**Executive Summary**

This Deliverable is an update of Deliverable 10.2 ‘Data Management Plan’ and
the new additions are introduced in **Chapter 1** along with the next steps
and future updates, to be presented in the final version (M30) of this
Deliverable.

An overview of ADAS&ME overall system (discussed in D 2.1: ‘ADAS&ME
Architectural

Framework and System Specifications’) and its sub-systems is presented in
**Chapter 2** accompanied by a description of the project’s repository
(discussed in D4.1: ‘Driver/rider state reference database and integration
suite’) to highlight the data sources, profiles, distribution and storage
destinations/ access standards across the UCs and pilot sites.

**Chapter 3** provides an overview of partners responsibilities in relation to
data management and protection.

**Chapter 4** describes the data handling according to FAIR. The different
data management roles in the project are discussed in **Chapter 5** .

Data security is re-visited in this version and discussed with consideration
for GDPR compliance ( **Chapter 6** ).

This update concludes with **Chapter 7** , with the next steps to be taken and
the work to be performed and included in the final version of this
Deliverable.

The GDPR compliance questionnaire and the Data Privacy Impact Assessment
(DPIA) template can be found in **Annex 1** that will be distributed to
partners to be completed by the end of the project. The latter will be
circulated and completed two times by the end of the project. The first
assessment will be included in the final version of the Deliverable (M30) and
the final version in the final technical report.

Additional data management plan templates were prepared in this version based
on the data collected per Use Case, as presented in D7.1: ‘Evaluation
Framework’. The consolidated filled in template can be found in **Annex 2** .

  1. **Introduction**

  

  

This document is an update of the version submitted in M6. The Data Management
Plans aims to define the processes of data handling during and after the end
of the project. In the first version of this Deliverable, data generated by
sensors and devices were annexed, the standards and methodologies were
presented, and the data privacy protection procedure was defined along with
guidelines on how data can be openly shared in order to comply with ORDP
requirements with regards to their storage, curation and preservation.

This update aims to address the following aspects:

  * Data collection per UC pilots, as presented within D7.1 (submitted M18). Types of data along information about privacy, confidentiality, and other characteristics are presented in Table 1 (Annex 2), following the same format with the table annexed in the first version of this deliverable. 

  

  * A short description of the ADAS&ME data repository, based on D4.1, submitted in M18. 

  

In the first version of this deliverable, Annex I, included a very detailed
and long table including all sensors and objective data collected during the
pilots in order to develop the affective state algorithms and respective DSS.
In the second version, the same table includes the data collected per UC in
each pilot site.

  2. **Data architecture and storage in ADAS &Me: an overview **

  

  

The general ADAS&ME system encompasses several subsystems that are further
divided into modules, including both hardware and software components (Figure
1).

There are five different subsystems: a) the **Sensor Subsystem (SS)** , b) the
**Driver state Monitoring subsystem (DSMS)** , c) the **Environmental
Situation Awareness Subsystem (ESAS)** , d) the **ADAS &ME Core (ADAS&ME C) **
, and e) the **Vehicle Automation Subsystem (VAS)** .

Therefore, 5 different types of data are collected: _Soft sensor data, driver
monitoring data, environmental/ vehicle data, digital infrastructure data and
HMI data_ . How these data are handled in the project is presented in the
annexed tables in both this and the previous version of D10.2. Data
collection, storage and analysis is conducted always in accordance to the
project’s data privacy policy, as it has been defined within the first version
of this Deliverable and the Ethics Manual (D9.1).

Environmental Situation Awareness Subsystem

(

ESAS

)

Algorithms for Environmental Situation Determination

ADAS

&

ME Core

(

ADAS

&

ME C

)

Personalization Module

(

PM

)

Decision Support Module

(

DSM

)

HMI Controller Module

(

HMI CM

)

Vehicle Automation Subsystem

(

VAS

)

Vehicle Automation Module

(

VAM

)

Soft Sensor

data

Driver

monitoring Data

Environmental

/

Vehicle Data

Digital

Infrastructure

Data

HMI Data

Interface Module

(

IM

)

Sensor Subsystem

(

SS

)

Driver State Monitoring Subsystem

(

DSMS

)

Algorithms for Driver State Determination
p.18)

All these data will be collected and stored in the ADAS&ME repository for
sharing datasets among partners. A data repository and a suite of
optimization/machine learning algorithms was created within A4.1. The
framework, the mechanisms and the repository are described in detail in
Deliverable 4.1 – Driver/rider state reference database and integration suite.
The repository allows for sharing the sets of data collected during the pilots
with different access rights per allocated partner to ensure alignment and
confidentiality across the project. The repository is accessed through a GUI
and an API. It also offers an optimization/machine learning suit for seamless
prototyping and testing of detection algorithms as well as a RESTful interface
for the integration of customized algorithms, where partners can further use
denoising algorithms.

The repository is available (http://150.140.150.85:8000/repox/index.php) to
registered users only (Figure 2) and it is login protected with accounts
obtained by the administrator (UPatras). Registered users have access only to
their own data, which are categorized per UC.

Data are grouped under Use Cases and not necessarily per pilot site. There are
occasions where certain data are collected across UCs and pilot sites (e.g.
subjective forms and questionnaires).

GDPR compliance for all these aforementioned parts of the ADAS&ME is being
monitored and will be reported in the final version of this Deliverable.
Compliance is monitored through a dedicated questionnaire that can be found
Annex 1. Additionally, the impact of adherence to GDPR to the project will be
estimated through another questionnaire (Data Privacy Impact Assessment (DPIA;
Annex 1). This questionnaire will be distributed to ADAS&ME partners twice
until the end of the project. The first Privacy Impact Assessment (PIA) will
be reported in the final version of this deliverable in M30 and the final one
in the final technical project reporting.

**3 Partners’ Responsibilities**

In order to face data management challenges efficiently, All ADAS&ME partners
have to respect the policies set out in this DMP and datasets have to be
created, managed and stored appropriately.

The **Data controller role** within ADAS&ME Ethics will be undertaken by the
Technical Manager of the project who will directly report to the ADAS&ME
Ethics Board. The **Data controller** acts as the point of contact for Data
Protection issue and will coordinate the actions required to liaise between
different beneficiaries and their affiliates, as well as their respective Data
Protection agencies, to ensure that data collection and processing within the
scope of ADAS&ME, will be carried out according to EU and national
legislation. Regarding the ORDP, the data controller must ensure that data are
shared and easily available.

Each data producer and pilot site leader is responsible for the integrity and
compatibility of its data during the project lifetime. The data producer is
responsible for sharing its datasets through open access repositories. They
are in charge of providing the latest version of their datasets.

Regarding ethical issues, the deliverable D9.2 details all the measures that
ADAS&ME will use to comply with the H2020 Ethics requirements.

The **Data Manager** roles within ADAS&ME will directly report to the
coordination team. The **Data Managers** (CERTH and UPatras) will coordinate
the actions related to data management and in particular the compliance to
Open Research Data Pilot guideline. The data manager is responsible for
implementing the data management plan and to ensure it is reviewed and
revised.

**4 Findable, accessible, interoperable and reusable (FAIR) data**

ADAS&ME project will in principle participate in the Open Research Data Pilot
(ORDP) but data marked as “restricted” or under an “embargo” period will be
excluded. To this end, the data that will be generated during and after the
project and will be included in ORDP should be ‘FAIR’, that is **findable,
accessible, interoperable and reusable** . These requirements don’t affect
implementation choices and don’t necessarily suggest any specific technology,
standard, or implementation solution.

The FAIR principles were generated to improve the practices for data
management and datacuration, and FAIR aims to describe the principles to be
applied to a wide range of data management purposes, whether it is data
collection or data management of larger research projects regardless of
scientific disciplines.

With the endorsement of the FAIR principles by H2020 and their implementation
in the guidelines for H2020, the FAIR principles serve as a template for
lifecycle data management and ensure that the most important components for
lifecycle are covered. This is intended as an implementation of the FAIR
concept rather than a strict technical implementation of the FAIR principles.

**Making data findable, including provisions for metadata:**

  * The datasets will have very rich metadata to facilitate the findability. 

  

  * All the datasets will have a Digital Object Identifiers provided by the ADAS&ME (public part of) repository or another online data storage repository (e.g., ZENODO). 

  

  * The reference used for the dataset will follow this format: ADAS&ME _WPX_AX.X_XX, including clear indication of the related WP, activity and version of the dataset. • The standards for metadata will be defined in the “Standards and metadata” section of the dataset description table (see Table 1 for the current version of the template). 

  

**Making data openly accessible:**

  * Datasets openly available will be marked as “Open” in the “Data Sharing” section of the dataset description table (see **Fel! Hittar inte referenskälla.** ). 

  

  * The repository that each dataset is stores, including Open access datasets, are mentioned in the “Archiving and Preservation” section of the dataset description table (see Table 1). Public repositories such as ZENODO will be one of the considered options. 

  

  * “Data sharing” section of the dataset description table (see Table 1) will also include information with respect to the methods or software used to access the data of each dataset. 

  

  * Data and their associated metadata will be deposed either in a public repository or in an institutional repository. 

  

  * “Data sharing” section of the dataset description table (see Table 1) will outline the rules to access the data if restrictions exist. 

  

**Making data interoperable:**

  * Metadata vocabularies, standards and methodologies will depend on the repository to be hosted (incl. public, institutional, etc.) and will be provided in the “Standards and metadata” section of the dataset description table (see Table 1). 

  

**Increase data re-use (through clarifying licenses):**

  * All the data producers will license their data to allow the widest reuse possible. More details about license types and rules will be provided in the next version “Data Sharing” section of the dataset description table (see Table 1) is the field where the data sharing policy of each dataset is defined. By default, the data will be made available for reuse. If any constrains exist, an “embargo period” or “restricted flag” will be explicitly raised in this section of Table 1\. 

  

  * The data producers will make their data available for third-parties within public repositories only for scientific publications validation purposes. 

  

**5 Data management roles in the project**

In order to face the data management challenges efficiently, all ADAS&ME
partners have to respect the policies set out in this DMP and datasets have to
be created, managed and stored appropriately. This Chapter identifies ADAS&ME
roles related to the management of the data and their responsibilities. These
are: a) the data controller, b) the data producer and c) the data manager. The
GDPR compliance questionnaire that can be found in Annex 1 will be used in
order to define which partners will play these key roles. At this stage, the
roles have provisionally been appointed to CERTH and UPatras (as discussed in
previous chapter). However, data producers are the pilot sites per se.

The **data controller** acts as the point of contact for data protection
issues and will coordinate the actions required to liaise between different
beneficiaries and their affiliates, as well as their respective data
protection agencies, in order to ensure that data collection and processing
within the scope of ADAS&ME, will be carried out according to EU and national
legislation. The data controller must ensure that data are shared and easily
available.

Given the different pilot sites that are considered in ADAS&ME, the consortium
investigates who is the most appropriate partner to take the role of the data
controller. This role may be undertaken either by the pilot leader of each
specific pilot site or the overall data repository administrator (UPatras) or
by each data provider per se depending on the data to be collected and or
generated. The name(s) of the data controller(s) will be announced in the
final DMP version (M30). The **data producer** is any entity that produces
data within ADAS&ME scope. Each data producer is responsible for the integrity
and compatibility of its data during the project lifetime. The data producer
is responsible for sharing its anonymised datasets through open access
repositories, according to the principles and mechanisms defined in the
current document. He is in charge of providing the latest version.

Last but not least, the **data manager** (to be announced in the final version
of the DMP) will coordinate the actions related to data management, will be
responsible for the actual implementation of the DMP successive versions and
for the compliance to Open Research Data Pilot (ORDP) guidelines. As the
ADAS&ME open data will be hosted either by institutional databases or by an
open free of charge platform (e.g. Zenodo), no additional costs will be
required for hosting the data. As partners are not positive in sharing data
outside the data, due to the sensitive and innovative nature of the work
performed within the project, therefore aggregated or inferential data,
metadata and description, as well as open publications might be shared
instead. However, this decision will be made for the final version of this
document.

All research entities participating in the ADAS&ME project shall ensure that
they have entered into an appropriate data sharing agreement prior to any
personal data being shared.

**6 Data Security and GDPR**

ADAS&ME partners ensure that security mechanisms and management procedures are
in place, to: a) ensure personal (sensitive) data protection through a strict
process of data collection, anonymization, harmonization and integration and
b) guarantee data integrity and reliability, ensuring system’s high-
performance operation through the exchange of the necessary information.

The consortium research partners will fully comply at all times with all
applicable data protection legislation and regulation during this project, to
ensure the security and protection of individuals' personal information in
relation to this project. This includes compliance with the General Data
Protection Regulation (GDPR), which came into effect on 25 May 2018. The
consortium and research partners acknowledge the various new obligations and
the new rights granted to data subjects under the GDPR and are aware of the
significant fines that may be imposed should a data breach occur.

In terms of **personal data protection** , personal data will be anonymised
and strictly used for project’s purposes. Before collecting any personal data,
the Local Ethics Representative (will be responsible for informing the
involved pilot users/participants and collecting their informed consents that
will be maintained and stored based on the Grant Agreement rules and
European/local laws. No personal data will be centrally stored, without
anonymisation or pseudonymisation. No personal information will be made
available by the Local Ethics Representative to the pilot sites, i.e., ADAS&ME
partners participating in the pilots. Only one person per site (the Local
Ethics Representative) will have access to the informed consent form
containing the personal information and only that person will be aware of the
relation between the participant’s unique identifier code and their personal
identity, in order to administer the tests. In practice, the Local Ethics
Representative will collect those data required for contacting the
participants and arranging with them the sequence of the current or future
tests. The Local Ethics Representative will then issue a single Test ID
(unique identifier code) for each of them. This person (Local Ethics
Representative) will not participate in the evaluation and will not know how
each user behaved. One month before the end of the project, this reference,
i.e., the reference between the Test ID and the real-life contact details of
the participant, together with any other personal information held on the
participant will be deleted, thus safeguarding full anonymisation of the
results.

The stored data will refer to a user’s age, gender, nationality and other
information relevant to the testing objectives will be safeguarded, stored and
processed only in accordance with all applicable data protection laws and
regulations. The stored data will not contain any other identifier apart from
the Test ID. In no circumstances will a participant be asked for information
relating to their beliefs, political or sexual preferences. User-related data
will be securely and safely stored. Also, data will be scrambled where
possible and abstracted to permit its use to achieve project outcomes while
ensuring data integrity and security.

Any party which provides any data or information (the "Providing Party") to
another party (the "Receiving Party") in connection with the project will not
include any personal information relating to an identified or identifiable
natural person or data subject. To this end, the Providing Party will
anonymise or pseudonymise all data delivered to other parties to an extent
sufficient to ensure that a person without prior knowledge of the original
data and its collection cannot, from the anonymised or pseudonymised data and
any other available information, deduce the personal identity of participants.

Each party shall be solely responsible for the selection of specific database
vendors/data collectors/data providers, and for the performance (including any
breach) of its contracts between it and such database vendors/data collectors,
(to which no other project partner shall be a party, and under which no other
partner assumes any obligation or liability) and shall further warrant that it
has the authority to disclose the information, if any, which it provides to
the other parties, and that where legally required and relevant, it has
obtained appropriate informed consents from all the individuals involved.

Partners supplying special data analysis tooling, shall have the right on
written notice and without liability to terminate the license that it has
granted for such tooling to be used in connection with the project, if the
supplying partner knows or has reasonable cause to believe that the processing
of particular data through such tooling infringes the rights (including
without limitation privacy, publicity, reputation and intellectual property
rights) of any third party, including of any individual.

Each pilot site will have its own Ethics Committee and one person will be
nominated per site as responsible for following the project’s Ethics Board
recommendations and data protection.

Moreover, a Data Privacy Impact Assessment (DPIA) will be used to support this
DMP. In particular, the DPIA will assist with, and demonstrate, compliance
with the GDPR. This will be carried out within the next 6 months and as the
project evolves it will demonstrate compliance in the collection and
processing of personal information. This DPIA will ensure that collection,
handling, use and storage of personal information are reviewed to ensure
compliance with all applicable privacy legislation and regulations. The DPIA
will: • assess whether the proposed collection, handling use and storage is
legally permissible;

  * assess whether the proposal is justified and proportionate; 

  

  * detail the actions necessary to ensure collection, handling, use and storage is compliant and to mitigate any risk to personal information; and 

  

  * provide a record of the decisions that are made to introduce or change the way in which personal information is collected, handled, used or stored. 

  

An indicative template of the DPIA to be used for ADAS&ME can be found in
Annex 1.

Last but not least, whenever **authorisations for data collection** ,
processing and management have to be obtained from national bodies, those
authorisations shall be considered as documents relevant to ADAS&ME. Copies of
all relevant authorisations and approvals shall be submitted prior to
commencement of the relevant part of the research work. The cases where such
authorizations are needed are identified at the pilots by the pilot execution
teams.

**7 Conclusion and next steps**

The data collected per UC and pilot site (Table 1) and the data management
roles (Chapter 5) were defined in this version accompanied by an overview of
the ADAS&ME system and the data management repository characteristics (Chapter
2)for sharing the datasets created and stored per UC tests.

Data privacy was re-visited with consideration for different data management
roles, as required by GDPR. The overall plan related to data management to be
followed during the lifecycle of the project was further refined with
consideration for both pilot planning and respective indicators (D7.1) as well
as the ADAS&ME Ethics related policy (D10.3). A decision upon data visibility
remains to be made.

The next steps entail the following:

  * Circulate the GDPR Questionnaire to further update compliance processes followed by each Pilot site and each data owner; 

  

  * Estimate DPIA twice by the end of the project (M30 an dM36, respectively); 

  

  * Finalise decisions about data openness, structure of shared data, place of sharing. 

  

In addition, it sets the steps, roles and processes towards GDPR adoption
within the project. However, the complete adherence will be described in the
final version of this deliverable in M30.

The final version will include a description of the datasets that will be
shared outside the Consortium of the project (if any), the duration and the
sharing medium and/ technologies used. In addition, the steps taken within the
project to comply to GDPR will be recorded and reported as well as any issues,
difficulties and lessons learnt from this process, as it is new for the
project partners. The final version of the Data Management Plan will also
clearly state which datasets will be shared with the public and which parts
(or whole datasets) will not.