Facilitating world-class research
The University’s data protection policy and the GDPR apply irrespective of location. Appropriate measures need to be taken to ensure personal data can be processed in a secure and compliant way.
The exact measures to be adopted for each research project will need to be considered on a case-by-case basis as projects will be processing different data, collected from different sources and with different funding requirements. Before any changes take place, consideration should be given to the data privacy and security risks associated with home working and how these risks will be mitigated (for example, by training staff, developing standard operating procedures etc.). Where research projects have undertaken data protection impact assessments (DPIAs), these will need to be reviewed before any changes are made. Any research projects that do not have DPIAs should ensure that one is prepared in advance of any changes (for more information see the Information Compliance Team webpages on privacy by design). CTRG/CUREC should also be consulted to ensure any changes are within the ethical requirements of the project or to submit an appropriate amendment. You may find it helpful to review guidance from CUREC and CTRG.
You must ensure the agreed data access and sharing protocol is maintained, as failure to do so could invalidate any data sharing agreements and pose a security or data privacy risk.
The University has published general guidance for working remotely and the Information Security Team has guidance on its webpages on how to do so securely.
This guidance assumes that staff are working remotely within the UK. If you are seeking advice about working remotely at a destination outside the UK please contact the Information Compliance Team.
Of significant importance is to review the funders and/or data sharing agreements (where applicable) to identify if minimum security requirements and conditions are set out in contractual T&Cs. For example this may include requirements stating ‘access only permitted on networks that the University manages/owns’. The InfoSec Team have reviewed this particular aspect and deems that access over the MSD IT VPN using a University issued and maintained device provides an equivalent level of security. Deviation from such an approach would require further consideration and approval from the funder and/or data sharing entity as appropriate.
If you work within a department that has the NHS Data Security and Protection Toolkit (DSPT), or an alternative agreed governance model in place, then you will need to review what access provisions there are for the systems within the scope of these frameworks. It is recommended that you seek advice from your departmental information governance officer.
In accordance with InfoSec’s information handling rules, and if the data sharing agreement and security protocol permits the use of self-managed (‘personal’) devices to access research data (confidential data classification), then specific authorisation must be sought from the head of department, who owns the risk associated with accessing confidential data on such devices. If self-managed devices are proposed to be used, then you should only access data through the MSD IT VPN (or central IT Services VPN for non-MSD users) and should follow the security guidance for protecting devices on Information Security’s website.
You may need to make some adjustments to your working environment to maintain and protect the privacy and confidentiality of data subjects and shared information, such as:
However, you should ensure compliance with all principles of GDPR. For example: in terms of transparency, you will also need to consider how any operational activities have been described in any privacy notices or participant information sheets provided to participants and whether the proposed way of working would be in conflict with that. In terms of data minimisation, you can ensure compliance by not downloading and saving copies of data onto mobile, laptop or home devices but instead saving data to the University network. No copies of research data containing personal data should be printed off at home. This may also be a contractual condition on the use of the data.
In general terms, University-managed or owned mobiles that have appropriate security settings would be preferred. It is recommended that approval is sought from the appropriate budget holder for any associated billing.
It is not recommended that personal devices or landlines are used, due to the impracticalities of managing a retention policy when participants’ phone numbers and possibly voicemail messages (if they try to call the researchers) are stored on personal devices. Additionally, consideration should be given to the health and safety safeguards for University staff as a result of the risk of exposing personal phone numbers to participants.
Chorus is not recommended for contacting research participants. The IT Services Chorus soft client and Chorus Web Portal (for managing call forwarding from your work phone to home) are alternative solutions available in the University. However, as Chorus does not encrypt phone calls by default, Chorus does not provide an adequate level of security for data of a confidential classification.
As an alternative to a phone call it is possible to use Microsoft Teams to set up a virtual meeting with participants using their email address (if held).
If the participant’s email address is already held, you will need to consider how compatible this use is with the purposes for which it was originally collected and take into consideration the privacy information provided to the data subject. Ethical consent may be required to collect email addresses if not already held. It is recommended that CUREC/CTRG are consulted.
Microsoft Teams may not be appropriate if there are contractual requirements stipulating that research data is only permitted on networks that the University manages/owns.
The participant would receive an invitation email from the organiser with a link to join the meeting. If the participant is using a laptop/computer they will be able to join the meeting within their default internet browser. If the participant is using a mobile phone/tablet they will be required to download the Teams app.
You will need to consider how to manage data privacy risks and such steps to mitigate these risks could be outlined in a standard operating procedure (SOP) for the trial or study. All researchers involved should be trained on the procedures and records of training maintained.
For further advice and support on the use of Microsoft Teams, you can contact the IT Services helpdesk at email@example.com.
The information below sets out the points of consideration for data protection when remotely recording participants. As outlined above, you should undertake privacy by design for projects proposing to remotely record participants. CTRG/CUREC should also be consulted to ensure any changes are within the ethical requirements of the project or to submit an appropriate amendment.
With the move to remote working, there is now a demand to be able to hold participant interviews and collect data remotely using video-conferencing tools. However, in the first instance you should consider whether there is a need to remotely record participants if it was not necessary to record them prior to a remote working situation. For research, the University generally relies on ‘public interest task’ as its lawful basis for processing personal data. To rely on this lawful basis, the recording must be necessary for an active research activity and there must be ethical approval in place to conduct that activity.
Microsoft Teams is the University’s approved tool for virtual meetings and the only tool approved for confidential subject matter. Microsoft Teams has the functionality to video meetings, but you will still need to consider the risks described in the sections above when setting up a virtual meeting for the purposes of recording. To find out more, visit IT Services’ page on recording meetings.
Consideration should be given to the necessity and proportionality of the video recording. For example, if a video recording is necessary to capture an assessment of the participant, the video recording should be limited to the assessment only as it may not be necessary to record the entire meeting for the purpose of the research.
It may only be necessary to record the audio feed of the meeting for the purposes of transcription and later analysis. However, Microsoft Teams does not currently have the functionality to isolate audio from a video recording of a virtual meeting. In order to restrict the recording of the meeting to audio only, all attendees must switch off their cameras before starting the recording. This can only be done by each attendee. The onus is therefore on the participant to disable their own camera feed as it cannot be switched off by the meeting organiser. With this approach, there is a risk that participants may accidentally enable their camera during the recording and the researcher may inadvertently capture their video feed. As a safeguard to ensure that only audio is captured, the template invitation email to the invitees could be edited to remind them to ensure their webcams are switched off prior to joining the meeting. You should then remind all attendees in the meeting and check that all cameras are switched off before pressing record.
Where it is necessary to record the audio feed only but you need to be able to see the individual during the recording, there will be a risk of over-collection of personal data. You will need to consider how to mitigate those risks to avoid processing more personal data than necessary, for example, deleting the video as soon as the transcription is complete, ensuring data security measures are in place to protect the data until it can be destroyed and only using a third party transcription service:
It is possible to create closed captions for recorded videos in Microsoft Stream. Further work to explore this functionality and the potential production of transcripts continues and further guidance will be issued in due course.
Before the meeting starts, you should ensure that your working environment is set up appropriately to maintain and protect the privacy and confidentiality of data subjects, such as using headphones and not allowing unauthorised persons to look over your shoulder.
Once complete, the recordings are saved on Microsoft Stream. The organiser must ensure that the permissions to the recording are set appropriately whilst the recording is stored by Microsoft and restricted to those with a need to know. For guidance on this, check IT Services’ page on recording meetings. The default permissions for the recording are set with the person who made the recording (the meeting organiser) as the owner of the video and, if applicable, the internal Nexus 365 users who were on the meeting invite are set as viewers. External or guest meeting participants will not have access to the recording.
As the recording will be on an individual organiser’s account as opposed to a shared mailbox, it is recommended that recordings are downloaded and saved to the University IT network (for example restricted access folder, password-protected format) for data availability and business continuity purposes and so the retention policy for that data can be easily managed. The recording will exist in Microsoft Stream as long as the owner keeps it there or for as long as their account exists. Once downloaded, the recordings should be deleted from the organiser’s individual Microsoft Stream account.
Note that when a user deletes a recording, it is sent to the recycle bin and they have 30 days to recover this before it is permanently deleted. Recordings can also be permanently deleted from the recycle bin before the automatic 30 days.
It is important that participants are informed about the proposed recording activities or proposed changes to recording activities for projects already in flight through participant information sheets. It is recommended that CTRG/CUREC are consulted on any changes to participant information sheets.
Microsoft Teams virtual meetings can be used to facilitate the interviews with participants but the audio of the interview recorded in a separate encrypted dictaphone device (personal mobile phones would not be appropriate).
Make sure that your working environment is set up appropriately to ensure that you can maintain and protect the privacy and confidentiality of data. This is of greater importance if the interview is being recorded over a dictaphone as this will require
the audio to be played over the computer speakers.
It is recommended that any recordings captured through the device are transferred to the University IT network as soon as possible (for example restricted access folder, password-protected format) and deleted from the device. There are data security risks
with this approach, particularly around secure destruction of data held on the device and also the risk of loss of device (and subsequent loss of personal data held on the device) which could result in a confidentiality and an availability personal
The recording function within Microsoft Teams is switched off by default to discourage the inappropriate use of recording. For information on video recording for other purposes not relating to research participants, please see the
target="_blank">Information Compliance pages on general video conference recording.