Data management as a student

Universitätsbibliothek Teaching Tool ”Data management as a student“: Safe handling of personal data In collaboration with Datenschutzteam, UZH, June 2025. Learning objectives (slide 1) — Students understand the concept of personal data and sensitive personal data. — Students understand why personal data is protected. — Students understand the conditions under which they can collect and store personal data. Text suggestions for the slides Slide 2 Personal data refers to all (partial) information that relates to an identifiable, living person and can therefore identify this person. Sensitive data is a particular type of personal data. Which data is considered sensitive data is defined in the Data Protection Act. Slide 3 Personal data are protected by law. When processing personal data, it is important to ensure that a person’s data is handled securely in order to protect the privacy of the individuals from whom the data was collected. The term ‘data protection’ therefore refers to the protection of people's privacy. The Data Protection Act is intended to ensure that every individual has control over which of one's personal data is passed on, when, to whom and for what purpose (right to informational self-determination). This also means that if you process someone’s personal data, you need to inform them about what is being done with one's data. Like other data, personal data can be collected, stored, collaboratively processed and shared. However, additional measures must be taken to comply with the Data Protection Act. Note for instructors: The relevant legal texts can be found under the following links: − Federal Act on Data Protection (FADP) − Act on Information and Data Protection, Canton of Zurich (IGD) − Federal Act on Research involving Human Beings (Human Research Act, HRA) Slide 4 Personal data is essential for certain areas of research such as in medicine, linguistics, psychology, religious studies, etc. In addition to legal aspects when handling personal data, researchers should also think about ethical considerations go beyond the Data Protection Act. Ethical considerations that could be taken into account include, for example, thinking about unnecessary burdens and risks for participants and researchers. There could also be inappropriate incentives, conflicts of interest and/or dependencies between researchers and study participants. You could also consider the University of Zurich | Teaching Tool “Data management as a student” 2 | 4 question of how to deal with socially vulnerable people who are involved in the research project. If the study participants are children, you would also have to think about how to deal with the informed consent process. In addition, the principle of data minimisation should be applied, i.e. only data that is actually needed should be collected. In other words, you should ask yourself which information about the participants do you really need and why do you need this information? Now, what does this mean in practice? What security measures need to be considered when planning, collecting and processing such personal data? Information for instructors: Researchers (but not students) at UZH can make use of the DESAT Tool, a Data protection/ethics self-assessment tool, to identify the criteria the project needs to meet in order to be compliant with any ethical or legal requirements regarding the handling of personal and sensitive data. Slide 5 Before the data is collected, participants to your study need to sign an informed consent form. This ensures the legal basis for handling personal data. What should go into an informed consent? [See list on the slide]. Even if the data is shared with team colleagues or supervisors, this must already be mentioned in the informed consent and participants need to agree to this. Note for instructors: If the data is collected in already anonymised form for research purposes, no declaration of consent is required. Completely anonymised data does not fall under the Data Protection Act, as the individuals cannot be identified. Subsequent anonymisation is difficult to achieve (keyword: big data). It should therefore be considered whether to collect the data directly in anonymised form. It is always necessary to inform the participants about the purpose of the research project. For further information, see Data protection [CLARIN-CH]. (last accessed on 17.03.2025) Slide 6 When collecting data from people, you have to make sure that the tools adhere to data protection laws. For surveys, UZH offers the two survey tools, Lime Survey and Unipark. These tools are legally compliant with Swiss data protection laws. It is therefore highly recommended to use these tools for surveys. Lime Survey is hosted at UZH. Unipark is an external product. A contract between the provider and UZH ensures that all aspects of data protection are covered. If you wish to use other software/tools, you must clarify whether they comply with Swiss data protection guidelines. Above all, this means checking where the data is stored (and possibly processed) and who has access to it. Additionally, participants must be informed about and consent to data processing by third-party tools. Be careful: If particularly sensitive data is collected, you must clarify whether other legal requirements apply. Note for instructors: See also the website of the Central IT Department UZH (last accessed on 17.03.2025). If you have any questions, you can also contact the team Data Protection UZH. Slide 7 Note: The general recommendation is to store personal data on external hard discs and not on the laptop, as there is a lower risk of being stolen. If you need to store personal data on your own laptop, you should make sure that the data is stored securely: − Data files must be protected with passwords. The key rule is: long passwords are strong passwords. The linked video explains clearly how passwords work and how passwords or passphrases can be created that are ‘uncrackable but easy to remember’. University of Zurich | Teaching Tool “Data management as a student” 3 | 4 − Another step towards securely storing data on your laptop is to encrypt the data files. During encryption, digital content is encoded or translated into a meaningless code in such a way that unauthorised persons cannot understand it without the corresponding key. If you need to work with others and send them your data files containing personal data, useSWITCHfilesender. This service allows large files (up to 300GB) to be exchanged securely. There are at present no national services in Switzerland that are suitable for storing personal data. UZH does not currently offer any new server space for this either (as of April 2025). OneDrive UZH, SWITCHdrive, Dropbox, Google Drive and similar services are therefore not suitable for storing personal data. Note for instructors: More information on data security and encryption software in Chelazzi Grandinetti's presentation slides from the Data Protection Week, available on Zenodo: https://doi.org/10.5281/zenodo.14749504. Depending on the subject area, there are so-called Trusted Research Environments available for use. BioMedIT was developed as part of the Swiss initiatives SPHN (Swiss Personalised Health Network) and PHRT (Personalised Health and Related Technologies), and the Leonhard Med Secure Scientific IT Platform was developed at ETH with secure data and IT solutions for sensitive research data. These platforms are open to all Swiss universities, hospitals, research institutes and other interested partners but their use is not free of costs. Slide 8 As shown so far, various questions arise when dealing with personal data: legal questions, ethical considerations, but also questions with regard to tools that may or may not be used. Each case is therefore slightly different, with different questions arising depending on the context and situation. So, if you work with people's personal data, ask your supervisor any questions you may have and discuss together any sensitive issues that may arise when handling this kind of data. You can find further information and contact persons on the websites of the Open Science Office, the UZH Data Protection Team and the Central IT. Note for instructors: If you (e.g. as a supervisor of student theses) have further questions regarding the handling of personal data, you will find the information listed below and any contact details on the UZH website. Please do not hesitate to contact the support services if you have any questions. Website of the Open Science Office, links to information on: − UZH’s Legal Services and Data Protection − Data Protection / Ethics Self-Assessment Tool − Handling personal and sensitive data − Information on research involving human beings or animals or genetic resources with links to the ethics committees of the faculties and their contact persons − CARE principles for ethical considerations Website of Legal Services and Data Protection, contains information on: − Leaflets on various areas of data protection (e.g. principles of data protection, data protection in everyday work, data protection in research projects) − Data protection glossary with the most important terms relating to data protection − Contact point for questions Website of Central IT, contains information on: − Information on legal aspects of the survey tools − Additional information on the Limesurvey tool for the collaborative management of the tool and the handling of surveys with many participants − Contact points for software support University of Zurich | Teaching Tool “Data management as a student” 4 | 4 Slide 9 Discussion Questions inspired by Q&A on CESSDA. Notes for discussion: − Yes. Even if you interview your family and friends, a declaration of consent must be obtained. Participants must also be informed about how the data is processed. Furthermore, it should be remembered to delete the data when it is no longer used. − Even in the case of publicly accessible data such as from social media platforms, researchers should (if possible) ask the people whose social media content they are analysing for their consent. In addition, the licences of the respective platforms must be checked, as many social media channels regulate the further use of their content. Additional questions and notes for advanced students: − Open science is an approach that aims to make scientific findings, processes, data and publications accessible to researchers and the public. How can researchers reconcile the “open data” approach with the data protection regulations for personal data? → The open science motto ‘as open as possible, as closed as necessary’ is relevant for personal data. Striving for open access and open science does not mean that legal provisions can be waived. When dealing with personal data, ‘as closed as necessary’ is therefore crucial. − In the field of human medicine, data is collected for a study and consent is obtained from the test subjects. Several years later, it becomes apparent that the same data could be used to conduct another study with promising results. However, the test subjects from the existing data can no longer be found in full for a further declaration of consent. Can this second study be conducted with the data or not? → An important criterion for deciding the extent to which the data may be used is the way in which the data is collected or stored, i.e. whether it is in anonymised or pseudonymised form. While anonymous and anonymised data is no longer considered personal data, pseudonymised data is still considered personal data. See also the UZH policy on the ethical review of research projects on and with humans. Further information A learning video on “Handling Personal Data in Research” (created by the University Library) is available on the UZH mediaspace platform. All logos and symbols of organisations are protected by copyright. Unless otherwise noted, this slide set is licensed under a CC-BY-4.0 International license. Cite as: Regula Zwicky. 2025. Teaching Tool ”Data management as a student“: Safe handling of personal data. University of Zurich.