1. Katrine Utaaker Segadal
DASISH
Digital Services Infrastructure for
Social Sciences and Humanities
Legal and Ethical Issues (WP6)
Katrine Utaaker Segadal
Norwegian Social Science Data Services (NSD)
IASSIST
Toronto, 4th June 2014

2. Overall objectives of WP6
Identify the legal and ethical issues, constraints and requirements for all data types;
Deal with the legal and ethical challenges imposed by new data types;
Look for professional long-run preservation strategies and policy-rules.
WP6 addresses various legal and ethical issues that modern research in SSH is confronted with.
To identify the legal and ethical issues, constraints and requirements for all data types occurring in the SSH domain;
To deal with the legal and ethical challenges imposed by new data types emerging in the SSH;
To look for professional long-run preservation strategies and policy-rules.
NSD©2014

3. Task 6.1: New Ethical and Legal Challenges (Leader: MPG (MEA); Partner: CITY)
Specific objectives:
Identify the various new data types;
Determine the IPR Requirements;
Define guidelines for appropriate measures and identify tools that help to take appropriate measures.
The output D6.1 and D6.2:
Report about NEW IPR Challenges
Sample merged paradata sets
Focus on new data types within the SSH domains.
Specific objectives:
Identify the various new data types including sensitive data;
Determine the IPR Requirements for these new data types;
Define guidelines for appropriate measures and identify tools that help to take appropriate measures.
The output D6.1 and D6.2:
Report about NEW IPR Challenges
Sample merged paradata sets
NSD©2014

4. D6.1 Ethics and Legal Challenges of SSH Research
Findings and Conclusions:
The on-going negotiations about the proposed new European General Data Protection Regulation cause uncertainties
The fragmentation of data protection law in the EU Member States poses a big challenge to cross-country research
The organisation of the national ethics committee systems in Europe differs a lot between the Member States
Technological developments give rise to specific issues which are not covered in existing ethics codes
NSD©2014

5. Task 6.2: Virtual L&E Competence Center
(Leader: MPG (MEA); Partner: CITY, NSD, UIB, GESIS)
” …create a virtual center that collects and systemizes all respective legal information from the member countries…”
The output D6.4, D6.5 and MS19:
Midterm report on the establishment of virtual centres
Handbook on legal and ethical issues for SSH data in Europe
Establishment of virtual L&E competence centres
” This task will professionalize routine legal and ethical procedures in the day-to-day operation of SSH data collection. It will create a virtual center that collects and systemizes all respective legal information from the member countries, create templates for letters and communication, model contracts for all involved partners, and standard procedures for the handling of legal issues.”
The output D6.4, D6.5 and MS19:
Midterm report on the establishment of virtual centres
Handbook on legal and ethical issues for SSH data in Europe
Establishment of virtual L&E competence centres
NSD©2014

6. Task: Task 6.3: Preservation Challenges
(Leader: NSD; Partner: KCL, NSD, MPG (MEA), UIB)
“… a report that describes the policy-rules that need to be considered when sensitive data will be preserved in a distributed data preservation and curation infrastructure.”
Describe and evaluate the proposed forthcoming changes in the European legal framework on data protection;
Identify and evaluate ethical and legal challenges of long-run preservation and data sharing in a distributed and cross country environment.
Outcome/deliverable: D6.6 Report about Preservation Policy-Rules
The output of this task is a report that describes the policy-rules that need to be considered when sensitive data will be preserved in a distributed data preservation and curation infrastructure.”
Describe and evaluate the proposed forthcoming changes in the European legal framework on data protection (GDPR)
Background and progress of the new data protection regulation
Summary of key issues and concerns raised by selected research organisations (e.g. through hearing statements or other official publications) with regard to the possible effects the proposal may have on their research activities. Main focus will be on sensitive data and intellectual property rights (IPR).
Summary report of the most important provisions for the research sector in the GDPR, and possible effects that new general data protection regulation may/will have concerning research data preservation and e-infrastructure development (see appendix 1 for preliminary list of important provisions and issues).
Identify and evaluate ethical and legal challenges of long-run preservation and data sharing in a distributed and cross country environment.
To be done after the evaluation of the forthcoming changes in legal framework on data protection ). The aim is to build a general but strong scaffold that can assist repositories and archives in dealing with the ethical and legal challenges connected to the long-term preservation of sensitive data.
D6.6 will emphasize the preservation aspect of the research process. That is, building on D6.1 we intend to expand and elaborate on relevant issues within the data processing and data access / preservation phases. Some of the most relevant issues identified (and tools to deal with these issues) so far are:
Data transfer licenses
License and acquisition agreements between data producers and archive/repository
Data sharing licenses, re-use purposes
Data access regulations
IPR/Copyright
Data security
Hence, the first part of this sub-task will consist of a short summary of sensitive data issues, now and in the future, that needs to be taken into account when preparing and curating for long-term preservation in SSH data archives/repositories.
The second part of the sub-task will describe and evaluate current relevant guidelines and practices in a selection of SSH repositories (e.g. looking at concrete license agreements, copyright statements, and data access regulations, etc.).
The descriptions and evaluations should be considered in light of the forthcoming EU’s general data protection regulation, and we will try to keep our emphasis on ‘new’ and ‘emerging’ data types (as described in 6.1 and 6.2).
Outcome/deliverable: D6.6 Report about Preservation Policy-Rules (delivery date: month 30)
Recommendations for policy-rules that can act as guidelines for deposit services within the SSH offering long-term preservation and access rights while at the same time protecting data confidentiality and integrity. The overall purpose is to contribute/create an environment of trust (see appendix 2 for a preliminary suggestion of policy content).
NSD©2014

7. General Data Protection Regulation (COM(2012)0011):
New legal challenges:
General Data Protection Regulation (COM(2012)0011):
The European Commission, January 25, 2012
Replaces Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and the free movement of such data.
New Instrument; a (directly applicable) Regulation, to ensure a unified legal framework in Europe.
The regulations for processing personal data affect large areas of European research and research infrastructures. The proposal for new data protection regulations in Europe and how they will subsequently be implemented and practiced at the national level is therefore of great interest to the scientific communities and research infrastructures in Europe. The main question asked is whether the new regulation creates good, secure and predictable framework conditions for scientific research and research infrastructures, framework conditions being defined here as opportunity to collect, store and analyse personal data.
NSD©2014

8. Commission Proposes a Comprehensive Reform of the Data Protection Rules
For the research community the question is whether the new regulation provides good, safe and predictable conditions for research.
The main conclusion is that the Commission’s proposal for the most part does accommodate research interests and implies more continuity than change in conditions
One important exception is the provision on purpose limitation principle in Article 5 (b) of the Regulation which corresponds to Article 6 (b) in the EU Directive.
When the European Commission published its proposal for a Regulation on the processing and transfers of personal data on 25 January 2012 our main conclusion was that the proposed legislation did not signify any dramatic changes in the framework conditions for scientific work, including more or less all of the research provisions implemented in the current Data Protection Directive 95/46/EF to safeguard the research sector's interest in processing personal data. However, one highly important research provision had been moved from the text of the law to the preamble, thus to some extent weakening the position of the research compared to its position in the current regulation.
The EU Directive's provision in Article 6 (b) (which corresponds to Article 5 (b) of the Regulation) which states that the processing of personal data for research purposes is not considered to be incompatible with the original purpose of collecting the data, is no removed and included in recital (40) of the preamble. This particular research exemption is seen as a basic principle and a guarantee for further (secondary) use of personal data for research purposes regardless of the original purpose. Our message at that stage was that the scientific community and its representatives should work ensure that the provision stating that further processing of personal data for a scientific purpose is a „not incompatible purpose‟ on condition that appropriate safeguards (technical and procedural) are in place, is incorporated in the wording of the new data protection regulation.
NSD©2013

9. The “Albrecht-Report”
Suggests to drop more or less all the important research provisions (derogations) that grants research a privileged position with regard to access and use of personal data.
Argues that scientific research is not special with regard to its public interest, and do not deserve a privileged position within the legal framework
For the scientific research this is devastating and initiatives is taken to ensure that the research guarantees are continued
In December the same year the Committee on Civil Liberties, Justice and Home Affairs (LIBE) published the Albrecht Report, which contained proposals for amendments to the European Commission's proposal. The Albrecht Report has been a source of widespread concern, especially in the health science communities in Europe. The reason for this was that the Albrecht Report proposed amendments to the Commission‟s proposal that implied to delete or amend more or less all the research exemptions and provisions that ensured a good balance between research interests and data protection interests in the proposed regulation.
The provisions in the legislation that LIBE Committee proposed to drop are pivotal for the possibility of reusing and sharing research data in all academic fields, and, consequently, for the long-term storage and open access to data.
NSD©2014

10. The European Parliament’s proposal:
Does not involve as dramatic consequences for research as feared after the Albrecht Report;
Important research provisions have been re-incorporated in the draft legislation in line with the European Commission's proposal;
However, amendments to the EU Commission's proposal have been made that may have negative consequences;
The important principle stating that research is a „not incompatible purpose‟ has now been removed entirely from the regulation.
The European Parliament has reached an agreement on a major data protection legislative reform. The next step is to start the negotiations between the Parliament and the Council of Ministers as soon as the Council agrees on its own negotiating position. To become law the proposed Regulation has to be adopted by the Council of Ministers using the "ordinary legislative procedure" (co-decision). The Council of Ministers (Jus-tice and Home Affairs, JHA) will meet in June to discuss the proposal. There is still some time to influence the Council to improve the conditions for scientific research.
On 21 October 2013, the LIBE Committee adopted several amendments to the Commission‟s proposal, and on 12 March 2014 the European Parliament accepted the proposal, including the amendments proposed to the proposal by the Commission. The good news is that the legislative reform adopted by the European Parliament does not involve as dramatic consequences for research as feared after the Albrecht Report. Important provisions currently implemented in the EU Directive to safeguard the research sector's legitimate interest in processing personal data will continue to apply, among other things the special authorisation for the processing of personal data for research purposes without consent, cf. Article 6 second paragraph, also as regards sensitive personal data, cf. Article 9 second paragraph (i). In addition, exemptions from the obligation to provide information, the obligation to erase and the right to be forgotten/erased are included, all of which apply specifically to research.
However, amendments to the EU Commission's proposal have been made that may have negative consequences for specific research designs and research areas. Several proposed amendments remove and/or tighten the special research provisions that, in the current regulations and the European Commission's proposal, 'protect' and facilitate research as an activity of particular importance to society. This primarily concerns the purpose specification principle and the exemptions from the main requirement for 'specific and explicit consent for the use and storage of personal data' as formulated in the European Commission's proposal in Articles 81 and 83. The latter have become significantly narrower as the regulation proposal has made its way through the European Parliament.
Several provisions in the new proposal remove and/or tighten the research provisions in the current regulations and the European Commission's proposal. The important principle stating that research is a „not incompatible purpose‟ has now been removed entirely from the regulation. This mean that the basic guarantee for further use of data for research purposes regardless of why the data were initially collected is lost and that the special position afforded research as a particular legitimate public interest is weakened in the proposed data protection legislation. This can, in the worst-case scenario, lead to a limitation on secondary use of data for research purposes, especially when the possibility of granting exemptions from the requirement for explicit consent for research purposes has also been more restricted.
NSD©2014

11. Processing of personal information should be de-identified.
Consent:
Shall be «purpose-limited» and given to «one or more specified purposes» which exclude broad consent. Even more problematic given the removal of the provision specifying that research is not incompatible with the original purpose.
Processing of personal information should be de-identified.
Processing of health data shall be permitted only with the consent of the data subject.
Member States may provide exemptions on condition that data are anonymous, de-identified or pseudonym
Shall be «purpose-limited» and given to «one or more specified purposes» which exclude broad consent. Even more problematic given the removal of the provision specifying that research is not incompatible with the original purpose.
In the proposed regulations, it is a requirement that consent must be limited to one or more specified purposes, cf. Article 6 first paragraph (a), cf. Article 9 second paragraph (a) and cf. Article 7 fourth paragraph. What this entails is somewhat unclear, but the legislators' intentions seems to be that one can only consent to one or more specified purposes and that the consent is limited to that or those purpose(s). Among other things, this means that broad consent is not an option, which is unfavourable; especially for major population surveys within the social and health sciences. The principle of broad consent is widely supported and also practised by European data protection authorities and ethical review boards in relation to large-scale social science projects. This must be seen in conjunction with the wish to promote research and facilitate and simplify research that benefits society where the risk of integrity violations is minimal.
Processing of personal information should be de-identified.
The general condition that data for research must be anonymised has been tightened in the proposed regulation; cf. Article 83 (b). This concerns projects that are not based on specific consent. In principle, the current regulations provide for the processing of both directly and indirectly identifiable personal data without consent. This can be necessary out of consideration for both the purpose and the form of data collection. The requirement for anonymisation may therefore lead to a significant tightening of research conditions. In particular, internet research, and partly also register research, may be affected.
Processing of health data shall be permitted only with the consent of the data subject.
In research projects where health data are processed, the conditions are even more stringent, cf. Article 81 (2a). It is our understanding that the main rule is that consent from the data subject is required in order to process health data for research purposes.
Member States may provide exemptions on condition that data are anonymous, de-identified or pseudonym
However, exemptions from the requirement for consent can be granted for research that serves a high public interest, but it is up the individual Member State to adopt such an exemption provision. Furthermore, we understand the provision to mean that the anonymisation requirement for the processing of research data applies in all cases, regardless of the basis for processing, i.e. also when consent has been obtained for the processing of the health data. In our opinion, this is problematic and may have very unfortunate consequences for the use of health data for research purposes. It will affect medical and health research in particular, but also other research purposes for which the processing of health data is necessary.
NSD©2014

12. Data management and preservation
From the point of view of research and research data archives, it is positive that separate grounds have been included for the processing of personal data by archive services, in which storage for research purposes is specifically mentioned, cf. Article 9 (ia).
This is new and clearly strengthens the legitimacy and the framework conditions for national infrastructure services and research data archives.
From the point of view of European as well as national research infrastructures and research data repositories, it is positive that separate grounds have been included for the processing of personal data by archive services, in which storage for research purposes is specifically mentioned, cf. Article 9 (i a) , cf. Article 83 (a). This is completely new and clearly strengthens the legitimacy and the framework conditions for research infrastructures and research data archives such as CESSDA member institutions.
NSD©2014

13. Now it is time to Act!
The European institutions is now entering a crucial stage in the legislative process both in the Council and Parliament.
Our role and duty as national research infrastructures is to make research funders and ministries among others, aware of the damaging effects to research and society if the proposed amendments in the Albrecht report are implemented.
The proposal is contradicting high level policies for open access and data sharing across Europe.
It is also contradicting the aim towards harmonisation.
NSD©2014

14. Thank you for listening!
NSD©2014