NB: There isn’t really a perfect delineation between direct and indirect identifiers, but, rather, more of a sliding scale. Something may be a direct identifier because of it’s uniqueness (e.g. a unique tattoo) or based on context (e.g. the current Prime Minister of the Netherlands). It is important to be aware of any of these less commonly considered direct identifiers when you are working on de-identifying your data.
NB: Personal data do not necessarily need to be considered “sensitive” data to receive protection under the GDPR. If your data are considered personal, based on the definition above, they must be handled in accordance with the GPDR, regardless of whether or not you consider the data sensitive.
NB2: Almost all data about human subjects are considered personal data under the GDPR. The vast majority of the data collected at FGB are about human beings and should therefore be treated as personal data unless you have confirmed with an expert that the data are anonymous. This reference card on anonymity from the National Coordination Point for RDM further explains this concept.
NB1: Publishing data does not mean that the data must be open access or publicly accessible. Access to the data can be restricted and granted upon valid request.
NB2: Data underlying a published research article must be published (in addition to being archived) so that, at a minimum, the metadata can be found and reviewed by others.
NB: The purposes for which data may be reused and the parties which may be authorized to reuse the data depends on whether the data are personal/confidential data, as well as what the research participants consented to with regards to data reuse. The FGB data stewards and privacy champions can assist with determining if data may be reused, as well as how to develop your consent forms to ask for consent to reuse from your participants.