The collection, storage, disclosure and use of personal data by researchers must comply with all legislation relating to data protection and arrangements must be put in place by researchers to carefully protect the confidentiality of participants, their data and/or tissue. Details that would allow individuals to be identified must not be published or made available to anybody not involved in the research unless explicit consent is given by the individuals concerned.
Before consent is obtained, researchers must inform prospective participants of:
(i) Any potential risks that might mean that the confidentiality or anonymity of personal data may not be guaranteed;
(ii) Which individuals and organisations, if any, will be permitted access to personal data, and under what circumstances such access will be granted;
(iii) The purpose for which personal information provided is to be used (e.g. if video material might be used for teaching purposes).
If it is necessary, in undertaking research, to identify participants explicitly, then the researchers must explain why this is the case and how confidentiality will be protected. Researchers must be aware of the risks to anonymity, confidentiality and privacy posed by all kinds of personal information storage and processing which directly identify a person (e.g. audio and videotapes, electronic and paper-based files, e-mail records). Measures to prevent accidental breaches of confidentiality must be taken, and in cases where confidentiality is threatened, relevant records should be destroyed. Provisions for data security at the end of a project must be made.
Guarantees of confidentiality and anonymity given to research participants must be honoured, unless there are clear and overriding reasons to inform appropriate third parties (e.g. cases of child abuse or where an uninvolved 3rd party may be at risk through the participant’s actions). All participants under the Data Protection Act have the right to access personal information, whether or not it is confidential, that relates to them, and to be provided with a copy of the information on request. People should have the right, following the completion of their period of involvement in the research and following discussions with the researcher, to withdraw their consent and to require that their own data be destroyed, if practicable.