For questions, contact your privacy officer (PO). On the My EUR page of the Privacy Office (PO) you can find contact details for your faculty’s PO.
This section contains the main terms relevant for discussing privacy and handling personal data, most of which are defined in the General Data Protection Regulation (GDPR).
| Personal data: | Personal data means any information relating to an identified or identifiable individual. An identifiable individual is one who can be identified, directly or indirectly. |
| Direct identifiers: | Information that is sufficient on its own to identify an individual (e.g., name, telephone number, Student ID (ERNA ID at EUR), government issued ID, facial image) |
| Indirect identifiers: | Data points that indirectly identify an individual (e.g., date of birth, gender, ethnicity, location, cookies, IP address, license plate number), especially when combined. Notable traits such as unusual job titles, advanced age, rare diseases, or specific organizational positions can also serve as indirect identifiers, particularly in smaller datasets. |
| Special categories of personal data: | Data that concerns health, race, ethnic origin, political views, religious beliefs, ideological convictions, trade-union membership, sexual behaviour, sexual orientation, genetic data, or biometric data. |
| Sensitive data: | Information that, if made public, could have negative consequences for an individual. While not specifically defined by the GDPR, it encompasses special categories of personal data as well as other types of data such as criminal records, sensitive financial information, social security numbers (BSN), data posing risks to public safety, or data that could be used for discriminatory purposes. |
| Criminal data: | Data relating to criminal convictions and offences or related security measures. |
| Anonymisation: | The process by which personal data is irreversibly altered in such a way that an individual can no longer be identified or is identifiable directly or indirectly. Once data is truly anonymous the GDPR does not apply (recital 26 GDPR). Be aware that whether something is anonymous can change over time, with more data and new technology becoming available. Hence, rather than “anonymity” or “anonymous data”, it is good to talk about data to which anonymisation techniques have been applied. |
| Pseudonymisation: | Pseudonymisation of data means replacing any identifying characteristics of data with a pseudonym, or, in other words, a value which does not allow the research participant to be directly identified. It is different from anonymisation as, in many cases, it still allows identification using indirect identifiers. The pseudonymisation key, i.e., the file (or other form) in which the direct identifiers are linked to the pseudonym, needs to be stored separately from the pseudonymised data. |
| De-identification: | Removal or obscuring of identifying information in a dataset to prevent identification of specific cases. The term can refer to different actions depending on the circumstances and can be confusing. We prefer talking about anonymisation and pseudonymisation, since these terms are defined within the GDPR. |
| Data minimisation: | Data minimisation involves collecting only the minimum amount of personal data necessary to achieve a specified purpose, such as research goals. Personal data should not be collected on a speculative basis; there must be a clear, specified need for its collection. |
The content of this page is largely based on the information provided by Finnish Social Science Data Archive which we recommend for further reading.
Figure 1. Examples of the difference between fully identifiable, pseudonymous, and anonymous data. From National Coordination Point Research Data Management, https://doi.org/10.5281/zenodo.3584841
This page was last updated in June 2024. Did you find a broken link or (seemingly) incorrect information? Please send an email with the title 'Website content' to datasteward@eur.nl.