d1.6 open research data management plan

1

Project no. 732027

VIRT-EU

Values and ethics in Innovation for Responsible Technology in EUrope

Horizon 2020

ICT-35-2016

Enabling responsible ICT-related research and innovationStart date: 1 January 2017 – Duration: 36 months

D1.6OpenResearchDataManagementPlan

Due date: 30 April 2017

Revision submission date: 10 April 2019 Number of pages: 27

Lead beneficiary: ITU Author(s): all partners

2

Project Consortium

Beneficiary no. Beneficiary name Short name 1 (Coordinator) IT University of Copenhagen ITU 2 London School of Economics LSE 3 Uppsala Universitet UU 4 Politecnico Di Torino POLITO 5 Copenhagen Institute of Interaction Design CIID 6 Open Rights Group ORG

Dissemination Level

PU Public X CO Confidential, only for members of the consortium (including the Commission

Services)

EU-RES Classified Information: RESTREINT UE (Commission Decision 2005/444/EC) EU-CON Classified Information: CONFIDENTIEL UE (Commission Decision

2005/444/EC)

EU-SEC Classified Information: SECRET UE (Commission Decision 2005/444/EC)

Dissemination Type

R Document, report DEM Demonstrator, pilot, prototype DEC Websites, patent filling, videos, etc. O Other ETHICS Ethics requirement X

3

ContentsExecutiveSummary..........................................................................................................................................................................4

EthicalConsiderations–datatypesandtheirvulnerabilities.......................................................................................6

DataSharingandAnalysiswithinVIRT-EU...........................................................................................................................7

GDPRConsiderations.......................................................................................................................................................................8

Table1:Legalgroundfordifferentdatacollectionactivities...................................................................................8

QuantitativeDataManagement...............................................................................................................................................10

Datacollectionactivities........................................................................................................................................................11

Table2.QuantitativeDataCollectionActivitiesoverview......................................................................................12

Datastorageapproaches........................................................................................................................................................12

Dataprocessingactivities......................................................................................................................................................13

Table3.ExpectedVIRT-EUdataprocessinginformation........................................................................................13

QualitativeDataManagement...................................................................................................................................................13

Datacollectionactivitiesandoralconsent.....................................................................................................................14

GDPRconsiderationsfororalconsent..............................................................................................................................15

Writtenconsent..........................................................................................................................................................................16


DataProcessingActivities.....................................................................................................................................................17

DesignResearchDataManagement.......................................................................................................................................17

Datacollectionactivitiesandconsent..............................................................................................................................17


Dataprocessingactivities......................................................................................................................................................18

OpenResearchDataRequirements........................................................................................................................................18

ITUResearchEthicsCommitteeStatement........................................................................................................................20

Appendix1:ResearchInformationSheet............................................................................................................................21

Appendix2:ConsentForm.........................................................................................................................................................22

Appendix3:Additiontoconsentform..................................................................................................................................23

Appendix4:Partner-specificconsentforms……………………………………………………………………………………..24

4

ExecutiveSummaryThisdocumentisarevisionoftheDeliverable1.6(submittedon28April2017).Thisdeliverablehasbeen reviewed to describe the procedures adopted to comply with the Regulation (EU) 2016/679,whichisapplicablesinceMay25. Universitiescarryoutprocessingoperationsthatareoften(like inourcase)strictlyrelatedtospecificandtemporaryprojectsandhavealimitedlegalstaffandDPOstaffthat should cover a variety of research initiatives being also compliant with administrative lawrequirements, in terms of internal procedures and due administrative process. Against thisbackground, the different obligations imposed by the GDPR (e.g. records of processing activities,exerciseofdatasubject’srights,assessmentoperations)concerncontrollers(i.e.theuniversity).We,asresearchers, are persons “acting under the authority of the controller or of the processor” (Art. 29GDPR) and, according to our role and the existing administrative and GDPR framework, we cannotdirectlyassumeanydeliberationonbehalfofourinstitutions,sincewedonothaveanypowerethertolegallyrepresentthemortoassumedecisionsonbehalfof thedatacontrollerespeciallywithoutanypreviousdecisionsadoptedbythedesignatedbodies.Assuch,thetextpresentedinthisdeliverableisas complete as it can be prior to the relevant administrative units completing their review andfinalizingthenecessaryagreements.

TheVIRT-EUOpenResearchDataManagementPlan(DMP)outlineshowresearchdatawillbehandledduring andafter theprojectduration. It describeswhat typesofdatawill be collected,processedorgeneratedwithwhichmethodologies and standards,whether and how these datawill be shared ormade open, and how these data will be curated and preserved. The DMP describes the datamanagement lifecycleforalldatasets.ThepurposeoftheDMPistoprovideananalysisofthemainelementsofthedatamanagementpolicythatwillbeusedinVIRT-EUwithregardtoalldatasetsthatwillbegeneratedbytheproject.TheDMPwillberegularlyrevisitedandupdatedifnecessarytoensureconsistencyandcomplianceofprojectdatapractices.TheDMPisestablishedbytheCoordinatorwithcontributionsfromallpartnersinvolvedindatacollection,processingandmanagementandagreedonbytheparticipants inordertodetailexplicitlyandformallyalldatamanagementaspects.VIRT-EUiscommittedtoensuringcompliancewiththeEUGDPR,theDataProtectionActandtheNationalcodesofconductsuchas,forexample,theDanishCodeofConductforResearchIntegrity1.For the purposes of this project, personal data of natural persons different from the people directlyinvolvedintheproject(i.e.researchers,administrativeteam,andtechnicalstaff)areprocessedbyLSE,ITU,UU,ORGandCIIDonly.Data areprocessedby eachpartner autonomously and theyact asdatacontrollers with regard to the processing activities described below. All partners that act as datacontrollershaveadoptedappropriatedataprotectionpoliciesconcerningdataprocessedforresearchpurposes (see below) and data are processed for the purposes of the VIRT-EU project according tothesepolicies.

1DanishCodeofConductforResearchIntegrity(2014):http://ufm.dk/publikationer/2014/the-danish-code-of-conduct-for-research-integrity2SharingcollectedTwitterdata–evenifpublic–isnotallowedbyTwitterTOS.NeverthelessitispossibletosharealistofTweetIDsthatcanbeusedbyotherresearcherstore-collectthesamedatasetoftweetsandverifytheresults.Thisensures

5

The partners, in their role of controllers, adopt all the measures necessary to comply with theobligations of the Regulation (EU) 2016/679 (e.g. records of processing activities, data protectionimpactassessment,etc.)withinthecontextofalloftheirresearchactivities.

Inorder to facilitateappropriatedatamanagement, storageandprocessingactivitiesandensure thehighest level of scientific output, the VIRT-EU partners are in the process of negotiating a joint-controlleragreementfacilitatedbytheDPOsateachinstitution.

ThepurposeoftheempiricalcomponentsofVIRT-EUresearchactivitiesis:First,toachieveobjective1oftheproject:

Empiricallyidentifyhowlocalcultureandnetworksocietyinfluencetheunderstanding

and movement of particular social values among technology developers and how localdifference and networked commonalities can influence the development of ethical subjectsfromavirtueethicsperspective,usingdatamining,socialnetworkanalysis(SNA),qualitativeinquiryanddesignmethods.

Second,empiricaldatacollectionandanalysisare intended to lay thegroundwork foraccomplishingobjectives2and3ofVIRT-EU:

DevelopaPrivacy, Ethical andSocial ImpactAssessment (PESIA) framework shapedbystate of the art legal research and empirical data, to enable developers and other societalstakeholders to reflect upon, evaluate and take into account not only the data protection,security and privacy aspects of new technologies but also the ethical and social concernsembeddedwithinthatchallengeautonomyandfreedom.

Systematically consider and implement the PESIA framework by co-designing self-

assessmenttoolswithtechnologydevelopers,whomaynotbeabletoanticipatethefutureuse of their projects and their clients andpartners, grounded in existingdeveloper practicesandbasedonquantitative,casestudyanddesignresearchthatidentifieshowethicsoperateasprocess.

Toachievethesethreecoreobjectivesoftheproject,VIRT-EUrequiresthecollectionofthreedifferenttypesofdata.Firstisquantitativedataaboutdevelopers,collectedfromonlinesocialmediaanddigitalrepositories,thesecondisqualitativedatacollectedthroughthevariousfieldsitesandthethirdisdatacollectedinthecourseofco-designworkshopsandstakeholderworkshopsaswellasduringthefinalDesignChallenge. These data collection practices involve the collection of personal information, andrequire careful handling for storage and processing as well as decision-making with respect topreparing these data for participation in the EU Open Research Data Pilot program. The differentnature of these data requires different data collection and handling protocols. All approved datacollection and handling protocols will follow the general guidelines at both national and EU level(http://ec.europa.eu/justice/data-protection).Novulnerablepopulationwillbe involvedinourstudyand the data will represent no more than minimal risks to participants beyond what is normallyentailedintheparticipationindevelopercommunicationandcollaborationeventsandnetworks.Therisksanddiscomfortsentailedbyparticipationinthisstudyareminimal,asdetailedinthecorepartsof

6

theDMP.Datacollectionconsistsofparticipantobservationonlineandoffline,interviews,collectionofpubliclyavailableonlinedatafromonlineforumsandsocialnetworks,anonymoussurveys,co-designandstakeholderworkshops,demonstrationsandexhibits.Participantsmaywithdrawfromthestudyatanypoint.All requests fordatadeletionor redactionwillbe immediatelyhonored to thebestofourability.The IT University of Copenhagen Research Ethics committee has committed to evaluating andapprovingtheVIRT-EUpersonaldatamanagementplanpriortosubmissionoftheofficialdeliverableto the EU and should major changes become necessary. Further, the VIRT-EU consortium includesAssociate Professor Rachel Douglas-Joneswho is an expert in research ethics as this is her primaryarea of research. She will conduct research ethics oversight for all data collection activities,developmentof informationand consent forms, requirements for thehandlingof consent formsanddataandsafecustodyofresearchoutcomes.Finally,projectmembersJavierRuiz(ORG)andAssociateProfessorAlessandroMantelero(POLITO)areexpertsintherelevantEuropeanlegislationasitappliestodataprotectionlaw.TheywillhelpusensurecompliancewiththeRegulation(EU)2016/679.TheVIRT-EUOpenResearchDataManagementPlanprovidesinformationaboutthefollowingpointsindetailforeachofthethreedifferenttypesofdatacollection(quantitative,qualitativeanddesign):

• Datacollectionactivities(includingselectionoflegalgroundandapproachestomanagingconsent)

• Datastorageapproaches• Dataprocessingactivities

TheDMPgivesafirstoverviewonthediversity,scaleandamountofdata,whichwillbehandledduringtheVIRT-EUproject.Further,thisdocumentincludesabriefdiscussionofresearchethicsasitpertainstoVIRT-EUdatamanagementactivities.Finally,we includea section thatdetails requirements tobefulfilledfordatasetstobedeterminedassharablethroughtheopenresearchdatapilotprogram.TheDMP is not a fixed document, but evolves during the lifespan of the project. This is the seconditeration of the DMP developed to address project reviewer commentary and suggestions. Asinstitutional-levelagreementscanoftentakeasignificantamountoftime,especiallygiventheverynewand evolving set of institutional practiceswith respect to GDPR compliance, this DMP still does notincludethefinalizedjointcontrolleragreement.However,thisDMPrepresentstheparticularsthatwillbeincludedintosaidagreement.

EthicalConsiderations–datatypesandtheirvulnerabilities

Data management is an ethical issue. The types of data collected here carry differentvulnerabilities, as the sections below indicate: some are more easily linked to personallyidentifyinginformationthanothers.BydividingtheDMPaccordingtodatatype,weacknowledgeandaddressthisethicaldimensionofdatamanagement.However,therearealsodifferentethical

7

issues at the different stages of research, from collection to processing and storage. The DMPaddresseskeyethicalissuescommontotheprojectasawholebutwehavetailoredtheseissuestobeappropriateand relevant toeach typeofdata collected.Working from the recommendationscombined from the Danish Code of Conduct for Research Integrity and the research ethicsguidelines of ourmultiple professional organisations,wehave integrated ethical considerationsintoourplan forhowdata in thisprojectwillbecollected,processedandstored.These includeconsiderationofwhenandwhereconsentprocessestakeplace,howdataisanonymizedandwhathappenstore-identificationkeys,thetechnicalitiesofstorageofdataovertime,howdatawillbeshared within and beyond the project, and takes into consideration the representation ofparticipantsatthepointofpublication.

Participants inVIRT-EUdatacollectionanprocessingactivitiesarenotdefinitionallyvulnerable:theyarenotdependentonVIRT-EUresearchers,theydonotlackdecision-makingcapacitynordotheylackanabilitytoprotecttheirowninterests;theyarenothistoricallyvulnerableongroundsof inequality or exclusion, nor vulnerable to coercion or undue influence. Through the consentprocedures, recommendedbyprofessionalorganizationsand followedwithinVIRT-EU, theyareprovidedwiththeopportunitytoautonomouslydecide,withoutcoercionandwiththeoptiontowithdraw,thattheywishtoparticipateintheproject.However,researchersintheprojectwillbeattentive during data collection to the potential for vulnerabilities to arise due to participantsengagementwiththeresearchprojectitself,giventhenetworkedprofessionalnatureofthefieldintowhichwe intervene,and thepotentialpowerasymmetries thatmaycome toexistbetweenresearchersandparticipants.TheseriskswillbeminimizedbyVIRT-EU’sanonymizationpracticesandreflexivepublicationstrategies,asmentionedbelow.

DataSharingandAnalysiswithinVIRT-EU

VIRT-EUisaresearchprojectwithinter-connectedworkpackagesandresearchersworkingwithinandacross institutions. This raises a challenge for generating an efficacious work environment forresearchers,withoutundulyburdensomeorrestrictiveblocksonmutualwork.VIRT-EUaddressesthischallengethroughacarefuluseofuniversity,commercialandopensourceinfrastructuresavailabletotheprojectmembers.Ourquantitativedatawillbesecurelystoredonuniversity-managedservers inSweden, allowing all relevant consortium members controlled and limited access to the data via asecure web interface detailed below. Unprocessed social media data listed below are shared onlybetween ITU andUU, by granting to the projectmembers operating at ITU controlled access to thesecureserversfromUU.

Unprocessed observational and interview data are not shared among the research partners. Ourqualitativeanddesigndatawillbestored insecure folderson theserverscontrolledby therelevantpartnerwho is in chargeof collectingdata. Collaborative coding anddata analysis toolswill onlybeused on de-identified field notes and transcripts. The de-identification of these data subjects is theresponsibilityoftherelevantdatacontrollerwiththecollaboratingpartnerssettingrequirementsforthetypeofdatatheyneedfortheirscientificactivities.Accesstophysicalartifactsproducedthroughco-designwill bemanaged via digital images stored in shared folders on an encrypted cloud server,

8

ensuring appropriate levels of pseudonymization in place. All participant lists will be stored by therelevantdatacontrollersandaccesswillbemadetocollaboratingpartnersinacontrolledfashion.NopersonaldataareincludedinthedeliverablesorinanyotherdocumentsmadepublicbytheVIRT-EUproject.

Theseinteractionswillbedrivenbytherequirementsoftheprojectandgovernedbythetermssetoutin the joint controller agreement. Consortium partners are separately responsible for observing theprinciples for processing of personal data, to the extent that the regulations apply to theresponsibilities of the party concerned, pursuant to the joint-controller agreement currently undernegotiation.

GDPRConsiderations

LegalgroundfordatacollectionTheVIRT-EUprojectrequiresheterogeneousdatacollectionmechanismsandthusdifferentlegalgroundforensuringethicalconduct.SeeTable1fordetails.

Formofdatacollection Legalground Othercomments

Qualitativeethnographicparticipantobservationandinformalinteraction

Oralconsent

Althoughtheethnographicresearchisperformedbyuniversityresearchers,therequirementsofresearchethicsmandateensuringconsentforparticipation.FollowingthebestpracticesinresearchethicsassetoutbyprofessionalsocietiessuchasAmericanAnthropologicalAssociation(US)andtheAssociationofSocialAnthropology(UK),oralconsentisrecordedinresearcherfieldnotes

Qualitativeformalinterviews,designandstakeholderworkshops,Designchallengeparticipation

Writtenconsent Consentformsaresecurelystoredbytheresponsiblepartnerconductingdatacollection

AutomatedTwitterandMeetUpdatacollectionbasedonhashtagsandobservationofTwitterandMeetUpactivityonthetopicofIoT

Publicinterest

ThesedataarecollectedandprocessedonlybypublicuniversitiesandnotSMEandnon-profitpartners.However,significanteffortwillbemadetoensuredataminimizationandprovidingfacilitiesfordatasubjectstorequestdatadeletion

Table1:Legalgroundfordifferentdatacollectionactivities

Thecollectionofqualitativedatabyourethnographersentailsbothwrittenandoralconsent(foramorespecificdiscussionoforalconsentseesectiononQualitativeResearchbelow).Oralconsentisregisteredbytheresearcherintheirfieldnotes.Thismakesitpossiblefortheresearcherinquestiontocomplywithanylaterdatadeletionrequestsfromthedatasubject.

Thecollectionofqualitativedatainallotherresearchengagementssuchas:formalinterviews,co-designandstakeholderworkshops,demonstrationsandexhibitsaswellasduringthedesignchallengewillbeconductedwithexplicitwrittenconsent.

9

Onlinedatacollectedbytheprojectdoesnotrelyonconsentasalegalbasis,butontheperformanceofataskinthepublicinterest:scientificresearchinpubliclyfundedinstitutions.Wewillhowever,complywiththeinformationrequirements,wheneverpossible.InformationtransparencyTheVIRT-EUprojectmakes studygoalsanddatamanagement informationprominentlyavailableontheprojectwebsite.Thisensuresthatallparticipantsintheprojectresearchactivitiesaswellasthoseconcernedorinterestedinoureffortscangaindetailedinformationatanytime.

Data subjects whose information is directly collected by consortium members are provided withinformation in accordance with Article 13 of GDPR, using information that is similar to the onlineresourcebutusingprintedouthardcopies.

PurposespecificationWeexplaintoourresearchsubjectsintheinformationsheetthatthemainpurposeoftheprocessingisscientific research but we will also need to communicate with them and comply with legalrequirements.

Inthisplanandourinformationsheetweprovideasmuchdetailaspossibleaboutpurposeswithinthelimitationsinherentinresearch.Asexplainedinrecital33ofGDPR:“It is often not possible to fully identify the purpose of personal data processing for scientific researchpurposesatthetimeofdatacollection.2Therefore,datasubjectsshouldbeallowedtogivetheirconsenttocertain areas of scientific research when in keeping with recognised ethical standards for scientificresearch.3Data subjects should have the opportunity to give their consent only to certain areas ofresearchorpartsofresearchprojectstotheextentallowedbytheintendedpurpose.”

DataminimizationAs explained throughout this documentwe apply dataminimization principles at every stage of theresearch.

ResearchexemptioninGDPRTheimplementationoftheresearchexemptionacrosstheEUisbeingdevelopedatthetimeofwriting,andweareintheprocessofconsultingwithourrespectiveinstitutionshowtobestimplementnationallegislation.Asamatterofprinciplewehaveagreedtocomplywithanyrequestsforaccess,rectificationorerasure,independentlyofthelegalrightsofthesubjectinthecountry.

FulfillingobligationstotheDataSubjectsConsortium members are responsible for ensuring the rights of the Data Subject through carefulobservation of the General Data Protection Regulation rules. Moreover, as data controllers, allconsortiummembersareresponsibleforassistingeachother,totheextentthatthisisdeemedrelevantandnecessary,inorderforallpartiestobeabletoobservetheobligationsrequiredinrelationtotheDataSubjects.

10

QuantitativeDataManagement

Thedigitaldatasourcesareaselectionofonlinesocialmediafromwhichwewillextractinformationabout: which event individuals and groups under analysis attend – MeetUp data – and how theycommunicateaboutIoTrelatedtopics–Twitter.ThusVIRT-EUdatacollectionwillmainlytakeplaceonsocial media platforms that are used within a public and professional context. Platforms such asMeetUP andTwitter, are usually perceived as public spaceswhere public visibility is often not onlyexpectedbutactivelysought.Despitethegeneralperceptionofthesedigitalplatformsaspublicspaces,VIRT-EUdatacollectionwillactivelypursuedataminimizationbynotcollectingadditionalinformationbeside publicly available usernames, lists of publicly displayed connections and publicly sharedcontent. Usernames, when belonging to companies, corporate, civil society or media actors (e.g.@ericssonor@wired),will be retainedas is.Usernames,whenbelonging to identifiable individuals,willnotbeused inanypublic communication (e.g. socialmediaposts, articles,publicpresentations)withoutexplicitconsent.Existingtoolstocollectonlinedata(includingtheonewehavere-engineeredand integratedwith our system)make it difficult to strictly enforce the principles contained in theGDPR.Inparticular,thetoolsactasblackboxesanddonotprovidethepossibilityofcustomizingthedatacollectionprocesswithoutmodifyingtheircode,butonlyprovidethecollecteddataasoutput.Asaconsequence,pseudo-anonymizationofthedataisperformedassoonastechnicallypossible:afterthedatacollectionprocessisterminated.Thisisaconcerndespitethefactthatthecollecteddataisfrompublicsourcesandispassword-protectedduringstorageatalltimes(followingtheresultsofaPrivacyImpactassessmentanalysiswehavenot identifiedanysignificantrisks in temporarilystoringpublicdatainsideapassword-protecteddatabase).

To address this concern, we devoted some project resources to design a prototype tool for datacollectionfromsocialmedia,wherethedatacanbepseudo-anonymisedatcollectiontimeandasettingis added so that a notice can be automatically sent to the user accounts present in the data.UnfortunatelyourefforttoautomaticallyinformtheusersoftheirdatabeingcollectedwasstoppedbyTwitter itself, because such form of the automatic notification system was interpreted as aninfringementofitstermsofservices.

Even though we target publicly available data (e.g., MeetUp data, tweets) for our data collectionactivities,incaseofreleasingthesenetworks,orofaggregatedmultilayernetworks,aspartoftheOpenResearchDataPilotwewillremoveallreferencestotheidentityoftheindividualsreplacingtheuseridentifierswithrandomlygeneratedplaceholders.Incaseswheredatacollectionwilloccuronforumsand discussion spaces where login requirements can create an expectation of privacy, the researchteamwillannounceourpresenceand intentions to thecommunityon the forum, informthemaboutthe studyand follow the requirementsof the community inourdata collectionpractices.Due to thenature of the project, focusing mainly on developers and IoT companies, monitoring and trackingactivitieswill bebasedon specific keywordsor groups thatminimize the risk of accidentally collectdatafromvulnerablegroupsorminors.However,ifVIRT-EUresearcherscometoknowthatwehaveaccidentallycollectedsocialmediadatathatispotentiallyabletoidentifytheauthorasamemberofavulnerablegrouporaminor,thedatawillbeimmediatelyremovedfromtheproject’sdataarchive.Asitisoftenimpossibletoassessvulnerablegroupmembershipquantitatively,researcherswillperformrandomqualitativechecksonourdataperiodicallytoguardagainstsuchapossibility.

11

Forouralgorithmic studieswedonotneed to retain informationabout the sourceof eachnetwork,makingidentityidentificationpracticallyimpossible.Duringtheresearchphasesallprojectdatawillbesecurely stored inside our single handling sites at Uppsala University (in Sweden), where only theportion of the data required to perform the analysis of the networkwill be replicated in encryptedform.Even if theprojectwill collectpubliclyavailabledataemergent informationmightbeobtainedthankstothemultiplexnatureofthedatawearecollecting.Thereforewewillactaccordingtoaveryclear policy for accessing the full dataset: Access to the server will only be granted to researchersofficiallyinvolvedintheproject,orassociatedresearchers(e.g.,masterthesisstudents)aftersigninganon-disclosureagreement.Anonymisedversionsofspecificportionsofdatawillbemadeavailableforvalidation and re-use through theOpenAccess to ResearchData Pilotwhichwill be negotiated anddecidedbyconsortiummembers.

DatacollectionactivitiesThe quantitative digital data collection approved when this document is being finalized lists fourspecificdatasources:Twitter,MeetUp,ad-hocwebsites.Giventheexistingdiversity inavailabledataand in technological solutions it is required a platform-specific description of the data collectionprocedures.AnoverviewisprovidedinTable1.

Twitter:UsingbothRESTandSTREAMAPITwitterwillbequeriedinordertocollect:a)tweetsproducedusingapre-defined topicalhashtag (e.g.#iot,#iotdays)b) list of followers/following connectionsbetweenpubliclyavailablekeytwitterusersidentifiedduringtheethnographicphase.

MeetUp:Using the available public API we will collect attendance data of specific iot-related public events.Attendance data will then be used to construct an attendance networkwhere people attending thesameeventswillappeartobeconnected.

Throughout the project we are adopting a data minimization strategy by collecting only the datastrictlynecessarytoachievethegoalsoftheproject:

PlatformData

collectionDatatype Anonymized

Pseudo-anonymization

Explicituserauthorization

Information Shared

Twitter API Tweets NO YES NO NO NO2

Twitter API Followingnetworks NO YES NO NO NO

MeetUP API Attendance IFreleased YES NO NO YES

2SharingcollectedTwitterdata–evenifpublic–isnotallowedbyTwitterTOS.NeverthelessitispossibletosharealistofTweetIDsthatcanbeusedbyotherresearcherstore-collectthesamedatasetoftweetsandverifytheresults.Thisensuresreplicability,whichisoneofthecornerstonesofscientificpractice.

12

Table2.QuantitativeDataCollectionActivitiesoverview

Whilepreviousauthorizationfromuserswillnotbeobtained,beingatask inthepublic interest,andinformationhasproventobe impossible,wewillhoweverput inplaceasecurewebpagewheretheuserswillbeable tocheckwhat informationhasbeencollected (e.g.whatmessagesandwhatsetofconnections)andhe/shewillhavetheopportunitytowithdrawhis/herconsentandremovethedatafromthedataset.

DatastorageapproachesDatawillbestoredinpassword-protectedvirtualmachinesnotdirectlyaccessiblefromoutsideaVPNat Uppsala University. Both raw and curated relational data will be stored. In addition, a pool ofmonitoringsystemswillbedeployed.Thesystemswillbecontrolledthroughawebinterfacethatwillalso be used to inspect the database. Access to the web interface will be granted only to the datacontroller for Quantitative Data: Uppsala University and IT University of Copenhagen. Backups willhappenatvirtual-machinelevel.

A relational database will be used to store the curatedinformationextractedfromtherawdata.Everytimeanactorisidentifiedasrelevant,s/hewillbeinsertedinthedatabaseand annotated with properties and connections to otheractors.Theroleofthedatabaseistokeepahighdataquality,by avoiding duplicate information and simplifying theidentificationofmissinginformation.Aconceptualschemaofthedatabasewillbeprepared.Thedatawillbestoredforupto 12 months after the end of the project to ensurecompletion of the final analyses and publication and thendeleted.

WebinterfaceThe web interface, built with Django over a relationaldatabasemanagement system,will beusedmainly toallowallresearchersinvolvedintheprojecttoprovideinformation

aboutthedatatobeextractedinacontrolledwayandtogiveinformationaboutthedataalreadystoredinthesystem.Thissite will be password-protected. That is, all researchers in

theconsortiumareabletocontributeparticularrelevanthashtagstofocusTwitterdatacollection.Forexample, several researchershave recently initiatedaTwitterdata collectionactivityon thehashtag#FUD to address the emergent relevant discussions around a particular concept that the qualitativeresearchers have identified as relevant through a recent analysis of manifestos and other publicdocuments produced by the communities of practice under study. Further, qualitative researcherscontributeTwitterhandlesforparticularwellknownpublicfiguresintheIoTdevelopercommunitytohelpfocusdatacollection.Thedatacollectedinthisfashionallowsthequantitativeanalysistoproduceanoverviewof IoT-relatedactivity inEuropebyanalyzing follower, retweetandpublicconversationnetworkpatterns.

Figure1:Overviewofthedataflowanddataaccessforthequantitativedata.

13

DataretrievalprocessspecificationThe units responsible for the data collection are UU and ITU. All the parties will receive a processspecification describing the steps to submit new requests for data collection to the units atUppsalaUniversity and ITU Copenhagen. All interactions from partners other than Uppsala University willhappenthroughtheWebinterface.Whileaddingtothemonitoringsystemanewuseroranewhashtagisopentoallthememberoftheconsortium,theactualaccesstothecollecteddataisonlypossibletothe UU and ITU, while processed and pseudonymized data will be made available to the otherconsortiummembers.

DataprocessingactivitiesDifferenttypesofdigitaldatawillbeprocessedindifferentways.Tweetsobtainedfromhashtagdrivencollection will be processed in order to obtain communication networks (identifying patterns ofinteractionbetweenTwitterusers)andtopicanalysisinordertoidentifythemaintopicsoftheonlineconversations. MeetUp co-attendance data will be transformed into a bipartite network and thenprojectedontoanetworkshowingtheco-attendanceasarelationbetweenusers.NetworkdatafromTwitter, MeetUp, will be used to build a multilayer network model as described in the researchproposal. All the necessary details of data processing are provided in Table 3. The strike-throughformatting indicates the alterations to originally expected data collection activities that the projectpartnershavemadeinthecourseoftheprojectsofar.

Data Originalformat Processedformat Analysis

Tweets Text(.csv) Network(.graphml) CommunicationNetworks

Tweets Text(.csv) Annotatedtext(.csv) Topicidentification

Twitterfollowing Network(.csv) Network(.graphml) Clusteranalysis

MeetUp Attendance(.csv) Network(.graphml) Clusteranalysis

Multilayernetwork Network(.csv) Network(.mpx) Cluster&centralityanalysis

Table3.ExpectedVIRT-EUdataprocessinginformation

QualitativeDataManagementVIRT-EUwillanalyzeandmaptheethicalpracticesofEuropeanhardwareandsoftwareentrepreneurs,makerandhackerspaces,andcommunityinnovators.LeveragingstateoftheartcollaborativeSSHandICT methodological innovations, data collection tools will include data mining, quantitative andqualitative social science and design research practices. Specifically, data will be collected throughethnographicobservations,surveys,questionnaires,structuredand/orsemi-structuredinterviews,co-designandstakeholderworkshops,andaDesignChallengeactivity.

The VIRT-EU consortium is comprised of experienced anthropologists and ethnographers who willfollowtheethicalguidelinesoftheAnthropologicalAmericanAssociation(US)andtheAssociationofSocial Anthropology (UK) – considered the gold standard for ethical research practice in the field(wheretheseguidelinesdiverge,themorestringentwillbefollowed.)Consortiummembersinvolved

14

in this form of data collection are trained to address ethical issues reflectively throughout datacollectionandinthecourseofanalysis.

DatacollectionactivitiesandoralconsentFor our qualitative and ethnographic studies of online and offline communities of practice, we willcollect screenshots, audio/visual recordings, field notes and observations. We recognize that theseformsofdatacollectionmayidentify individuals.Keypillarsofethics inethnographicandqualitativestudiesarereflexivityandaccountability.Researchersatthevariousresearchsitesareresponsibleforidentifying and adhering to local community norms and practices about data and information. Anyrecordingof interviews, collectionofphotographicevidenceand the like,willbe conductedwith theexplicit consent of participants (see below). Participantswill be informed that they arewelcome torequestremovalanddestructionofanycollecteddataatanytime,andthatthepointofcontactistheprincipalinvestigatorattheuniversitywhoemploystheresearcherwhotheymeet.Informationabouttheresearchprojectwillbeprovidedinwrittenformandwill includethecontactinformationfortheprincipal investigator. We also provide details of the Data Protection Officer where applicable inaccordancewithArticle13ofGDPR.

Byagreeingtotakepartinthisstudyparticipantswillbecontributingtoresearchrelatedtoidentifyinghowlocalcultureandnetworksocietyinfluencetheunderstandingandmovementofparticularsocialvalues among technology developers, and how local difference and networked commonalities caninfluencethedevelopmentofethicalsubjectsfromavirtueethicsperspective.Thereislittleornorisk,inconvenienceordiscomforttothosewhoparticipateinthisstudy,assuredthroughtheextensiveuseof pseudonymization and anonymization in the research process and reporting. Participantswill beabletorequestthatanydatarelatingtotheirparticipationisdestroyedupuntilprojectcompletionoruntil the relevant data have been published in project reports and other output. A practice ofanonymizationorpseudonymization ispracticedbydefaultunlessa researchparticipant specificallyrequeststobe identified inresearchfindings.Thepracticeoforalconsentenablestheresearcherstoensurethatparticipantsarenotdirectly identifiedinthedatashouldtheyprefernottobeidentified.However, qualitative data is situational and complex and, as such, removal of all identifying data isimpossible.Inordertoensureconfidentialitythroughout,qualitativeresearcherswillstoredigitaldataonsecureencryptedhardwareandphysicalmaterialsunderlockandkey(seebelowfordetails).

The research team will anonymise all participants in the research, acknowledging that fullanonymisationisnotalwayspossiblewithinsmallcommunitiesofpractice,andrespectanyrequestsfor information to be left off the record. The qualitative researcherswill continually reflect on theirownroleinconstructingthenarrativeoftheirresearchsite,andacknowledgeanypowerdifferentialsthatmightresult.Resultsofqualitative fieldworkwillbecommunicatedbacktoparticipants throughco-designexercisesandstakeholdermeetingsthroughouttheprojectinWP3,WP5andduringthefinalDesignChallengeeventinWP6.

Throughout all qualitative fieldwork will be taking informed consent as a basic ethical tenet ofethnographicanddesignresearchpractice.However,theuseofthewrittenconsentformintheprocessofethnographicresearchiscounterproductive.Thuswewillprimarilyrelyoniterativeoralconsentininterviewing and participant observation, with provision of written information including contact

15

details of researchers who can be contacted with questions or in the event that the participantwithdraws consent to participate. Ethnography is a long-term engagementwith others, and the up-frontnatureofasigneddocumentmeansthatwhatisbeingconsentedtowillchangeovertime.AstheAssociation of Social Anthropology puts it, “Given the open-ended and often long-term nature offieldwork, ethical decision-making has to be undertaken repeatedly throughout the research and inresponsetospecificcircumstances”(ASA2011:2).Further,theuseofthewrittenconsentformrequiresparticipants to identify themselves in writing, while the use of oral consent allows participants toremainanonymousiftheysochoose.

Oral consent entails making sure that interlocutorsunderstand they are taking part in a researchproject and are free to refuse participation;understand that they can opt out of the study at anytime;knowifandwhenwearecollectinginformationthatcouldidentifythem,andthatwewillrespecttheirwishestohavetheir identityacknowledgedorkeptconfidential;theyunderstandwhatkindsofinformationwearecollectingandwhatwearecarryingfromourinteractionswiththem.Therisksandbenefits of participating in theresearchwill be discussed, along with options to minimize risk (e.g.anonymity).Oral consent/Verbal consent is a recognized formof alternate consent by the twomainbodiesofanthropology,theAmericanAnthropologicalAssociation(USA)andtheAssociationofSocialAnthropologists (UK), most often used in ethnographic practice in settings where written consentwouldbedisruptive,unwelcome,orinappropriate.Inengagingwithoralconsent,researcherswillpayparticular attention to explicit opt out requests that will be noted down in field-notes and thentransferredintotheparticipantconsentandopt-outinformationdocumentmaintainedbytheproject.

Asabackupprecautionalldatawillbereviewedimmediatelyaftercollectionandcross-checkedwithparticipant consent and opt-out information collected in prior engagements. If any data has beeninadvertently collected relating to a non-consenting individual, this material will be immediatelydeleted or destroyed. The documentation accompanying oral consent is typically a ResearchInformationSheetasmentionedabove(seeAppendix1). Inourcase,a jargonfreestudyinformationsheetwithfurtherinformationwillbeavailableonline,whichwillcoverprojectgoals,datatreatmentand participant rights, as well as the contact details of the researchers involved including the localprincipal investigator, as well as the ethical oversight committee at ITU. This information will bepresentedtoallparticipantsviaourwebsitewiththelinkavailableonourbusinesscards.

GDPRconsiderationsfororalconsentAccordingtotheGuidelinesonConsentunderRegulation2016/679:“TheGDPRdoesnotprescribetheform or shape in which information must be provided in order to fulfill the requirement of informedconsent. This means valid information may be presented in various ways, such as written or oralstatements,oraudioorvideomessages”. In fact,Recital32setsoutspecificguidanceonthis: “Consentshouldbegivenbyaclearaffirmativeact…suchasbyawrittenstatement,includingbyelectronicmeansoranoralstatement.”AssuchoralstatementsofconsentareinfactcompliantwithGDPRand,giventhefield-notestyleofethnographicresearch,thesearerecordedinfield-notes.Moreover,Recital33withrespect to research states: “It is often not possible to fully identify the purposes of personal dataprocessingforscientificresearchpurposesatthetimeofdatacollection.Therefore,datasubjectsshouldbeallowedtogive theirconsent tocertainareasof scientificresearchwhen inkeepingwithrecognized

16

ethicalstandardsforscientificresearch.Datasubjectsshouldhavetheopportunitytogivetheirconsentonly to certain areas of research or parts of research projects to the extent allowed by the intendedpurpose.” These statements recognize the contingent nature of research and the requirements offlexibilityinherentinconductingcertaintypesofscientificwork.

Theethical researchpracticeguidelinesprovidedby theprofessional associations for ethnographersand anthropologists recognize oral consent as a vitally necessary approach in such work.Ethnographersandanthropologistsarespecificallytrainedinethicalconductthroughreflexivepraxisinsuchsituations.

WrittenconsentFor more structured data collection such as formal interviews, surveys or questionnaires, allparticipants will be presented with a Research Information Sheet prior to entering the survey(https://virteuproject.eu/researchinfo). The purpose, procedures, and risks of participation will beconveyed to participants in keeping with the processes of informed consent, and participation willproceedonlyiftheyagreewithoutcoercion.Wewillpresentpotentialparticipantswithanoverviewoftheresearchandaccepttheiractiveselectiontocontinuewiththesurveyasanindicationofconsent.No personally identifying information will be collected throughout the survey unless participantsactively choose to identify themselves in their answers or to contact us directly. Such identifyinginformationwillbecarefullyremovedfromthedatapriortoanalysisandretainedforreportingonlyifparticipantsexplicitlywishtobeidentified,asissometimesthecasewiththisformofdatacollection.

DatastorageapproachesAudiorecordings,transcriptions,onlineobservationdataandfieldnoteswillbemanuallyscrubbedofall identifying information and assigned a code as soon as data collection is complete and the leadresearchers return from the field.The codekey linking thedatawith identifying informationwill bekeptseparately inasecuredfolder inasharedfolderrepositorymaintainedbytheproject.Accesstotherepositoryismadeavailableonlytoprojectpersonnelinvolvedintheempiricaldatacollectionandprocessing.Oncecoded,alldatawillberetainedindefinitelyforfuturestudy.Thekeywillbedestroyeduponcompletionoftheproject.Oftentimesqualitativestudiescanyieldimportantinsightsmuchlater,after similarly themed studies have been conducted at different sites, and some national researchbodies require retention of research findings generated in publicly funded projects. However, theinsightpotentialsofsuchqualitativedatadonotrelyontheidentificationkey.Thus,uponcompletionof the project the de-identified data will be stored securely as encrypted files, maintained by thecoordinatinginstitution.

Datacollected throughsurveysorstructuredquestionnaireswillbecarefullyscrubbedof identifyinginformation ifanyshouldbeentered.Such informationwillbekept forreferenceonly inaccordancewithexplicitwishesoftheparticipants.

In case during the project it is considered relevant to acquiremore information about some of theindividualsinvolvedinthepubliconlinediscussions,wewillfirstcontacttheseindividuals,askforanexplicit consent in retaining their data, ensure that they are informed about our usage of the data,retention and disposal periods, that they can at any time remove or update the information in our

17

servers, and we will follow the general guidelines at both national and EU level(http://ec.europa.eu/justice/data-protection).

Withexplicitconsentofparticipantswemaymakeanonymisedqualitativedataavailableforvalidationandre-use throughtheOpenAccess toResearchDataPilot,whichwillbenegotiatedanddecidedbyconsortiummembers.

DataProcessingActivitiesGiventhediversityofdatasourcesanddataactivities,personallyidentifyinginformationwillattimesbenecessarytoconnectdifferentdatastreamsandtointerpretthese.Theuseofsuchinformationwillbedonewithutmostcare fordataanalysisonlyandnever forreportingorpublication.Forexample,personally identifying informationmaybenecessarytoconnectquantativedatacollectedviaTwitterwith ethnographic observations in order to aid interpretation of both types of data. Such analyses,however,will be kept securly in sharedproject folders and all partnerswill agree to ensure thatnoidentifyinginformationiseverrevealedinpublishedform.

Qualitativedataprocessing includesarangeofactivitiessuchascoding,semanticanalysis,memoing,situationalmapsandthematicanalysisamongothers.VIRT-EUresearcherswillensurethatallanalysisoutput isscrubbedof identifying informationwhensuchoutput issharedwithpartiesoutsideof theprojectmembers such as research participants ormembers of the advisory board. Any publicationsthat includequotesorpictureswillbeanonymized.Allanonymoussurveydatawillbeanalyzedandpublishedatthepopulationandnotattheindividuallevel.

DesignResearchDataManagement

The design research component of VIRT-EU will pay special attention to research ethics practicesensuring that all participants in co-design workshops and stakeholder meetings are provided withstudy informationsheetsandaregiven theopportunity toprovidewrittenconsent forparticipation.Participants will retain the right to revoke consent and to stop participating at any time. Writtenconsentwill also be collected for official structured or semi-structured interviews conducted by theconsortiummembersduringtheevaluationphaseattheconclusionoftheDesignChallengeaspersonalinformationwill be collected during those interviews to assist participation in theDesign Challengeitself. Design research in practice holds to the same research integrity tenets that govern all ofqualitativeresearchactivitiesofVIRT-EU.

DatacollectionactivitiesandconsentThroughout all qualitative fieldwork researchers will be taking informed consent as a basic ethicaltenet of research practice. The design research component of VIRT-EU will primarily focus onconducting co-design and stakeholder workshops throughout years 2 and 3 of the project. Designresearch isnot constrained toworkshopsalone, thusa research InformationSheet (seeAppendix1)will be provided to participants for those instances when data is gathered via structured surveysand/orquestionnaires, and structured/semi-structured interviewswherenopersonal information iscollected orwhere personal identifiers are removed from the data. TheResearch Information Sheetwill establish clearly that consent is implied for participating in the survey or questionnaire, and

18

participatingintheinterviewsandco-designworkshops.If,however,aresearchengagementextendsbeyond asking questions to include activities such as discussing incidents and activities that couldpotentiallyidentifytheindividual,thenwrittenconsentisrequired.

Asco-designandstakeholderworkshopsentailprolongedandintensiveface-to-faceengagementwithparticipants,however,additionalcarewillbetakentoobtainconsentforparticipationandtorespectthewishesofparticipantswithregardstothemanagementofresearchdataandthephysicalartifactsproduced.Toensuretheintegrityofresearchpracticeandresearchcontentgatheredduringco-designorstakeholderworkshops,writtenconsentforms(seeAppendix2)willbeused.TheseconsentformswillbestoredinlockedcabinetsattheCopenhagenInstituteofInteractionDesignseparatelyfromthedatatoensurethatthedataremainconfidential.Uponcompletionoftheproject,consentformswillbestoredbythecoordinatorandretainedforfiveyearsforauditpurposes.

DatastorageapproachesAlldata collected in the courseof co-designworkshopsand stakeholderworkshopswill be carefullyscrubbedofallidentifyinginformation.Participantlistswillbekeptseparatelyforthedurationoftheproject to ensure a longitudinal aspect to the co-designprocess that requires repeatedengagementswiththesameparticipantsinco-designworkshopsandduringandaftertheDesignChallengeheldattheendoftheprojecttoenableanevaluationofeffectivenessofprojectoutcomes.Participantlistswillbe destroyed at the completion of the project. All physical artifacts produced in the course of theworkshopswill be held under lock and key in the offices of the Copenhagen Institute of InteractionDesignforthedurationoftheprojectanddestroyeduponcompletionoftheprojectunlesspermissionisobtaineddirectlyfromtheparticipantstodisplaytheseartifacts.

Anonymized and processed data will be kept separately and retained after project completion. Allparticipantswillbenotifiedofthepossibilityoftheirdatabeingkeptafterprojectcompletionpriortoinitialparticipationandconsentwillbeobtainedviaconsentform.

DataprocessingactivitiesWewillusetheprocessesdescribedaboveforallqualitativedataforalldesign-specificdatacollectedduringco-designandstakeholderworkshops.

OpenResearchDataRequirements

Selected data will be shared publicly during or after the lifetime of the project.Which data will besharedwill depend on the scientific relevance of the collected data, nevertheless personal deta andsensitive data will never be released or shared. All long term data collected or generated will bedeposited in a repository. If required, the entire information content of the VIRT-EU project can bestoredondiskforarchiving.ThisfunctionalitycanalsobeusedtotransferVIRT-EUcontenttoanothersystem. The final repository has not been chosen yet but the consortium is currently testing theopportunitiesofferedbyDataverse.Dataversesatisfymostofthenecessaryrequirements:

− OffersanopensourceoptionthatwillbehostedatITU.− DatawillbephysicallylocatedinEU(Denmark)

19

− Supportsalargevarietyofdatatypes,fromnetworkdatatoqualitativeobservations.− Supportsdifferentialaccesstodataallowingforpublicorprivatedataaccess.− Supportsseveraltypesoflicenseforshareddata,includingCC0(CCZeroWaiver)orODBL�(Open

DatabaseLicense).

20

ITUResearchEthicsCommitteeStatementThe ITU Research Ethics Committee has reviewed the original VIRT-EU Open Research DataManagementPlanandconfirmsitscompliancewiththeDanishCodeofConductonResearchIntegrity.Giventhe2-weekdeadlinetocompletetheserevisionstherewasnotenoughtimetoobtainthisreviewapproval. Wewill include thereviewapproval inournextamendment to thisdocumentat the timewheninstitutionalpermissionsfromalloftherelevantDPOswillbereceived(currentlyinprogress).

____________________________________

EspenArseth,ProfessorChair,ITUResearchEthicsCommittee

21

Appendix1:ResearchInformationSheet

VIRT-EUrecognizesthattheparticularsoftheinformationcontainedinthisresearchinformationsheet–theidentityofthedatacontroller,thespecificpurposesofdataprocessingandtheexerciseoftherightsofaccesstodata–willdifferonthebasisofthespecificcircumstancesinwhichdataarecollected.Theinformationbelowwillbeaugmentedasapplicablebasedontheresearchcontextandpriorexperience.TheinformationpresentedinthisversionoftheResearchInformationSheetisanexemplarofinformationtobeprovidedtoallresearchparticipants.Thisresearchinformationsheetwillbepairedwiththe“GDPRinformationform”(seeAppendix3)aswellastheconsentformwhenevertheconsentformisnecessary,suchaswhenorganizingco-designorstakeholderworkshops.

virteuproject.eu

Rued Langgaards Vej 7 – 2300 Copenhagen S – Denmark – Ph. +45 7218 5000 – CVR 29057753 www.itu.dk

RESEARCHINFORMATIONSHEET

Project:VIRT-EU:ValuesandEthicsinInnovationforResponsibleTechnologyinEuropePrincipalInvestigator’snames: 1.IrinaShklovski–ITUCopenhagen2.JavierRuiz–OpenRightsGroup3.MatteoMagnani–UppsalaUniversity

4.AlisonPowell–LondonSchoolofEconomics5.AlessandroMantelero–PolitechnicoDiTorino6.AnnelieBerner–CopenhagenInstituteofInteractionDesign

Youareinvitedtotakepartinaresearchstudyaboutvaluesandethicsininnovationpractices.Ifyouwouldlikemoreinformationabouttheprojectpleaseseehttp://virteuproject.eu

Whatdoestheresearchinvolve?Theaimofthisresearchistoempiricallyidentifyhowlocalcultureandnetworksocietyinfluencetheunderstandingandmovementofparticularsocialvaluesamongtechnologydevelopers,andhowlocaldifferenceandnetworkedcommonalitiescaninfluencethedevelopmentofethicalsubjectsfromanethicalperspective.Empiricaldatacollectionandanalysisareintendedtolaythegroundworkforaccomplishingthefollowingobjectives:

DevelopaPrivacy,EthicalandSocialImpactAssessment(PESIA)frameworkshapedbystateoftheartlegalresearchandempiricaldata,toenabledevelopersandothersocietalstakeholderstoreflectupon,evaluate,andtakeintoaccountnotonlythedataprotection,securityandprivacyaspectsofnewtechnologiesbutalsotheethicalandsocialconcernsembeddedwithinthatchallengeautonomyandfreedom.Systematicallyco-designwithtechnologydevelopersself-assessmenttoolsandtoolssupportingethicaldiscussionsinIoTdesign.AsIoTdevelopersmaynotbeabletoanticipatethefutureuseoftheirprojectsandtheirclientsandpartners,weseektosupportdecision-makingwithtoolsgroundedinexistingdeveloperpracticesandbasedonquantitative,casestudyanddesignresearchthatidentifieshowethicsoperateasprocess.

Whatdoesparticipationentail?Theresearcher/swillconductformalandinformalgrouporindividualinterviewswithparticipantswhoagreetobeinterviewed.Theformalinterviewswillbeaudiotapedandtranscribed.Ifatanypointyouareuncomfortablewiththeaudiotaping,pleaseletusknowandwewillturnoffallrecordingdevices.Youmayalsobeinvitedtoparticipateinanyofthefollowing:ashortonlinesurvey,aseriesofco-designworkshops,anonlinediscussionviaanemaillist,and/oraDesignChallengefocusedondevelopingnewapproachestoethicalinnovationpractices.Theworkshopswillbeconductedatatimeconvenientforthoseinvolved.Participationintheprojectandinanyoftheseresearchactivitiesisoptionalandvoluntary.Thereisnocosttoyouforparticipating.Youmayrefusetoparticipateordiscontinueyourinvolvementatanytimewithoutpenalty.Youcanchoosetoskipaquestionatanytime.Youcanrequestthatyourdataareremovedfromtheprojectdatacorpusatanytime.

virteuproject.eu

Rued Langgaards Vej 7 – 2300 Copenhagen S – Denmark – Ph. +45 7218 5000 – CVR 29057753 www.itu.dk

SourceoffundingThisprojecthasreceivedfundingfromtheEuropeanUnion’sHorizon2020researchand innovationprogrammeundergrantagreementNo732027.

ConsentingtoparticipateintheprojectandwithdrawingfromtheresearchYoucanconsenttoparticipatingintheprojectandinanyoftheactivitiesoutlinedabovebycompletingtheconsentformattachedtothisExplanatoryStatementandreturningittotheresearcherconductingtheparticularstudyandactingastherepresentativeofthedatacontroller.Youcanalsowithdrawfromtheresearchatanytime.Upuntiltheprojectresultsarereportedinpublicationsyoucanrequestthatanydatarelatingtoyourparticipationbecompletelydestroyed.Uponpublicationofresults,thedatatheprojectholdswillstillbedestroyedbutthepublicationscannotbealtered.

(a) Ifyouparticipateintheobservationalandinformalinterviewactivities,wemaycollectanonymiseddataaboutyourexperiences.Forinstance,theresearchersmaycollectdataaboutyouropinionsonresponsibleinnovation,dataprotection,issuesofprivacy,andsecurity.Wewillrelyonoralconsentforthiskindofdatacollectionthatwilloccuraspartofyourinteractionwithourresearchers,trainedinethnographicresearchmethods.Shouldyouexpressanyreservationsinthecourseoftheinteractionwiththeresearchers,theywillensurethatyourdataaretreatedinaccordancewithyourwishes.Wewillprocessanyinformationlawfullyandsecurelyinaccordancewithdataprotectionlegislation.

(b) Survey,workshops,DesignChallenge,structuredandsemi-structuredinterviews:ifyouwishtoparticipateinthesurvey,workshops,DesignChallenge,and/orstructuredandsemi-structuredinterviewpleasesignandreturntheconsentformtotheresearchers.

PossiblebenefitsandriskstoparticipantsByparticipatinginthisstudyyouwillbecontributingtoresearchrelatedtounderstandinghowEuropeanIoTinnovatorsanddevelopersmakeethicallyconsequentialdecisions–aboutcode,hardwareanddata–fornewconnectivedevices,andtheassumptionsabouthumanbehaviour,privacyandfreedomthatunderpinEuropeanculturesofIoTinnovation.Thereislittleornorisk,inconvenienceordiscomforttoyouinparticipatinginthestudy.

ConfidentialityandstorageofdataAllresearchdatawillbede-identifiedandstoredsecurelyandconfidentially.Thismeansthatyournameandidentifyingdetailswillberemovedpriortoreportingandpublicationandwillnotbesharedwithothers.However,wecannotguaranteecompleteanonymitysincethecontentofwhatyousay,despiteourbestintentions,maybeidentifiabletopeoplewhowork/communicatecloselywithyou.Onlytheresearchersinvolvedinthedatacollectionwillhavedirectaccesstothedata.Thedatawillnotbeusedforpurposesotherthanthepurposesofthisresearchproject.

ResultsResultsandprojectoutputswillbepublishedontheprojectwebsite,reports,conferenceproceedings,andinjournalarticles.Youarewelcometoemailtheresearcherstorequestfindings,whichwillbeemailedtoyouinsummaryform.AdditionalinformationIfyouhaveanycomments,concerns,orquestionsregardingtheconductofthisresearchingeneralorquestionsabouttheVIRT-EUprojectcoordinationactivities,pleasecontacttheprojectadministrator–JonasLangelandPedersenbyphone+4572185227;[email protected];orbymail:ITUniversityofCopenhagen,RuedLanggaardsVej7,2300CopenhagenS,Denmark.

22

Appendix2:ConsentForm

Whiledataprocessingwill begovernedbyaproject-wide joint controller agreement,data collectionwill typically beperformedby a single partner or atmost twopartners in collaboration.As such, inorder to avoid confusion and to ensure that data subjects know exactlywho is responsible for datacollectionactivitieseachpartnerhaseditedtheconsentforminordertoaddtheirrelevantinformationforidentifyingdataprotectionofficer/informationcommissionerfortherelevantinstitutions.Theformpresentedinthisappendixisinitsgenericform.

<<DATA CONTROLLER LOGO>> virteuproject.eu

CONSENTFORMFORINTERVIEWS,SURVEY,ANDWORKSHOP RESREARCHPARTICIPANTS

Project:VIRT-EU:ValuesandEthicsinInnovationforResponsibleTechnologyinEurope

DataController: <<Controllerphysicaladdressandcontactinformation>>

PrincipalInvestigator(s):<<PartnerPI>>Researchers<<Projectresearchteaminvolvedintheresearch>>

IhavebeeninvitedtoparticipateintheVIRT-EUresearchprojectspecifiedabove.IhavereadandunderstoodtheattachedExplanatoryStatementandIherebyprovideconsenttotakepartinthisproject: 1. IconfirmthatIreceivedinformationabouttheproject.Ihavehadtheopportunityto

considertheinformation,askquestionsandhavehadtheseansweredsatisfactorily.

2. IunderstandthatmyparticipationisvoluntaryandthatIamfreetowithdrawatanytime,withoutgivinganyreason.

3. Iunderstandthatanyinformationgivenbymemaybeusedinfuturereports,articlesorpresentationsbytheresearchteamandtheircollaboratorsintheVIRT-EUproject.

4. Selectoneofthefollowing:a. Idonotwantmynameusedinanypublicationsofreportsinthisproject

b. Pleaseuseanalternativenameforme(writenamehere)__________________

c. IwouldlikemynameusedandunderstandthatwhatIhavesaidorwrittenas

partofthisstudywillbeusedinreports,publicationsandotherresearchoutputssothatanythingIhavecontributedtotheVIRT-EUprojectcanberecognizedasmycontribution.

5. Iagreetotheinterview/workinggroup/consultationbeingphotographed,audioand/orvideorecorded

6. Iagreetotheuseofquotes,pictures,videoandaudioinpublicationsandpresentations(Inthecaseofwithdrawalofconsentallrecordsofyouwillbedeleted,orincasewhereyouappearwithotherparticipantswhohavegiventheirconsent,youwillbeanonymizedtomakesureyourpresenceinthedatasetisunrecognizable)

NameofParticipant:

SignatureDate

23

Appendix3:Additiontoconsentform

Theadditiontotheconsentformwillalsobeeditedtoensurethattherelevantdatacontrollerinformationiseasilyavailabletothedatasubjects.Thisformwillaccompanyboththestudyinformationsheetandtheconsentforminallourdatacollectionactivities.

<<DATA CONTROLLER LOGO>> virteuproject.eu

Data Handling Information Notice

We primarily process your personal information with your consent for scientific research, as explained in the research information sheet in detail. You may have signed a consent form at one of our workshops or provided oral consent to one of our researchers, who has kept a written record of this. As part of the research we may have to contact you from time to time but we will not be making any marketing offers. If you have specifically consented we may use your information in dissemination materials and presentations. You can revoke you consent at any time. Your information will not be shared directly with other VIRT-EU consortium members but insights and aggregated analyses based on your data will be shared under strictly controlled circumstances as detailed in the project’s Data Management Plan, which can be found online [PUBLIC URL of D1.6]. Your information may be accessed if we are forced to comply with any legal obligations, including audits by the project funders. We will keep your information in our systems for the duration of the project plus the legally required periods for auditing purposes, currently five years. In addition, your information may be sent to a long-term research repository with your name and any personal identifiers removed and the dataset appropriately anonymized in compliance with the requirements of the GDPR. Your information will not be transferred outside the European Union at the time of writing. We must make you aware that two of the project partners are located in the United Kingdom, which has started proceedings to exit the European Union in March 2019. The future data protection arrangements are unknown but we shall ensure compliance at all times. If you have specific concerns please let us know. European legislation on the protection of personal data (GDPR) creates a general right for individuals to request access, rectification or erasure of data. However, the law also allows for certain exceptions for scientific research, which change from country to country and in some cases have not been fully developed at the time of writing. For avoidance of doubt we want to assure you that we will always comply with your requests independently of the legal situation. IfyouhaveanyissuesyouhavearighttolodgeacomplaintwiththeInformationCommissioner’sOffice(ICO)/DataProtectionOfficer(DPO),theircontactdetailsareasfollows: <<Relevant ICO or DPO contact information>>

24

Appendix4:Partner-specificconsentforms

Thesepartner-specificconsentformsdemonstratehowGDPR-compliantdatacollectionsprocedureshavebeenimplementedbytheproject.

virteuproject.eu



DataController: ITUniversityofCopenhagenRuedLanggaardsVej72300CopenhagenSDenmark+4572185000

PrincipalInvestigator(s):Dr.IrinaShklovski

ResearchersDr.RachelDouglas-JonesEsterFritschBarbaraNiñoCarrerasCarolinaNémethy











NameofParticipant:

SignatureDate

virteuproject.eu


We primarily process your personal information with your consent for scientific research, as explained in the research information sheet in detail. You may have signed a consent form at one of our workshops or provided oral consent to one of our researchers, who has kept a written record of this. As part of the research we may have to contact you from time to time but we will not be making any marketing offers. If you have specifically consented we may use your information in dissemination materials and presentations. You can revoke you consent at any time. Your information will not be shared directly with other VIRT-EU consortium members but insights and aggregated analyses based on your data will be shared under strictly controlled circumstances as detailed in the project’s Data Management Plan, which can be found online [PUBLIC URL of D1.6]. Your information may be accessed if we are forced to comply with any legal obligations, including audits by the project funders. We will keep your information in our systems for the duration of the project plus the legally required periods for auditing purposes, currently five years. In addition, your information may be sent to a long-term research repository with your name and any personal identifiers removed and the dataset appropriately anonymized in compliance with the requirements of the GDPR. Your information will not be transferred outside the European Union at the time of writing. We must make you aware that two of the project partners are located in the United Kingdom, which has started proceedings to exit the European Union in March 2019. The future data protection arrangements are unknown but we shall ensure compliance at all times. If you have specific concerns please let us know. European legislation on the protection of personal data (GDPR) creates a general right for individuals to request access, rectification or erasure of data. However, the law also allows for certain exceptions for scientific research, which change from country to country and in some cases have not been fully developed at the time of writing. For avoidance of doubt we want to assure you that we will always comply with your requests independently of the legal situation. IfyouhaveanyissuesyouhavearighttolodgeacomplaintwiththeDataProtectionOfficer(DPO),theircontactdetailsareasfollows: ITU Data Protection Officer Rasmus Balle IT University of Copenhagen Rued Langgaards Vej 7 Copenhagen S 2300 Denmark [email protected]

virteuproject.eu



DataController: LondonSchoolofEconomicsDepartmentofMediaandCommunicationsLondonSchoolofEconomicsandPoliticalScienceFawcettHouse,7thFloorHoughtonStreet,LondonWC2A2AE

PrincipalInvestigator(s):Dr.AlisonPowellResearchersDr.FundaUstek-SpildaSebastiánLehuedé








partofthisstudywillbeusedinreports,publicationsandotherresearchoutputs

sothatanythingIhavecontributedtotheVIRT-EUprojectcanberecognizedas

mycontribution.



NameofParticipant:

SignatureDate

virteuproject.eu


We primarily process your personal information with your consent for scientific research, as explained in the research information sheet in detail. You may have signed a consent form at one of our workshops or provided oral consent to one of our researchers, who has kept a written record of this. As part of the research we may have to contact you from time to time but we will not be making any marketing offers. If you have specifically consented we may use your information in dissemination materials and presentations. You can revoke you consent at any time. Your information will not be shared directly with other VIRT-EU consortium members but insights and aggregated analyses based on your data will be shared under strictly controlled circumstances as detailed in the project’s Data Management Plan, which can be found online [PUBLIC URL of D1.6]. Your information may be accessed if we are forced to comply with any legal obligations, including audits by the project funders. We will keep your information in our systems for the duration of the project plus the legally required periods for auditing purposes, currently five years. In addition, your information may be sent to a long-term research repository with your name and any personal identifiers removed and the dataset appropriately anonymized in compliance with the requirements of the GDPR. Your information will not be transferred outside the European Union at the time of writing. We must make you aware that two of the project partners are located in the United Kingdom, which has started proceedings to exit the European Union in March 2019. The future data protection arrangements are unknown but we shall ensure compliance at all times. If you have specific concerns please let us know. European legislation on the protection of personal data (GDPR) creates a general right for individuals to request access, rectification or erasure of data. However, the law also allows for certain exceptions for scientific research, which change from country to country and in some cases have not been fully developed at the time of writing. For avoidance of doubt we want to assure you that we will always comply with your requests independently of the legal situation. IfyouhaveanyissuesyouhavearighttolodgeacomplaintwiththeInformationCommissioner’sOffice(ICO),theircontactdetailsareasfollows: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF +44 1625 545 700 https://ico.org.uk/global/contact-us/email/

virteuproject.eu


Project:VIRT-EU:ValuesandEthicsinInnovationforResponsibleTechnologyinEuropeDataController: CopenhagenInstituteforInteractionDesign

Toldbodgade37B

KøbenhavnK1253

Denmark

PrincipalInvestigator(s):AnnelieBerner

ResearchersRaffaellaRovida

MonicaSeyfried

IhavebeeninvitedtoparticipateintheVIRT-EUresearchprojectspecifiedabove.Ihavereadand

understoodtheattachedExplanatoryStatementandIherebyprovideconsenttotakepartinthisproject:

1. IconfirmthatIreceivedinformationabouttheproject.Ihavehadtheopportunityto


2. IunderstandthatmyparticipationisvoluntaryandthatIamfreetowithdrawatany

time,withoutgivinganyreason.

3. Iunderstandthatanyinformationgivenbymemaybeusedinfuturereports,articles

orpresentationsbytheresearchteamandtheircollaboratorsintheVIRT-EUproject.

4. Selectoneofthefollowing:

a. Idonotwantmynameusedinanypublicationsofreportsinthisproject



partofthisstudywillbeusedinreports,publicationsandotherresearchoutputs

sothatanythingIhavecontributedtotheVIRT-EUprojectcanberecognizedas

mycontribution.

5. Iagreetotheinterview/workinggroup/consultationbeingphotographed,audio

and/orvideorecorded

6. Iagreetotheuseofquotes,pictures,videoandaudioinpublicationsand

presentations(Inthecaseofwithdrawalofconsentallrecordsofyouwillbedeleted,orin

casewhereyouappearwithotherparticipantswhohavegiventheirconsent,youwillbe

anonymizedtomakesureyourpresenceinthedatasetisunrecognizable)

NameofParticipant:

SignatureDate

virteuproject.eu


We primarily process your personal information with your consent for scientific research, as explained in the research information sheet in detail. You may have signed a consent form at one of our workshops or provided oral consent to one of our researchers, who has kept a written record of this. As part of the research we may have to contact you from time to time but we will not be making any marketing offers. If you have specifically consented we may use your information in dissemination materials and presentations. You can revoke you consent at any time. Your information will not be shared directly with other VIRT-EU consortium members but insights and aggregated analyses based on your data will be shared under strictly controlled circumstances as detailed in the project’s Data Management Plan, which can be found online [PUBLIC URL of D1.6]. Your information may be accessed if we are forced to comply with any legal obligations, including audits by the project funders. We will keep your information in our systems for the duration of the project plus the legally required periods for auditing purposes, currently five years. In addition, your information may be sent to a long-term research repository with your name and any personal identifiers removed and the dataset appropriately anonymized in compliance with the requirements of the GDPR. Your information will not be transferred outside the European Union at the time of writing. We must make you aware that two of the project partners are located in the United Kingdom, which has started proceedings to exit the European Union in March 2019. The future data protection arrangements are unknown but we shall ensure compliance at all times. If you have specific concerns please let us know. European legislation on the protection of personal data (GDPR) creates a general right for individuals to request access, rectification or erasure of data. However, the law also allows for certain exceptions for scientific research, which change from country to country and in some cases have not been fully developed at the time of writing. For avoidance of doubt we want to assure you that we will always comply with your requests independently of the legal situation. IfyouhaveanyissuesyouhavearighttolodgeacomplaintwiththeInformationCommissioner’sOffice(ICO)theircontactdetailsareasfollows:

Datatilsynet,Borgergade28,5.1300KøbenhavnK

Tlf.33193200

virteuproject.eu



DataController: OpenRightsGroupUnit7,TileyardAcornStudios,103-105,BlundellStreet,London,[email protected]+442070961079

PrincipalInvestigator(s):JavierRuizDiazResearchersEdJohnson-WilliamsBenByford











NameofParticipant:

SignatureDate

virteuproject.eu


We primarily process your personal information with your consent for scientific research, as explained in the research information sheet in detail. You may have signed a consent form at one of our workshops or provided oral consent to one of our researchers, who has kept a written record of this. As part of the research we may have to contact you from time to time but we will not be making any marketing offers. If you have specifically consented we may use your information in dissemination materials and presentations. You can revoke you consent at any time. Your information will not be shared directly with other VIRT-EU consortium members but insights and aggregated analyses based on your data will be shared under strictly controlled circumstances as detailed in the project’s Data Management Plan, which can be found online [PUBLIC URL of D1.6]. Your information may be accessed if we are forced to comply with any legal obligations, including audits by the project funders. We will keep your information in our systems for the duration of the project plus the legally required periods for auditing purposes, currently five years. In addition, your information may be sent to a long-term research repository with your name and any personal identifiers removed and the dataset appropriately anonymized in compliance with the requirements of the GDPR. Your information will not be transferred outside the European Union at the time of writing. We must make you aware that two of the project partners are located in the United Kingdom, which has started proceedings to exit the European Union in March 2019. The future data protection arrangements are unknown but we shall ensure compliance at all times. If you have specific concerns please let us know. European legislation on the protection of personal data (GDPR) creates a general right for individuals to request access, rectification or erasure of data. However, the law also allows for certain exceptions for scientific research, which change from country to country and in some cases have not been fully developed at the time of writing. For avoidance of doubt we want to assure you that we will always comply with your requests independently of the legal situation. IfyouhaveanyissuesyouhavearighttolodgeacomplaintwiththeInformationCommissioner’sOffice(ICO)/DataProtectionOfficer(DPO),theircontactdetailsareasfollows: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Telephone: 0303 123 1113 Fax: 01625 524510 https://ico.org.uk/global/contact-us

d1.6 open research data management plan

Documents