{"id":57,"date":"2024-04-04T04:36:11","date_gmt":"2024-04-04T01:36:11","guid":{"rendered":"https:\/\/sisu.ut.ee\/andmehaldus\/ethical-and-legal-aspects\/"},"modified":"2024-04-16T17:39:04","modified_gmt":"2024-04-16T14:39:04","slug":"ethical-and-legal-aspects","status":"publish","type":"page","link":"https:\/\/sisu.ut.ee\/andmehaldus\/ethical-and-legal-aspects\/?lang=en","title":{"rendered":"Ethical and Legal Aspects"},"content":{"rendered":"<p style=\"text-align: justify\">\n\t\u00a0\n<\/p>\n<p>\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">It is not only researchers who use open research data \u2013 the data is accessible for all people regardless of their purpose of using them. As the objective of open science is to preserve the machine readable FAIR data and make it accessible, the data is accessed by machines, making it impossible to control the actual use of the open data. <\/span><\/span>\n<\/p>\n<p>\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">Therefore, it is important to underline in the data management plan that you are aware of the ethical and legal aspects involved in your project and you know how to handle them. <\/span><\/span>\n<\/p>\n<ul>\n<li>\n\t\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">Intellectual property right, copyright and licences<\/span><\/span>\n\t<\/li>\n<li>\n\t\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">Sensitive data (special categories of personal data, business secrets, national security, data concerning endangered species)<\/span><\/span>\n\t<\/li>\n<li>\n\t\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">Protection of personal data (including the metadata of personal data<\/span><\/span>\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify\">\n\tNorms and laws of ethics have an effect on all aspects of data life cycle \u2013 how the data are collected, how it is preserved during the course of the work, who has the rights to access it, which data processing methods are used, and where, in which format and for how long are the data stored after the end of the project.\n<\/p>\n<h3 style=\"text-align: justify\">\n\tIntellectual property right, copyright and licences<br>\n<\/h3>\n<p style=\"text-align: justify\">\n\tIt is important to find out the owners of intellectual property rights and copyrights. If some of these rights belong to third parties, you need to sign with them contracts which satisfy all the parties.\n<\/p>\n<p style=\"text-align: justify\">\n\tAn example: the intellectual property rights of a researcher employed by the university belong to the university, but the intellectual property rights of a student belong to the student. A doctoral student is still a student, thus you should sign a contract with every doctoral student participating in your project, about transferring these rights to the university. This is important regarding the sharing and publishing of data, as well as on the occasion when the doctoral student leaves the university.\n<\/p>\n<p style=\"text-align: justify\">\n\tIf your research group collaborates with a commercial enterprise, which is not interested in publishing the data, the fact has to be indicated. Point out all factors that limit data sharing, such as the issues of property rights or patent applications.\n<\/p>\n<p style=\"text-align: justify\">\n\tSee also <a data-url=\"https:\/\/sisu.ut.ee\/andmehaldus\/licenses\" href=\"https:\/\/sisu.ut.ee\/andmehaldus\/licenses\" target=\"_blank\" title=\"\" rel=\"noopener\">Licences<\/a>\n<\/p>\n<p style=\"text-align: justify\">\n\tSpecific issues of copyright are dealt with by the university lawyer, whom you can contact when necessary. The UT lawyer has worked out the following statement about licences of grant results. This is ready for copying into your data management plan:\n<\/p>\n<p style=\"text-align: justify\">\n\t<strong>Licencing in UT:<\/strong>\u00a0\n<\/p>\n<p>\n\t\u2022 The data belong to the University of Tartu. Persons employed for filling the grant will assign the proprietary rights to the results of the research (including the data) performed under the grant agreement to the University with the Employment Contract (academic employees) or with another written document (Act of Assignment of the Intellectual Property Rights).\n<\/p>\n<p>\n\t\u2022 Data will be disclosed under the Creative Commons license CC-BY 4.0\n<\/p>\n<p>\n\t\u2022 A third party, whose data have been used for creating the results of the grant, may set restrictions to the usage of the data. In this case those restrictions must be considered while the data are being licensed, i.e. the university can give the license for the data usage only in the scale of rights allowed by the third person (i. e. the scale of rights that university has received from the third persons)\n<\/p>\n<p>\n\t\u2022 If the University or a third person, whose data have been used for creating the results of the grant, wants to submit a patent or a utility model application, the publishing of the data has to be postponed until the submission of the application.\n<\/p>\n<h3 style=\"text-align: justify\">\n\tProtection of Personal Data<br>\n<\/h3>\n<p>\n\t<span style=\"font-size:15px\"><span style=\"background-color:#ff0000\">New!<\/span> In case you process personal data during youtr research, take a look at the <a data-url=\"https:\/\/wiki.ut.ee\/display\/dataprotection\/Guide+for+data+protection+in+research\" href=\"https:\/\/wiki.ut.ee\/display\/dataprotection\/Guide+for+data+protection+in+research\" target=\"_blank\" title=\"\" rel=\"noopener\">Guide for data protection in research<\/a>:<\/span>\n<\/p>\n<p>\n\t<span style=\"font-size:15px\">Juurik, M., M\u00e4esalu, T., &amp; Tarkpea, T. (2023).\u00a0<i>Guide for Data Protection in Research<\/i>. University of Tartu; T\u00dc Wiki.<\/span>\n<\/p>\n<p>\n\tProtection of personal data has become especially topical after the implementation of the General Data Protection Regulation on 25.05.2018. Data Processing should follow <a data-url=\"https:\/\/www.ut.ee\/en\/data-protection-policy\" href=\"https:\/\/www.ut.ee\/en\/data-protection-policy\" target=\"_blank\" title=\"\" rel=\"noopener\">Data Protection Policy of University of Tartu<\/a>.\u00a0\n<\/p>\n<p style=\"text-align: justify\">\n\tIn research, especially in social and medical studies, informing of persons under examination and asking for their consent, and the protection of personal data has always been part of the code of conduct for research integrity. This is probably the reason why the Regulation does not restrict the use of personal data in research, historical studies and statistics in the cases where all appropriate legal and technical measures to safeguard the privacy of persons under examination have been applied.\n<\/p>\n<blockquote>\n<p style=\"text-align: justify;margin-left: 40px\">\n\t\t<strong>Personal data<\/strong> are all kinds of information about an identified or identifiable natural person. An identifiable natural person is a person who can be directly or indirectly identified by such identification as name, identification number, location information, online identifier, or by one or several physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.\u00a0\n\t<\/p>\n<p style=\"text-align: justify;margin-left: 40px\">\n\t\t<strong>Special categories of personal data<\/strong> are data\u00a0revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person\u2019s sex life or sexual orientation.\n\t<\/p>\n<p style=\"text-align: justify;margin-left: 40px\">\n\t\t<strong>Processing of personal data<\/strong> is any automated or not automated operation performed on personal data or sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, reading or use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.\n\t<\/p>\n<\/blockquote>\n<p style=\"text-align: justify\">\n\t<strong>Principles of processing personal data<\/strong>\n<\/p>\n<ul>\n<li style=\"text-align: justify\">\n\t\tprocessed lawfully, fairly and in a transparent manner in relation to the data subject\n\t<\/li>\n<li style=\"text-align: justify\">\n\t\t<strong>collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes (not relevant for research)<\/strong>\n\t<\/li>\n<li style=\"text-align: justify\">\n\t\tdata minimisation\n\t<\/li>\n<li style=\"text-align: justify\">\n\t\taccurate and kept up to date data\n\t<\/li>\n<li style=\"text-align: justify\">\n\t\t<strong>Storage limitation (not relevant for research)<\/strong>\n\t<\/li>\n<li style=\"text-align: justify\">\n\t\tintegrity and confidentiality\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify\">\n\t\u00a0\n<\/p>\n<p>\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\"><strong>To illustrate the occasions when restrictions on the collection and preservation of personal data do not apply for research<\/strong>, we point out the long-term targets of genetic research and the first paragraph in the letter of consent for becoming a gene donor (<\/span><\/span><a data-url=\"https:\/\/geenidoonor.ee\/nousoleku-vorm\" href=\"https:\/\/geenidoonor.ee\/nousoleku-vorm\" target=\"_blank\" title=\"\" rel=\"noopener\">translation of\u00a0consent form in Estonian<\/a><span lang=\"EN-GB\"><span style=\"line-height:107%\">):<\/span><\/span>\n<\/p>\n<p>\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">The long-time targets of genetic research are:<\/span><\/span>\n<\/p>\n<ul>\n<li>\n\t\tTo create conditions for better care of the health of our descendants\n\t<\/li>\n<li>\n\t\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">To support the development of science and medicine<\/span><\/span>\n\t<\/li>\n<li>\n\t\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">To provide doctors with opportunities for better health promotion<\/span><\/span>\n\t<\/li>\n<li>\n\t\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">To allow researchers to study our genetic descent<\/span><\/span>\n\t<\/li>\n<li>\n\t\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">To help to make Estonia better known in the world of science<\/span><\/span>\n\t<\/li>\n<\/ul>\n<p>\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">In order to achieve these long-time targets, the gene donor gives their consent:<\/span><\/span>\n<\/p>\n<p>\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">\u201cI have been informed and I am aware of the following:<\/span><\/span>\n<\/p>\n<p>\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">1. The aim of the Estonian Genome Project is to establish the Gene Bank, a database that contains data on the health and heredity of the people of Estonia. The Gene Bank can be used only for research, for studying and treating the diseases of gene donors, for studying the public health and for statistical purposes. Research carried out with the help of the Gene Bank shall not be limited to the present scientific level.\u201d<\/span><\/span>\n<\/p>\n<p>\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\"><strong>Giving their consent, the gene donor allows the use of their data for different genetic research-related purposes for an unlimited period<\/strong>. If the requirements that personal data can be collected only for a single certain purpose and that the data should be destroyed after the achievement of this purpose, it would make such genetic research, as well as much of other, personal data-based research, entirely impossible. <\/span><\/span>\n<\/p>\n<p style=\"text-align: justify\">\n\t\u00a0\n<\/p>\n<p style=\"text-align: justify\">\n\t<strong>In the context of research, we can talk about two\u00a0legal basis for processing personal data.<\/strong>\n<\/p>\n<p style=\"text-align: justify\">\n\t1.\u00a0<strong>A study subject (natural person) has given their consent for processing their personal data<\/strong> for one or several specific purposes.\n<\/p>\n<blockquote>\n<p style=\"text-align: justify\">\n\t\tThe consent is a freely given specific, informed and unambiguous indication of the data subject by a statement or a clear affirmative action that they agree to the processing of their personal data.\n\t<\/p>\n<\/blockquote>\n<p style=\"text-align: justify\">\n\t2.\u00a0<strong>Public interest \u00a0(processing without consent).<\/strong>\n<\/p>\n<p style=\"text-align: justify\">\n\tPublic interest must be substantiated and it must be shown that these interests outweigh the person\u2019s right to private life and the protection of their personal data,\u00a0<span lang=\"EN-GB\"><span style=\"line-height:107%\">still using as many organisational and technical measures as possible.<\/span><\/span>\n<\/p>\n<p style=\"text-align: justify\">\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\"><span><strong>Public interest<\/strong> could arise, for example, from the Statutes of the University of Tartu, stating that \u201c<\/span><\/span><\/span>The University of Tartu\u00a0is the national university of the Republic of Estonia, a universal integrated research, development, study and culture institution, aiming to advance science and culture, provide the possibilities to acquire higher education based on the development of science and technology on three levels of higher education in the field of humanities, social, medical and natural sciences and to provide public services based on teaching, research and other creative activities\u201d.\n<\/p>\n<p style=\"text-align: justify\">\n\t\u00a0\n<\/p>\n<p>\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">To summarise, the task of the university is to carry out research in the public interest. <\/span><\/span>\n<\/p>\n<p style=\"text-align: justify\">\n\t\u00a0\n<\/p>\n<p style=\"text-align: justify\">\n\t<strong>Public interest<\/strong> is often the basis for secondary research, where the data has been collected by consent for one objective, but it may be useful also for some other objective. In this case, it is necessary to assess the effort needed for asking a new consent from all the data subjects. If the effort would be unreasonably massive, you have to contact the Data Protection Inspectorate and\/or Research Ethics Committee and apply for a substantiated permission for a new study.\n<\/p>\n<p style=\"text-align: justify\">\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">The homepage of the <\/span><\/span><a data-url=\"https:\/\/www.ut.ee\/en\/research-ethics-committee-university-tartu\" href=\"https:\/\/www.ut.ee\/en\/research-ethics-committee-university-tartu\" target=\"_blank\" title=\"\" rel=\"noopener\">Research Ethics Committee of the University of Tartu<\/a><span lang=\"EN-GB\"><span style=\"line-height:107%\"> has guidelines and application forms for correct procedures. It is necessary to know that the permission from the Committee needs to be received prior to the start of the research, it is not granted retrospectively.<\/span><\/span>\n<\/p>\n<p style=\"text-align: justify\">\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\"><span>A brief overview about the ethical aspects of research which should be taken into account can also be found on the web page of the Estonian Research Council:\u00a0<\/span><\/span><\/span><a data-url=\"https:\/\/www.etag.ee\/wp-content\/uploads\/2022\/02\/Eetika_Tabel_ENG_2022.pdf\" href=\"https:\/\/www.etag.ee\/wp-content\/uploads\/2022\/02\/Eetika_Tabel_ENG_2022.pdf\" target=\"_blank\" title=\"\" rel=\"noopener\">Guidelines for Completing Your Ethics Self-Assessment for Grant Application.<\/a>\n<\/p>\n<p style=\"text-align: justify\">\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">Data management plans should pay special attention to the processing of personal data when working with sensitive personal data, and with children or minority groups. <\/span><\/span>\n<\/p>\n<p>\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">When preserving and processing personal data, it is important to discuss security measures, see <\/span><\/span><a data-url=\"https:\/\/sisu.ut.ee\/andmehaldus\/data-storage-and-information-security\" href=\"https:\/\/sisu.ut.ee\/andmehaldus\/data-storage-and-information-security\" target=\"_blank\" title=\"\" rel=\"noopener\">Data preservation and information security<\/a><span lang=\"EN-GB\"><span style=\"line-height:107%\">. <\/span><\/span>\n<\/p>\n<p style=\"text-align: justify\">\n\tIt is important to differentiate between <strong>pseudonymised data, which are personal data, and anonymised data, which are not personal data<\/strong> because anonymisation is not a reversible process. You do not need a permission from the Research Ethics Committee for carrying out a new research using the anonymised data, because the persons under examination cannot be identified any more.\n<\/p>\n<p style=\"text-align: justify\">\n\tPseudonymisation is the processing of personal data in a way where personal data cannot be attributed to the data subject without using additional information (a key), but with the existence of the key, the person can still be identified.\n<\/p>\n<p style=\"text-align: justify\">\n\t\u00a0\n<\/p>\n<p>\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">On the other hand, we need to think about whether anonymisation could affect or distort the value of the data. For example, when the data is anonymised in medical research, it is not possible to give feedback to the participants about their genetic and health risks.<\/span><\/span>\n<\/p>\n<p>\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">Anonymisation of the data could create an illusory feeling that such data can be shared without specific security measures. However, we still need to consider whether re-identification could be possible by aggregating the data with some other databases of personal data or by using new technologies and methods. <\/span><\/span>\n<\/p>\n<p style=\"text-align: justify\">\n\t\u00a0\n<\/p>\n<p style=\"text-align: justify\">\n\tThis London Metro Map Approach to PIA could be helpful when deciding, what steps to take:\n<\/p>\n<p style=\"text-align: center\">\n\t<img decoding=\"async\" alt=\"\" src=\"https:\/\/sisu.ut.ee\/wp-content\/uploads\/sites\/301\/london_metro.png\" style=\"width: 800px;height: 577px\">\n<\/p>\n<p style=\"text-align: justify\">\n\t<strong><span style=\"background-color:#ffd700\">Additional material<\/span><\/strong><span style=\"color:#ffd700\"><strong>:<\/strong><\/span> In case you collect\u00a0and process\u00a0personal data, the OpenAIRE webinar could be useful:\n<\/p>\n<p style=\"text-align: justify\">\n\t<\/p><div class=\"ratio ratio-16x9 mb-3\"><div class=\"video-placeholder-wrapper video-placeholder-wrapper--16x9\">\n\t\t\t    <div class=\"video-placeholder d-flex justify-content-center align-items-center\">\n\t\t\t        <div class=\"overlay text-white p-2 w-100 text-center d-block justify-content-center align-items-center\">\n\t\t\t            <div>Kolmandate osapoolte sisu n\u00e4gemiseks palun n\u00f5ustu k\u00fcpsistega.<\/div>\n\t\t\t            <button class=\"btn btn-secondary btn-sm mt-1 consent-change\">Muuda n\u00f5usolekut<\/button>\n\t\t\t        <\/div>\n\t\t\t    <\/div>\n\t\t\t<\/div>\n<\/div>\n\n<h2>\n\t<b><span lang=\"EN-GB\"><span style=\"line-height:107%\">Protection of the researcher\u2019s privacy<\/span><\/span><\/b><br>\n<\/h2>\n<p>\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">Much attention is paid to the ways how researchers should protect the personal data of research subjects.<\/span><\/span>\n<\/p>\n<p>\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">However, we should not forget that researchers need to protect their own privacy as well and to recognise the dangers related with the collection or processing of their data. <\/span><\/span>\n<\/p>\n<p>\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">For example, the eElurikkuse (eBiodiversity) portal contains data about nature observations:<\/span><\/span>\n<\/p>\n<p>\n\t<a data-url=\"https:\/\/elurikkus.ee\/generic-hub\/occurrences\/search?q=*%3A*&amp;sort=occurrence_date&amp;dir=desc&amp;pageSize=100&amp;fq=basis_of_record%3A%22HumanObservation%22&amp;fq=country%3AEstonia#records\" href=\"https:\/\/elurikkus.ee\/generic-hub\/occurrences\/search?q=*%3A*&amp;sort=occurrence_date&amp;dir=desc&amp;pageSize=100&amp;fq=basis_of_record%3A%22HumanObservation%22&amp;fq=country%3AEstonia#records\" target=\"_blank\" title=\"\" rel=\"noopener\">https:\/\/elurikkus.ee\/generic-hub\/occurrences\/search?q=*%3A*&amp;sort=occurrence_date&amp;dir=desc&amp;pageSize=100&amp;fq=basis_of_record%3A%22HumanObservation%22&amp;fq=country%3AEstonia#records<\/a>\n<\/p>\n<p>\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">By opening the entries, it is possible to learn who, when and where observed some certain species or phenomena. The search can be made by the name of the observer, giving full information about the regions where the observer moved. If the observer has the habit of repeatedly walking in the same area at the same time of the day, (for example, birdwatching on Sunday mornings), it is easy to use the data to predict their activities and specify their location. <\/span><\/span>\n<\/p>\n<p>\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">A bird observer often carries a good and valuable camera and mobile equipment, posting current photos and observation data into databases. Photos are provided with plenty of technical metadata, giving some idea about the equipment the person carries. Uploading of image files to <\/span><\/span><a href=\"https:\/\/www.get-metadata.com\/\"><span lang=\"EN-GB\"><span style=\"line-height:107%\">https:\/\/www.get-metadata.com\/<\/span><\/span><\/a><span lang=\"EN-GB\"><span style=\"line-height:107%\"> enables to examine the metadata of these files.<\/span><\/span>\n<\/p>\n<p>\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\">Aggregating it with other metadata could pose a direct danger to the property and safety of a person by describing their property, location and habits. <\/span><\/span>\n<\/p>\n<p>\n\t<span lang=\"EN-GB\"><span style=\"line-height:107%\"><span>Such data is easily accessible by everyone and the purpose of using personal data cannot be controlled. Editing of metadata before publishing the data in order to increase their security is the task and responsibility of the collector of the data. <\/span><\/span><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u00a0 It is not only researchers who use open research data \u2013 the data is accessible for all people regardless of their purpose of using them. As the objective of open science is to preserve the machine readable FAIR data &#8230;<\/p>\n","protected":false},"author":78,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"class_list":["post-57","page","type-page","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/sisu.ut.ee\/andmehaldus\/wp-json\/wp\/v2\/pages\/57","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sisu.ut.ee\/andmehaldus\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/sisu.ut.ee\/andmehaldus\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/sisu.ut.ee\/andmehaldus\/wp-json\/wp\/v2\/users\/78"}],"replies":[{"embeddable":true,"href":"https:\/\/sisu.ut.ee\/andmehaldus\/wp-json\/wp\/v2\/comments?post=57"}],"version-history":[{"count":1,"href":"https:\/\/sisu.ut.ee\/andmehaldus\/wp-json\/wp\/v2\/pages\/57\/revisions"}],"predecessor-version":[{"id":307,"href":"https:\/\/sisu.ut.ee\/andmehaldus\/wp-json\/wp\/v2\/pages\/57\/revisions\/307"}],"wp:attachment":[{"href":"https:\/\/sisu.ut.ee\/andmehaldus\/wp-json\/wp\/v2\/media?parent=57"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}