Data protection and ethics

Data protection

The General Data Protection Regulation (GDPR) is a new, Europe-wide law that replaces the Data Protection Act 1998 in the UK. The GDPR, sets out six possible legal bases for processing of personal data and consent is one of these bases. Where consent is used, it must be unambiguous ’opt-in’ consent.

However, for academic research, the basis for processing personal data will generally be Article 6(1)(e), i.e. the ‘public task’ basis. The ’public task’ basis applies where processing is necessary to perform a task in the public interest or for an institution’s official functions, and the task or function has a clear basis in law. Because universities are public authorities for the purposes of data protection legislation, the ‘public task’ basis is appropriate for research purposes.

Where the ’public task’ basis is used, it is not necessary to collect consent from participants. However, it is necessary to provide detailed privacy information which sets out their rights under data protection law, including the right to withdraw personal data from research. We have taken this approach for the SOMEONE LIKE ME project. In respect of ethnicity data, which is treated as ‘special category’ data for the purposes of data protection law, our legal basis for processing the data is the ‘research’ condition set out in the GDPR and the UK Data Protection Act 2018.


In order to obtain ethical approval for a project and to comply with accepted ethical standards for research, it is still necessary to obtain the informed consent of individual participants for their involvement in the research. GDPR recital 33 notes that research must act in a manner that is ‘in keeping with recognized ethical standards for scientific research’.

Therefore, in order to use personal data research, it is necessary to secure two bases:

  • the legal basis (GDPR)

  • the ethical basis (informed consent)

’Opt-out’ consent is widely used as the ethical basis for informed consent (this is not affected by the GDPR) and has been approved for use in this project by the University College London Research Ethics Committee (application number 11263/001).

What this means in practice

For the SOMEONE LIKE ME project, a letter must be sent parents for pupils in Years 8-11 and directly to Year 12-13 pupils. The letter:

  • Provides information about the research and participants’ rights under data protection law (providing the legal basis for processing data)

  • Offers participants the chance to ’opt-out’ of the project (providing the ethical basis for processing data)