Data Protection and Privacy in Research

Anonymization (or true anonymization) is irreversible removal of identifiers such that re-identification is not possible, even in theory. Once data is anonymized, it is no longer personal data (under GDPR) and is not subject to data protection regulations. De-identification is removal of identifiers such that re-identification is not reasonably possible with available means, but theoretically possible (e.g., via linkage with other databases). De-identified data still receives some legal protection. In practice, few research datasets are truly anonymized; most are de-identified using HIPAA Safe Harbor or expert determination. For research, de-identification is usually sufficient if re-identification is not reasonably possible.

This depends on your jurisdiction. In the U.S., de-identified data is not subject to the Common Rule (45 CFR 46) and ethics review is not required (exempt). Under HIPAA, de-identified health data can be used without consent. In the EU under GDPR, truly anonymized data is exempt, but pseudonymized data (identifiers replaced but key retained) is still personal data and requires lawful basis (typically consent). Verify your data is genuinely de-identified according to Safe Harbor or expert determination. If using existing de-identified data and your institution considers it exempt, ethics review may be expedited or waived; consult your IRB/REC.

Immediate steps: (1) Contain the breach: identify how the breach occurred, secure systems, disable compromised accounts, prevent further unauthorized access. (2) Assess risk: determine what data was accessed, how many participants affected, what is the likelihood of harm to participants. (3) Notify affected participants: if breach poses high risk to participant rights/welfare (identity theft risk, privacy violation), notify participants within required timeline (GDPR: without undue delay, typically within 30 days; HIPAA: within 60 days). Notification should include what happened, what data was involved, contact information for questions, and steps participants can take (credit monitoring, password changes). (4) Report to regulators: GDPR requires notification of data protection authority (usually within 72 hours if high-risk); HIPAA requires notification of HHS Office for Civil Rights. (5) Conduct root cause analysis: determine why breach occurred and implement corrective measures to prevent recurrence (additional training, improved access controls, system upgrades). (6) Document everything: maintain records of breach, response, and corrective actions. Have legal counsel review notification language; early communication with institutions legal team is wise.

This depends on participant consent and jurisdiction. If original consent stated 'data may be used for any research purpose,' secondary use is broadly permitted. If consent was specific ('data will be used to study cardiovascular disease'), secondary use for a different disease requires new consent (or waiver if justified) under most frameworks. GDPR requires either explicit new consent or that secondary use is compatible with the original purpose (assessed by institutional legal review; very strict interpretation in practice). Best practice: if possible, use broad consent ('data may be used for any health research') to enable secondary use. For existing data with specific consent, consult your IRB/REC or data governance office before secondary use.