PANELFIT Code of Conduct on Data Protection for Research and Innovation

Examples of CoCs

• Relating to research & data protection

• Relating to ICTs and AI

• Relating to RRI

• Mentioned in the Draft Guideline (country-specific)

• CoC-related issues in the Critical Analysis

• Academic articles on:

  • CoCs and GDPR

  • CoCs and RRI

• Share research at PANELFIT meeting

• Draft versions of CCDP

  • Multiple rounds of comments & corrections

  • Feedback at Mutual Learning Encounter

• Final version of CCDP

EU-level, under GDPR

None approved so far under Art. 40 of the GDPR

EU-level, under GDPR

One submitted:

Code of Conduct on Data Protection in Online Gambling.

(In Malta. Multi-year preparation process, and 18-24 months for approval.)

EU-level, under GDPR

Some being submitted for approval, formulated, conceptualized, etc.:

• EU Cloud Code of Conduct (SCOPE Europe)

• Code of Conduct on Health Research (BBMRI-ERIC)

• Code of Conduct on Language Research (CLARIN)

• Code of Conduct on Genomic Data (early stages, TBD)

EU-level / EU-funded Guidance on Research

• RESPECT Code of Practice for Socio-Economic Research.

• Guidelines on Data Protection Issues Relating to European Socio-Economic Research.

• European Charter for Researchers.

• European Code of Conduct for Research Integrity.

• Global Code of Conduct for Research in Resource-Poor Settings.

EU-level / EU-funded Guidance on Research

• Code of Practice on Secondary Use of Medical Data in European Scientific Research Projects.

• Preliminary Opinion on Data Protection and Scientific Research, by the European Data Protection Supervisor.

• EFAMRO & ESOMAR’s Guidance Note for the Research Sector: Appropriate use of different legal bases under the GDPR.

• GREAT's Guidelines for Responsible Research and Innovation.

• EU Code of Conduct on Agricultural Data Sharing by Contractual Agreement.

EU-level / EU-funded Guidance on Research

The Responsible Innovation Compass project has catalogued 130 publicly-funded RRI projects in Europe, including 19 focussed on the ethics component of RRI.

Globally, on AI and Ethics

• (As of 2019) at least 84 sets of ethical guidelines on AI

  • 13 from EU member-states and

  • 6 from EU institutions

CoCs on Research and DP in EU member-states

None approved post-GDPR on research.*

Pre-2018 examples like Dutch "Code of Conduct for the Use of Personal Data in Scientific Research"

*Post-2018 examples exist, like Spain's "Code of Best Practices on Data Protection for Big Data Projects", but that's not focussed on research

Research on CoCs & Research

CoCs weren't successful under Data Protection Directive.

But hope is GDPR has addressed concerns & has added incentives.

Research on CoCs & Research

Genomics, Language, Bio-banks, etc.

Benefits of CoCs include harmonization, increase legal certainty due to specificity.

Research on CoCs & Research

Pessimism:
(Koscik & Myska)
"It is difficult to find an institution that would have the mandate to speak for a research community" (ALLEA, EUA?)

Research on CoCs & Research

Pessimism:

"We presume that the adoption of a Europe-wide code of conduct for data protection in research is very unlikely."

Research on CoCs & Research

Pessimism:

"Each research discipline uses specific methods and many scientific disciplines do not need to process personal data at all."

Research on CoCs & Research

However:

"… likely that individual codes of conduct will be adopted for some narrow research fields and specific research-related activities such as biobanking, genomic research, social networks research, and sociological surveys."

Trade-off between width of applicability of CoC and depth of guidance.

Most CoCs & guidelines on research don't deal with data protection in depth, with some exceptions like EDPS's "Preliminary Opinion" and EFAMRO & ESOMAR’s "Guidance Note for the Research Sector".

No extant CoCs under Art. 40

Most CoC-related issues raised by Critical Analysis can't be addressed by non-Art. 40 CoCs

There already exist >130 EU-funded RRI projects

(including at least 19 on RRI & ethics, and many guidelines, good practice documents, frameworks, etc.)

There already exist >84 documents on AI and Ethics

(including at least 19 from the EU region)

CCDP is not meant to be a CoC under Article 40 of the GDPR

There are few CoCs on data protection in research, but the PANELFIT Guidelines on Data Protection Ethical and Legal Issues in ICT Research and Innovation already provide extensive guidance on this issue.

 The CCDP needed to be distinguished both from existing EC-funded CoCs on RRI, as well as the PANELFIT Guidelines themselves.

There's a trade-off between being applicable to all forms of research and providing specific guidance.

Limited to covering:

• broad data protection principles

(Articles 5, 6, 9, 10, 38, 89 + Recitals 26, 33, 51–56, 159)

• good practices

• keeping in mind researchers' needs

Not meant to be a substitute for

"Guidelines on Data Protection, Ethical and Legal Issues in ICT Research and Innovation"

"Critical Analysis of the ICT Data Protection Regulatory Framework"

Any sector-specific CoC

Preamble

Aim, scope, and need for CCDP for responsible research & innovation

Data Protection Principles

Lawfulness, fairness, transparency

Data Protection Principles

Purpose limitation

Data Protection Principles

Data minimization

Data Protection Principles

Accuracy

Data Protection Principles

Storage limitation

Data Protection Principles

Integrity and confidentiality

Data Protection Principles

Accountability

Good Practices

Anonymization, pseudonymization and encryption

Anonymization: not "personal" data anymore

Pseudonymization: data minimization + confidentiality

Encryption: confidentiality

Good Practices

Aggregate and coarse data

Aggregate data: Multiple people's data together

Coarse data: Non-specific data (e.g., age range, instead of birthdate)

Good Practices

Multiple grounds for processing

What happens when multiple grounds are used for processing, and one of the grounds is removed (e.g., consent is revoked)?

Good Practices

Consent in data protection and in ethics

Keep consent for data protection separate from consent as human research participant

Good Practices

Legitimacy, fairness, and ethics approvals

Ethical data collection and use is important, so don't collect/use data in a manner that an ethics board would disapprove.

Good Practices

Data protection authorities and ethics boards

Good Practices

Data protection guidelines, DPIA, and DPOs

Annexure 1

Key resources