Research Data Management GDPR AVG 9 May 2019

Research Data Management & GDPR (AVG) 9 May 2019 Yasemin Turkyilmaz-van der Velden Data Steward @TU Delft Faculty of Mechanical, Maritime and Materials Engineering y. turkyilmaz-vandervelden@tudelft. nl @Yasemin. Turkyilm Slides are available: https: //doi. org/10. 5281/zenodo. 2682600 1

Who am I? Data Steward @ TU Delft www. tudelft. nl/library/datastewardship/ Secure data storage, data sharing, citation Advice Archiving 4 TU. Centre for Research Data or disciplinary repositories For data management in grant proposals Costs Advice and templates Compliance With funders' and journals’ policies DMPs Workshops, information sessions Tools Training For data and software management 2

Outline • Basics of RDM & GDPR - What & How? • How to be in line with GDPR and funders’ requirements? • How does it work at TU Delft? 3

General Data Protection Regulation (GDPR) • In effect since 25 May 2018 • Applies to: – any EU researcher who collects personal data about a citizen of any country, anywhere in the world – Any non-EU researcher collecting personal data on EU citizens – Applies only to ‘personal data’ from a living person • Anonymised or de-identified data is NOT personal data so GDPR does NOT apply Adapted from Veerle Van den Eynden, https: //zenodo. org/record/1408108#. XGUQk. TBKj. IU 4

General Data Protection Regulation (GDPR) • Strengthens existing rights and empowers individuals with more control over their personal data. • For institutions it implies stricter rules, more rights for citizens and higher fines when it comes to violations to the act (privacy, unauthorized sharing of personal data, data-loss, etc. ) https: //www. tudelft. nl/over-tu-delft/strategiedocumenten-tudelft/integriteitsbeleid/human-research-ethics/gdpr/ 5

What is Personal Data? • "Personal Data" (GDPR, Article 4): any information relating to an identified or identifiable natural person: • a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person https: //gdpr-info. eu/art-4 -gdpr/ 6

Personal data elements • General: Name, gender, age, date of birth, civil status, nationality, languages, IP addresses • Organisational: work/home addresses, phone, e-mail, id number • “Special”: Race, Religion, sexual orientation, health, sex life, criminal record, Biometric data • In the Netherlands, super special: BSN number Adapted from slides of Shalini Kurapati 7

GDPR principles for processing personal data 1. Process lawfully, fair and transparent • Inform participant of what will be done with the data, process accordingly 2. Keep to the original purpose • • Collect data for specified, explicit and legitimate purposes Do not process further in a manner incompatible with those purposes 3. Minimise data size • Personal data collected should be adequate, relevant and limited to what is necessary 4. Uphold accuracy • Personal data should be accurate and kept up to date 5. Remove data which aren't used 6. Ensure data integrity and confidentiality • Protection against unauthorised or unlawful processing, accidental loss, destruction/damage, using appropriate technical or organisational measures Adapted from Veerle Van den Eynden, https: //zenodo. org/record/1408108#. XGUQk. TBKj. IU 8

Some terminology Processing - Any operations performed on personal data, such as storage, collection, recording, organisation, updating, modification, retrieval, consultation, use, disclosure, etc. Data subject - The person whose personal data are processed. Controller - The party (person or organisation) that determines the purposes for which and the means by which personal data is processed. Processor - The processor is responsible for processing personal data on behalf of the controller. Data processing agreement - An agreement or other binding legal act laying down the arrangements made with the processor with regard to the processing of personal data. 9

Some terminology Data Protection Officer - is mandatory for organisations that process a great deal of personal data and internally monitors and provides advice on the application of and compliance with the GDPR by the organisation. The Data Protection Officer is also the contact person for the data subject and is responsible for creating awareness about data protection. Data Protection Impact Assessment (DPIA) - needs to be carried out if the processing of the personal data results in a high risk to the data subjects Data Breach - The GDPR definition: “an accidental (unintentional) or unlawful (intentional and/or grossly negligent) breach of security leading to destruction, loss, alteration or unauthorised disclosure of, or access to, personal data and/or other confidential information transmitted, stored or otherwise processed. ” Must be reported within 10 72 hours.

Grounds for processing personal data One of these must be present to process a data subject’s personal data: • • • Consent of the data subject Necessary for the performance of a contract Legal obligation placed upon controller Necessary to protect vital interests of the data subject Carried out in the public interest or is in the exercise of official authority Legitimate interest pursued by controller Adapted from Veerle Van den Eynden, https: //zenodo. org/record/1408108#. XGUQk. TBKj. IU 11

In the informed consent procedure, the data subject should be informed about: ● The name and contact details – researchers, contact person and data protection officer – how to file a complaint ● The research procedures ● Benefits, discomfort and risks ● The purposes of the processing ● The retention period for the personal data ● Data subject’s rights with regard to the processing of personal data: – access, rectification, erasure, restriction and objection https: //www. ru. nl/rdm/collecting-data/informed-consent-ethics-committees/ https: //www. tudelft. nl/over-tu-delft/strategiedocumenten-tudelft/integriteitsbeleid/human-research-ethics/template-informed-consent-form/ 12

https: //www. tudelft. nl/over-tu-delft/strategiedocumenten-tudelft/integriteitsbeleid/human-research-ethics/template-informed-consent-form/ 13

Working with Personal Data During the project What to do? • • Collect and store only what is necessary Restricted access (only to those who need to have access) + extra layer of security such as encryption • Encryption can be done: ○ ○ • At file or folder level by Vera. Crypt At disk level by Bit. Locker (Windows) or File. Vault (Mac) Informed consent -> also personal data and needs to be securely stored 14

Working with Personal Data During the project What to do? • • Collect and store only what is necessary Restricted access (only to those who need to have access) + extra layer of security such as encryption • Encryption can be done: ○ ○ • Important to consider: At file or folder level by Vera. Crypt At disk level by Bit. Locker (Windows) or File. Vault (Mac) Informed consent -> also personal data and needs to be securely stored • How to securely store data? • • Who has access to what? Do data need to be shared with other project partners? If so, are they stated in the informed consent form? If not, can data be shared after de -identification? 15

Secure Data Storage and Backup ● Regular and preferably automatic backup to avoid data loss ● Contact your ICT department if not sure 16

Secure Data Storage and Backup Always read the small print… Google services Terms of Use: https: //www. google. com/intl/en/policies/terms/ 17

● Secure cloud storage ○ 30 -day backup, synchronize and share data ● Up to 250 GB ● Possible to share data with external collaborators ○ public link + with password protection + expiry date ● Not suitable for long term storage ○ account expires when you leave ● It is a personal storage space ○ but you can give access to others https: //www. surfdrive. nl/en 18

https: //www. surf. nl/en/surffilesender-send-large-files-securely-and-encrypted 19

Working with Personal Data After the project What to do? Publish: • Fully de-identified data can be published in an open access repository • If data is not fully de-identified, can be published in a restricted access repository such as EASY 20

Working with Personal Data After the project What to do? Publish: • Fully de-identified data can be published in an open access repository • If data is not fully de-identified, can be published in a restricted access repository such as EASY Important to consider: • • How to make the data available for others? Pseudonymization, anonymization? How? Restricted/open access? Have you asked consent (in case the data is not fully de-identified)? 21

https: //www. ukdataservice. ac. uk/manage-data/legal-ethical/anonymisation/step-by-step. aspx 22

De-identifying qualitative data • plan or apply editing at time of transcription – except: longitudinal studies – de-identify in the end • avoid blanking out; use pseudonyms or replacements • avoid over-anonymising – removing / aggregating information in text can distort data, make them unusable, unreliable or misleading • consistency within research team and throughout project • show replacements, e. g. with [brackets] • keep a log of all replacements, aggregations or removals made – keep separate from de-identified data files Adapted from Veerle Van den Eynden, https: //zenodo. org/record/1408579#. XGUP-TBKj. IU 23

Example anonymization Adapted from Veerle Van den Eynden, https: //zenodo. org/record/1408579#. XGUP-TBKj. IU 24

Some tools for de-identification • Amnesia: Cloud based, easy to use – https: //amnesia. openaire. eu/ • R tool - sdc. Micro (scripting + GUI) – – • • R package (and free dependable software R and RStudio) reference manual new Shiny GUI – in detailed vignette SDC methods and sdc. Micro μ-Argus: standalone software recommended by Eurostat for government statisticians – software and manual ARX : comprehensive open source software for anonymizing sensitive personal data – software and documentation Adapted from Cristina Magder, https: //zenodo. org/record/1408579#. XGUP-TBKj. IU 25

https: //dans. knaw. nl/en/about/organisation-and-policy/informationmaterial/Dans_A 5 Flyer 7 stepsengonline. pdf 26

Funders’ Requirements & GDPR? http: //ec. europa. eu/research/press/2016/pdf/opendata-infographic_072016. pdf#view=fit&pagemode=none • Requirement of NWO, Horizon 2020, Zon. Mw • NWO: – ‘’Besides publications also research data that emerges from NWO-funded research should be as accessible and reusable as possible. ’’ 27

Funders’ Requirements & GDPR? http: //ec. europa. eu/research/press/2016/pdf/opendata-infographic_072016. pdf#view=fit&pagemode=none • • • FAIR≠Open “As open as possible, as closed as necessary” NWO: – ‘’Due consideration is given to aspects such as privacy, public security, ethical limitations, property rights and commercial interests. ’’ 28

How does it work at TU Delft? ● The completion of a Data Management Plan (DMP) is recommended for all projects working with personal research data (for compliance with the GDPR). ● Data Steward helps with the DMP and directs researchers to ICT, Human Research Ethics Committee, privacy and legal team when necessary. ● Projects which involve sensitive personal data and require Human Research Ethics Committee approval, first need a DMP approved by the Data Steward. 29

TU Delft Data Management Plan Compulsory Section for projects with personal data: 1. Please detail what type of personal data will you collect, for what purpose, how will you store and protect that data 2. Will you be sharing personal data outside of the European Union? 3. What is the legal ground for personal data processing? 4. Will the personal data be shared with others after the end of the research project, and if so, how and for what purpose? 5. Does the processing of the personal data results in a high risk to the data subjects? -> DPIA Checklist 6. Does the project need the approval of the Human Research Ethics Committee? -> Ethics Review Checklist 30

To see the TU Delft DMP, go to https: //dmponline. dcc. ac. uk/ Sign in / Create a new account

Generate a new plan https: //dmponline. dcc. ac. uk/plans/new Choose Delft University of Technology as the primary research organization

Finally • Don’t be scared of GDPR : ) It’s about proportionality, ethics and common sense • Investigate early which aspects apply • Seek advice from Human Research Ethics Committee, privacy and legal team • If it is necessary to collect / handle personal or sensitive data: – transparency about processing personal data – best practices for processing Adapted from slides of Shalini Kurapati 33

More materials https: //zenodo. org/record/1408108#. XGUQk. TBKj. IU https: //zenodo. org/record/1408579#. XGUP-TBKj. IU 34

Thank you Questions? Yasemin Turkyilmaz-van der Velden Data Steward @TU Delft Faculty of Mechanical, Maritime and Materials Engineering y. turkyilmaz-vandervelden@tudelft. nl @Yasemin. Turkyilm Slides are available: https: //doi. org/10. 5281/zenodo. 2682600 35