First and foremost, your university or research institution should be able to assist you in gaining sufficient information about how sensitive personal data can be accessed, stored and analysed. Both legal and ethical guidelines will apply in most cases. In some cases, researchers might be required to draw up a data protection impact plan, where the impact of processing sensitive personal data for research participants and other central stakeholders is explicitly considered, and a risk analysis and mitigation plan is outlined. Projects involving medical and health data usually have additional legal requirements, such as requirements regarding clinical trials, that researchers should comply with.

It is important to assess how the use of sensitive personal data might impact the privacy of children and young people. In most cases, where researchers process fully anonymous data, they do not need to devise specific data protection impact plans. It is, however, important to understand that anonymous data cannot in any way identify individuals – either directly through a name or personal number, or indirectly through background variables, or even through a name key or link key, encryption formula or code. Researchers should consult their respective data protection authorities to ensure that their approach to anonymisation complies with these requirements.

All personal data must be stored securely. Universities and research institutions have different policies and procedures in this regard. Some personal data, which may or should be available to the general public, can be stored freely on private devices as long as they are password protected. Personal data relating to children and young people will normally not be data that may or should be available to the general public. Personal data that is not anonymised and that is sensitive should be stored much more securely. This will usually entail storage on encrypted servers that are subject to higher levels of security, in particular regarding who can access the data and how this can be managed. It is also important that sensitive personal data is only stored for as long as necessary and is safely destroyed once the research project has been completed.

The analysis of sensitive personal data that is not anonymised should also be subject to sufficient safeguards, including encryption and the management of identification and access. Many universities and research institutions now provide access to solutions that can support this kind of analysis. It is important that data is only accessible to those that need to use it. It is less cumbersome for teams of researchers to analyse sensitive personal data together once the data has been transcribed and anonymised. It is, however, important that the process of anonymisation complies with the requirement outlined above – i.e. that the data cannot in any way identify individuals.

Privacy and the right to be free from intrusion or interference by others is a basic human right and is articulated for children in Article 16 of the United Nations Convention on the Rights of the Child. According to guidance issued by ERIC (Ethical Research Involving Children), best practice regarding the protection of children’s privacy in research requires researchers to:

Respect children’s right to privacy and ensure that their information remains confidential;

Securely store, protect and dispose of information/data that has been collected;

Be mindful that any assurance about confidentiality also includes explicit mention of the limits to this, and always be prepared to act sensitively on safety concerns.

(ERIC, online) 

Researchers have an ethical responsibility to consider children and young people’s privacy, anonymity and personal integrity throughout the research process, whether in planning, implementation, analysis or dissemination. The most important considerations at each stage of the research process are outlined under the relevant headings below.

In the planning phase:

Research protocols can be developed to ensure that information is kept private, anonymised where possible and appropriately and securely stored. 

During implementation:

Researchers should consider that issues may arise which require more flexibility and ethically sensitive reactions on their part. Interviews, for example, can be conducted in locations that are not as private as initially anticipated or where parents, teachers or caregivers are present during data collection. It is best practice to ensure that children can participate in research in a way that protects their privacy and allows them to share information freely without being concerned that other individuals are listening to what they say. Researchers are ethically obliged to respect children’s privacy and personal integrity even in cases where teachers, parents or other adults are interested in having access to the data that they have provided. Researchers need to be prepared to respond to these kinds of situations that can compromise the privacy and personal integrity of children and young people and potentially expose them to harm. 

In dissemination:

As a general rule, it is important that children and young people are not identifiable in research reports, presentations or other forms of dissemination, including photographs and films that can compromise children’s privacy and safety.

Researchers should also consider that children may not always want to share information with them. Where this is the case, researchers need to respect children’s decisions. It is also important that researchers consider that children may not always understand the consequences of sharing sensitive personal information with researchers. Researchers, therefore, have a responsibility to explain to children how it might sometimes be preferable to keep certain information private. This, in turn, needs to be balanced with children’s right to be consulted on matters that concern them, as well as their right to share information that they choose to share in the research context.

The research context is also an important consideration, particularly in the case of internet-based research, where children and young people often interact as individuals in group contexts, for example, in the case of research in various social media platforms or games. In this case, researchers need to carefully consider how they will deal with information they encounter as this relates to groups of research participants and how they will respect the privacy and personal integrity of groups of children in online contexts.

A further important consideration is how researchers should react when they encounter incidental findings, most importantly where they become aware of concerns about children’s safety during the research process. In this case, researchers need to balance their obligation to respect the privacy and confidentiality of children and young people with their duty to notify relevant authorities of concerns such as child neglect, abuse or other forms of harm. 

Please share your question with us via the "Share your feedback & input!" button in the bottom right corner.