Transparency
Any personal data used for research, must be obtained and processed fairly. There should be no surprise to participants in relation to the use of their personal data.
Primary Data Collection
In advance of any data collection, researchers must inform participants in a concise, easy to read format (within an information leaflet, privacy notice or equivalent) of the following:
- the purpose of the research;
- the legal basis under GDPR;
- who is collecting the personal data;
- with whom that personal data may be shared (and whether it will be transferred outside EEA);
- the methods being used;
- the possible outcomes of the research;
- demands, discomforts, inconveniences and risks that the participants may face
- how long data will be retained (or criteria to establish the retention period if this is not possible)
- rights of individuals in terms of their personal data, including the right to lodge a complaint with the Data Protection Commission;
- contact information of DPO and PI; and
- the existence of automated decision making, including profiling (if applicable).
These notice obligations apply for all research, regardless of whether you obtain the participant’s consent to take part in the research or not.
Secondary Data Use
If the personal data has not been obtained directly from the individual, they still have the right, in principle, to be fully informed that their data is being used by Trinity for research purposes.
However, under Article 14(5)(b), and Recital 62, GDPR the obligation to provide information does not apply if it
The number of data subjects, age of the data and any appropriate safeguards should be taken into consideration when making this assessment.