Data management plan (version 1.0). Report No D6.1 of the Horizon Europe Project 101082212 — PLANET4B

BETTER DECISIONS FOR BIODIVERSITY AND PEOPLE Horizon Europe Project PLANET4B DATA MANAGEMENT PLAN (VERSION 1.0) 1.1.5 2 PLANET4B receives funding from the European Union’s Horizon Europe research and innovation programme under grant agreement No 101082212. This project is funded by UK Research and Innovation (UKRI) under the UK government’s Horizon Europe funding guarantee. This work has received funding from the Swiss State Secretariat for Education, Research and Innovation (SERI). Views and opinions are of those of the authors only and do not necessarily reflect those of the European Union, European Commission, the government of the United Kingdom, or the government of Switzerland. The European Union, the European Commission, the government of the United Kingdom, or the government of Switzerland cannot be held responsible for them. iii Key deliverable information Deliverable number D6.1 Deliverable title Data Management Plan (version 1.0) Task leader Coventry University (CU) Corresponding author Alex Franklin Dissemination level Public Status Final Deliverable description The Data Management Plan includes FAIR (Findable, Accessible, Interoperable, Reusable) data management criteria and EU's Open Science practices, data types, licences and formats along with data practices to be applied within the project. Version Status Date Authors/Reviewers 0.1 Draft 31/03/2023 Authors: PLANET4B Ethics Committee [Alex Franklin (CU); Sandra Karner (IFZ); Robert Home (FiBL)] 0.2 Draft 05/04/2023 Reviewers: Eszter Kelemen (ESSRG); Michelle Mayer, Research Data Management Officer (CU); Christian Neumeister, Data Protection Officer (MLU); Agnes Zolyomi 0.3 Draft 06/04/2023 Reviewers: All PLANET4B Research Partners 0.4 Draft 19/04/2023 Authors: PLANET4B Ethics Committee [Alex Franklin (CU); Sandra Karner (IFZ); Robert Home (FiBL)] 1.0 Final 30/04/2023 Reviewer: Torsten Wähler (MLU) Project acronym PLANET4B Project title understanding Plural values, intersectionality, Leverage points, Attitudes, Norms, behaviour and social lEarning in Transformation for Biodiversity decision making Starting date 01st November 2022 Duration 36 months Website https://planet4b.eu/ Project coordination and scientific lead team Ilkhom Soliev; Alex Franklin; Agnes Zolyomi; Torsten Wähler iv Recommended citation Franklin, A., Karner, S., & Home, R. (2023). Data Management Plan (version 1.0). Report No D6.1 of the Horizon Europe Project 101082212 – PLANET4B. Brussels: European Research Executive Agency. DOI: 10.5281/zenodo.15496016 Rights and license This work is licensed under a Creative Commons Attribution 4.0 International License. The Creative Commons Attribution license allows re-distribution and re-use of a licensed work on the condition that the creator is appropriately credited. Read more. v Table of Contents Key deliverable information ..................................................................................... iii Executive Summary ................................................................................................... 1 1. Introduction ......................................................................................................... 1 2. Data Summary ..................................................................................................... 2 3. FAIR data ................................................................................................................ 3 3.1 Making data findable, including provisions for metadata ........................................ 3 3.2 Making data openly accessible ................................................................................... 4 3.3 Making data interoperable ........................................................................................... 5 3.4 Increase data re-use (through clarifying licences) ................................................... 6 3.5 Allocation of resources ............................................................................................... 6 4. Data security ........................................................................................................... 7 4.1 Data to be stored .......................................................................................................... 7 4.2 Data storage .................................................................................................................. 8 4.3 Accessibility ................................................................................................................. 9 5. Ethical aspects ....................................................................................................... 9 5.1 Overview ....................................................................................................................... 9 5.2 Humans ......................................................................................................................... 9 5.3 Procedures and criteria to identify/recruit research participants ......................... 10 5.4 Informed consent procedures ................................................................................... 11 5.5 Templates of informed consent and information sheet ......................................... 12 5.6 Involvement of vulnerable individuals/groups and measures to prevent enhancing their vulnerability/stigmatisation .................................................................. 12 5.7 Incidental findings policy .......................................................................................... 13 5.8 Securing consent/assent in the case of children and adults unable to give informed consent ............................................................................................................. 14 5.9 Research ‘in the field’ ................................................................................................ 14 5.10 Protection of Personal Data .................................................................................... 14 5.11 Confirmation of authorisation ................................................................................. 15 5.12 Justification of personal data collection ................................................................ 15 5.13 Templates of informed consent and information sheet ....................................... 16 5.14 Publicly available data ............................................................................................. 16 5.15 Data not publicly available ...................................................................................... 16 6. Third Countries .................................................................................................... 16 6.1 Conformity with Horizon 2020, European Union, national and international legislation .......................................................................................................................... 16 vi 6.2 Authorisation for importing of research data to the European Union .................. 16 7. Data Management and the GDPR ....................................................................... 17 7.1 Personal data must be processed fairly and transparently ................................... 17 7.2 Personal data can only be collected for specified, explicit and legitimate purposes ........................................................................................................................... 17 7.3 Personal data must be adequate, relevant and limited to what is necessary for processing ........................................................................................................................ 18 7.4 Personal data must be accurate and kept up to date ............................................. 18 7.5 Personal data must be kept in a form such that the data subject can be identified only as long as it is necessary for processing .............................................................. 18 7.6 Personal data must be processed in a manner that ensures its security ............ 18 7.7 The controller’s responsibility .................................................................................. 19 Annex 1 ..................................................................................................................... 20 ETHICS: PLANET4B Informed Consent Template Forms .................................... 20 Part I: Information Sheet .................................................................................................. 20 Part II: Certificate of Informed Consent Form [Example template] ............................. 24 Annex 2 ..................................................................................................................... 25 PLANET4B Website Privacy Policy ........................................................................ 25 Introduction ...................................................................................................................... 25 Type of data and related treatment ................................................................................. 25 Purpose of data collection and treatment ...................................................................... 25 Data Controller ................................................................................................................. 26 Data protection and storage ............................................................................................ 26 4 Cookies Policy ............................................................................................................... 26 Legislation of personal data protection and treatment ................................................ 26 Duration of data process ................................................................................................. 27 Data transfer ..................................................................................................................... 27 Rights of Data Subject ..................................................................................................... 27 Changes to Privacy Notice .............................................................................................. 27 1 Executive Summary Alarming and continued loss of biodiversity now threatens both the biosphere and human life through failures in fundamental ecosystem service delivery. System-wide transformative changes are needed, including altering paradigms, behaviour and values (IPBES, 2019). To address this, PLANET4B will provide insight into the diverse perceptions of biodiversity and its communication to understand behaviours and motivations around biodiversity prioritisation. Existing multidisciplinary behaviour theories (e.g. framing, nudging, leverage points) that could be applied for biodiversity decision making will be explored. Factors such as gender, religion, ethnicity, race, age, culture, disability will be reviewed to understand how they can potentially impact biodiversity perception and decision making. Founded on this knowledge, a transdisciplinary framework will be developed for changing attitudes and behaviour in a generative way, which actively embraces the transformative power of plural knowledges and intersectional diversity. Relevant behaviour change (e.g. experiential games), creative and deliberative (e.g. story-telling) methods will be adapted and applied in 11 place-based and sectoral cases from 8 countries, EU and at global level to explore the applicability of these theories and methods for triggering transformative change. Having monitored the impacts of these co-creative and participatory interventions in a range of key sectors, as well as socio-cultural and environmental settings, the findings will be synthesised and scaled up to EU and global levels to serve as inputs for EU and international policies (e.g. implementation of the EU Biodiversity Strategy for 2030, post-2020 global biodiversity framework) and for businesses about how transformative change can be triggered. Target groups, sectors and institutions will be enabled with the gained knowledge and methods to initiate transformative change. 1. Introduction This Data Management Plan (DMP) explains how the PLANET4B project will secure and manage data and how it complies with data management policies including the FAIR principles and the General Data Protection Regulation (GDPR). The DMP predefines guidelines for all consortium members, inclusive of all individuals who will have access to, manage and use the project data, on how to handle various types of data sensitivity and data security. This version (V1.0) of the PLANET4B DMP is the first of three scheduled iterations to be produced during the active life-time of the project. It will be replaced by a second (updated) version (2.0/Deliverable 6.2) in month 18, and by a third and final version (3.0/Deliverable 6.3) in month 36 of the project. By implementing a staged approach to the planning and management of PLANET4B data throughout the lifetime of the project, we will be able to ensure that we remain responsive to and up-to-date with any changes in methodological strategy at both the individual case study and overall project level. This precautionary approach is important given the participatory (action orientated) and generative approach that forms the basis of PLANET4B. Regular review is also important in the context of the still unresolved legal status of the UK following its Exit from the European Union in 2 2020 and the associated implications of this for data management and handling by the UK consortium partners (CU, WCMC, DC) and any associated data collection activity undertaken within the UK. This DMP is primarily concerned with the management of data for research purpose. In the case of data collected and stored – via the PLANET4B website – for the purpose of communicating research findings (and/or any associated ‘ask the expert’ online interaction with data subjects), this is governed by a separate data privacy policy, a copy of which is included as an Annex to this document. In the remainder of this document, firstly a data summary is provided, followed by sections on the FAIR Data Management principles and implications of the project, data security and ethical aspects as well as the GDPR principles integration to the project. The document concludes with an Annex containing template ‘Participant Information’ and ‘Informed Consent’ forms (Annex 1) and a copy of the PLANET4B website privacy policy (Annex 2). 2. Data Summary The purpose of the data collection and its relation to the objectives of the PLANET4B project is to provide insight into the diverse perceptions of biodiversity and its communication to understand behaviours and motivations around biodiversity prioritisation. The data collection is required in order to understand 1) how factors such as gender, religion, ethnicity, race, age, culture, disability, norms, values and behaviour intersect and are implicated in biodiversity relevant decision making across a range of different scales and settings; and in turn, 2) how best to channel this understanding of complexity into the design of stakeholder interventions, transformative pathways and a series of targeted (yet, scalable) policy recommendations, in order to prioritise biodiversity and halt biodiversity loss. The data collection will be centred around adapting and applying relevant behaviour change, creative and deliberative methods in 11 intensive/place-based and extensive/sectoral cases from 8 countries, EU and at global level to explore the applicability of these theories and methods for triggering transformative change. This activity will be complimented with the use of a mix of more traditional deskand fieldbased social science methods alongside, including for the purposes of measuring the impact of any interventions undertaken. PLANET4B will involve both primary and secondary data collection. The project will commence with desk-based secondary data collection (e.g. literature reviews) and also consortium partner workshops (Work Packages 1, 2 and 3). As an integral part of this first stage (particularly months 1–9) consortium partners will also make known to Task leaders any existing data sets which have relevance to the project (including, if applicable, reducing the requirement for primary data collection in instances where the required data/information already exists). In relation to the primary data collection associated with the 11 case studies, exact data collection methods will be largely agreed upon during the first 6–15 months of the project (with further detail on data collection methods accordingly being included in Version 2.0 of the DMP). In the case of the intensive place-based case studies it is anticipated that, in addition to standard social science research methods (e.g. interviews, focus groups, survey) they will all 3 feature at least one form of generative intervention method and potentially a combination of more than one type (e.g. behavioural nudge, ‘serious game’, creative, arts based). Depending on the outcomes and learning gained from the application of the intervention methods within individual case study settings, refined versions will also then be used to support the project’s scaling up and scaling out activities with key national and international stakeholders (Work Package 4). Overall then, the format of the data will vary in size and attribute. It will include data such as original tangible data (video (.mp4) and audio recordings (.mp3), hard copy surveys, field notes, signed consent forms (.doc, .pdf), drawings (.jpg), etc.), digital data (e.g. interview schedules, workshop design, transcribed interviews and focus group discussions (.docx, .pdf), photographic (.tif) or video recordings (.mp4)), and processed data sets used in publications, including information to understand the processing (e.g. coding steps, data (.doc, .xls) to allow others to check and/or replicate the process leading to the results, and to guarantee transparency and scientific integrity of data processing. PLANET4B research will involve human participants as ‘volunteers for social or human sciences research’. The involvement of human participants refers to their role as respondents, and upon occasion as participatory action research collaborators – during individual case study interventions especially (WP3). All such involvement will be subject to detailed ethical standards (please see the Ethics section of this DMP; ‘Part 4: Ethics Self-Assessment' of the Grant Agreement; also Articles 14 and 15 of the Grant Agreement for further details). Ethical issues primarily relate to the involvement of research participants, including members of the public from minority groups and the youth. Emphasis will be placed on engagement of individuals representing (in total) a wide range of social characteristics (e.g. gender, age, ethnicity, religion, disability) in accordance with the call’s prioritisation of intersectionality. Data collected may include sensitive personal data (e.g. race or ethnic origin, religious beliefs, political opinion, health). Interventions will be designed for the purpose of achieving the impact of encouraging greater understanding, support and action towards prioritisation of biodiversity. There will be no negative or adverse impacts (social, environmental, economic, political or cultural) resulting from research participation in this project, or from the research activities more broadly. 3. FAIR data 3.1 Making data findable, including provisions for metadata PLANET4B will make data open whenever possible, but as closed as necessary when taking into consideration personal data and privacy. When affecting confidentiality and privacy, data will not be shared publicly. In all other cases, we aim to make the research data as widely available as possible, considering the FAIR principles. As methods of data collection, as well as data types, are yet to be finalised at this stage in the project, included in this DMP version 1.0 are indicative answers on metadata and data findability. Accordingly: 10 role as respondents during method testing (WP2), individual case study based (WP3) and/or scaling up intervention activity (WP4), the latter including interactive and generative communication and dissemination activities. All research undertaken in connection with the 11 case studies of the PLANET4B programme (WP3) is subject to the ethical standards in force at the respective associated lead case study partner institution, or in the case of consortium partners for whom no in-house ethical review board exists (FUG; OOF; DC; CGE), their involvement is subject to the ethical standards of the directly associated research partner institution (respectively: IFZ; NINA; CU; MLU). In the event no ethical standards are yet in force at one or more institution, the research will be subject to the ethical standards with regard to research with human participants set by the PLANET4B coordinating institute MLU. 5.3 Procedures and criteria to identify/recruit research participants The research is expected to involve voluntary participation of humans in the following type of individual and group research activities: serious games, story-telling workshops, in-depth, semi-structured and structured interviews/surveys; mobile (walking) interviews, discussion groups; creative visualisation workshops; face-to-face meetings; online platforms; participant observation; action research; participative methods; observation of group behaviour (to be confirmed in V2.0 of the DMP). None of those activities belong to any of the activities highlighted by the Ethical Issues Checklist. Among the participants are likely to be: community members; policymakers at different administrative levels; representatives of civil society organisations; representatives of local and international businesses; profit and non-profit organisations such as schools and social enterprises. The participants will be able and will be asked to give informed consent before taking part in research activities. In advance of being asked to give informed consent all participant rights as well as duties and obligations of the researchers will be provided in an accompanying participant information sheet (see Annex 1). Should any case studies require the recruitment of minors and/or vulnerable adults as part of the research, the PLANET4B Ethics Committee will support the associated partners in developing a purposefully adapted version of the participant information and informed consent sheets. These sheets will also be submitted for approval by the associated institutional ethics review board (or, where this does not exist, by Coventry University ethics committee). The recruitment of the participants will be based on their interest or participation in community environmental activities. Participants will include those who were engaged in self-directed environmental activities, community group activities, or private and public initiatives. Others may be contacted because of the relevance of their knowledge and experience about biodiversity protection practice, decision making, behaviour change and/or collaborative forms of local environmental management. The data that the participants will be asked to provide will be dependent on the individual case study or type of involvement (workshop, survey) and will be further elaborated upon by V2.0 of this DMP. Each individual consortium partner has been consulted during the drafting of V1.0 of this DMP. Furthermore, each has been tasked with identifying and communicating to 11 the P4B-EC any/all ethical issues relating to their specific case. With regard to the identification and recruitment of research participants this includes: • How research participants will be involved in the project, for which goals, and how they will be recruited; • The choice of methods, e.g. serious games workshops, arts-based workshops, multi-stakeholder participation, interviews, observation etc.; • How respondents will be informed about the collection, use, storage, sharing and ownership of the information; • The requirement that research participants will be asked to sign a letter of consent; • An Annex with the Informed Consent Form and Information Sheet. This will have been approved by the prevailing ethics review board at the project partner institution, or in the event of a partner not having an in-house ethics review board, it will be approved either by the directly involved research partner, or (where the research partner does not have an in-house ethics review board) by Coventry University ethics review board. Approval will be secured prior to the commencement of any primary data collection. Further specification of participants and types of interventions as well as related data provided will be specified in V2.0 of the DMP. 5.4 Informed consent procedures Informed consent will be secured from all human participants when they participate in any PLANET4B primary data collection activities (see Annex 1). All participants will take part in the research voluntarily and could decide at any moment to discontinue their participation. The WP3 lead, working in collaboration with the P4BEC and the co-ordinating institutions, have finalised and approved informed consent participant information sheets for all potential participants in the project (see Annex 1), providing a clear written account of the goals of the research, the methods employed and use made of its results, as well as its relevance to the respondent and the implications of participation. This document will be translated into all languages that are associated with primary data collection. The informed consent participant information sheets explain any potential risks that might be involved (for example being identified as part of a particular group or providing personal information by chance) and how confidentiality will be ensured throughout the collection, analysis and dissemination of data. The informed consent participant information sheets also provide information on how and who to contact regarding any further questions about the project. The information will be explained in person at the start of each new data collection activity, after which – unless for ethical reasons in a limited number of specific cases (e.g. blind participants) it is considered inappropriate to do so – the participants will be asked to sign an informed consent form indicating their consent to participate in the research. In instances where, either an individual indicates that they wish to participate in the study but do not want to sign any formal documentation to this effect, or it is considered inappropriate to ask them to do so (see above), they will instead be asked to provide oral consent. Such oral consent will either be given in the presence of a witness, audio 12 recorded, or reconfirmed in writing in follow-on from the research (together with a reminder of all rights of participation (i.e. Participant information consent form) In the case of any research activities involving minors (WP3 e.g. Urban Youth (Germany) case study; ‘Enabling intersectional nature recreation and biodiversity stewardship for urban resilience’ (Norway) case study; Environmental awareness raising in Education (Hungary) case study), adequate protection of children and young people will be ensured. All information on the research will be composed and communicated in an accessible manner and all minors will be given adequate time to discuss the research with a trusted adult of their choice prior to being asked to confirm if they are willing to give informed consent for participation. In addition to securing the consent of the child, in accordance with national and institutional research ethics procedural requirements and good practice guidelines, permission will also be secured from a legally recognised adult (e.g. parental consent). Where applicable any legal requirements for working with the specific population will be met in full. All participants will be informed that they can withdraw their consent for whatever reason they wish. Permission will be sought to digitally record data collection activities (audio, visual), record via creative drawn image-based capture, or to record them in writing, explaining that all possible steps will be taken to ensure confidentiality and anonymity of participants at the level of the individual (unless participants specifically request otherwise). The researchers will ensure that participants are aware of the archiving process, the accessibility of the data and asked the consent to their research material being stored in this way. The researchers may also produce photographs, drawings, videos, or other similar forms of creative visual data, for the purpose of dissemination on-line, in conferences and exhibitions, and in publications. The use of the visual material produced as part of PLANET4B is limited to dissemination about this project and will not be used otherwise, except where explicit consent has been given by participants. All PLANET4B beneficiaries will use the standard informed consent form, translated into the relevant languages, unless host partner regulations or national laws require specific adaptations. 5.5 Templates of informed consent and information sheet Templates of the informed consent forms and information sheet will be kept on file and will be submitted upon request to the REA. Copies are included in the current version of this document. 5.6 Involvement of vulnerable individuals/groups and measures to prevent enhancing their vulnerability/stigmatisation Partners have been informed about the procedures on the identification and recruitment of research participants in the specific context of vulnerable groups, as well as more broadly. The PLANET4B consortium partners will ensure that all employed researchers are trained to be sensitive to the fact that additional care is imperative when working with vulnerable people and children. Some case studies will potentially include ‘vulnerable individuals or groups’. Detailed information on this, including the types of vulnerable individuals or groups, will be 13 included in Version 2.0 of this DMP, by which point this will have been agreed upon (and all associated institutional level ethical approval secured) . Notably, participants drawn from such groups will be limited either to persons able to give informed consent, or persons accompanied throughout by guardians with legal qualification to give consent on their behalf (e.g. in the case of a minor, parental consent and/or consent of Teacher (where legal authority held to do so)). Given the potential for individuals from vulnerable groups to possess lower than average educational qualifications or training means, all PLANET4B researchers are aware that it was particularly important to check whether participants need any additional support to understand the purpose of the research, data management, and particulars of consent. 5.7 Incidental findings policy The term ‘incidental findings’ is used here to refer to sensitive findings which arise during the collection of research data but which do not directly relate to the aims of the study. An incidental finding could include (for example) a disclosure about criminal activity. Due to the focus of the PLANET4B research and methods of data collection (primarily qualitative; non-medical), it is anticipated that incidental findings will be unlikely to arise. In the event, however, that the PLANET4B research does produce incidental findings, the following procedure would apply. This procedure is in direct accordance with the Coventry University ‘Reporting Disclosure Protocol and Guidance on Result Feedback’. Prior to undertaking any research, individual partner institutions are required to assess the likelihood of sensitive incidental findings becoming known and document how they will be dealt with in accordance with the incidental findings policy of PLANET4B. The information sheet to be provided to research participants at the outset (in accordance with the procedure for informed consent (see below)) makes reference to the incidental findings policy to be adhered to by all PLANET4B researchers. During data collection, in the event that an incidental finding does arise, the researcher is instructed to follow the following Coventry University protocol: • You realise the seriousness of the information; • End the method of data collection (dependent on the situation, either when it’s safe to do so or explain why you cannot progress); • Record any relevant notes; • Contact the most senior level non-involved person/manager immediately or as soon as safe to do so. In accordance with the above, the researcher is obliged to inform their line manager and/or relevant senior personnel of the occurrence and to seek immediate advice from the lead representative of the ethics research committee in their host institution. The local ethics committee (and where relevant, legal representatives within the host institution) would then inform the researcher of any statutory legal and ethical requirement to disclose the finding to a relevant third party (for example, the police force of that nation). In parallel, the researcher is also required to inform the PLANET4B Ethics Committee of the incident. In the event that a researcher’s host partner institution does not have an ethics research committee, they are required to report directly to / seek advice from the PLANET4B Ethics Committee. In such a case the P4B-EC will act in accordance with the incidental findings policy of Coventry 14 University. All incidences of incidental findings will be securely stored on file in accordance with the wider Data Management Policy of PLANET4B and made available to the REA upon request. 5.8 Securing consent/assent in the case of children and adults unable to give informed consent PLANET4B research will be limited only to persons able to give informed consent or persons accompanied throughout by guardians with legal qualification to give consent on their behalf. 5.9 Research ‘in the field’ In accordance with the Grant Agreement, and the standard ethical research practice procedure of Coventry University, all researchers are required to abide by recognised procedures which are established and approved by the Steering Committee to help keep researchers and subjects safe in the field. As specified in the Horizon Europe Guidelines these include: • Keeping careful notes of all research engagements. • Ensuring that a designated contact person within the host institution has full details of where the researcher is, as well as expected start and completion time. • Using mobile phones to keep in touch with the research base. • Reporting any health and safety incidents. Risk assessment constitutes an integral part of the ethics review process within PLANET4B. As employees, all researchers are fully insured (for working nationally and internationally) through their host partner institutions for all activities undertaken in accordance with their employment and research position (including all fieldwork activity). 5.10 Protection of Personal Data The research involves personal data collection and processing, including ‘special categories of personal data’ (formally known as ‘sensitive data’). The research also involves further processing of previously collected personal data (secondary use) (for further information on personal data processing, please see section on GDPR below). The term ‘data’ is used here to refer to all results from research activities – varying from interview recordings and transcripts, to individual logbooks with observations and protocols, to serious games, creative workshops and other forms of participatory visual and creative data construction, to secondary data already available in the public domain. Where personal data collection is required, it may include characteristics of gender, income, education attainment, affiliation, personal values and opinions. In accordance with GDPR and national data protection law, where the collection of personal data is required, the PLANET4B consortium will ensure that: 1. Personal data is processed fairly and lawfully. 15 2. Personal data is obtained only for one or more specified and lawful purposes, and is not further processed in any manner incompatible with that purpose or those purposes. 3. Personal data is adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed. 4. Personal data is accurate and, where necessary, kept up to date. 5. Personal data processed for any purpose or purposes is not kept for longer than necessary for that purpose or those purposes. 6. Personal data is processed in accordance with the rights of data subjects in accordance with national data protection law 7. Appropriate technical and organisational measures are taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data 8. Personal data is not transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data. 9. Data sharing with third parties will be limited to anonymised processed data only, with no GDPR sensitive raw data shared. For the processing of ‘special categories of personal data’ (formally known as ‘sensitive data’) the following additional conditions will also apply: 1. The data subject has given their explicit consent to the processing of the personal data 2. Use of the data is in the substantial public interest, necessary for research purposes and neither supports measures or decisions with respect to any particular individual, nor is likely to cause substantial damage or substantial distress to any person. 5.11 Confirmation of authorisation Where individual case studies involve the collection of personal data, prior authorisation will be secured from the associated Ethics Review Committee or institutional data protection officer of the partner institution at which the researcher is employed, and/or, where required, also from the national data protection authority. Authorisation will be secured in accordance with the GDPR, and with national law. Copies of the authorisation will be kept on file and will be submitted upon request to the REA. 5.12 Justification of personal data collection To be considered for approval any application for personal data collection will be supported by full and detailed justification of the reason as to why collection and/or processing of personal is required. The justification will be submitted to the associated ethics review committee or institutional data protection officer of the institution at which the researcher is employed, and where required, to the national data protection authority. Copies of the justification case will be kept on file and will be submitted upon request to the REA. 16 5.13 Templates of informed consent and information sheet The informed consent forms and information sheet will be kept on file and will be submitted upon request to the REA. Copies of both templates are included in Annex 1. 5.14 Publicly available data Where personal data is collected and used and such data is publicly available, the researcher is required to explicitly confirm that the data were already publicly available. 5.15 Data not publicly available Where personal data is collected and used and such data were not publicly available the researcher is required to secure relevant authorisation prior to its collection and use. Authorisation will be secured in accordance with the GDPR on data protection, and with national law. Copies of the authorisation will be kept on file and will be submitted upon request to the REA. 6. Third Countries 6.1 Conformity with Horizon 2020, European Union, national and international legislation Of the 11 individual case studies, six will involve data collection in a country outside the European Union – referred to here as a ‘third country’: • For the case study ‘Opening nature and the outdoors to Black, Asian and ethnic minority communities’ the ‘third country’ is the UK. • For the case studies 'Enabling intersectional nature recreation and biodiversity stewardship for resilience’, and ‘Sustainable investment behaviour’ the ‘third country’ is Norway • For the case study ‘Trade and Global Value Chains’, the ‘third country’ is Brazil. • For the case study of ‘Agriculture and Migration’, this may potentially involve research in the ‘third countries’ of UK and Switzerland. For the case study 'Swiss attitudes towards agricultural biodiversity’ the ‘third country’ is Switzerland. Notably, in all cases, the research partner institution staff directly involved in undertaking data collection in the associated case study (CU – UK; NINA – Norway; FIBL – Switzerland all already has considerable existing personal experience and knowledge of undertaking data collection in compliance with both national and European Union regulatory and ethical protocols. 6.2 Authorisation for importing of research data to the European Union For the six case study projects anticipated to involve data collection in a ‘Third Country’ (UK, Norway, Switzerland, Brazil), being aware and according with national and international agreement on data sharing, the following procedures have been followed: • For all case studies, where personal data needs to be transferred out of the Third Country and into the European Union, consent will first be obtained from the data subject and, where relevant in accordance with national legislation, 17 authorisation from the relevant governing research body. The consortium partner research institution will keep on file, and submit upon request to the REA such authorisation. In addition to gaining authorisation to export data, the consortium partner will also adhere to all aspects of the PLANET4B policy for the collection of personal data (see above). 7. Data Management and the GDPR As of May 2018, the General Data Protection Regulation came into effect, the main principles of which (Article 5 of the GDPR) are integrated to the PLANET4B DMP as follows. 7.1 Personal data must be processed fairly and transparently “Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject”. PLANET4B will follow Coventry University strict policy on Data Protection that ensures compliance with the data protection principles when collecting personal data. This shall incude: i) Review of forms and documents that are used for data collection; ii) Determine the lawful basis for processing personal data i.e. public interest, legitimate interest, consent; iii) Review and ensure compinace with tranperancy requirements, specifically the transeperancy information which is to be provided for the data subject; iv) Ensure that the any data processing is secure and the data is managed in line with the relevant statotury, regulatory or industry best practice to ensure the highest levels of compliance; v) The participants shall be informed of their rights to withdraw from project, and will be informed of their data protection rights through the published Privacy Notice; vi) Any data collected through the project shall only store and process relevant data, whereas unused and redundant data will be purged; vii) We shall anonymise personal data as soon as possible, Where full anonymisation is not possible the data shall be pseudonymised. The consortium will be fully transparent in the collection of personal data. When collecting data an information leaflet and consent form included relevant information on data use, the data collection methods and processes, the purpose of the research and the way of dissemination as well as open access. The data subjects will also be informed about the possibility to withdraw their data, as well as their rights on requesting information on the types of data stored about them. 7.2 Personal data can only be collected for specified, explicit and legitimate purposes “Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes”. 18 PLANET4B will not collect any (personal) data that is not within the scope of our project. 7.3 Personal data must be adequate, relevant and limited to what is necessary for processing “Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed”. Only data relevant to the project’s research will be collected. Nevertheless, it may have occurred that during the data collection, additional personal information is shared that was not intended to be collected by the project. In such case, data will either be purged, or if somehow relevant to the research, anonymised and after adequate consent further processed. 7.4 Personal data must be accurate and kept up to date “Personal data shall be accurate and, where necessary, kept up to date”. All data collected will be checked with the data subject and if needed updated accordingly. However, in cases where the datasets are difficult to keep up to date, anonymisation and relevant processing of data will be opted for. In addition, datasets will be processed as accurately as possible, with the use of indicating parameters that help with accurate data (e.g. marking the relevant year in datasets). 7.5 Personal data must be kept in a form such that the data subject can be identified only as long as it is necessary for processing “Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”. All personal data that are no longer in use for specific research purpose will be purged as soon as they are not needed. Accordingly, also all personal data will be made anonymous once data has been processed, while it will be ensured during anonymisation that no individual can be identified. At the end of the project, the anonymised data sets will be stored in open repositories. If data cannot be made anonymous, it will be pseudonymised as much as possible and stored according to project and institutional guidance archiving rules and data policy. 7.6 Personal data must be processed in a manner that ensures its security “Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures”. All personal data will be handled in accordance with relevant security protocols. Accordingly, personal data will only be stored on a secure institutional server (e.g. Microsoft Teams hosted by Coventry University, or similar server by other host institutions) complying with GDPR and additional data protection, where access (via 19 Multi Factor Authentication) is managed by the project manager and university IT expert and only provided to authorised personnel and the partners of the project. Access can be limited and withdrawn immediately if needed. Additional people will not have access to these data. At the Microsoft Teams site, the only personal data stored and shared, will be that which a priori were consented by the data subject. Such data are forbidden to be downloaded or stored in a non-secure place. Personal data are only stored for project reporting purposes, and will be deleted as soon as they become unnecessary. Personal data will not be otherwise shared apart from via the Microsoft Teams server. 7.7 The controller’s responsibility “The controller is responsible for, and must be able to demonstrate, compliance with the Data Protection Principles and for securing the same assurances from any 3rd parties” At project level, the project management and coordination team is responsible for the correct data management within the project, which will be regularly checked. At each host institution, there will be one designated person responsible for data management and sharing, who will be accountable for managing and securing personal data sets. Besides, all members of PLANET4B will liaise with relevant bodies of data management and ethical committees in terms of complying with the GDPR and additional data privacy and protection regulations. 26 Data Controller GoodIssue Ltd./Jóügy Kft. the beneficiary partner and lead of communication and dissemination work package is the Data Controller of the personal data collected and treated via PLANET4B website. Goodssue Ltd. management has the accountability and the responsibility to set structure and procedures to treat and protect your data. Appointed members of the staff are responsible for the actual treatment of your data. Other consortium’s members might occasionally operate as Data Processor, in that case, they will comply with the same rules as stated in this privacy notice. Data protection and storage The data processing related to the website’s services takes place at the registered office of Jóügy Kft., Budapest Lehel u. 15. H-1115. 4 Cookies Policy Our websites use cookies so that we can provide you with the best possible user experience. Without some of these cookies, the website simply would not work. Other cookies perform functions like recognising you each time you visit the site or helping our team to understand which parts of the site you find most interesting and useful. Cookies used on PLANET4B website: Session cookie – A session cookie only lasts for the duration of the user’s website visit. A web browser normally deletes session cookies when it quits. • Persistent cookie – A persistent cookie will outlast user sessions. If a persistent cookie has its maximum age set to 1 year, then, within the year, the initial value set in that cookie would be sent back to the server every time the user visited the server. This could be used to record a piece of information such as how the user initially came to this website. • Secure cookie – A secure cookie is only used when a browser is visiting a server via HTTPS, ensuring that the cookie is always encrypted when transmitting from client to server. • First-party cookie – First-party cookies are cookies set with the same domain (or its subdomain) in the browser's address bar. • Third-party cookie – Third-party cookies are cookies set with different domains from the one shown on the address bar (i.e. the web pages on that domain may feature content from a third-party domain – e.g. Google Maps or YouTube). Privacy setting options in most modern browsers allow you to block third-party tracking cookies. Legislation of personal data protection and treatment The Data Controller has the Legitimate Interest to treat your personal data as per art. 6 (f) GDPR 179/2016. Our detailed rationale for claiming legitimate interest is based on a Legitimate Interest Assessment (LIA), periodically reviewed. We believe that it is a mutual benefit to remain in contact; you will receive from us communications 27 exclusively as detailed in the previous paragraphs. We are counting to hear from you back on the specific topics through our communication activity for a mutual growth. Duration of data process Your data will be processed for the whole duration of the mandatory maintenance of the project website and results or until the date when Data Subject withdraws its consent to data process. Data transfer Data Controller processes do not require any transfer of data to external third parties with the sole exception of auditing authorities of the public institutions that funded the project. Following the processes and treatments described above, your personal data can be communicated to the Data Controller’s staff. Furthermore, and in so far as necessary, Personal data shall be disclosed, in so far as they are concerned, to but not limited to the following categories: • Organisations that are part of the PLANET4B Consortium; • Persons in charge of managing the website and the related activities; • Persons who provide services for the management of the information system of the company; • Persons carrying out monitoring, auditing and certification activities linked to the project; The personal data you provide will not be sold to or shared with third parties. Rights of Data Subject EU GDPR legislation guarantees the right to access, rectify or erase your personal data and the right to restrict the processing of your personal data. Where applicable, you also have the right to object to the processing of your personal data and the right to data portability. To read more about the rights of data subjects and the rights and obligations of data controllers see here: General Data Protection Regulation (2018) You have consented to provide your personal data for the present processing operation. You can withdraw your consent at any time by notifying the Data Controller. The withdrawal will not affect the lawfulness of the processing carried out before you have withdrawn the consent. You can exercise your rights by contacting the Data Controller. Your requests will be handled within a maximum of 10 working days. Contact information: [email protected] Changes to Privacy Notice If necessary, we may amend or update this Privacy Statement to reflect changes on the website and feedback from our users. If there are material changes in the way we use or process your personal data, we will notify you by posting a notice of the changes before these come into effect or by sending a notification to you directly.