In my work as Research Data Management Librarian I often meet researchers who are concerned with the difficulties of sharing confidential or sensitive data. In this post I’m going to go through a few tips and point to some resources which I hope will help anyone working with this kind of data.
Plan ahead
Click to enlarge
Even sensitive and confidential data can be shared ethically and legally if researchers pay attention, from the beginning of the research, to three important aspects:
- when gaining valid consent, include provision for data sharing
- where needed, protect people’s identities by anonymising data
- consider controlling access to data
Gaining valid consent
You are probably already used to obtaining valid consent for people to participate in research and for use of the information collected but you should (where possible) also obtain consent for any future uses of data. At a minimum, consent forms shouldn’t preclude data sharing, such as by promising to destroy data unnecessarily.
With this is mind, before collecting data you should always:
- inform participants how research data will be stored, preserved and used in the long term
- inform participants how confidentiality will be maintained, e.g. anonymisation
- obtain valid consent, either written or verbal for data sharing
The following short video, prepared by the University of Edinburgh for their excellent online MANTRA training course details the experiences of one University of Edinburgh researcher obtaining consent for data sharing (also available on Youtube)
Protecting identities
Anonymity by Thomas Hawk (CC-BY-NC 2.0)
Anonymisation can be time-consuming and costly, particularly for qualitative textual data. This is especially true if anonymisation is not planned early in the research or left until the end of the project. Planning ahead will ensure that you are aware of the costs and time involved in anonymisation, and you may be able to include these costs in your bid for external funding.
I am often asked is whether it is possible to ethically share audio-visual research data. While digital manipulation of this type of data is possible, it is labour-intensive, expensive and will often result in damage to the value of the research data. In most cases, the best way to share this type of data is to obtain consent from research participants to share the data unaltered, with additional access controls if necessary.
Another method of avoiding disclosure of sensitive, confidential or personal data without having to carry out costly anonymisation procedures, is to simply not collect it – so think carefully about how you word your interviews and surveys and which data you really need.
Regulating access
Sometimes the best way to safeguard sensitive and confidential data is by controlling access. While some data may not be suitable for public access, you might still want to allow access for educational or research purposes.
Ways of restricting access include:
- requiring a registration process to apply for access
- placing data under embargo for a given period of time
- providing access to approved researchers only
- providing secure access to data through enabling remote analysis of data but excluding the ability to download
- providing on-site access only
What next?
The following resources may be of use to anyone working, or planning to work with sensitive, confidential or personal research data.
- OU Research Ethics web pages
- OU guidance on Data Protection (internal link)
- Guidance on ethics and data protection and publishing and sharing sensitive data decision tree on the OU RDM intranet site (internal links)
- UK Data Archive’s guidance on consent and ethics, (includes a number of example consent forms)