1. Personal data protection in research projects 20130916

2. Personal data Personal Data means any data (a) relating directly or indirectly to a living individual; (b) from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and (c) in a form in which access to the processing of the data is practicable.

3. For example, “personal data” can be names, email addresses, telephone numbers, identity card numbers, addresses, or information of any type linked to any personal identifiers gathered for the purposes of research, teaching or staffing/employment-related activities.

4. Data Protection Principles (http://www.pcpd.org.hk/english/ordinance/ordglance1.html) Principle 1: Purpose and manner of collection –This provides for the lawful and fair collection of personal data and sets out the information a data user must give to a data subject when collecting personal data from that subject. Principle 2: Accuracy and duration of retention –This provides that personal data should be accurate, up-to-date and kept no longer than necessary. Principle 3: Use of personal data –This provides that unless the data subject gives consent otherwise personal data should be used for the purposes for which they were collected or a directly related purpose.

5. Principle 4: Security of personal data –This requires appropriate security measures to be applied to personal data (including data in a form in which access to or processing of the data is not practicable). Principle 5: Information to be generally available –This provides for openness by data users about the kinds of personal data they hold and the main purposes for which personal data are used. Principle 6: Access to personal data –This provides for data subjects to have rights of access to and correction of their personal data.

6. Department Data Security Policy Any research project that involves personal data must be reported to the School. The personal data protection protocol must be submitted to and approved by the Data Protection Committee. Personal data must not be stored with the research data. If both personal data and research data must be stored in the same database, prior permission from the Director must be sought. Special security measures will be set up for the designated computers.

7. Personal data must only be accessed by the authorized researchers, designated by the principal investigator of the research project. Personal data in electronic form must be securely protected with a strong encryption algorithm and password. Special security measures will be set up for the designated computers. Those in other forms must be physically locked after use. Electronic personal data must not be stored in any portable storage devices without prior permission from the Director. All personal data must only be stored on the official encrypted portable devices provided by the Department/School, with a strong encryption password.

8. Personal data must not be taken outside the office without prior permission from the Director. Personal data must be securely destroyed immediately after use All media with personal data must always be protected against unauthorized access, and be checked regularly. Any loss of personal data must be reported to the School immediately.

9. Keep your computer up-to-date by applying the most recent security patches (eg Windows Update in Microsoft Windows). No peer-to-peer applications (eg BitTorrent, Foxy) Firewall (eg Microsoft Windows Firewall) Antivirus software (eg Sophos) should be frequently updated (eg daily). Department/School computers To enhance data security:

10. It is the School software policy that only legitimate computer software can be used on School computers –A warning will be given to those staff members who are found to use illegitimate computer software on the School computer. –If the staff member continues to violate the policy, his case will be reported to the university for further action. –All breach incidents will be officially documented.