Cheat Sheet on Personal Data Management: Laws and Regulations

Research Data Management Network Research Data Management Network Personal Data Management Laws and Regulations What qualifi es as personal data? What are you (not) allowed to do with it? Does your research project involve personal data? Do you know how to handle and store it? Any researcher working with personal data is subject to (Swiss) data protection law and needs to be aware of the relevant laws and regulations. What is personal data? Personal data is any information relating to an identifi ed or identifi able natural person (data subject). There are different categories of personal data: https://researchdata.unibas.ch • This work is licensed under CC-BY 4.0. • [email protected] Illustration by FD[email protected], modifi ed Ordinary personal data: Personal data is information referring to a defi nite or defi nable natural person. Examples include: • Name • Date of birth • Email address • Phone number • Sex • Information about particularly characteristic features, e.g. “only woman working in a certain team” Sensitive personal data: Personal data which are particularly sensitive in relation to fundamental rights and freedoms, which include but are not restricted to: • Political, religious or philosophical beliefs • Trade union-related views or activities • Health • Sexual life and/or sexual orientation • Processing of genetic and/or biometric data • Data of vulnerable persons, e.g. children, ethnic minorities etc. Key laws The Law on Information and Data Protection of the Canton of Basel-Stadt (IDG-BS), the Swiss Federal Act on Data Protection (FADP) and the General Data Protection Regulation of the European Union (GDPR) protect privacy and regulate the handling of personal data. The Human Research Act (HRA) protects the dignity, privacy and health of human beings involved in research concerning human diseases and the structure and function of the human body. Research Data Management Network Research Data Management Network Which law applies when you process personal data? • Research at the University of Basel: In general, the Cantonal Law on Information and Data Protection (IDG-BS) and the Ordinance to the IDG-BS apply to public bodies of the Canton of Basel-Stadt and its municipalities (e.g. University of Basel). • Private Research and Research at the ETHZ/EPFL: In general, the Swiss Federal Act on Data Protection (FADP) and the Ordinance to the FADP apply to private persons and federal bodies (e.g. ETHZ). • Cross-cantonal research: When processing personal data, the data protection law of the canton where the processing occurs (e.g. collection, storage, revision, or disclosure) typically applies. This means that, in cases involving multiple locations, more than one cantonal data protection law may apply. • Research with an international dimension: • Often the data protection law at the foreign research location is also applicable. • If you process personal data of EU individuals or monitor the online behavior of users based in the EU, GDPR is applicable. Data and information classifi cation In order to ensure the confi dentiality and security of sensitive data, the directive on data and information classifi cation of the University of Basel (in German) defi nes four protection classes and, in this context, also the responsibilities for handling sensitive data. Find more information on data and information classifi cation on the Intranet of the University of Basel. For more information on data protection at the University of Basel, visit the Data Protection Offi ce or contact the Data Protection Offi cer (DPO): datensc[email protected]h. If you have questions about data and information classifi - cation, contact [email protected]h. https://researchdata.unibas.ch • This work is licensed under CC-BY 4.0. • [email protected] Illustration by FD[email protected], modifi ed