Dataset Information

DAISY: A Data Information System for accountability under the General Data Protection Regulation.

ABSTRACT: BACKGROUND:The new European legislation on data protection, namely, the General Data Protection Regulation (GDPR), has introduced comprehensive requirements for the documentation about the processing of personal data as well as informing the data subjects of its use. GDPR's accountability principle requires institutions, projects, and data hubs to document their data processings and demonstrate compliance with the GDPR. In response to this requirement, we see the emergence of commercial data-mapping tools, and institutions creating GDPR data register with such tools. One shortcoming of this approach is the genericity of tools, and their process-based model not capturing the project-based, collaborative nature of data processing in biomedical research. FINDINGS:We have developed a software tool to allow research institutions to comply with the GDPR accountability requirement and map the sometimes very complex data flows in biomedical research. By analysing the transparency and record-keeping obligations of each GDPR principle, we observe that our tool effectively meets the accountability requirement. CONCLUSIONS:The GDPR is bringing data protection to center stage in research data management, necessitating dedicated tools, personnel, and processes. Our tool, DAISY, is tailored specifically for biomedical research and can help institutions in tackling the documentation challenge brought about by the GDPR. DAISY is made available as a free and open source tool on Github. DAISY is actively being used at the Luxembourg Centre for Systems Biomedicine and the ELIXIR-Luxembourg data hub.

SUBMITTER: Becker R

PROVIDER: S-EPMC6892452 | biostudies-literature | 2019 Dec

REPOSITORIES: biostudies-literature

ACCESS DATA

Publications

DAISY: A Data Information System for accountability under the General Data Protection Regulation.

Becker Regina R Alper Pinar P Grouès Valentin V Munoz Sandrine S Jarosz Yohan Y Lebioda Jacek J Rege Kavita K Trefois Christophe C Satagopam Venkata V Schneider Reinhard R

GigaScience 20191201 12

<h4>Background</h4>The new European legislation on data protection, namely, the General Data Protection Regulation (GDPR), has introduced comprehensive requirements for the documentation about the processing of personal data as well as informing the data subjects of its use. GDPR's accountability principle requires institutions, projects, and data hubs to document their data processings and demonstrate compliance with the GDPR. In response to this requirement, we see the emergence of commercial ...[more]

PMID: 31800037

Similar Datasets

Project description:Context Big Data Analytics is a rapidly emerging IT practice whose applications offer benefits for a wide variety of business areas across an organisation. Given the wide scope of applications, the many types of processing involved, including those for purposes not yet foreseen, and the inherent privacy concerns resulting from collecting and storing personal data, the newly introduced General Data Protection Regulation (GDPR) poses specific challenges for safeguarding the security and protection of big data. These challenges are not limited to the IT function but extend across the entire organisation. This raises the question whether Enterprise Architecture Management (EAM), as an approach for ensuring the coherence, strategic alignment and focus on value creation of all organisational resources, offers guidance for addressing those challenges in a holistic manner, and thus provides a fruitful ground for developing an approach for complying to GDPR requirements in a Big Data context. Objective This study surveys the state-of-the-art in research on security, privacy, and protection of big data. The focus is on investigating which specific issues and challenges have been identified and whether these have been linked to GDPR requirements. Further, it examines whether previous research has investigated the potential of EAM in addressing those challenges and what the main findings of those studies are. Method We used Systematic Mapping Review (SMR), which is a methodology for literature review aimed at surveying the state-of-the-art in a research field as it is documented in the scientific literature. Further, we used Template Analysis, which is a thematic analysis technique, for coding the texts of the selected papers, classifying the research studies, and interpreting the different themes addressed in the literature. Results Our study indicates that only few researchers have explored the use of EAM practices in relation to data security and protection in a Big Data context. We further identified seven trends within the areas under consideration that could be subjects for further research. Conclusions Our study does not invalidate the potential of EAM to help addressing GDPR requirements in a Big Data context. However, how EAM practices may contribute to risk management and data governance in environments where big data are being processed, is still a huge research gap, which we intend to address in our future research. Supplementary Information The online version of this article (10.1007/s10257-020-00500-5) contains supplementary material, which is available to authorized users.

Project description:As of May 2018, all relevant institutions within member countries of the European Economic Area are required to comply with the European General Data Protection Regulation (GDPR) or face significant fines. This regulation has also had a notable effect on the European Union (EU) candidate countries, which are undergoing the process of harmonizing their legislature with the EU as part of the accession process. The Republic of Serbia is an example of such a candidate country, and its 2018 Personal Data Protection Act mirrors the majority of provisions in the GDPR. This paper presents the impact of the GDPR on health data management and Serbia's capability to conduct international health data research projects. Data protection incidents reported in Serbia are explored to identify common underlying causes using a novel taxonomy of contributing factors across aspects and health system levels. The GDPR has an extraterritorial application for the non-EU data controllers who process the data of EU citizens and residents, which mainly affects private practices used by medical tourists from the EU, public health care institutions frequented by foreigners, as well as expatriates, dual citizens, tourists, and other visitors. Serbia generally does not have well-established procedures to support international research collaborations around its health data. For smaller projects, contractual arrangements can be made with health data providers and their ethics committees. Even then, organizations that have not previously participated in similar ventures may require approval or support from health authorities. Extensive studies that involve multisite data typically require the support of central health system institutions and relevant research data aggregators or electronic health record vendors. The lack of a framework for preparation, anonymization, and assurance of privacy preservation forces researchers to rely heavily on local expertise and support. Given the current limitation and potential issues with the legislation, it remains to be seen whether the move toward the GDPR will be beneficial for the Serbian health system, medical research, protection of personal data and privacy rights, and research capacity. Although significant progress has been made so far, a strategic approach is needed at the national level to address insufficient resources in the area of data protection and develop the personal data protection environment further. This will also require a targeted educational effort among health workers and decision makers, aiming to improve awareness and develop skills and knowledge necessary for the workforce.

Project description:UnlabelledThe Massachusetts Screening, Brief Intervention and Referral to Treatment (MASBIRT) Program, a substance use screening program in general medical settings, created a web-based, point-of-care (POC), application--the MASBIRT Portal (the "Portal") to meet program goals.ObjectivesWe report on development and implementation of the Portal.MethodsFive year program process outcomes recorded by an independent evaluator and an anonymous survey of Health Educator's (HEs) adoption, perceptions and Portal use with a modified version of the Technology Readiness Index are described. [8] Specific management team members, selected based on their roles in program leadership, development and implementation of the Portal and supervision of HEs, participated in semi-structured, qualitative interviews.ResultsAt the conclusion of the program 73% (24/33) of the HEs completed a survey on their experience using the Portal. HEs reported that the Portal made recording screening information easy (96%); improved planning their workday (83%); facilitated POC data collection (84%); decreased time dedicated to data entry (100%); and improved job satisfaction (59%). The top two barriers to use were "no or limited wireless connectivity" (46%) and "the tablet was too heavy/bulky to carry" (29%). Qualitative management team interviews identified strategies for successful HIT implementation: importance of engaging HEs in outlining specifications and workflow needs, collaborative testing prior to implementation and clear agreement on data collection purpose, quality requirements and staff roles.DiscussionOverall, HEs perceived the Portal favorably with regard to time saving ability and improved workflow. Lessons learned included identifying core requirements early during system development and need for managers to institute and enforce consistent behavioral work norms.ConclusionBarriers and HEs' views of technology impacted the utilization of the MASBIRT Portal. Further research is needed to determine best approaches for HIT system implementation in general medical settings.

Dataset Information

DAISY: A Data Information System for accountability under the General Data Protection Regulation.

Publications

DAISY: A Data Information System for accountability under the General Data Protection Regulation.

Similar Datasets

OmicsDI is part of the ELIXIR infrastructure

Tweets