4

The GDPR (or national legislation implementing it) places requirements on anyone who processes personally identifiable data concerning residents of the EU and the UK. As per this question the GDPR applies to reference managers. While it seems that either legitimate interest or scientific or historical research purposes would provide justification for the processing, other sections of the law may impose requirements on individuals using these tools:

  • Right to be informed
  • International transfers
  • You must not keep personal data for longer than you need it.
    • The GDPR says "you must not keep personal data for longer than you need it". How is this interpreted when it comes to reference managers?
  • Security of data
    • There is a requirement to keep data secure. Obviously reference manager software only holds public information, but there is no exception in the GDPR for this. Should reference manager databases be considered high security documents such that extra security measures are taken?

What measures are appropriate to allow legal use of reference managers that contain data about authors who reside within the EU/UK?

Improve this question
7
  • 3
    I am certainly not a lawyer, but would have found it weird if this case was forgotten when drafting GDPR. The same problems are present when processing data about anybody "public", and I can't, for instance, imagine a newspaper sending a member of parliament a GDPR information note when starting to write an article about them. A quick google finds the following article: lexology.com/library/… - Here, there is a "journalistic exemption" mentioned, which also seems to include academic purposes. Perhaps that may apply here as well?
    – DCTLib
    Apr 6, 2022 at 8:06
  • 1
    Personally, I think the answer to the question you linked (that GDPR applies to reference managers) is incorrect. Using similar logic one could imply that keeping a copy of Nature around after you've read it would violate the GDPR since, well, all that 'personal' data is just sitting there on your desk unprotected and unused. However, this question would be better off over on Law SE if you want a real answer.
    – Jon Custer
    Apr 6, 2022 at 13:30
  • @JonCuster My opinion is that the law was not intended to apply in these situations, but the way it was written it does. I thought the linked question covered the legal aspects, and this the practical academic aspects. A paper journal does not have "processing of personal data wholly or partly by automated means" so the GDPR does not apply. A collection of journals organised by date may.
    – User65535
    Apr 6, 2022 at 13:52
  • @User65535 - I'm pretty sure the full GDPR text is much longer than the snippet listed in the linked answer. Again, asking on Law SE would prove more fruitful than opinions here.
    – Jon Custer
    Apr 6, 2022 at 14:00
  • The way I understand this (again, IANAL), the article I linked to in a comment above explains that the GDPR itself applies to the author information, but the "journalistic exemption" frees the holder of the reference database from the relevant obligations that come with it in the way specified in the national laws. If that is really the case, the answer that the OP got on law.stackexchange is correct, but not helpful, because it doesn't clear this up.
    – DCTLib
    Apr 6, 2022 at 14:10

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .