[SOP Request] Allow data subjects to object to their data being disclosed

[jdylan]

SOP topics

Data protection & security

SOP type

Node-specific

SOP Title

Inform data subjects about reseach on their data, including the posibility of opt-out

Detailed Description

1. Determine the data subject whose data has been requested by a data access request
2. Inform the data subjects of the proposed research and data access request, as well as a method to object to their data being disclosed, along with appropriate timelines
3. Once a certain time has elapsed since the communication was performed, if no response from the data subject has been received confirm the access request, or if a response has been received objecting to the release of their data remove the data pertaining to the data subject from the release
4. Record and document the whole process, and where a data subject has opt-ed out of their data been releases uniquely identify the new dataset being released, as well as inform the requester about the updated aggregate statistics on the updated dataset.

Motivation

Under the data governance, as as voted on by the MS, dynamic consent must be supported by the GDI. As such, this means that a data subject has the right to opt-out of having their data being used for a research purpose. Therefore a mechanism must be put in place for communication with the data subject regarding research that may involve their data.

Existing Procedures or References

No response

Impact

This is high impact as without it GDI cannot conform to the GDPR requirements.

Stakeholders

1+MG WG2
GDI Pillar I
GDI Pillar II
Operational 'nodes' with real data
GoE

Additional Information

No response

Requester GDI role

Yes

Requester GDI Node

Finland CSC

Confirmation

• I have searched the existing SOPs and this request does not duplicate an existing SOP.
• I understand that submitting this request does not guarantee the creation of the SOP.

[M-casado]

Potential trigger for Issue #55. See also Pull #62.