Personal data is any information that refers to identified or identifiable natural persons. In other words, when a person can be identified by direct or indirect means (by means of any physical, physiological, psychological, economic, cultural or social information), without disproportionate efforts being necessary.

Personal data are not only identifying data, such as name and surname, ID card number or address, but any data that can identify a person, directly or in combination with other data.

Special categories of personal data require special processing. These are data on health, racial or ethnic origin, sex life, ideology, trade union membership, religion, beliefs, genetic data and biometrics. Data on administrative and criminal offences also have a special consideration.

Data relating to legal persons are NOT personal data, nor are data relating to persons who are already dead.

Personal data must be processed in accordance with the following basic principles:

• Purpose: Data may only be collected and processed for specified, explicit and legitimate purposes. They may not be processed for other purposes.
• Necessity: Only data that are adequate, relevant and not excessive in relation to the purpose for which they have been collected may be processed. Data must be deleted when they are no longer necessary.
• Accuracy and timeliness: Data must be accurate. They must be updated to reflect the actual situation of the data subject.
• Limitation of the retention period: Data must only be retained in such a way that they can identify individuals, during the period necessary to fulfill the purpose for which they were collected
• Integrity and Confidentiality: Data must be processed in a way that ensures adequate security, including protection against unauthorised or unlawful processing, loss, destruction or damage. Security must be ensured by appropriate technical and organisational measures.
• Lawfulness, fairness and transparency: Personal data must be processed lawfully, that is to say, in accordance with one of the conditions for legitimate processing (Article 6 GDPR), fairly and transparently in relation to the data subject.

They are rights of persons:

• Right to information: the data subject must be informed, among others, of the identity of the data controller, the purpose of the processing and the possibility of exercising his/her rights (Article 11 LOPDGDD, Article 13 RGPD). Generally, this is done by adding an informative legend to the data collection form. You can consult how the UPF, as the party responsible for certain processing operations, guarantees this right to information. 
• Consent: consent is necessary for the processing of personal data, unless otherwise provided by law (article 6 LOPDGDD). Special cases: minors, legally incapacitated persons, special categories of personal data, data transfers, processing for purposes other than those initially foreseen.
• Right of access: the individual has the right to request confirmation from the data controller as to whether or not personal data concerning him/her are being processed. If they are indeed being processed, the individual has the right to access these data and to obtain information such as: the purpose of the processing, the categories of personal data being processed, the period foreseen for the storage of these data, etc. (Article 15 RGDP).
• Right of rectification: the individual has the right to obtain from the controller the rectification of inaccurate personal data concerning him/her. The individual also has the right to the completion of incomplete personal data (Article 16 RGDP).  
• Right of erasure: The individual has the right to obtain from the controller the erasure of personal data concerning him/her. In any case, the controller will have to delete, among others, personal data that are no longer necessary in relation to the purposes for which they were collected or processed (Article 17 GDPR).
• Right of restriction: the individual has the right to obtain the restriction of data processing provided that a series of circumstances are met, among which we find: the contestation of the accuracy of the data or the unlawfulness of the data (Article 18 GDPR). 
• Right of portability: the individual has the right to receive in a structured, commonly used and machine-readable format the data he or she has provided to the data controller. He or she also has the right to migrate his or her personal data from one controller to another, provided that the processing is based on consent or a contract, and the processing is carried out by automated means (Article 20 GDPR).
• Right to object: the individual has the right not to be subject to a decision based solely on automated data processing, including profiling, which produces legal effects or significantly affects him or her in a similar way (Article 21 GDPR).

The data controller and its employees have the following duties:

• To treat data in accordance with the legally established principles.
• To guarantee the rights of individuals.
• To maintain the confidentiality of personal data, even after leaving the job.
• Protection by design: the controller has to implement, both at the time of determining the means of processing and at the time of processing, appropriate technical and organisational measures designed to effectively implement the data protection principles and to integrate in the processing the necessary safeguards to comply with the applicable law.
• The Data Protection Officer (DPO) will supervise compliance with the applicable data protection legislation as well as the controller's data protection actions. He or she is also responsible for advising the controller on the data protection impact assessment and supervising its implementation.

• Transfers of data: Disclosures of personal data to a person other than the data subject. Data may only be disclosed to a third party for purposes directly related to the legitimate purposes of the data controller or the third party, with the prior consent of the data subject. Consent is not required in the cases provided for by law. Publishing data on the Internet is considered a transfer of data. There is no transfer when anonymised data is provided.
• Data processing: Processing of data by third parties when it is necessary for the provision of a service to the data controller (not considered a transfer of data). A contract or agreement is required regulating the processing of the data, purpose, security measures, return or destruction of the data at the end of the service, etc.
• International transfer: Processing of data that involves its transmission to countries outside the European Economic Area.  Subject to special requirements (Spanish Data Protection Agency).

Article 89 of the GDPR regulates the processing of personal data relating to scientific research purposes and establishes a number of safeguards. Article 5 of the same Regulation stipulates that research purposes are compatible with the processing of personal data.

The Seventeenth Additional Provision of the LOPDGDD specifically regulates research in the field of health.

First of all, it is necessary to assess whether personal data will actually be processed in the course of the project.

Remember that not only identifying data such as name and surname or address are personal data. Personal data are all data that directly or in combination with other data or information can identify a person.

"(...) In determining whether a natural personal is identifiable, account should be taken of all the means, such as singling out, which may reasonably be used by the controller or any other person to identify the natural person directly or idirectly. In determining whether there is a reasonable likelihood that means are used to identify a natural person, account should be taken of all objective factors, such as the costs and time necessary for identification, taking into account both the technology available at the time of processing and technological developments (...)" (Recital 26 GDPR).

Pseudonymised data are personal data processed in such a way that they can no longer be attributed to a specific person without the use of additional information. Pseudonymisation is often carried out by assigning a numerical or alphanumeric identification code to the participant in research projects, so that the data obtained from his or her participation are identified only by this code. It is necessary to store separately and under the corresponding technical and organisational measures the file containing the participants' identification data with the assigned numeric or alphanumeric code.

Pseudonymisation is a security measure and should be applied to personal data whenever possible.

Pseudonymised data are considered personal data.

Information that does not relate to an identified or identifiable natural person, or data processed in such a way that the person cannot or irreversibly ceases to be identifiable (e.g. because each participant has been allocated a numerical identification code, the file containing the person's identification data and the corresponding assigned numerical code has been deleted and, in addition, the set of data collected does not provide information that allows the participant to be identified).

It should be noted that replacing the person's name with a pseudonym or a numerical code may not be sufficient to anonymise data. Sometimes a person can be identified through a combination of other information or data.

It should be remembered that the image or voice of individuals is personal data, and therefore the audio or audiovisual recording of participants implies the processing of personal data even if their names are not mentioned.

Anonymous or anonymised data are not personal data.

You can find advice on how to anonymise data here: 

• Article 29 Data Protection Working Party, Opinion 05/2014 on anonymisation techniques
• ICO (UK), Anonymisation: code of practice
• UKAN-UK Anonymisation Network, Resources
• ICPSR (United States) "The practice of protecting confidentiallity", Guide to Social Science Data Preparation and Archiving

Consider whether your project needs to process personal data and what type of data.

Personal data may only be collected and processed if they are adequate, relevant and not excessive in relation to the purpose and legitimacy sought (Article 5.1.c GDPR).

Remember:

• do not collect personal data if it is not necessary
• only collect data that is necessary for your research. DO NOT collect other data under the pretext that they might be useful to you in the future.

Direct collection

If you plan to collect personal data from participants, for example, because you want to conduct interviews, questionnaires, or record participants, you must have the informed consent of the individual. Remember that in the case of research involving individuals, the University has an Internal Ethics Review Committee (CIREP).

Re-use of data

If you want to reuse personal data files for other projects, you should check if it is possible in the consent forms that were signed in the initial data collection. You can also ask CIREP for support.

The data you will process...

- ... allow you to assess aspects of the participant's personality or behaviour? In this case, basic and medium level security measures must be applied to the data.

• In this case, basic and medium level security measures must be applied to the data.

- ... Are they data on health, racial origin, sex life, ideology, trade union affiliation, religion or beliefs of the participants?

• You need the express consent of the participant to deal with these subjects (article 9.1 LOPDGDD in relation to article 9.2 RGDP). Remember to include this information and the request for express consent in the informed consent form.
• Basic, medium and high level security measures must be applied to the data.

- ... is the data of minors?

• You have to adapt the consent forms to a language they can understand.
• You cannot ask for data concerning their relatives without their consent. are they data of children under 14 years of age?

- ... are they data of children under 14 years of age?

• You will also need to obtain the consent of their legal representatives (usually their parents). are they data of persons who have been declared incompetent?

- ... are they data of persons who have been declared incompetent?

• You will need to obtain the consent of their legal representatives.

In the collection of data:

• To be informed of the processing of their data, that it is intended to be done and that their consent is obtained. Consult the Guide to Informed Consent
• not to provide data they do not want

At any time during the research:

• to contact the researchers for any questions, clarification or request regarding your personal data: you must provide your contact details.
• to exercise their rights of access, rectification, deletion, opposition, portability and limitation
• to revoke your consent

Appropriate security measures must be applied to personal data to ensure that the data are protected against unauthorised or unlawful processing, and against accidental loss, destruction or damage. They should be adapted to technological developments. See the applicable security measures.

Where possible, encrypt and pseudonymise data.

Personal data should only be kept for as long as they are necessary and not excessive: this may coincide with the duration of the project and additional time may be foreseen for possible audits, reviews, etc. of the project.

If you want to keep anonymised data files for future re-use, ask participants for their consent. See the Informed Consent Guide.

The publication of participants' personal data requires their consent: for example, to include photographs or to show excerpts from recordings at seminars or conferences. It is also necessary to seek the consent of the participants in order to disseminate their data via the Internet.

Informed consent form