I want to find out more about re-purposing personal data and use it for research purposes

Do not use personal data if you could reasonably achieve the same research outputs without using personal data, it must be more than 'just useful' or 'because it’s always been done'

Consider:

• Does this processing help to further the outcome you’re aiming to achieve?
• Is there another less intrusive way to achieve the same result?

Research purposes are broadly interpreted and include for social sciences, humanities and the arts, and technological development, as well as for demonstration. It is likely to fit within a research purpose if the purpose is to:

• Ensure the permanent preservation and usability of records of enduring value for general public interest (archiving).
• Provide innovative solutions to problems, generate new understandings or insights that add to knowledge on the subject matter (scientific or historical research).
• Generate statistics that may be used for further purposes, including scientific research (statistics).

Consider, will the personal data be processed:

• To secure records for future educational use?
• Because there is a long-term benefit to society to preserve personal information?
• To produce new knowledge or apply existing knowledge in novel ways?
• To formulate and test hypotheses?
• To interpret and analyse data?

If the personal data being re-used for a research purpose, was originally collected by º¬Ðß²ÝÊÓƵ, use the original lawful basis as the legal justification for the new processing activity, unless the original lawful basis was consent.

Consent must always be specific and informed, meaning personal data can only be processed for the purposes the individual consented to. If you wish to conduct research using data originally collected for a different purpose on the basis of consent, you will need to ask for new consent. If you want to re-use personal data collected by another organisation using consent as their lawful basis, they will need to obtain permission from the individuals before sharing it with you.

Consider:

• Consent as a lawful basis for processing personal data is different and separate to gaining ethical consent to participate in research,
• Where did the personal data originate from? Will it be provided by a separate organisation or was it originally collected by the University?
• Personal data collected using consent as the lawful basis cannot automatically be repurposed and re-used for research activities.

There must be technical and organisational measures in place to safeguard individuals’ personal data, in particular to ensure their data isn't processed unnecessarily. 

If sensitive special category data will be processed, a Data Protection Impact Assessment must be completed to evaluate and mitigate, or remove possible risks and issues.

Consider:

• Only collect the personal data needed to complete the research, do not collect additional data in case it might be useful.
• Where it is possible, use anonymised or pseudonymised personal data. According to the UK GDPR, pseudonymised data is personal data. However, pseudonymisation will reduce the risk of damage or distress in the event of a data breach.
• From the outset, plan where will the data be stored so it is secure, who will have access to it? Will the data be encrypted; and if it is necessary to share data, how will it be transferred safely?
• Ensure the study complies with relevant University policies, such as
  • data protection,
  • responsibilities of all staff and research students, and
  • the Open Access Policy.

Update privacy information to include the new processing activity and inform the data subjects, unless doing so would be impossible or involve disproportionate effort; or providing information would prevent or seriously impair the achievement of the research purposes.

Consider:

• Including information about your lawful basis and intended purpose for processing the personal data for research.