Personally Identifiable Information in Human Trials

If you've read our post on GDPR, you will be aware of the ethical complications of collecting personally identifiable information (PII) in human trials. As highlighted by many regulatory frameworks and best practice guidelines, participant well-being and safety must be protected. This is often extended beyond the trial itself. For example, a participant may have taken part in a human trial many years ago which recorded PII, and, a more recent data breach might mean that their sexual orientation, gender identity, ethnicity, name, address and more have become public knowledge. This data could get into the hands of persons who might wish to do harm to participants, for example, to exploit them financially. Therefore, when all is done and dusted and the trial has completed, your responsibilities do not end just there.

‍

Examples of Personally Identifiable Information

‍

Some items of PII that might come up frequently in your research might include some of the following. This list is not exhaustive, but should provide sufficient clarification on what constitutes PII:

• Name: Full name, maiden/surnames, previous names, mother's maiden name or an alias.
• Personal Identification Numbers: Social security number (SSN), National Insurance Number (NI), passport number, driver's license number/ID, Tax ID/Reference numbers, patient identification number (e.g. at a health service or practice), financial account numbers, credit card numbers.
• Personal Address Information: Street address, or email address.
• Personal Telephone Numbers: Phone number, SIM registered SIM or eSIM card numbers, fax numbers.
• Personal Characteristics: Photographic images or videos (including any identifiable characteristics or traits), fingerprints, handwriting.
• Biometric Data: Retina scans, voice signatures, or facial geometry.
• Information Identifying Personally Owned Property: VIN number or title number.
• Asset Information: Internet Protocol (IP) or Media Access Control (MAC) addresses that consistently link to a particular person.

‍

Standalone Personally Non-identifiable Information

‍

Other items could be considered PII if linked with other information, however, in isolation they would not be considered PII. These could be non-unique items which require additional data to reveal an identity, For example, many people could share a date of birth, but a street address in combination with this could reveal an identity.

• Date of birth
• Location of birth
• Business telephone number
• Business mailing or email address
• Race
• Religion
• Geographical indicators
• Employment information
• Medical information
• Education information
• Financial information

‍

‍

The most important consideration? Data is both incredibly important and useful, however... always consider if you actually need it! Best practices of data collection include only taking what information is required. In a research study, ask yourself, is this data pertinent to the research question? will it be used? and can we ensure that it is stored safely?

‍

As always, do get in touch if you have any questions - and continue to follow our blog series to get updates and insights in this space.