1 / 28

DATA PROTECTION

DATA PROTECTION. DATA PROTECTION and Research. David Cauchi Office of the Data Protection Commissioner. University Research Ethics Committee – 08.05.2006. DATA PROTECTION. Data Protection Act . General Provisions Processing for Research Purposes

norina
Download Presentation

DATA PROTECTION

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. DATA PROTECTION DATA PROTECTION and Research David Cauchi Office of the Data Protection Commissioner University Research Ethics Committee – 08.05.2006

  2. DATA PROTECTION Data Protection Act • General Provisions • Processing for Research Purposes • Procedure agreed with UREC • Practical Problems

  3. ORIGIN DATA PROTECTION Council of Europe – ETS 108 Convention on the protection of individuals with regard to automatic processing of personal data Data Protection Act CAP. 440 Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data

  4. WHAT IS DATA PROTECTION ACT? DATA PROTECTION An Act that makes provision for the protection of individuals against the violation of their privacyrights by theprocessing of personal data.

  5. DATA PROTECTION Key Termsin Data Protection

  6. PERSONAL DATA DATA PROTECTION “…any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;” DPA Art. 2

  7. SENSITIVE PERSONAL DATA DATA PROTECTION “…personal data that reveals race or ethnic origin, political opinions, religious or philosophical beliefs, membership of a trade union, health, or sex life;” DPA Art. 2

  8. PROCESSING DATA PROTECTION “…includes the collection, recording, organisation, storage, adaptation, alteration, retrieval, gathering, use, disclosure by transmission, dissemination or otherwise making information available, alignment or combination, blocking, erasure or destruction of such data” DPA Art. 2

  9. CONSENT DATA PROTECTION “…any freely given, specific and informed indication of the wishes of the data subject by which he signifies his agreement to personal data relating to him being processed” DPA Art. 2

  10. DATA PROTECTION Criteria for Processing

  11. DATA PROTECTION PERSONAL DATA DPA Article 9 1. Unambiguous consent or 2. Contract performance or 3. Legal obligation or 4. Vital interests of data subject or 5. Public Interest / Official Authority or 6. Legitimate interest • SENSITIVE PERSONAL DATA • DPA Articles 12 & 13 • Explicit Consent • Subject made data public • Conditions of employment • Vital Interests & data subject • incapable of giving consent • 5. Legal claims

  12. DATA PROTECTION Data Protection Principles

  13. THE NINE PRINCIPLES for ‘good information handling’ DATA PROTECTION Personal Data to be: 1. processed fairly and lawfully 2. processed in accordance with good practice 3. collected for specific, explicitly stated & legitimate purposes 4. processed for reasons compatiblewith the purpose it was collected 5. adequate and relevant to the processing purpose 6. not more than required for the processing purpose 7. correct and, if necessary, up to date 8. rectified 9. not kept for longer than necessary for the processing purpose DPA Art. 7

  14. DATA PROTECTION Rights of Data Subjects

  15. RIGHTS OFDATA SUBJECTS (1) DATA PROTECTION • INFORMATION • The controller must provide the data subject with at least the following: • identity and habitual residence or principal place of business of controller; • purposes of processing; • any further information such as: • i) recipients or categories of recipients of data • ii) whether reply to any questions is obligatory or voluntary, and possible consequence of failure to reply • iii) existence of right of access, right to rectify and where applicable right to erase data. • DPA Art. 19

  16. RIGHTS OFDATA SUBJECTS (2) DATA PROTECTION ACCESS • Request of Data Subject • must be: • at reasonable intervals • in writing • signed by data subject • Data Controller to provide: • without excessive delay • without expense • written information in an intelligible form DPA Art. 21

  17. RIGHTS OFDATA SUBJECTS (3) DATA PROTECTION RECTIFICATION • The Data Subject shall have the right to request and • The Data Controller shall have the obligation: • to rectify, block or erase personal data Where the law so requires. Data Controller also to notify third parties about such rectification, blocking or erasure; DPA Art. 22

  18. DATA PROTECTION Processing For Research Purposes

  19. DATA PROTECTION IN RESEARCH DATA PROTECTION • THE DATA PROTECTION ACT APPLIES WHEN: • Research is about individuals • Research involves personal data • Individuals are identifiable

  20. PROCESSING CONCERNING RESEARCH DATA PROTECTION • Sensitive Personal Data may be processed for Research Purposes: • On Public Interest grounds • With the approval of the Commissioner, on the advice of a Research Ethics Committee • DPA Art 16

  21. DATA PROTECTION Procedure agreed with UREC

  22. PROCEDURE (1) DATA PROTECTION RESEARCH INVOLVING SENSITIVE PERSONAL DATA • Proposal Form for ethical approval is filled by the researcher • Research Proposals are examined by the Faculty Research Ethics Committee and by the UREC • Approval is given if proposals are satisfactory • Approval from the UREC is deemed to be an adequate advice for the approval by the Commissioner • Researcher may proceed with the project once it is approved by the UREC

  23. PROCEDURE (2) DATA PROTECTION • A list of approved projects are periodically forwarded to the Commissioner for final approval The UREC may always consult the Commissioner in case of problems with particular projects OBJECTIVE • Allow the researcher ample time to proceed with the study The Researcher is not required to obtain an approval directly from the Commissioner

  24. PROPOSAL FORM DATA PROTECTION INCLUDES: • Data Protection Principles • Rights of Data Subjects OBJECTIVES: • Inform researchers and ensure that these principles and rights are respected It is important that all faculties include the same conditions so that all students are properly informed

  25. DATA PROTECTION Practical Problems

  26. PRACTICAL PROBLEMS DATA PROTECTION • In cases where research is not only for academic purposes but also considers other factors (e.g. administrative matters in Hospital) Is the UREC still responsible for the approval?? • What data is the researcher entitled to use once the project is approved? Is the researcher allowed to use personal details accessed to contact individuals? Does an approval oblige the Data Controller (e.g. Hospital, school) to give access to the researcher?

  27. DATA PROTECTION Further Information Office of the Data Protection Commissioner E-Mail:commissioner.dataprotection@gov.mt Website: www.dataprotection.gov.mt

  28. DATA PROTECTION THANK YOU! Floor is open for discussion

More Related