Sharing data with personal information through SND

Datasets containing personal information may only be documented and shared through the SND research data catalogue if your organization and SND have an agreement for this. The organizations that have agreements for sharing are listed below. If your organization does not have an option for sharing datasets with personal information through SND, you need to ensure that data are anonymized before you describe and share them. You can read more about anonymization here.

Datasets that contain personal information may not usually be made freely accessible in the SND research data catalogue, but should be shared with restricted access. Restricted access means that the data description is visible in the research data catalogue, but access to data is provided only after a request to access the material has been reviewed and approved.

When describing a dataset in DORIS, SND's documentation system:

• Specify which accessibility level the dataset should have.
• For sensitive data – data that should not be freely accessible – select “Access to data is restricted.”
• Check the "Yes" box if the data contain personal data or other sensitive information. Also state what type of personal data/sensitive information the data contain.
• Documentation files are always freely accessible in the catalogue entry and should not contain personal data or other sensitive information.

If you are unsure about whether your data can be made freely accessible, please contact your local research data support unit or SND.

Sharing sensitive data with restricted access

Researchers in the following organizations can share research data with personal information through DORIS and the SND research data catalogue:

• Chalmers University of Technology
• Halmstad University
• Jönköping University
• Karolinska Institutet
• Karlstad University
• KTH Royal Institute of Technology
• Luleå University of Technology
• Stockholm University
• Swedish Polar Research Secretariat
• Swedish University of Agricultural Sciences
• Södertörn University
• University College Stockholm
• University of Borås
• University of Gothenburg
• University of Gävle
• University of Skövde
• Uppsala University
• Örebro University

These organizations all use DORIS for documenting datasets, but they have different internal solutions for handling the actual data files. When you have started a data description in DORIS, you can send a message to your local data support unit, who can direct you as how to proceed.

Storing the data

Legally, SND never becomes the personal data controller for data shared via SND, regardless of whether the data are uploaded in DORIS or by other means. Protected data are either in a storage location under the control of the research principal, or the organization has established a personal data processing agreement with SND for storage of files at SND.

Remember: It is the research principal that decides how data may be made accessible.

Things to consider when sharing research data that contain personal information

It is always important that data are described and documented in detail. For datasets with restricted access, it is especially important that good documentation is openly accessible. Documentation is central to determining whether a dataset is suitable for a particular use. For example, information about questions asked in surveys, variables measured in field studies, or geographic areas covered by a dataset are pieces of information that should be included in the data description or in a documentation file.

Personal data

As a rule, data files that are intended for reuse should never contain personal names or other direct identifiers. When there are direct identifiers associated with the data, the dataset should be pseudonymized as part of the preparations for sharing the dataset. This means that potential identifiers in the data files are replaced with a code or a serial number. Identifiers are stored in a so-called code key. The code key should be preserved according to established archival practice but, should never be included in the dataset that is intended for reuse. Please note that pseudonymized data are still considered personal data.

Some research data contain personal information that cannot be linked to a code key, for example images or audio recordings. For research data where an interview is recorded and transcribed, it may be appropriate to create a dataset intended for sharing that contains only the transcription, with all identifiers masked.

No protected information in metadata

It is also important to avoid including protected or personal information in the metadata or documentation files. The SND research data catalogue and associated documentation are always public and descriptions are easily found through a web search. Take extra care to ensure that the metadata description itself does not contain information that could lead to backtracking (e.g., by specifying precise geographic coordinates of residences).