Abstract
Personal data protection is an ethical issue. In this study we analyzed how research ethics committees (RECs) and data protection officers (DPOs) handle personal data protection issues in research protocols. We conducted a mixed-methods study. We included heads (or delegated representatives) of RECs and DPOs from universities and public research institutes in Croatia. The participants provided information about data protection issues in research and their mutual collaboration on those issues through structured interviews that contained closed and open-ended questions. Qualitative description was used to analyze open-ended questions. The results showed that 55% of the REC representatives were not aware who was DPO in their institution. Among RECs, 65% never contacted the DPO. There were 61% of RECs who reported that they received no training from the organization on personal data protection. When asked about barriers to personal data protection in their institutions, 26% of REC members highlighted the lack of a clear protocol for assessing personal data protection issues, while 30% of DPOs mentioned lack of knowledge among researchers about personal data. In conclusion, we found that when it came to protecting personal data in research protocols, RECs and DPOs hardly ever worked together. When developing future personal data protection policies for academic and scientific research institutions, it is essential that RECs and DPOs should collaborate and both continue to expand/update their knowledge on personal data protection procedures.
This is a preview of subscription content, log in via an institution to check access.
Similar content being viewed by others
Availability of Data and Material
Raw data collected within this study are available from the corresponding author on request. Please note that the qualitative data was collected in the Croatian language and the transcripts were also written in the Croatian language.
References
Chafe, R. (2017). The value of qualitative description in health service and policy research. Health Care Policy, 12(3), 12–18.
Clarke, N., Vale, G., Reeves, E. P., Kirwan, M., Smith, D., Farrell, M., Hurl, G., & McElvaney, N. G. (2019). GDPR: An impediment to research? Irish Journal of Medical Science, 188(4), 1129–1135. https://doi.org/10.1007/s11845-019-01980-2
Council of Europe Steering Committee on Bioethics. (2012). Guide for research ethics committee members [Internet]. Available at https://www.coe.int/t/dg3/healthbioethic/activities/02_biomedical_research_en/Guide/Guide_EN.pdf
Croatian Personal Data Protection Agency. (2022a). The DPO handbook. Guidance for data protection officers in the public and quasi-public sectors on how to ensure compliance with the European Union General Data Protection Regulation. [Internet]. Available at https://azop.hr/wp-content/uploads/2021/01/the-dpo-_handbook_-t4data.pdf
Croatian Personal Data Protection Agency. (2022b). Legal framework. [Internet]. Available at https://azop.hr/legal-framework/
EUR LEX. (2022). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance) [Internet]. Available at https://eur-lex.europa.eu/eli/reg/2016/679/oj
European Commission. (2022). Statement ahead of the 5th anniversary of the general data protection regulation. [Internet]. Available at https://ec.europa.eu/commission/presscorner/detail/en/statement_23_2884
European Data Protection Board. (2022). Guidelines on data protection officers. [Internet]. Available at https://edpb.europa.eu/our-work-tools/our-documents/guidelines/data-protection-officer_en
European Data Protection Board. (2023). National reports on the CEF DPO. Available at https://edpb.europa.eu/system/files/2024-01/edpb_report_20240116_cef_dpo_appendix_1.2_national_reports_en_0.pdf
European Data Protection Board. (2024). 2023 Coordinated enforcement action. Designation and position of data protection officers. Adopted on 16 January 2024. Available at https://edpb.europa.eu/system/files/2024-01/edpb_report_20240116_cef_dpo_en.pdf
European Data Protection Supervisor. (2020). A preliminary opinion on data protection and scientific research. Available at https://edps.europa.eu/sites/edp/files/publication/20-01-06_opinion_research_en.pdf
Ferretti, A., Ienca, M., Velarde, M. R., Hurst, S., & Vayena, E. (2022). The challenges of big data for research ethics committees: A qualitative Swiss study. Journal of Empirical Research on Human Research Ethics, 17(1–2), 129–143. https://doi.org/10.1177/15562646211053538
Gefenas, E., Lekstutiene, J., Lukaseviciene, V., Hartlev, M., Mourby, M., & Cathaoir, K. O. (2022). Controversies between regulations of research ethics and protection of personal data: Informed consent at a cross-road. Medicine, Health Care and Philosophy, 25(1), 23–30. https://doi.org/10.1007/s11019-021-10060-1
Mishra, N. N., Bhatia, T., Nimgaonkar, V. L., Deshpande, S. N., & Parker, L. S. (2018). Indian Journal of Medical Ethics, 3(4), 315–320. https://doi.org/10.20529/IJME.2018.054
Mladinic, A., Puljak, L., & Koporc, Z. (2021). Post-GDPR survey of data protection officers in research and non-research institutions in Croatia: a cross-sectional study. Biochemia Medica (Zagreb), 31(3), 030703. https://doi.org/10.11613/BM.2021.030703
Puljak, L., Mladinic, A., Iphofen, R., & Koporc, Z. (2020). Before and after enforcement of GDPR: Personal data protection requests received by Croatian Personal Data Protection Agency from academic and research institutions. Biochemia Medica (Zagreb), 30(3), 30201. https://doi.org/10.11613/BM.2020.030201
Puljak, L., Mladinic, A., & Koporc, Z. (2023). Workload and procedures used by European data protection authorities related to personal data protection: A cross-sectional study. BMC Research Notes, 16(1), 41. https://doi.org/10.1186/s13104-023-06308-z
Republic of Croatia Parliament. (2018). Implementation of the general data protection regulation. Official Gazette 44/2018.
Solis Sanchez, G., AlcaldeBezhold, G., & Alfonso Farnos, I. (2023). Research ethics: From principles to practical aspects. Anales de Pediatría (English Edition). https://doi.org/10.1016/j.anpede.2023.06.016
Tong, A., Sainsbury, P., & Craig, J. (2007). Consolidated criteria for reporting qualitative research (COREQ): A 32-item checklist for interviews and focus groups. International Journal for Quality in Health Care, 19(6), 349–357. https://doi.org/10.1093/intqhc/mzm042
Acknowledgements
We are grateful to the individuals who participated in this study. This study was conducted as a part of Master of Nursing thesis of the first author (KL). The thesis was written and defended in the Croatian language. We are grateful to the Croatian Personal Data Protection Agency (AZOP) for the collaboration.
Funding
This study was conducted within the project Promoting integrity in the use of research results in evidence-based policy: a focus on non-medical research (PRO-RES), funded from the European Union’s Horizon 2020 research and innovation programme under grant agreement No. 788352.
Author information
Authors and Affiliations
Contributions
Original study design: Anamarija Mladinic (AMl), Zvonimir Koporc (ZK), Livia Puljak (LP). Revised final study design: Karlo Loznjak (KL), AMa (Anamaria Malesevic), AMl, ZK, LP. Data collection, analysis, and interpretation: KL, AMa, MČ, AMl, ZK, LP. Writing first version of the manuscript: KL, LP. Revising the manuscript for intellectual content: KL, AMa, MČ, AMl, ZK, LP. Final approval of the manuscript: KL, AMa, MČ, AMl, ZK, LP.
Corresponding authors
Ethics declarations
Ethics Approval and Consent to Participate
The Ethics Committee of the Catholic University of Croatia approved the protocol of this study (Classification number: 641-03/20-01/22; Registration number: 498-03-02-06-02/1-20-02). Participants who took part in online interviews provided informed consent via e-mail. Written informed consent was obtained on paper from the participants who were interviewed in-person.
Consent for Publication
Not applicable.
Competing Interests
The authors declare they have no competing interests.
Additional information
Publisher's Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Supplementary Information
Below is the link to the electronic supplementary material.
Rights and permissions
Springer Nature or its licensor (e.g. a society or other partner) holds exclusive rights to this article under a publishing agreement with the author(s) or other rightsholder(s); author self-archiving of the accepted manuscript version of this article is solely governed by the terms of such publishing agreement and applicable law.
About this article
Cite this article
Ložnjak, K., Malešević, A., Čargo, M. et al. Comparison of Heads of Research Ethics Committees with Data Protection Officers on Personal Data Protection in Research: A Mixed-Methods Study with Structured Interviews. J Acad Ethics (2024). https://doi.org/10.1007/s10805-024-09509-8
Accepted:
Published:
DOI: https://doi.org/10.1007/s10805-024-09509-8