Schuster, H.

English

MPG.PuRe

OPEN RESEARCH DATA AND GDPRHeidi SchusterData Protect ion Off icer  of the MPGM A X- P L AN C K- G E S E L L SC H AF T |  H E I D I  S C HU S T E R  1WHAT IS IT ALL ABOUT?M A X- P L AN C K- G E S E L L SC H AF T |  H E I D I  S C HU S T E R  2Open ScienceThe movement to make scientific research, data and their dissemination available to any member of an inquiring society, from professionals to citizens.Data ProtectionThe protection of natural persons with regard to the processing of personal data.Sharing ofpersonal dataSHARING SCENARIOSWithin an existing project collaboration• inside the EU / EEA• outside the EU / EEAWithout an existing project collaboration• Data service center / repository• Internet platform• Restricted /controlled recipients?• Unlimited recipients?What kind of personal data?M A X- P L AN C K- G E S E L L SC H AF T |  H E I D I  S C HU S T E R  3PERSONAL DATAany information relating to an identified or identifiable natural person (‘data subject’).identified person: person can be clearly determined from the data availableidentifiable person:  person can be identified, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;M A X- P L AN C K- G E S E L L SC H AF T |  H E I D I  S C HU S T E R  4PERSONAL DATATo determine whether a natural person is identifiable, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, available technology and technological developments. A group less than or equal to three is never anonymous.The differentiation between identified and identifiable person is irrelevant for the protection of the law.M A X- P L AN C K- G E S E L L SC H AF T |  H E I D I  S C HU S T E R  5PERSONAL DATAspecial kinds of personal data (sensitive data)  racial or ethnic origin (NOT nationality) political opinions  religious or philosophical beliefs trade union membership health  sex life genetic data biometric data for the purpose of uniquely identifying a natural personThese data is particularly worthy of protection. M A X- P L AN C K- G E S E L L SC H AF T |  H E I D I  S C HU S T E R  6PERSONAL DATA IN RESEARCHcontact data name, address, email, phone numbercharacteristics blood pressure, left-/right-handed, medical history, age, date of birth, capability to undergo MRI, EEG, etc., native languageexperimental data examinations (medical, questionnaires, etc.), interview outcomes, imaging data (photos, MPI, X-Ray, CT, etc.), laboratory results, video-/audio recordingIn case these data types are linked by an ID, there is always a connection to a person.Characteristics and experimental data are on their own always seen as pseudonymized data.They might become anonymous when contact data and connecting link are deleted.M A X- P L AN C K- G E S E L L SC H AF T |  H E I D I  S C HU S T E R  7LAWFULNESSM A X- P L AN C K- G E S E L L SC H AF T |  H E I D I  S C HU S T E R  8The processing of personal data is generally prohibited. necessary for the performance of a contract / for pre-contractual measures consent on the basis of a balancing of interests […]under the conditions of Art. 6, 9 GDPR or national law permittedArt. 6: lawfulness of processingArt 9: processing of special categories of personal dataimportant:all legal bases have remained the sameall legal bases are equivalentCONSENT‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;formal aspects• the existence of consent has to be proofed• signature, email; electronic consent: opt-in• documented oral consent -> documentation by recording or by procedure• minors (in any case under 16 years of age): consent of the legal guardiansM A X- P L AN C K- G E S E L L SC H AF T |  H E I D I  S C HU S T E R  9WITHDRAWALThe data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.Withdrawal is only relevant if the data is not anonymous.if data is coded only (= pseudonymised) withdrawal is relevantM A X- P L AN C K- G E S E L L SC H AF T |  H E I D I  S C HU S T E R  1 0INFORMED CONSENTpurpose of the data processing• „broad consent“: data subjects can give their consent to certain areas of scientific research when recognised ethics standards are met• linkage with administrative data has to be explicitly mentionedmethod of storing and processing data• contact data, characteristics, research data• explicit reference to special categories of personal data • information about the data separation and coding list• combination with data from other sources?Data Sharing scenariosM A X- P L AN C K- G E S E L L SC H AF T |  H E I D I  S C HU S T E R  11DATA SHARINGLegitimacy• First step: Sharing as such regardless of the recipient country -> consent• Second step: transfer to data outside the EU / EEA -> it dependsEU „Whitelist“• Adequacy decision of the commission• Andorra, Argentina, Australia, Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, Canada (only companies), Switzerland, Uruguay, New Zealand, UKAll other countries:• Contracting EU Standard Contract Clauses (SCC) with the recipient• Consent with the explicit information about possible risks of such transfers due to the absence of an adequacy decision and appropriate safeguardsM A X- P L AN C K- G E S E L L SC H AF T |  H E I D I  S C HU S T E R  1 2PUBLICATION OF DATASection 27. Data processing for purposes of scientific or historical research[…](4) The controller may publish personal data only if the data subject has provided consent or if doing so is indispensable for the presentation of research findings on contemporary events.What kind of data will be publishes?• Legally anonymous data?• Or “not identifiable” data?“No contact data will be published. Identification will not be possible on the basis of the research data to be published.”M A X- P L AN C K- G E S E L L SC H AF T |  H E I D I  S C HU S T E R  1 3TEMPLATEShttps://max.mpg.de/Zentrale-Beauftragte/Datenschutz/Pages/Datenschutz_EN.aspxM A X- P L AN C K- G E S E L L SC H AF T |  H E I D I  S C HU S T E R  1 4TEMPLATESM A X- P L AN C K- G E S E L L SC H AF T |  H E I D I  S C HU S T E R  1 5TEMPLATESM A X- P L AN C K- G E S E L L SC H AF T |  H E I D I  S C HU S T E R  1 6TEMPLATESM A X- P L AN C K- G E S E L L SC H AF T |  H E I D I  S C HU S T E R  1 7THANK YOU FOR YOUR ATTENTIONPlease do not hesitate to contact me!Heidi SchusterDatenschutzbeauftragteMax-Planck-Gesellschaft zur Förderung der Wissenschaften e.V. Hofgartenstr. 8, 80539 MünchenTelefon + 49 89 2108-1554E-Mail heidi.schuster@gv.mpg.dewww.mpg.de

Open Research Data and GDPR

http://hdl.handle.net/21.11116/0000-0008-F814-A

Open Research Data and GDPR

Abstract

Similar works

Full text

Available Versions

MPG.PuRe