Privacy Policy for Research Participants
This document provides information about privacy of personal data of research participants when you take part in any of research projects conducted by Pakistan Institute of Living and Learning (PILL) and how PILL collects and uses this data. It is important to understand and read this privacy policy along with the Participant Information Sheet for a particular study in which you are planning to take part.
Introduction
The Pakistan Institute of Living and Learning (PILL) is a non-profit organization. We ensure that our research outcomes should be of public interest. Our research projects are intended to add new and or existing knowledge with the cross-cultural context. We strive to achieve high standards in our research projects. This means, our researchers must follow ethical principles and standard codes of conduct, policies and guidelines to ensure the research they conduct is in compliance with Good Clinical Practices (GCP). This includes the General Data Protection Regulation (GDPR) and Pakistan’s Personal Data Protection Act, 2017. Our researchers ensure to protect the privacy and confidentiality of the personal data/information sensitively that you as research participants provide to us.
What is research?
Research is a systematic process of investigating and analyzing information to discover and organize new knowledge. Research conducted by PILL is intended to make a great contribution to existing knowledge. Our research is published in high impact national and international journals in order to share that knowledge with the wider society. Please visit our website www.pill.org.pk.
What is Personal Data?
Personal data is any information that relates to an identified or identifiable natural persons (GDPR, 2016). In other words, different pieces of information when collected together can lead to the identification of a particular person is called personal data. Any personal data that has been de-identified, encrypted or pseudonymised but later can be used to re-identify a person, remains a personal data. When personal data is anonymised in a way that identification of a particular person is no longer identifiable, it is no longer considered personal data. For personal data to be truly anonymized, the anonymization process must be irreversible.
Examples of personal data may include following but not limited to:
- Your name
- Contact number
- Residential address
Who is responsible for my personal data?
PILL manages the research projects and is the Data Controller. PILL decides in what way your personal information is collected, analyzed, used, shared/transferred, archived and deleted. PILL informs their research participants the purpose of collecting their personal information, how to exercise their right of access to, or correction of their personal information before collecting data. We obtain research participants consent where appropriate (e.g., if we need to use the personal information or disclose it for a purpose other than the reason for which the information was originally collected).
PILL is responsible to keep your personal information in its custody or control. PILL has an appointed manager of research ethics and governance who is responsible to ensure that all PILL staff is trained on their responsibilities of protection to the privacy of personal data. PILL does not take responsibility for the privacy, use and disclosure of the personal information of research participants that is submitted directly to a third party for a joint funding initiative.
What personal information do we use within research projects?
Before we collect your personal information, PILL identifies the purposes for its collection, use or disclosure, and provide information of these purposes to its research participants. PILL collects the personal information that is necessary to meet the objectives of the research project. Personal details that are not essential will not be collected. The study Participant Information Sheet will inform you of what information will be collected about you. PILL will collect personal information only with the consent of the research participants. To ensure transparency in consent process, we seek consent in local languages taking into account the nature and sensitivity of the information being collected.
How we store your data?
We respect privacy and confidentiality of research participants and put particular emphasis to provide assurances and safeguards to data provided. Once we collect your data, identifiable data is immediately anonymized by assigning a unique study number to each participant’s data and inputted into a study-specific password protected database. Paper copies of questionnaires and consent are stored in locked cupboards, separate from other research data. Only named members have access to this data on a need to know basis.
Whom we share your data with?
To disseminate our research to the academic community and public, your anonymized data is likely to be published in scientific journals or presented in conference or public talk, i.e. your name or any information that can lead to your identification will not be shared. Where researchers need to use any information that would identify you, prior consent will be sought. The privacy of your personal data is extremely important for us and we will not disclose your data unless there is a justified purpose for doing so. PILL NEVER sells personal data to third parties.
Safeguards:
PILL protects personal information using safeguards appropriate to the sensitivity of the information collected.
Following some examples of safeguards that PILL adhere to:
- The staff collecting personal information are trained in Good Clinical Practices (GCP);
- Regular training of research staff on information governance;
- Employees are trained on codes of maintaining the confidentiality of personal information;
- Physical measures; i.e. we keep data into locked cabinets and access is restricted to offices;
- Organizational measures; i.e. we limit access on a “need to know basis”;
- Technological measures, such as we use encrypted password protected computers, ensure permissions control on our internal document management system, secure transmission of data, data back-up and recovery procedures
Confidentiality Breach:
A breach of confidentiality occurs when data or information provided in confidence by a participant is disclosed to a third party without the participant’s consent. There are certain circumstances in which PILL holds the right to breach confidentiality. These circumstances are:
- If there is a serious risk or threat to participant’s life, i.e. serious risk of suicide
- If there is a serious risk or threat to life of others
- If there is a serious risk or threat to physical, sexual or serious emotional abuse and neglect
- Where it is required by Law
How long do we keep your data?
PILL may store your data for up to 10 years after the end of a research project.
What are your rights as a research participant?
You have the following rights in relation to your personal data processed by us:
Right to be informed – PILL will ensure you have adequate information to confirm that you are satisfied about the purpose and process of your personal data being collected and stored, and that you know how to exercise your rights.
Right of access to data and data portability – You have the right to see all the information collected about you. Where data is stored electronically, in a database, you reserve the right to receive that data in a common electronic format that permits you to share that data to a third party – this is called “data portability”.
Right of rectification – If you notice that the data we hold about you is incorrect, you have the right to get it corrected.
Right to erasure – You can ask us to discard your data and PILL will take reasonable steps to do so where appropriate.
Please email any related requests to [email protected]
Right to restrict processing – If you find any problem with the accuracy of your personal data that we hold, or if you notice PILL is using your data unlawfully, you can request us, we will suspend any current processing until a resolution is agreed.
Please email any related requests to [email protected]
Right to withdraw consent – We rely on your consent to process your data, you may withdraw your consent at any time.
Who can I contact for further details?
If you have any questions about how we use your personal information, or wish to exercise any of your rights, please email our data protection officer [email protected] or reach us on following address.
Address: Suite no: 201, The Plaza, do Talwar, Clifton, Karachi
Contact: 021-35871845
Terminology Explained
Data controller: Data controller is a natural or legal person, agency or another body or public authority which, alone or jointly with others is responsible to determines the purposes and means of personal data processing. Data Controller is the main body to make decisions about personal data processing related activities.
GCP: Good Clinical Practices (GCP) is a certification course designed to prepare research staff in standards for the research design, its conduct and performance, monitoring and auditing, recording, analysis as well as reporting of clinical studies or clinical trials and to ensure protections to the rights, safety and well-being of participants involved in research.
GDPR: The General Data Protection Regulation (GDPR) is a legal framework to provide guiding principle on how to collect and process personal information from individuals living in the European Union (EU).