Data protection in research
The collection and processing of personal data in research are subject to data protection regulations.
Data protection is a form of protection of personal rights. Indeed, it is not data but people who are protected from violations of their personal rights by the incorrect or illegal handling of their data.
Research projects that involve the collection and analysis of personal data are subject to legal requirements regarding the protection of personal data. On request, the Data Protection Officers (DPOs) support you in complying with them. Service includes:
- Guidance on the legal aspects of data protection throughout the entire data lifecycle
- Support for agreements involving the transfer of personal data
Contact the DPOs well in advance of the planned collection and processing to allow time for proper guidance.
-
Legal grounds
The processing (i.e., collection, storage, disclosure, deletion, etc.) of personal data by researchers within the University is subject to the Data Protection Act of the canton of Fribourg. Depending on the specificities of the project and collaborations with partners, the application of other data protection acts (e.g., the Federal Data Protection Act or the General Data Protection Regulation of the European Union) could be relevant.
As a public institution, the University is considered the controller of the personal data processed for research purposes. But, researchers are responsible for ensuring that data collection and processing in their research projects comply with data protection regulations (Art. 64 Cantonal Staff Act and Art. 14 University Statutes).
The Cantonal Act on the University gives the University the legal task to contribute to the advancement of scientific knowledge through research and provides an indirect legal basis for processing research data. However, the consent of participants is required to collect and process personal data for a research project, for ethical reasons as well. The consent form furthermore allows the University to fulfill the legal duty to provide participants with the information required for them to exercise their rights and to guarantee transparent data processing.
-
Data Protection Review
Navigating legal data protection requirements and safeguarding the fundamental rights of research participants can be challenging. The Data Protection Review form has been designed to guide you through this process.
It highlights the key aspects that require careful planning and implementation when collecting and processing data in research projects.
If you wish to obtain support from the Data Protection Officers (DPOs) in assessing the legal compliance of your data processing activities, please send them the completed Data Protection Review Form by email. The review should be carried out before any personal data is collected or processed, and sufficiently early to allow for any necessary adjustments to the project.
If your project is also subject to approval by an institutional ethics committee, the DPOs’ review can be conducted either prior to submission or in parallel with the ethics review process. The DPOs may also liaise directly with the ethics committee to help facilitate and streamline the overall process.
-
Data Protection Impact Assessment
Certain types of data collection and processing in research – depending on their nature, scope, context, and purpose – may pose a high risk to the fundamental rights of participants. In such cases, a Data Protection Impact Assessment (DPIA) is legally required.
A DPIA is a structured and practical analysis that helps identify the measures needed to minimize potential risks, and to assess the severity of any remaining (residual) risks after mitigation.
To determine whether your research project may present a high risk, you can refer to the List of Potential Risk Factors. This assessment should be carried out before any personal data is collected or processed, and sufficiently early to allow time to complete the DPIA and implement appropriate risk mitigation measures.
If you consider that your research project involves one or more risk factors, the DPOs can assist you in conducting the DPIA. To request support, please email the DPOs with the completed Data Protection Review Form, along with a brief description of the anticipated risks.