The GDPR (or national legislation implementing it) places requirements on anyone who processes personally identifiable data concerning residents of the EU and the UK. As per this question the GDPR applies to reference managers. While it seems that either legitimate interest or scientific or historical research purposes would provide justification for the processing, other sections of the law may impose requirements on individuals using these tools:
- Right to be informed
- Data subject have a right to be informed about data processing. One could easily inform each corresponding author that one is processing their data (this could be automated by the reference manager). This could be viewed more as spam than useful information.
- International transfers
- You must not keep personal data for longer than you need it.
- The GDPR says "you must not keep personal data for longer than you need it". How is this interpreted when it comes to reference managers?
- Security of data
- There is a requirement to keep data secure. Obviously reference manager software only holds public information, but there is no exception in the GDPR for this. Should reference manager databases be considered high security documents such that extra security measures are taken?
What measures are appropriate to allow legal use of reference managers that contain data about authors who reside within the EU/UK?