Data controllers depositing research data to FSD for processing fulfil their obligations imposed by data protection legislation on the contents of the contract by using the new contract models. The new legislation is enforceable from 25 May 2018. The contractual arrangement also protects research subjects by ensuring high level of data protection and data security.
Why was it necessary to update the contract models?
Freedom of contract is a general principle that includes, for example, freedoms of content and form. Exceptions to freedom of contract usually stem from consumer protection legislation or competition law, for instance. The GDPR broadens the requirements set for contracts between data controllers and data processors, when compared to Directive 95/46/EC on data protection which was implemented in the Finnish legislation by the Personal Data Act (523/1999). Previously, the terms and clauses in contracts on data protection were governed by Article 17 of the Directive. Article 17 contained a rather general requirement to stipulate in a contract on the security of data processing and that the processor follows the instructions of the data controller. In contrast, the GDPR contains detailed provisions on the content and form of a contract between a data controller and a data processor.
In most cases, FSD acts as the data processor on behalf of the data controller who has deposited the research data. The detailed contractual terms required by the GDPR have been included in the annex of the deposit agreement. The fundamental solutions regarding data reuse have been left intact in the agreement. In the event where research data containing personal information is delivered to FSD before a deposit agreement is concluded, the situation is covered by a separate agreement on personal data processing for assessing the suitability of research data for archiving.
All research data do not necessary contain personal data. This is often difficult to evaluate at the outset without reviewing the data in more detail. For this reason, the contractual terms regarding the processing of personal data have been included in all contracts.
Benefits of the new contract terms
The new contractual terms have multiple benefits for data controllers depositing research data. From their point of view, the detailed contract terms on personal data processing
- facilitate fulfilling the data controller's obligation of accountability in accordance with Article (5)(2) of the GDPR
- increase research participants' confidence in responsible handling of their data
- allow to legally transfer research data to FSD for processing
- can be taken into account when performing data protection impact assessment (DPIA).
The contract terms also have benefits for the cooperation between the depositor and FSD. The contract
- enhances communication between the contracting parties
- strengthens the security of personal data processing
- clarifies the division of obligations and duties.
Additional information:
» Agreement on personal data processing for assessing the suitability of research data for archiving (PDF)
» Deposition Agreement (PDF)
Antti Ketola
lawyer
firstname.surname [at] uta.fi
This blog post is available also in Finnish:
Uudet sopimusmallit tutkimusaineistojen arkistointiin.
Ei kommentteja:
Lähetä kommentti