GDPR in research: rights of data subjects

This website provides information about rights of data subjects in the context of the GDPR in research:

Definition

The GDPR is specifically designed to emphasise the rights of data subjects concerning processing of their personal data, such as the right for transparency, access to, rectification and erasure of their personal data and data portability. Exceptions concerning personal data collected in scientific research are further described in the Dutch Uitvoeringswet AVG.

  • Research participants have the right to withdraw from participation during research; i.e. withdrawal should be as easy as giving consent.
  • Research participants have the right to receive transparent information about their rights concerning personal data processing (see the principle of transparency).
  • Summarising, data subjects have the right to receive transparent information concerning the processing of their personal data, to access their personal data, to rectify and erase personal data, to restrict processing, to be forgotten, and the right to data portability.
  • For processing of personal data for scientific purposes, the right to access, right to rectification and the right to restriction of processing do in principle not apply (see Uitvoeringswet AVG for exceptions concerning scientific research, Article 44).
  • As long as you can identify individual participants from data, the participant can request the removal of personal (research) data (i.e. the right to be forgotten). The right to be forgotten does not apply for data that must be archived for scientific (integrity) purposes. Any other restrictions/conditions concerning the right to be forgotten must be provided in the study-specific information brochure to make sure that the participant gives his/her consent for it.
  • A research participant has the right to receive personal data concerning him/her and to transmit those data to another processor without hindrance (i.e. right to data portability).

Guidelines

  1. In study-specific information brochures, be transparent about participants rights (and exceptions) concerning personal data processing (see the principle of transparency).
  1. Before starting collection, make yourself familiar with your institute’s procedures, or write your own procedure concerning exercising participants rights. That is: what should you do if the participant requests removal of data? How can you transfer data to the participant or another processor on request?
  1. Anonymised data (i.e. not containing direct identifiable data and including a limited number of indirect identifiers) can no longer be used to identify individual participants. Therefore, participants can no longer exercise their rights concerning (potential) personal research data.
  1. Explicit consent is required for public sharing of research data that contains personal data (such as video data). Participants must therefore be properly informed that they can no longer exercise the right to be forgotten or right to erasure as published data may have disseminated too many (unknown) users.
  1. If a participant withdraws from participation during research and no specific agreements are made, all data must be removed except for the informed consent form. This form must always be archived for scientific (integrity) purposes.

GDPR articles

More information about participants’ rights concerning their personal data processing can be found in the following recitals and articles in the GDPR and Dutch Uitvoeringswet AVG.

Uitvoeringswet AVG, Article 44
If personal data processing is done by institutions or services for scientific or statistical purposes and the necessary procedures are in place to ensure that personal data is only used for those purposes, the data controller can disregard art 15,16 and 18 of AVG (right of access, right to rectification and right to restrict processing).

Frequently asked questions

Read the frequently asked questions about rights of data subjects in the GDPR and its implications for research data management.