All research data is important, and keeping it secure is essential to preventing loss and unauthorized access or modification. But some data is especially risky, and could cause harm if released to the public. That is Sensitive data. A quick rule of thumb is, how embarrased would you be if your data was published on the front page of a major newspaper? If you'd be proud to see your data there, and not concerned about its disclosure, your data is likely not sensitive. On the other hand, if you think you might lose your job over the release of that data, your data is likely high risk. If you have sensitive data, you will face additional requirinments for storing and sharing your data. In particular sensitive information should be password protected and encrypted whenever on a device with internet access or stored online. 

Sensitive Data Risk Levels

Sensitive data is any data that, if released to the public, would cause potential harm. Some examples of sensitive data include research participants’ personal information like ethnicity or address, ecological data including endangered species nesting sites, sacred indigenous cultural practices, or confidential commercial information. Any research conducted using human participants must go through ethics review by either the McMaster Research Ethics Board (MREB) or the Hamilton Integrated Research Ethics Board (HiREB).

McMaster classifies research data into three levels of risk, Low, Medium, or High, based on the potential for harm if data is leaked or obtained by unauthorized individuals. These risk levels were designed around research involving human participants, although they may apply to other research designs as well.

Low Risk data is Research data that does not contain any sensitive or identifiable information about individuals, organizations, or communities. There is no significant risk from disclosure, loss, or unauthorized release of low risk data. Low risk data does not contain any sensitive information or identifiable information about individual, communities, or organizations.

Examples of low risk data include non-sensitive research documentation, publicly facing information, completely anonymized or de-identified data with no risk of re-identification, or published data intended for public access.

Medium Risk data is research data that may or does contain confidential, sensitive, or identifiable information about individuals, organizations, or communities. Disclosure, loss, or unauthorized release of medium risk data may result in putting participants at risk.

Examples of medium risk data include some sensitive research-related documentation, personally identifiable information, de-identified records of compensation, data and research protocols related to private or sensitive intellectual property, de-identified financial information associated with research payments, identifiable demographic data and/or information about participants’ beliefs, opinions, health, etc., that in the context of the study would be considered medium risk.

High Risk data is research data that contains highly sensitive information about individuals, organizations, or communities. Disclosure, loss, or unauthorized release of high risk data may result in significant risk for the participant, the researcher, and potentially the institution including reputational damage, significant professional or personal disruption, financial consequences and legal liability.

Depending on the study context, examples of high-risk data could include information with regard to racial or ethnic origin; political opinions; religious beliefs or other beliefs of a similar nature; trade union membership; physical or mental health or condition; sexual life; the commission or alleged commission by the data subject of any offence or criminal activity. Other examples of high-risk data may include Personally Identifiable Information (PII) (where a breach of confidentiality would carry a high risk for research participants), Personal Health Information (PHI) and credit card information (PCI).

High-risk data requires very strong controls against unauthorized disclosure, loss, and modification.

Encryption

Encryption is a process of transforming information so that it is only readable to a person with the correct authorization. Typically this authorization takes the form of a password but it can involve a hardware security key such as a YubiKey or MobiKey.

You might see the phrases “encryption at rest” or “encryption in transit”. “Encryption at rest” means data is encrypted when it is being stored, and “Encryption in transit” means that data is encrypted while it is being transmitted from your devices to the storage provider.

Data that is medium or high risk and stored on a device connected to the internet should be encrypted. That data must be encrypted if it is stored on a cloud storage platform such as OneDrive or Dropbox.

Warning: if you lose your password to an encrypted drive or file there is NO WAY to access the encrypted data.

Encryption Options:

Full Disk Encryption: Windows or MacOS computers can use full disk encryption, where the operating system encrypts the whole hard drive or SSD that the computer is using. See the following links for details:

MacOS

Windows

Encrypt a USB drive:

MacOS

Note: this method will produce drives running the Apple Protocol File System - Encrypted (APFS-encrypted), which requires 3rd party paid software to read on Windows computers. These drives cannot be written to on Windows.

Windows

Buy a pre-encrypted USB drive:

Products like the Kingston Datatraveler, Kingston Ironkey, Apricorn Aegis Secure Key, or ISTORAGE Datashur Pro come pre-encryped with their own secure access software.

Encrypt individual files:

An easy way to work with data while keeping it encrypted is to create an encrypted virtual disk. This virtual disk can be mounted similar to a USB key or other external drive and will appear in the list of drives similar to a normal drive (in windows it will have a drive letter like K:). When the drive is mounted the files will be accessible for work, and when the drive is unmounted the files will be encrypted and unable to be accessed without the password. These virtual disks can be stored and shared on normal file storage services such as OneDrive or MacDrive. 

MacOS can create encrypted ‘disk image’ files with the .dmg extension. Disk Images are files which act as containers for other files.

Microsoft Office can encrypt individual documents

Windows can easily encrypt individual files or folders.

Veracrypt is a third party free open source encryption software package for MacOS, Windows, and Linux. 

Research Data

FRDR (Federated Research Data Repository) is a national web-based platform for data discovery. FRDR allows researchers to search for datasets that exist in Canadian research data repositories—both in FRDR itself or in numerous repositories from which FRDR harvests metadata, including university based Dataverses. FRDR’s Geodisy map search (beta) is an open source discovery tool that allows users to find open data from Canadian researchers by using an interactive map.

Re3data is a global registry of research data repositories that covers research data repositories from different academic disciplines. It includes repositories that enable permanent storage of and access to data sets to researchers, funding bodies, publishers, and scholarly institutions.

Aggregate and Microdata

The McMaster Library Data Service serves as a central point of access to a wide assortment of digital numeric research data files, including both aggregate data and microdata. The collection covers a broad range of subject areas with an emphasis on Social Sciences, Health Sciences, Business, and Economics. Access to the numeric microdata files is restricted to current McMaster University faculty, staff and students for the purposes of teaching, research and private study only. The Library Data Service provides access to aggregate data (Canadian, US & International) through the self-serve websites.

The Research Data Centre at McMaster University is a member of the Canadian Research Data Centre Network (CRDCN) that provides researchers with access to Statistics Canada’s microdata 'masterfiles'.  The master files of a large number of Statistics Canada’s population, social, and health surveys, as well as the Census and administrative databases, are housed in the RDC. Access is free of charge to all faculty, students and staff affiliated with McMaster. All work must be conducted in the RDC and only vetted output is released. To protect the confidentiality of survey respondents, data in any form cannot be released or made accessible outside of the centre.

<odesi> (Ontario Data Documentation, Extraction Service and Infrastructure) is a digital repository for social science data, including polling data. It is a web-based data exploration, extraction and analysis tool. <odesi> provides researchers the ability to search for survey questions (variables) across thousands of datasets. There are both microdata and aggregate data available, in a range of formats.

File Organization

Organizing your research files with a consistent system will make your data easier to understand, share, and archive. When you revisit your data files over time, it will take less effort to find what you’re looking for. There is no one right way to organize your files, but the key to a good system is that it should be descriptive and standardized, and to implement it consistently. When you’ve come up with a file organization and naming system, describe it in your research project’s readme file.

File Naming Conventions

Important pieces of information to include in filenames include things like:

• Short description of file contents
• Date created as YYYYMMDD or YYYY_MM_DD
• Project name or acronym
• Initials of researcher (if working on a collaborative file)
• Version number
• Other important metadata such as location or

Other important practices in file naming are:

• Avoid special characters such as & , * % # * ( ) ! @$ ^ ~ ‘ { } [ ] ? < > –
• Try to keep names short, no more than 25-30 characters
• Separate parts of filename using underscore _ or by using CamelCase where every word is capitalized
• If you are writing your own code or working with code, avoid using spaces in file names

Example:

LakeMercury_TestData1_2020_10_01_TM_v3.csv

20201001LakeMercuryTestData1TMv3.csv

• LakeMercury = Project Name
• TestData1 = Description of file contents
• 2020_10_01 or 20201001 = data collection date
• TM = Tracy MacDonald
• v3 = Version 3

Research Collaboration Platforms

There are an increasing number of software platforms designed to enhance research collaboration.

Many document creation tools like Google Docs and Microsoft Office now offer real time collaborative document creation and editing. These tools can help avoid the confusion that comes with multiple versions and copies of documents being passed back and forth by email.

Reference Management tools such as Zotero, Mendeley, or Endnote (see the Library's Comparison Page for a comparison of these programs) can also support group work through shared citation libraries.

The Open Science Framework (OSF) is a free open platform for research collaboration. OSF provides a place to manage files, data, code, and protocols in one centralized location. Research can be organized into projects and components. Access can be provided to collaborators and to the public (if desired). Files on OSF have automated version control, and can be registered to keep snapshots of different phases of the work, such as pre-registering a hypothesis or analysis plan. Tools such as citation managers, data storage providers, or repositories can be easily linked to OSF on a project by project basis.

Sharing research data benefits you as a researcher and the whole research community. Open access to data allows for the verification and reproduction of research. The best way to share data is to publish it on a recognized data repository.

Data repositories come in two main flavours: domain specific repositories, which focus on certain types of data such as genomic information or astronomical information; or general repositories, which accept broader types of research data. If you are planning to archive data, we recommend that you archive to a domain specific repository when possible. Repository Finder, a tool by DataCite, can help you find an appropriate repository to deposit your research data.

Dataverse

At McMaster we support McMaster Dataverse, a part of the Scholars Portal Dataverse network. Dataverse is an open source repository software providing secure access controls, licensing, version management, data citation, DOI minting, and more. If you’re interested in publishing data on the McMaster Dataverse, please contact us at rdmgmt@mcmaster.ca

Portage Dataverse Primer 

Portage Repository Options Guide

Documentation and Supporting Material Required for Deposit

Federated Research Data Repository (FRDR)

The Federated Research Data Repository (FRDR) is a National Data repository. Any researcher affiliated with a Canadian institution can deposit data into FRDR. The platform can efficiently ingest datasets of any size, and preservation processing is done automatically. Data professionals from the Portage Network and institutions across Canada work with researchers to curate and approve deposited items. FRDR also provides powerful functionality to search for Canadian research data. The search tool aggregates metadata from numerous repositories.FRDR is an excellent choice for depositing large research datasets, and provides curation, discovery, and preservation services. Documentation on how to deposit data can be found on the FRDR Documentation page.

Licensing Data

Including a license with your published data set allows you to define what others can and cannot do with your data. Licenses range from giving data into the public domain, where it is free for anyone to use for any purpose, to narrower licenses which may restrict use to non-commercial use only or require attribution to the author when the data is used.

The most common data licenses are Creative Commons (CC) and Open Data Commons. McMaster Dataverse defaults to the CC0 Public Domain Dedication license. This license dedicates the dataset and its content to the public domain, free and unrestricted for everyone to use. However, Dataverse offers the ability to choose from a variety of CC licenses during the deposit process. Though CC0 waives copyright controls, researchers using data from Dataverse are still expected to follow the Dataverse Community Norms as well as scientific best practices which assert that proper credit should be given through citation of datasets. CC0 also does not prevent researchers from setting up access restrictions on datasets.

Licensing software code uses similar but slightly different licenses. There are many potential choices here. If you are looking to share research software code you have written, the ‘Choose a License’ website developed by Github can guide you through the process. 

Data Anonymization

Some research data may contain sensitive information, and cannot be shared for legal or ethical reasons. Sensitive information may contain data including:

• Personal Identifiers
• Personal Health Information
• Personal financial information
• Confidential business information
• Sensitive ecological information
• Indigenous cultural practices  

Some datasets containing Sensitive information can be anonymized or de-identified, allowing for sharing to happen. De-identification is the process of removing any identifiable data from a dataset. Typically this happens by removing or replacing personal identifiers. With some datasets, it may be impossible to completely anonymize the data, as even when direct identifiers are removed, combinations of other data may make it possible to still identify the individuals in the dataset. Datasets that cannot be completely anonymized should not be shared openly.

Several software packages exist which can help with de-identification of data. For a full review of the different packages, see the Portage De-Identification Guidance document. The recommended tools are Amnesia, and sdcMicro. Amnesia is considerably easier to use but sdcMicro has a more powerful feature-set.

Portage Network de-identification guidance document

Portage Reducing Risk Webinar:

• Slides
• Recording

Good data deserves to be remembered. The best way to keep data from being lost is to make sure it is properly archived. Many important data have been lost over time as storage devices become corrupted and fail, are lost, or are destroyed.

The best way to preserve important research data is to upload it to a reputable data repository. Data repositories come in two main flavours: domain specific repositories, which focus on certain types of data such as genomic information or astronomical information; or general repositories, which accept broader types of research data. If you are planning to archive data, we recommend that you archive to a domain specific repository when possible. Repository Finder, a tool by DataCite, can help you find an appropriate repository to deposit your research data.

Before archiving data for long term storage, there are a couple steps to follow.

1. Ensure that the data is stored in sustainable, open file formats. Open file formats help ensure access to your data over the long term as proprietary software can disappear when companies go out of business.

Sustainable file formats typically have the following attributes:

• Standardized
• Well documented
• In common usage
• Unencrypted
• Uncompressed

Examples of sustainable formats include:

• Text: PDF/A, RTF, TXT, XML, LaTeX, md
• E-Books: EPUB, PDF/A
• Audio: FLAC
• Image: TIFF, SVG, JPEG 2000, BMP, PNG
• Medical Images: DICOM
• Spreadsheet: CSV, TAB
• Video: MP4, OGV, OGG, MJ2

2. Data should be well documented and easily understandable. Research data should be packaged with metadata, so-called ‘data about data’. Data documentation is commonly included in readme files, codebooks, or data dictionaries. Metadata should include information about:

• File title, file format, language, creator, and date
• Data variable descriptions, including data type, allowable values, and calculations used (if applicable)

Research records

Research records are the documentation surrounding the research process, and can include consent forms, research proposals, grant applications, and other administrative or financial documents. These documents may have specific retention periods prescribed by ethics agency policy, law or granting agencies.