GDPR & submissions to journals

[MedSchoolRat]

My University has banned us from using Dropbox, Google Forms, Doodlepoll, SurveyMonkey, probably Twitter or Facebook too (which we do use professionally, for survey recruitment). Due to GDPR, since we don't have a data sharing agreement with them and there is usually a Microsoft equivalent except OneDrive never works for data sharing . Even a professional email (belonging to someone else) is too much personal information for us to store on these websites.

So... I got to thinking about journal submission. how the automatic systems demand lots of info about coauthors: full name, title, institution, email, full address, sometimes degree qualifications.

My Uni won't have data sharing agreements with each journal. I don't understand the legalese policy statements on journal websites, so I can't explain it to coauthors in order to get their consent (could search for the statement & send a link to it, I suppose). If someone else's email address is too much personal information to give Doodle, how can it be ok to give so much info to a journal submission machine?

Has this question come up for any one else?

[MedSchoolRat]

oh dear, just my institution getting so strict? DPO seems to be snowed under & not answering emails.

[moimichme]

I'm not quite sure, but I suppose in principle, once the journals have that information, it's them liable for any personal data related wrongdoing? So as long as you don't have that information about your co-authors, perhaps because they've given it to the journal themselves, it would be all right? My university is still trying to get us all fully trained on this and doesn't seem to be taking it incredibly seriously though (yet!).

[Thespringsthething]

I don't think this is happening at all at my work. It all seems quite sensible, we've had a lot of emails about storing our participants data and complying with the new regulations, but we haven't had to restrict our own usage as yet. Surely platforms like Twitter are used quite a lot in policy-facing areas?

[MedSchoolRat]

I probably over-reacted in thinking FBk or Twitter would be a problem for simple recruitment; FBk & Twit don't collect the data for which I would be responsible (I think).

But journal submissions: from what I can tell, when I upload a submission & enter (lots of) personal info about each coauthor, I am the data processor who is doing things with personal data, not my own.

Legalise:
Processors ... may only transfer personal data to a third country (in the absence of an adequacy decision) if the controller or processor has provided appropriate safeguards and on condition that data subjects have enforceable rights in that country with respect to the data.

wrt journals: How would I know? How could I know?

Appropriate safeguards may be provided in a number of ways including in the form of Binding Corporate Rules, model contract clauses, or a legally binding instrument between public authorities.

Seems to say I should not give them personal data from any data subject without the data protection agreement in place between my Uni (the Data controller) & the publisher.

If I can't give SurveyMonkey a professional email address without a data protection agreement, then how can I give a publisher a huge amount more personal details? I have legit reasons to use the data thus & They both have legitimate interest to hold the data.

[Thespringsthething]

I wouldn't personally be worried about this. Unis have a very strong incentive to keep REF publishing right now, so if they need to negotiate data agreements with large publishing houses, I'm sure they will. I don't see how it personally affects you though, really, unless I'm missing something. Every researcher and institution needs to publish in journals so it's not our individual problem to solve, surely?