desk drawers or cabinet.

Contact the Information Security team for more guidance; send an email to serviceline@soton.ac.uk marked for the attention of InfoSec.

Personal data should not be stored on removable devices if at all possible. If you have to collect data on a laptop, the data and the laptop should be encrypted. When undertaking international travel, ensure any devices are in hand luggage.

Windows laptops

Windows laptops should be UoS supplied, UoS build and regularly plugged in to network to receive updates. Windows laptops use Bitlocker.

• All laptops with Windows 7 or above are delivered with BitLocker as default.
• If you have a laptop with Windows 7 or less installed needs to be returned to the University to be updated/upgraded.
• Laptops should be connected to University network frequently (ideally monthly) to allow for the most recent updates and security measures to be installed.
• When at any events where the laptop is visible, you should ask to be issued with a security lock. Keep the code to yourself.
• When you have finished using the laptop ensure you fully log out of it. Leaving yourself logged in gives hackers half the information they need to get into your folders.

University-issued Apple products

Apple Mac devices are not supplied with encryption (‘Filevault’) enabled by default, as there is no UoS infrastructure available to manage and store encryption keys. You will need to enable this yourself.

When any other Apple device is issued it is provided with only factory default security settings. In order to make these are as secure as possible please undertake the following steps:

• Ensure iPhone/iPad carries a password/finger print/faceID log in. Where possible, upgrade your password to an alphanumeric password or use a combination approach of the possible options.
• Ensure iPhone/iPad is linked to iTunes and iCloud using University contact details (not personal accounts). This then allows the user to be able to wipe all data from the phone in the event it is lost or stolen.
• Ensure two-factor authentication is on all University devices, particularly on iCloud, iTunes and any email apps. Have a different password entry for individual apps.
• Ensure ‘Find my iPhone’ is activated.
• Enable ‘erase data’ on iPhone/iPad to ensure data is wiped after 10 incorrect passcode attempts.
• Ensure emails linked to iPhone/iPad are defaulted to not download after six months. (This can be done in the settings>email>account>advanced>deleted messages).

For further guidance, contact the Information Security team for more guidance; send an email to serviceline@soton.ac.uk marked for the attention of InfoSec.

You should ensure the personal data is stored securely, following the same guidelines as for new data. Electronic data should be stored on University servers and paper data should be kept in secure, locked cabinets in locked offices. See the Research Data Management: Sensitive Data guide for more information.

Paper should be shredded (using a cross shredder) or put into the secure confidential waste (white sacks). For electronic data, contact iSolutions Serviceline.

For more information see:

• University of Southampton Research Data Management: Destruction (paper & electronic)
• Data disposal (paper & electronic) - UK Data Archive

There is no limit on how far back you need to go. Before GDPR, you should have been holding personal data securely in accordance with the Data Protection Act.

If you no longer need the personal data that you hold, it should be destroyed (See the Research Data Management: Destruction guide for more information on how to do this securely). Do remember that for some types of research you may need to keep consent records for longer than the research project lasted; contact RIG for guidance. Also consider that the University's Research Data Management Policy requires significant research data to kept for at least 10 years, ideally these data would be anonymised to a level that would allow sharing, either openly or on request from bone fide researchers.

If at all possible, you should avoid saving or moving raw data on USB sticks but if you have to, you should only use encrypted USB sticks such as the Integra Crypto drive. Only use removable storage supplied by iSolutions: Staff equipment and purchasing.

Under GDPR, you will need: a legal basis to process personal data (e.g. name, postcode, cookies), an additional legal basis to process special category personal data, and to ensure that all additional legal requirements are met (e.g. the need to be fair and transparent, and to comply with the common law duty of confidence). Under the new law, the most relevant legal basis for researchers processing personal data for university research will usually be ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’. This justification for this should be internally documented by reference to the public research purpose as established by statute or alternative e.g. University Charter.

Consent is also an legal basis for processing and has very specific requirements under GDPR. If you use consent as your legal basis, you may need to re-consent to be GDPR compliant if your research started before 25 May 2018; alternatively you may be able to establish an alternative legal basis to proceed. You should liaise with the Research Governance Manager and the University Data Protection Officer for further information.

Consent forms must be stored in a secure location. At the very least you should store forms in a lockable cabinet in a lockable office. If you are able to scan the consent forms, you should dispose of the paper forms in confidential waste or shredded using a cross-cut shredder (see Research Data Management: Destruction (paper & electronic) for more information).

To be drafted.

Anonymisation is a trade-off against utilisation. What might be a reasonable level of anonymisation in a secure setting due to the high need for utilisation of the data, might not be suitable in an open setting due to the higher risk of re-identification.

"It can be impossible to assess re-identification risk with absolute certainty. [...] The risk of re-identification through data linkage is essentially unpredictable because it can never be assessed with certainty what data is already available or what data may be released in the future. It is also generally unfeasible to see data return (ie recalling data or removing it from a website) as a safeguard given the difficulty, or impossibility, of securing the deletion or removal of data once it has been published. That is why it is so important to take great care, and to carry out as thorough a risk analysis as is possible, at the initial stage of producing and disclosing anonymised data." ICO (2012), Anonymisation: managing data protection risk code of practice

"De-identification – refers to a process of removing or masking direct identifiers in personal data such as a person’s name, address, NHS or other unique number associated with them. De-identification includes pseudonymisation.

"Anonymisation – refers to a process of ensuring that the risk of somebody being identified in the data is negligible. This invariably involves doing more than simply de-identifying the data, and often requires that data be further altered or masked in some way in order to prevent statistical linkage.

"[For] both processes (i.e. de-identification and anonymisation) the purpose is to make re-identification more difficult. Both deidentification and anonymisation are potentially reversible; the data environment in which you share or release data is of critical importance in determining reversibility. In other words, the data environment can either support or constrain reversibility which means you need to think very carefully about the environment in which you share or release data. For example, it may be entirely appropriate to release deidentified data in a highly controlled environment such as a secure data lab but not at all appropriate to release them more openly, for example by publishing them on the Internet.

Re-identification might occur:

1. Directly from those data.
2. Indirectly from those data and other information which is in the possession, or is likely to come into the possession, of someone who has access to the data"

From: UKAN (2016), The Anonymisation Decision-Making Framework , pp.15-16

If you want to share data with external collaborators, even if they are part of the same research project, you should have a data sharing agreement in place. Contact riscontracts@soton.ac.uk for more information.

The safest and simplest way to share documents and data with collaborators external to the University so you can all edit the material, is to use a University SharePoint site.

• Set up SharePoint areas via iSolutions form: https://knowledgenow.soton.ac.uk/Articles/KB0038052
• Add non-Southampton people https://knowledgenow.soton.ac.uk/Articles/KB0041951
• Files stored on University controlled services
• Allows all collaborators to access files, and, dependent on rights given, to edit files
• Individual file limit of 50Mb

If you are just going to be sharing data with members of the University, you can also request space on the Research drive, contact your iSolutions BRM to set this up.

If you need to send data to a collaborator, internally or externally, you can also use the Safesend service. The service allows you to easily move files of up to 50Gb in and out of the University. All files are transferred across the network securely encrypted. Safesend is in not a cloud service; everything is stored on equipment directly owned by the University, and managed by its own IT staff. All access to data is very tightly and strictly controlled by the University; all accesses to data on Safesend are logged and can be easily checked if you are ever concerned that a 3rd party might have gained access to your data. Files are automatically deleted from Dropoff 32 days after you upload them. No backups are taken of the uploaded data (it's only a transitory stopping point), so after an uploaded file has been deleted, there is no way of recovering the file.

If at all possible, you should avoid saving or moving raw data containing direct and indirect identifiers on USB sticks but if you have to, you should only use encrypted USB sticks such as the Integra Crypto drive. Only use removable storage supplied by iSolutions, see: Staff equipment and purchasing

Research data you collect when employed by the University is owned by the University unless other data sharing or collaboration agreements apply to your research. A copy of the data must be left at the University when you leave. Depending on your actual research, you may be able to take a copy some of the data with you. Contact the Legal Services IP service for a response to your specific situation.

If you use data owned by a third party (copyright material, software or database), you need to understand the terms under which these are obtained and the scope of use. It is necessary to obtain permission from the data owner for re-use of such material, unless conditions of re-use have been explicitly indicated, for example, with a Creative Commons licence. It is your responsibility to ensure you comply with the terms that apply. RIS can assist with drafting/reviewing of data sharing agreements/T&Cs. In most instances, these are not negotiable. However, it may be possible to seek specific use terms or negotiate different licensing arrangements more appropriate to your specific requirements. It may be that in some circumstances, a commercial licence offers more freedom-to-operate than provisions for academic purposes.

You may also find that the terms of use of some data services, such as Census statistics, require you to deposit derived work with them. When depositing data in a repository you will be required to agree to a licence that asserts you have the rights to deposit that data.

Personal data transfers will continue to need to be approved though ERGO.

If data is from UHS patients collected under UHS sponsored studies, UHS will need to be consulted. RIS can assist with data sharing agreements as required. Generally if the protocol, consents and patient info describes the data transfer in detail an agreement may not be needed for transfers within UK.

If you want to share data containing direct or indirect identifiers, with external collaborators, even if they are part of the same research project, you should have a data sharing agreement in place (contact riscontracts@soton.ac.uk for more information). The PI or local CoI, as representatives of the University who is the Data Controller, should ultimately give permission for data to be shared. When you share the data with others, they will be data processors but the University will still be the data controller and therefore responsible for how the data is used.

At the end of the project, significant research data should be archived, and preferably made openly available, as per the University's Research Data Management policy. In order for data to be shared openly it should be throughly anonmyised with direct and indirect indentifiers removed or modified. See Research Data Management: Sensitive Data for further information.

International research projects should have data sharing agreements if personal data is going to transfered between countries. RIS can assist with data sharing agreements as required.

Raw data should be stored on University servers and of possible, raw data should not be transfered. If possible, remove personal data and reduce or anonymise identifiers in the data before transfering data to international collaborators. Data should be encrypted for transfer. The University's drop-off service allows you to transfer files of up to 50GB in size securely. To transfer larger files, contact serviceline for advice.

SharePoint provides a safe way to share documents collaboratively with other researchers both internal and external to the University. You simply need to create a new Sharepoint site. For more information see:

• Set up SharePoint areas via iSolutions form: https://knowledgenow.soton.ac.uk/Articles/KB0038052
• Add non-Southampton people https://knowledgenow.soton.ac.uk/Articles/KB0041951
• Files stored on University controlled services
• Allows all collaborators to access files, and, dependent on rights given, to edit files
• Individual file limit of 50Mb

Instead of dropbox (which should never be used for transfering personal data), we recommend that you use the University's Safesend service. The service allows you to easily move files of up to 50Gb in and out of the University. All files are transferred across the network securely encrypted. Safesend is in not a cloud service; everything is stored on equipment directly owned by the University, and managed by its own IT staff. All access to data is very tightly and strictly controlled by the University; all accesses to data on Safesend are logged and can be easily checked if you are ever concerned that a 3rd party might have gained access to your data. Files are automatically deleted from Dropoff 32 days after you upload them. No backups are taken of the uploaded data (it's only a transitory stopping point), so after an uploaded file has been deleted, there is no way of recovering the file. Unlike on a Dropbox view, once a file is deleted in Safesend, it really is deleted

GDPR prohibits transfer of personal data outside the EEA unless certain conditions are met:

• Transfer on basis of an adequacy decision
  If the European Commission considers the data protection laws in that country or territory ensures an adequate level of protection for data subjects, data can be transfered. So far very few countries meet this level. N.B. The EU-US Privacy Shield Framework is considered legal under the GDPR. See the ICO's guidance on Sending personal data outside the European Economic Area (Principle 8)
• Transfer subject to appropriate safeguards

For practical purposes, this means that if you are collaborating with organisations outside the EEA, you must have a data sharing agreement in place. Contact riscontracts@soton.ac.uk for more information.

If you leave to work at an organisation outside the EEA and take research data with you, this will count as a data transfer.

Many cloud services are based outside the EEA. Even if the service in question has signed up to the EU-US Privacy Shield, it may not be appropriate to use such a service, since the terms and conditions tend to be one-sided, and are unlikely to be sufficient to enable the University to meet all its obligations under the GDPR. When sharing data with collaborators, do not use cloud-based services unless they have been approved by the University, for example Office 365's One Drive for Business.