In light of the new EU General Data Protection Regulation (GDPR) [1] there are certain challenges in relation to the sharing of scientific data. For a data controller in a research institute, the requirement to monitor, implement and demonstrate conformance to the provisions of data subjects' rights represents a major upshift in the complexity of research data management. We are trying to address the issues by analysing the details of data subject rights in GDPR followed by extending existing linked open data vocabularies. We are proposing a concept of machine- readable data protection rights contract through introducing Data Protection Rights Language (DPRL).
Research in Europe that involves data from individuals is impacted by dual challenges of GDPR and increasing demands from research funders and publishers to adopt open data practices that facilitate replicability of results and bolster research integrity. Research involving individuals could include survey data, personal behaviour observation, recording of communicative acts (e.g. for social media, speech or gesture analysis) or bio data.
Current rules and practices on academic research ethics tend to vary from country to
country [
Researchers may have to make an undertaking regarding data protection, but there is rarely any follow-up to ascertain whether the data has been stored or destroyed as promised. Overall, the focus of institutional research ethics guidelines has been on obtaining informed consent from experimental subject rather than the later monitoring and enforcing of experimental data handling as consistent with the terms under which that consent is provided.
The EU’s adoption of GDPR imposes new requirements for tracking informed consent
for the usage of any form of personal data. GDPR addresses the processing and
movement of personal data, replacing the 1995 Data Protection Directive. It defines personal
data as “information relating to an identified or identifiable natural person”, who it
refers to as a data subject (Art. 4). When applied to research data, GDPR potentially
imposes more rigorous and legally enforceable requirements on the collection and
processing of data from individuals than current research ethics practices. There is a strong
requirement on data controller, who is responsible for handling of personal data, to be
able to demonstrate to regulators that any data subject’s personal data has been correctly
processed, being consistent with the GDPR and the terms of the informed consent under
which the data was obtained. This includes the sharing and use of personal data by third
parties. GDPR potentially imposes regulatory requirements of tracking data usage that
are similar to the rights offered to experimental subjects via informed consent, but that
are rarely enforced in practice. Art. 89(2) of GDPR provides for derogations of data
subject rights to access, rectify, erase, restrict, port or object to data processing,
provided appropriate safeguards are in place. Significantly, the precise nature of the
safeguards for any derogation are left for EU member states to legislate on [
Determining strategies to address this risk is potentially further magnified by the
requirement for open access to research data. Publication of the results of publicly funded
research has become common practice in recent years. However, the central importance
of data in all empirical research, in addition to the growth of big data research
approaches, has heightened the call for common policies on publishing and sharing
research data associated with a publication [
It is anticipated that from 2018 onwards, EC-funded projects will transition from
optional involvement in open data pilots to working under a stronger obligation to
provide open access to research data. This however needs to be within the constraints of
EU and national data regulations, which by that time will include GDPR. However,
when sharing research data openly, techniques of pseudo-anonymisation may prove
inadequate for protecting data subject identity if the third-party organisation receiving
the data attempts to combine the data with other data sources and potentially
de-anonymise it. Important classes of experimental data in computer science and bio sciences
(both at the forefront of scientific data sharing) have been shown as vulnerable to
deanonymization by third parties, including linguistic data [
The implication of this conflict between data protection and open scientific data requirement is that research institutes can no longer freely share research data containing any personal data. They must restrict sharing to third parties that make an undertaking: to ensure shared data is only used for the purposes agreed with data subject; to ensure cooperation in respecting data subject rights even after the data is shared; and to cooperate in any data protection compliance checks by the originating research institute. The legal basis for such inter-institutional undertakings, e.g. as a research data sharing contract, is out of scope of this paper, and ideally a subject for near term cooperation between national and EU-level scientific policy bodies. Instead, this paper addresses the data interoperability challenges involved in administering such data sharing contracts and supporting GRPR compliance. It proposes a machine-readable data protection rights contract that extends existing linked open data vocabularies and thereby aligns well with the existing directions of common technical interfaces and open data vocabularies for implementing open data science repositories. The paper starts by providing more details on the rights of data subjects that may be propagated between research institution sharing personal data about that subject. We then identify existing data management vocabularies that may form a suitable basis for large scale dataset cataloguing, sharing and data protection compliance checking. 3
One of the issues that will affect all the organisations in all industrial and academic
research is related to data subject rights. Although some rights presented in GDPR are
already familiar from earlier documents and number of comparisons have been made
[
The right to information states that there is an obligation on all data controllers to provide sufficient amount of information to the data subjects “in a concise, transparent, intelligible and easily accessible form, using clear and plain language” (Art. 12(1)). Data subject have the right of subject access - right to file a subject access request (SAR) and obtain a copy of their personal data from the data controller (Art. 15(1)). The right to rectification, as in previous regulations, gives data subjects rights to rectify their data in case of a need (Art. 16). Subjects have right to completely remove or erase their data in case the data is no longer needed for its original purpose, known as the right to erasure (the “right to be forgotten”) (Art. 17(1a)). Also, if the data access was given based on consent, and the data subject removes that consent, the data must be removed as well (Art. 17(1b)). It is up to every organisation to ensure they have facilities to truly and irreversibly remove the data (Art. (17(2)). GDPR also enables data subjects to get a copy of their data in machine-readable format and to transfer/port such data to another service provider, known as the right to data portability (Art. 20(1)). Data subjects have the right to restrict access to the data and right to object to any aspect of processing their personal data in relation to their legal rights (Art. 21(1)). Further, data controller must prove and demonstrate that the data processing falls within the previous agreements, and failing to do so, must stop all the data processing activities, including data used in scientific research and statistical purposes (Art. 21(6)).
For a data controller in a research institute, the requirement to monitor, implement and demonstrate conformance to the provisions of these data subjects’ rights represents a major upshift in the complexity of research data management. Whereas implementing the right to withdraw from studies granted to experimental subjects in conventional research ethics is typically left as a responsibility of the individual researcher or their school or department, under GDPR this becomes an institutional responsibility under a named data controller. From a data management perspective, this imposes new requirement to scale the cataloguing of datasets and the tracking of their use, particularly the provenance of data processing that leads to published results. This requires sophisticated data management and well-structured metadata schema for data sets. Further, as GDPR rights and the requirement to demonstrate compliance propagate to third party organisations in receipt of shared dataset containing personal data, bespoke or proprietary data management solutions will be inadequate, and solution based on interoperable meta-data will be required. Fortunately, open data vocabularies for managing the cataloguing, provenance, permission and obligations exist that may be applicable to this task as we examine in the next section. 4
ODRL [
DataID [
ODRL is very well suited to be used as a base for our further investigation into the
subject. It handles permissions, prohibitions, obligations and assertions. It also has
profiles support, enhancing the ODRL mode, enabling us to implement our own
requirements “whilst providing a common semantic layer for interoperability” [
The suggested approach is to use ODRL’s templating facility to extend it through specific case template that will better be suited to GDPR document. Therefore, Data Protection rights Language (DPRL) is an extension to ODRL, by the means of templating.
We will focus on data subject rights mentioned earlier, to have the ODRL mapping put in context. It is worth mentioning that there are some technological obstacles in following the criteria set by GDPR, as there might be ambiguity in some articles. For example, in Art. 20 it is mentioned that the data should be “portable”, but there is no common approach in the community at large when defining the format it should be in, as well as incompatibility of organisational systems between such providers. But the focus of this paper is not to define the techniques, but rather to establish simple workflow to follow the data from one data controller to another.
Common ground for all the mentioned data subject rights in GDPR are that the data
subjects are entitled to view, edit, withdraw, delete, move their data, to complain about
the procedures, to be informed about any changes in conditions and similar. When it
comes to data subjects, that translates to following ODRL concepts: copy, delete, read,
give, modify, preview, grantUse, reviewPolicy, transfer. For data controllers, relevant
ODRL concepts are: anonymize, archive, attribute, copy, digitize, display, grants,
inform, present. GDPR protects the rights of data subjects and set rules and obligations
for data controllers. Data subject’s role would mostly have certain “rights”. In
specialising ODRL for data protection, data controller’s role would be more related to certain
“duties” or “obligations”. It is important to identify the applicable rights and obligations
in common scenarios and as a part of this process in order for the data to be legally
compliant [
Furthermore and for our data subject’s rights usecase, we suggest adding the following concepts: dpAccess, dpRectify, dpErase, dpPort, dpRestrict, dpObject. Similarly as, for example, ODRL concepts derive and digitize are more specific terms of broader term use, the suggested concepts have their respective broader terms that are present in ODRL. Main reason for more specific concepts is to more clearly define certain scenarios that concern rights and where current ODRL model is not sufficient. Notice that all of the concepts pertain to data subjects. The suggested namespace would be dprl. 5.2
Proposed DPRL language/ontology would extend ODRL through its templating system, but would also extend some concepts from DataID that relate to the data usage and sharing tracking needed for data protection compliance under GDPR.
DataID has classes Dataset, DatasetRelationship and Distribution, that can be used in tracking the usage and sharing of data sets. Dataset and Distribution are subclasses of the similarly names classes in the DCAT vocabulary, and the Entity class of the PROV-O vocabulary, thereby integrating the fine-grained provenance tracking enabled by the latter vocabulary with the cataloguing metadata of the former. The Distribution class is a sharable form of the Dataset class and includes a license property (with machine-readable ODRL declaration). Based on that, there are some obvious advantages of bringing DataID into the mix to further explain and strengthen certain aspects of ODRL that are not ideal for describing and assigning datasets and their distributions. Distinguishing datasets and distributions also tackles the issue of data being in format that is machine-readable and portable (GDPR requirement), while the integration with PROV-O supports the tracking of informed consent, data sharing and data subject rights processing that must be logged to serve potential GDPR compliance checks. DUV would keep track of the usage through Usage class, again as per GDPR requirements. 5.3
Currently there is no established method commonly used between the academic institutions when sharing scientific data. Furthermore, data portability clause requires that the data subject can access their data in common machine-readable format. GDPR requires not only the provenance tracking of data processing to support compliance with serving data subject rights, but that this tracking extends to the data controller of any other organisation with which the data is shared.
Data sharing architrave that we propose in this paper potentially addresses all the challenges, pending future work’s improvements. Combining the knowledge on data subject rights, data controller’s obligations and by means of extending the existing ontologies, we summarise the concept in the following figure. In this paper, we identify the potential challenges faced by research institutes using personal data from EU citizens in research studies amid the conflicting requirements of open scientific data policies and GDPR. We describe an initial design for a Data Protection Rights Language (DPRL), as a modest extension to the DCAT and ODRL vocabularies already assembled into the dataset management metadata schema DataID. DPRL aims to support the use of DataID to manage the sharing scientific datasets with support of a machine-readable contracts expressing the permissions and obligations the parties exchange, to satisfy both data sharing and data protection concerns. We hope the development of such an open data vocabulary may be useful in deliberations around the cost and complexity of handling these challenges by European science policy fora and EU member states in considering GDPR derogation under Art. 89(2). It may also promote vendor independence in the procurement of systems for managing the cataloguing, sharing and data protection compliance of scientific data, and provide a basis for agreeing data sharing interactions with collaborators, such as commercial companies, that are not covered by GDPR Art. 89(2) derogations.
In future work, we plan to further develop DPRL through fuller integration with
data set processing provenance tracking using PROV-O and the use of SPARQL over
DPRL and other DataID components in undertaking GDPR compliance checks. We
will try to highlight how to share linked data itself through Linked Data Rights ontology
[