Privacy in research: asking the right questions

Educating researchers about privacy in research 

Within universities much research is conducted and many classes are taught about how to do research. Since the introduction of the General Data Protection Regulation (GDPR, in Dutch: AVG) protecting the privacy of stakeholders has become a top priority. That is why reusable and accessible educational materials about privacy in research are needed. These materials should be suitable for both online and face-to-face learning environments, in research-driven, multi- and interdisciplinary settings. A practical and manageable approach is needed, one that connects to the GDPR and existing codes of conduct for responsible research, and to discussions about responsible research. 

The project was proposed in response to the growing awareness of the importance of responsible research practices. Acknowledging that it is important to start educating researchers as early as possible, the project aims were: 

• To teach students how to ask the right questions about the privacy of stakeholders by considering and understanding privacy issues from different perspectives (researcher, subject, legal expert, IT expert, respondent, etc).
• To develop an approach to successfully design, implement and embed responsible research methodology in multi and interdisciplinary research, to be used university-wide at all levels of education. The approach is built on accessible and attractive educational materials based on the Data Protection Impact Assessment (online course, videos, case studies). 

Design roleplay, roadmap for teachers and cases 

Stakeholder involvement is organised through the involvement of the team and a growing community of practice. The community of practice consisted of teaching staff who suggested relevant scenarios for the roleplay and data management support staff (library and Central IT department). 

Data managers of the Digital Competence Centre were involved in the design of the roleplay. Experts of Educational Support and Innovation helped with know-how about communities of practice and roadmap for teachers. A postdoc developed the case on voice recognition and key concept cards. A post doc on risk communication was involved for the assignment for master’s students and PhDs. 

Support for the broader implementation is received from the community of practice as well as the participants. Research and educational directors function as ambassadors, a team and experts on privacy & security in faculties make it possible to embed the practice in a growing number of courses. Connections with the policy office as well as the teacher training department will contribute to a further dissemination. 

Community of practice and results 

No formal effectiveness study has been done, since the focus was more on practical growth of the community of practice and opportunities to learn from each other and the students. The e-learning material has been used by more than 600 students in courses of the RUG and worldwide. The roleplay has been incorporated in courses of four faculties (Law, Science and Engineering, Social and Behavioural Sciences and Campus Fryslân) and dedicated programs on research integrity and data science.  

Furthermore, the training has been offered to a community of practice with deans, policy developers, institutional privacy experts and data management support staff and teaching staff, members of ethics committees and supervisors. 

Information on this project, online courses, role-playing games and cases are published on the project website Privacy in research.

The impact improved due to the Teaching Academy Groningen. The new Digital Competence Centre is also committed to support training and awareness about responsible research. The costs to use the material are limited. Depending on the number of students it might take an investment to train student-assistants as moderators. This can be mitigated by involving staff from the community of practice in the role of moderators. An investment of time is needed when a new scenario is developed and reflection on learning goals is needed to fit this into existing courses. 

The approach of this project was recognized with an honorable recommendation as best practice by the Council of Europe.  

Relevante publicaties  

• Bieker, F., Friedewald, M., Hansen, M., Obersteller, H., & Rost, M. (2016, September). A process for data protection impact assessment under the European general data protection regulation. In Annual Privacy Forum (pp. 21-37). Cham: Springer International Publishing.
• Martin, N., Friedewald, M., Schiering, I., Mester, B. A., Hallinan, D., & Jensen, M. (2020). The data protection impact assessment according to article 35 gdpr. Fraunhofer Institute for Systems and Innovation Research ISI.
• Hoorn, E., & Montagner, C. (2018). Starting with a DPIA methodology for human subject research. Retrieved from https://www.rug.nl/digital-competence-centre/privacy-and-data-protection/gdpr-research/documents/dpia-guidance-doc.pdf
• Wenger-Trayner, E and B (2015) Communities of practice a brief introduction, April 15, 2015. Retrieved from Introduction to communities of practice – wenger-trayner
• Beaulieu, A., & Leonelli, S. (2021). Data and Society: A Critical Introduction. SAGE Publishing. https://hdl.handle.net/11370/c0881a90-1923-4a63-8fa5-7fa21600d46f 

Producten of presentaties over dit project

• Project website Privacy in Research (with information about the online courses, role playing game, cases, etc.)