How do we handle data collected for scientific research?
What data do we collect for scientific research?
Research data
Research data are the data we collect to answer the scientific research question. We only collect the research data that are necessary to answer that question. These data are stored in secure locations in accordance with Radboud University guidelines.
We store the research data in such a way that it is almost impossible to link the data back to you. We do this by replacing personal information—such as your name—with a code (a process called pseudonymisation).
Although we try to hide your identity in the data as much as possible, this is not always feasible, for example with video or audio recordings. If this is the case, we will inform you of this in the information you receive about the study and ask for your consent.
In reports about the study, we always only use anonymous data, so that you are not identified from the data. If we deviate from this, we will inform you in the information document and ask for your consent.
Administrative data
Sometimes we must store personal data such as your name and address for administrative purposes, for instance, to be able to contact you later. These administrative data are stored separately from the research data in a secure Radboud University location. They can only be viewed by authorised Radboud University staff. In addition, they may be accessible to people who audit or monitor the study. The administrative data are deleted as soon as they are no longer needed. The information document you receive for the study will tell you which data are stored and for how long.
Why are data collected to compensate participants financially for a study?
In some studies you may receive financial compensation or a reward for participating. To document that we have compensated you financially for your participation, we need to collect certain personal data. The study information you receive will specify which data we request for this purpose. For example, if you receive a gift or gift card, we may ask you to write down your name and signature. If we transfer the financial compensation via a bank payment, we need more information from you, such as your BSN (Burgerservicenummer, Citizen Service Number) and bank account number.
Which data do we pass on to the Belastingdienst?
If you receive financial compensation via bank transfer, Radboud University is required to report this to the Belastingdienst (Dutch Tax and Customs Administration). You must also declare this compensation yourself in your Income Tax return. We report the following data to the Belastingdienst: the financial compensation you received, your name, address, date of birth and BSN. We do not report what the financial compensation was for. Therefore, the Belastingdienst will not know that you participated in a study, nor which study you joined.
How long do we retain your data?
Research data
The study information you receive will state exactly how long your data will be kept. In most cases, research data are kept for at least 10 years. This is required in accordance with scientific standards, so the data can be checked or reused for other research. Studies that fall under the Dutch Medical Research Involving Human Subjects Act (WMO) must be stored for a minimum of 15 years orfor a minimum is 25 years for studies involving medicinal products.
In some cases, research data may be stored for fewer than 10 years for privacy reasons. If so, this will be clearly indicated in the information document you receive.
After the minimum retention period has passed, we check if we can delete the data. Is the data still important? Then we keep it longer, possibly for a newly determined period. Data are always stored in secure locations in line with Radboud University guidelines.
Administrative data
Administrative data are kept for as short a period as possible. As soon as these data are no longer needed, they are deleted. Data needed to process study compensation are usually stored for 7 years. For research funded by the European Research Council (ERC), the data must be kept for 15 years. The information document will specify the retention period that applies to your administrative data.
Who has access to your data during the study?
Researchers directly involved in the study have access to all of your data. In addition, people who monitor or audit the study may access your data. This may include an auditor or monitor working for Radboud University, or a member of a committee that oversees study safety. It may also include someone from a national oversight body such as the Health and Youth Care Inspectorate (Inspectie Gezondheidszorg en Jeugd) or the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Sometimes a study is conducted in collaboration with researchers who are not employed by Radboud University. These researchers may also be given access to your research data,but only to the specific data that are truly necessary.
Why are data shared after the study?
Your research data may also be useful for other scientific studies or for other interested parties after this study ends. Designing a study and collecting data often require a great deal of time and money. Reusing data across multiple studies makes science more efficient.
Sharing research data is also important so that results can be verified by other researchers or interested parties.
Moreover, we share research data to be transparent with society about our research.
Which data are shared and with whom?
Before we share research data with others, we will anonymise them as much as possible. Anonymous means that the data cannot be traced back to you. In principle, anyone worldwide may be able to access these anonymous research data.
Some research data that we want to share cannot be fully anonymised—for example, video recordings. For this type of research, you can indicate on the consent form whether you agree to these data being shared. If you indicate that you do not agree, we will not share the data. If you do give consent to share non-anonymous data, we will not distribute them openly to everyone. Users of such data must accept our conditions, which are designed to protect your privacy as much as possible.
Your name and contact details are not shared with anyone outside the study team. The only exceptions are that you have indicated on the consent form that you are willing to be contacted for additional studies within the research institute; or you receive your participation compensation via bank transfer and we must report your details to the Belastingdienst (see Which data do we pass on to the Belastingdienst?).
How are MRI scans shared?
In MRI studies, we often make what is called an anatomical brain scan. This is a sort of photo showing cross-sections of the brain in which the outlines of the head are also visible. To make a participant’s scan less recognisable, researchers remove the contours of the head and face (sometimes called defacing). Only after defacing are the scans shared with others.
There is a small chance that someone could still deduce that the scan is yours by combining information from multiple datasets. To reduce this risk, anyone who wants to download these scans must declare that they will not attempt to discover your identity. Because of these safeguards, we consider the likelihood that the scans can still be traced back to a participant to be very small. For this reason, we refer to these data as anonymous in the information document
Why are research data not always deleted when I request it?
There are several reasons why research data cannot always be deleted:
- If your data have been stored in a completely anonymous form, we no longer know which data are yours, and therefore we cannot delete them.
- If data are collected that are not (yet) anonymous, for example photos, audio or video recordings, or other data traceable to you, you can always submit a deletion request by contacting the researcher. If your participation ended more than one month ago, it may be that your data will not be deleted because the researchers are already so far along in the study that completing the research outweighs your deletion request. This decision is always considered carefully in consultation with the Privacy Officer and, if necessary, the Data Protection Officer (Functionaris Gegevensbescherming) of Radboud University. You will be informed about this.
- If we collect non-anonymous research data, we always ask for your consent for sharing these data with other parties. In case you have given permission, and we have already shared your data, we can no longer delete the data that were shared.
How do we handle sharing your data with a country outside the European Economic Area?
If an organisation outside the European Economic Area (in a so‑called third country) uses your personal data or research data for scientific research, we ensure that your data remain well protected. There are three lawful ways we may share data with organisations in a third country:
Where can I find more information about privacy?
Would you like to know more about your rights when your personal data are processed? Please visit our privacy webpage or the Autoriteit Persoonsgegevens website (https://www.autoriteitpersoonsgegevens.nl/en).
1. Transfer based on an adequacy decision.
Sometimes your data can be shared with a country that the European Commission has decided provides an adequate level of data protection. In that case, your separate consent is not required. A list of these countries can be found on the website of the Autoriteit Persoonsgegevens (https://www.autoriteitpersoonsgegevens.nl/en/themes/international/transfer-within-and-outside-the-eea/personal-data-transfers-outside-the-eeah).
2. Transfer based on appropriate safeguards or binding corporate rules.
Sometimes your personal data are shared with a third country under special arrangements, such as standard rules for data protection or binding corporate rules. Want to know more? Ask the researcher.
3. Transfer based on an exception.
In some situations, your personal data may be shared with a third country under an exception, for example, if you have given explicit consent or if the transfer is in the public interest. Want to know more? Ask the researcher.
You can read Radboud University’s Privacy Statement here.
Who can I contact if I have questions about my privacy?
We always recommend contacting the researcher conducting the study first. For general privacy questions you can contact the Privacy Officer and, if applicable, the Data Protection Officer (Functionaris Gegevensbescherming) of Radboud University at privacy [at] ru.nl (privacy[at]ru[dot]nl). You can also submit a complaint to the Autoriteit Persoonsgegevens.