Data…Person…I…am?<\/p>\n
Data…People…in…Academia?<\/p>\n
Data\u2026Processing\u2026is\u2026Awesome?<\/p>\n
Of course, a DPIA is none of the above. It is \u2013 in fact \u2013 a catchy acronym for what\u2019s known as a Data Protection Impact Assessment<\/em><\/strong>.<\/em> And just what does that <\/em>mean, exactly?<\/p>\n Well, in essence, exactly what it sounds like; a process by which you, yes YOU: the researcher, calculates and analyses the level of risk attached to (or the impact<\/em> <\/strong>of) the protection of the data you plan to use in your research, through which you can determine how to best minimise said risk appropriately.<\/p>\n If you work with healthcare data, it\u2019s extremely likely that you will almost always<\/em> be using \u2018high-risk\u2019 data in your research. Most medical data, for example genetic data, or biometric data, particularly when used for identification purposes, are classified as \u2018special category\u2019 data underArticle 9 of UK GDPR<\/a>1<\/sup> (as part of the Data Protection Act of 2018). Special category essentially equates to sensitive, personal data for which the additional legal basis for their collection, processing, and retention is required.<\/p>\n TL;DR<\/strong> \u2013 rule of thumb: the more protection attached to the data, the higher the risk.<\/p>\n Whilst there is no set template for conducting a DPIA, options are available<\/a>2<\/sup>, but the particular needs will vary from one research project to the next. This may seem quite laissez-faire but make no mistake \u2013 a DPIA is a legal obligation for the processing of data. Failure to do so can land you with a whopping fine (up to \u00a38.7m!). So, this is serious business for serious people!<\/p>\n I\u2019ll assume most of us made our way into the world of healthcare research along a spectrum of commonality as to the importance of people and their wellbeing. Whether working in a clinical capacity, or in data, or in academia, or in an administrative capacity, name a role \u2013 it should be obvious by now, but the rights and freedoms of the individuals whom we work with and for as health care professionals are paramount.<\/p>\n Yes, rights and freedoms, within which we can include protection against discrimination of any kind, financial and identity fraud, loss of the right to privacy, professional\/reputational damage, and social or economic disadvantage, but there are less-concrete risks to consider, too; such as loss of public trust within society writ large (not just at the individual level) of the institution in which you conduct your research should something go wrong, e.g., an academic institution, or an NHS health board, etc. The domino-effect can ultimately lead to a lack of public trust in these institutions and make similar research more difficult to conduct for others \u2013 which we can all agree, is bad news all around for everyone from the researchers to the public themselves. *<\/p>\n Recital 75<\/a>3<\/sup> is your friend, here.<\/p>\n * A slightly morose, but nonetheless important note is that when we are talking about rights and freedoms, we are referring to those of \u2018natural persons\u2019 \u2013 that is to say, people who are currently living.<\/strong> The same rights and freedoms do not apply<\/u> to the deceased. <\/em><\/p>\n \u00a0<\/em><\/strong><\/p>\n Consider a DPIA an evidencing of this understanding<\/strong>; that all associated data of said persons be seen as an extension of<\/em> the said persons, and the impact<\/strong> any misuse (however unintentional) of their data might have. You know, primum non nocere, <\/em>or \u201cFirst, do no harm\u201d \u2013 or perhaps more realistically, weigh up the calculated risk (cost of potential harm) against potential patient benefit \u2013 and show your workings<\/u>. *<\/p>\n *Trivia! \u2013 did you know, although primum non nocere<\/em> is attributed to Hippocrates, it comes from the treatise \u2018Of the Epidemics\u2019 (Book I), not the Hippocratic Oath, itself. Honest, Google it!<\/p>\n Completing a DPIA allows you to \u2018forecast\u2019 any potential difficulties with the processing of the data you need for your research ahead of time. <\/strong>It shows that you are serious about protecting the rights of your research participants, it shows your funders that you are legitimate and accountable, and helps others \u2013 whether your research participants, or the public, or potential collaborators, understand why \u2013 and importantly how<\/em> \u2013 you intend to use this information.<\/p>\n Moreover, the forward thinking a DPIA encourages means you could negate any potential upset during your research before it arises, perhaps even reduce the costs of your research, ensuring you collect and process only the data absolutely necessary, saving you both time and money in the long run.<\/p>\n DPIAs need not be static and rather viewed as frameworks that can be referred to at any point and amended where necessary to ensure you remain accountable to the interests of your participants throughout. Don\u2019t be afraid to revisit your DPIA if for some reason the research necessitates a different path; this is an opportunity to reevaluate the risks of the data required \u2013 seek engagement from your participants and collaborators. Have those crucial discussions and stay transparent.<\/p>\n You may find that a new software is introduced which might speed up your processing requirements; great! But what are the risks of using this software; are you required to share the data for off-site processing (e.g., involving a third party) \u2013 do you need another data processing agreement? Is this a well-established software developer with a robust professional reputation? What security measures do they have in place for the protection of the data they process on your behalf? You get the idea\u2026<\/p>\n References<\/em><\/strong><\/p>\nA useful way to consider this might be to ask yourself the following:<\/strong><\/h2>\n
On that note\u2026<\/strong><\/h2>\n
We\u2019ve talked a lot about risk, but what exactly do we mean?<\/strong><\/h2>\n
Evidence<\/strong><\/h3>\n
Accountability<\/strong><\/h3>\n
\n
Evaluate, then re-evaluate!<\/strong><\/h3>\n
\n