Research Data and Secondary Use: Consent, De-identification and Review

In short, research data and secondary use: consent, de-identification and review turns on one issue: which research dataset is involved, who holds it, and what purpose justifies the next step with it. Get those three answers right and most of the rest of the determination follows; miss any one of them and the requirement applied will be the wrong requirement for the facts in front of you.

Data minimisation is the cheapest control available: data never collected cannot be breached, misused or retained too long.

A confidentiality program that only reacts to incidents shall consistently be behind, because the decisions that create risk are made during procurement and design.

Proctoring tools collect some of the most personal information on campus, and their adoption needs a higher standard of review than a routine classroom tool.

Retention is a confidentiality decision, not a storage decision, and retaining information just in case is an objective that needs its own justification.

Parent and guardian access via a portal is a disclosure decision, and the portal's permissions should reflect rights transfer, not family habit.

Network logs hold connection information that may reveal student activity patterns, and access to those logs ought to be logged in turn.

State biometric laws add duties that vary by state, and a site operating across states must not assume one state's requirement covers another's.

Medical treatment records retained by a site clinic have their own treatment exception, and the exception ends when the file is used for another objective.

Equity in privacy means recognising that the same sharing harms different students differently, and that uniform processes may still produce unequal risk.

Advising platforms hold some of the most sensitive narrative information on site, because advisers file context that grades alone never demonstrate.

Train employees on the determinations they really make, using cases from their own office, rather than generic slides about a statute.

Trigger access reviews on role alters automatically where possible, and treat manual review as a fallback, not as the plan.

Analyse marketing uses of student information for consent even when the marketing feels ordinary, because ordinary is not authority.

Review privacy governance following a merger or platform change, since the data map from before the change shall no longer be accurate.

Give small colleges a shared-service option for confidentiality review, because an institution without a dedicated officer still carries the same duties.

Audit access to personal records, and follow up on anomalies, since an audit that finds nothing is either lucky or blind.

Retain a privacy committee that may actually stop a project, because a committee that solely advises shall be ignored when it matters.

Locate each copy before deciding, including the vendor copy, the backup copy and the copy in the shared drive.

Where the full record is genuinely required in such a case, the disclosing is limited, explained to the student where required, and noted in the record.

In that illustration the survey report shows solely aggregates above a specified threshold, and no small-group result can identify a respondent.

In that illustration the logs are released only to the extent the procedure needs, with redactions for students not involved.

The contract in that illustration names the data, limits use to the university's purposes, bans advertising use, and sets deletion ninety days following the contract ends.

In that illustration the study proceeds on the extract, the agreement limits use and requires destruction, and no identifiable file leaves the college.

Disclosing to a parent on the basis of family relationship alone, without establishing dependency, is a mistake that recurs each enrolment season.

Documenting an emergency disclosure following the fact, from memory, is a mistake, because later reconstruction rarely convinces a reviewer.

Auditing AI tools solely for accuracy, and not for data storage and prompt handling, is an error, since AI systems create records that ordinary audits miss.

Treating alumni records as unprotected history is an error, since graduation does not end the college's duty.

Leaving access in place following a role alter is a mistake that compounds silently, because the former access looks legitimate in each log.