Guidelines and legislation

Does your research involve human subjects? In that case, you will process personal data

Even if you reuse existing data in your research (e.g. social media data or CBS microdata) and the researcher does not know exactly which data belongs to which person, this is not anonymous data: it is personal data as long as the data can be used to somehow identify a person.

"Anonymous" data is rarely truly anonymous in practice

Anonymous data is defined in privacy law as data that cannot, or can no longer, be related to an identified or identifiable natural person, also if the data is or can be combined with other data. The fact that the researcher does not know who is who in the dataset does not mean that the dataset is anonymous, as it may be possible to identify people in the dataset if their data is combined with other data.

Data that can be used to identify a person indirectly is also personal data under the GDPR

All data that can be used to identify a natural person, whether or not this is done by combining it with other data, is considered personal data and therefore subject to the GDPR. This therefore also applies to data that has been pseudonymized (given an identification number) and to datasets with unique combinations of data.

Please also see FAQ: personal data & the GDPR on the BSS Infonet.

Laws, rules and guidelines:
-- General Data Protection Regulation (GDPR) (Dutch & English)
-- Dutch Implementation Act GDPR (UAVG) (Dutch)

Where the GDPR (which is European legislation) allows for interpretation by individual countries in the implementation, this is done in the Netherlands in the Dutch Implementation Act GDPR (UAVG). This concerns, for example, supplementary derogations for academic or historical research, or research for statistical purposes (UAVG art. 24).

Data protection authorities:
-- Dutch DPA: Dutch Data Protection Authority (Dutch & English)
-- EDPS: European Data Protection Supervisor (English)
-- EDPB: European Data Protection Board (Dutch & English)

Advice:
-- Ethics and Data Protection by the European Commission (English) with an accompanying decision tree as a guidance tool
-- VSNU Code of Conduct for Using Personal Data in Research (Dutch)
-- UG General Privacy Statement & General Policy on Protection of Personal Data (Dutch & English)

For information on privacy and data protection specific to the UG:

-- short clip De AVG en de RUG (Dutch) or The GDPR and the UG (English)
-- UG Privacy & Security Portal on the BSS Infonet
-- Data Protection & the GDPR (DCC) on the BSS Infonet

Please also see the FAQ: personal data & the GDPR on the BSS Infonet.

Subject to the WMO or not?

Research is subject to the Medical Research Involving Human Subjects Act (WMO) if:

• it is medical scientific research, and
• participants are subjected to procedures or are required to follow rules of behaviour.

Research that is subject to the WMO must be reviewed by an METc.

Medical Ethics Review Board UMC Groningen

Exemption letter (non-WMO declaration) from an METc

If the METc concludes that the research is not subject to the WMO, the researcher receives an exemption letter from the METc and must submit the research plan for review by the EC-BSS.

If you have received an exemption letter from the METc, please include this as an attachment to the EC Request application.

For further information, go to:

• Medical Ethics Review Board UMCG
• Central Committee on Research Involving Human Subjects (CCMO)

If the research involves participants outside the Netherlands, the researcher will need to consider the applicable legislation in the relevant country. This can include international and/or local laws, rules and guidelines, and may be related to privacy or to other issues. Examples are the HIPAA in the US or Islamic law (sharia) in the Middle East.

The researcher is responsible for ensuring that the research is conducted with due regard for local laws, rules and guidelines (see Nethics code, Section B7). The researcher may therefore ask someone who is acquainted with the particular area of law or a local ethics committee or similar body to review the research plan before submitting it for review to the EC-BSS, possibly accompanied by a declaration from this person or body.

In the case of unclear or contradictory laws or interests, the nature and circumstances of the dilemma must be documented clearly in the research plan and a solution must be provided.

In the case of doubt, UG employees may contact the General Administrative and Legal Affairs department (AJZ) for advice.

-- UG Research ethics (incl. confidential advisors) (NED & ENG)
-- More about integrity at the UG (NED & ENG)
-- More about animal experiments at the UG (NED & ENG)

In the case of multi-centre research, it is possible that part of the research is reviewed by EC-BSS, or that the whole research plan is reviewed by another institute. In accordance with the Nethics code of ethics, the term ‘centre’ is taken here to mean another institute of social and behavioural sciences outside the UG, such as FSW at Leiden University.

In the case of collaboration with other institutes (centres) and research institutes, the responsibilities of each institute and ethics committee need to be established. If personal data is to be processed, the GDPR dictates that the agreements made concerning the various responsibilities and obligations must be recorded, for example in a consortium agreement or in a Research Data Management Plan.

If personal data is processed at the UG as part of multi-centre research, the research must be registered in the UG research register.

Even if no personal data is to be processed, Section 3.2 (9) of the Netherlands Code of Conduct for Research Integrity states that the responsibilities and tasks must be recorded in written agreements.

For this reason, please present the ethical approval from another ethics committee to the EC-BSS before you start your research so that both parties are aware of the agreements.

Note:

Any agreement that needs to be signed should first be submitted to the UG General Administrative and Legal Affairs department. Researchers affiliated to BSS may contact the BSS privacy coordinator (login required).

Both codes of conduct named here can be found under Guidelines in the menu.