Special categories of personal data

You must always in particular consider whether the processing of personal data is necessary for achieving your purpose with the processing and if you can minimize the data in any way.

This can be illustrated by the following example. You plan to ask about citizens' experiences of their last visit to a healthcare centre. By limiting the questions to only the experience of the health center, and avoiding asking questions about why the citizen visited the health center or what diagnosis he/she/they sought for, you reduce the risk of processing more information than necessary.

Together with your supervisor, you must also assess the suitability of the intended project. Is the project something that is in line with your education? Can it be carried out so that the privacy of the individuals whose personal data is to be processed is not affected in a negative way?

You and your supervisor need to ensure that student project can be conducted under ethically secured and safe forms. If you are going to process special categories of personal data, or information about violations of the law, you need to ensure that this type of personal data is only processed to a lesser extent and that the project do not combine several different types of special categories of personal data.

As support for the assessment, you and your supervisor must discuss whether the project can be carried out under ethically acceptable forms based on the general principles of research ethics, such as the Swedish Research Counsil's report "Good Research Practice". Personal data can be processed if it is reproduced in a restrained manner from, for example, published judgments or information in the mass media and if the conditions decribes on this page can be met.

To the report Good Research Practice

If you and your supervisor are unsure whether a project is suitable to conduct or not, you can contact dataskydd@gu.se. It is also possible to contact the Swedish Ethical Review Authority for an opinion regarding a student project.

If you are to process special categories of personal data in your project, the university assesses that such processing requires that you obtain consent from the persons whose data is to be processed. GDPR places special requirements on how a consent to the processing of special categories of personal data must be designed. A special template should be used for the consent (only in Swedish as of now), you find it under "Templates".  

Keep in mind that you must keep the obtained consents organized in a safe place so that you can identify them afterwards if someone wants to withdraw their consent to the processing.

You may only use the tools and services provided by the university. It is not permitted to use services that you have free access to on the Internet. The tools provided by the university is found here: 

Digital tools
Other digital tools and software

Processing of special categories of personal data can only take place with digital tools and services that are approved for processing information in class 3 (that is, for example, special categories of personal data and classified information). At the moment, the university cannot offer any tools or services to students that meet these requirements. It is therefore particularly important that you carry out other security measures in order for the processing to be legal.

Special categories of personal data must be pseudonymised/coded as much as possible. This means that you need to replace the real name of the person referred to with something else. Usually, designations such as "person 1", "person 2" and so on are used instead of writing the real name. It is especially important that this has been done before a thesis is published. The code key, i.e. the explanation of who is person 1 or person 2, must be kept separately from other documents.

Keep in mind that even if names have been printed in convictions that can be found in legal databases, you still need to pseudonymize/code the information. It may be sufficient with another name such as "the complainant" or "the defendant".

A basic security measure is to ensure that only people who have the right to process the data have access to the data. In its simplest form this means that you are responsible for ensuring that no one other than yourself has access to the personal data. The data should therefore not be shown to or shared with fellow students, friends or family.

Your computer must be protected by a strong password. This means that the password should preferably meet the following requirements:

• The password should be as long as possible and consist of mixed upper and lower case letters, numbers and special characters. A long password is much better than a complex one.
• Do not use passwords that are directly related to yourself or things around you that others may know.
• Do not use the same password for different accounts.
• The password should not contain words that can be found in any glossary or dictionary, nor should it be a simple combination of two words.

To help remember a long password, a passphrase can be used. A passphrase means that you form the password by, for example, combining the first letter of each word in a sentence, phrase or song lyric. If you also vary the characters by using lower and upper case letters, numbers and special characters, the password will be even more secure. As an example, the passphrase “Your new four-wheel drive car is a Skoda and Bertil loves it!”, could be transformed to the password “Yn4wdciaSaBli!”. 

Never give your password to anyone else, do not write it down and do not allow the computer to save the user identification and password for automatic login.