Dear Shamim,

Find below the comments from the NKUA Data Protection Officer regarding the Joint Data Controller Agreement document

• The reference to the Consortium Agreement (paragraph 1 of the Background) does not provide a clear description of the personal data categories or sensitive personal data that will be processed, the categories of persons, the purpose and nature of the processing (which actions and procedures of the project include processing of personal data and what it consists of) that each partner will process. These could be included in an annex
• Since there is data exchange, the partners could be separated into data providers and data receivers, possibly specifying obligations for the latter, such as some additional technical and organisational measures they have to take or more generally when transferring and transmitting information (possibly in a second annex). An attempt is made in the text but from the wording it seems that there is some ambiguity ( e.g. in 4.3, 5, 6.3 which is the other Party?).
• In the sentence of the Background section: 'The Parties agree and acknowledge that it is rarely possible, before or at the start of personal data collection for research purposes, to completely identify the aim of such personal data processing. However, the Parties shall not, as far as possible, process personal data to a greater extent or for other purposes than stated in the primary agreement" we propose to make the corresponding deletion in the text because both the retrospective data and the prospective data of the project must  be collected for specific and legitimate purposes and must always be processed lawfully ( Articles 6(1) and 9(2) of the GDPR) otherwise they are unlawful.
  
• If during the project it is envisaged to use third parties as contractors who will process personal data (processors), it would be appropriate to describe obligations for Controllers such as the existence of personal data processing contracts based on standard contractual clauses or minimum technical and organisational measures to be met, taking into account the nature of the processing they undertake.
  
• Upon termination of the contract, for whatever reason, there may need to be provision for the return or deletion of the data by the data receiver.
  
• If all the provisions we mention are described in the required manner in the consortium agreement, or in deliverables, and you do not wish to include them in the JDCA text, there could be explicit references to them.

Best,

Marianthi

Dear All

 

The Joint Data Controller Agreement is on the agenda as an information point in tomorrow’s OMT meeting.

 

Attached is a draft version, prepared by Linnaeus University’s Data Protection Officer, and the Consortium Agreement which is the reference primary agreement.

 

1. Please pass this onto the appropriate person in your organisation. We would like your feedback and any request for changes by Thursday 24 November 2022.
2. Please check and confirm the name of the person who should sign this for your organisation. It may not be the person currently indicated on the signature pages, i.e., the same person who has signed the Consortium Agreement.
3. If you would like to provide, at the same time, any further information in response to the email sent to you on 24 October as attached, please do so.

 

Best regards

Shamim

-------------------------------------------------

Shamim Patel (ACA)

Project Manager | Exten.(D.T.)² Project

 

Linnæus University

Office of External Relations

SE-351 95 Växjö | Sweden

M: +46 (0)705 898396 | lnu.se

-------------------------------------------------

 

 

_______________________________________________
Extendt2_omt mailing list -- extendt2_omt@lists.sunet.se
To unsubscribe send an email to extendt2_omt-leave@lists.sunet.se

Χωρίς ιούς.www.avast.com