CUREG 2.0

15. What steps should I take if I collect sensitive personal data/personality profiles as defined by the LIPAD throughout the course of my research?

Reminder: for data to be considered sensitive personal data/personality profiling, the data must be processed in a non-anonymous way i.e., associated with personal data. For anonymous research (starting from the point of data collection), there is no sensitive personal data nor personality profiling.

 

The legislator has considered that sensitive personal data/personality profiles are information deserving of a higher level of protection, with the sole aim of protecting the fundamental rights of the individual.

Thus, according to article 41, paragraph 1, letter f of the LIPAD, it is necessary to obtain an authorization from the State Council (Conseil d’Etat) prior to processing sensitive personal data (SPD) or personality profiling. As a reminder, data collection is already considered by the law as a type of processing.

The authorisation request from the State Council must be done as soon as the research project has been accepted by the CUREG.

 

    • Procedure:
      1. From the CUREG’s perspective:
        1. If a project is concerned by this procedure, the CUREG informs the research supervisor and asks them if they can transmit the revised version to the DPO so that he can verify anything related to the protection of personal data corresponds to the legal rules. He may even ask for modifications regarding solely this issue.
      2. From the research supervisor’s perspective:
        1. Based on the model provided by CUREG, the research supervisor drafts a letter addressing the State Council.
        2. To draft this letter, we invite you to contact Mr. Alain Jacot-Descombes, DPO of the University of Geneva (pdt@unige.ch).
        3. The person in charge will be responsible for transmitting any useful documents to the State Chancellery.
        4. The research supervisor will receive a decision from the State Council.

 

  • Special cases:
    • If you collect your data anonymously, such as in the following cases:
      • Distribution of an online questionnaire, access to anonymous or anonymised databases
      • Setting up a procedure that ensures that at no time can you link participants’ responses to their identity
    • In these cases, it will not be necessary to apply for authorisation from the State Council for the processing of sensitive personal data/personality profiling within the LIPAD’s framework since you will at no time be aware of the identity of the participants.