#  Executive summary

This document “D10.2 Data Management Plan (DMP)” is a deliverable of the
PROTAX project, which is funded by the European Union’s H2020 Programme (Grant
Agreement Number 787098).

This document follows the template provided by the European Commission in the
Participant Portal.  1

The aim of PROTAX is to reach advanced and harmonised levels of organisation
and networking and develop a validated and tested set of law enforcement tools
which will be instrumental in capacity building and for an effective counter
tax strategy and solidarity in the EU for the long term.

PROTAX considers the importance of making research data accessible and
available for sharing among interested stakeholders and plans on using the
existing data archives and services to ensure proper curation, preservation
and sharing of collected and generated data.

The purpose of the Data Management Plan (DMP) is to provide an analysis of the
main elements of the data management policy that will be used by the
Consortium with regard to the project research data.

The data management plan includes data protection. Ownership of data,
information and knowledge generated through PROTAX is included in the
consortium agreement. Confidentiality agreements will be signed as relevant,
in particular for the data collected under Task 2.1 (Identify relevant
stakeholders in all 28 Member States). PROTAX will put special emphasis on
anonymisation and encryption when needed to prevent unauthorised access,
accidental deletion or corruption. Each partner will remain owner of its
intellectual and industrial property right over pre-existing know-how.
Knowledge generated by the project shall be the property of the partner
responsible for the work leading to this knowledge. Intellectual Property
Rights (IPR) of the project results shall be ruled as per the consortium
agreement.

Regarding publication of project deliverables and results in reviewed
publications, PROTAX will apply the route to open access publishing to support
the maximum openness to and accessibility of results. PROTAX will present the
results of the project through publications in peer-reviewed journals by
implementing the gold open access route. The partners have chosen the gold
route on the assumption that visitors to the websites of journals will find it
easier and more accessible to simply download our articles free of charge. In
addition, for visitors to the partners’ individual websites and the project
website, we will provide a link to the online journals to further improve the
widest possible accessibility to our published articles.

Figure 1: Research Data Life Cycle

Figure 2: The FAIR guiding principles

Figure 3: Disaster Recovery

**Table 1** : List of acronyms/abbreviations

#  Glossary of Terms  
  
<table>  
<tr>  
<th>

Term

</th>  
<th>

Explanation

</th> </tr>  
<tr>  
<td>

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Data collection

</td>  
<td>

The process of gathering information or data

</td> </tr>  
<tr>  
<td>

Data Management Plan

</td>  
<td>

A plan that includes information on the handling of research data during and
after the end of the project, what data will be collected, processed and/or
generated, which methodology and standards will be applied, whether data will
be shared or made open access and how data will be curated and preserved
(including after the end of the project). ( _H2020 Guidelines on FAIR Data
Management, 2016_ )

</td> </tr>  
<tr>  
<td>

Metadata

</td>  
<td>

Data that describes other data

</td> </tr>  
<tr>  
<td>

Open Access

</td>  
<td>

Open access (OA) refers to the practice of providing online access to
scientific information that is free of charge to the end-user and reusable.
'Scientific' refers to all academic disciplines. In the context of research
and innovation, 'scientific information' can mean peer- reviewed scientific
research articles (published in scholarly journals) or research data (data
underlying publications, curated data and/or raw data). ( _H2020 Guidelines to
the rules on open access to Scientific Publications and Open Access to
Research Data in Horizon 2020, 2017_ )

</td> </tr>  
<tr>  
<td>

Personal Data

</td>  
<td>

Any data relating to an identified or identifiable natural person (‘data
subject’); an identifiable natural person is one who can be identified,
directly or indirectly, in particular by reference to an identifier such as a
name, an identification number, location data, an online identifier or to one
or more factors specific to the physical, physiological, genetic, mental,
economic, cultural or social identity of that natural person  2  
</td> </tr>  
<tr>  
<td>

Research Data

</td>  
<td>

Information, in particular, facts or numbers, collected to be examined and
considered as a basis for reasoning, discussion, or calculation.

( _H2020 Open Access Guidelines, 2017_ )

</td> </tr>  
<tr>  
<td>

Scientific Information

</td>  
<td>

Can mean peer-reviewed scientific research articles (published in scholarly
journals) or research data (data underlying publications, curated data and/or
raw data). ( _H2020 Guidelines to the rules on open access to Scientific
Publications and Open Access to Research Data in Horizon 2020, 2017_ )

</td> </tr> </table>

_Table 2: Glossary of Terms_

#  0 Introduction

The DMP is not a static document, but will evolve over the lifespan of the
project, particularly whenever significant changes arise such as dataset
updates or changes in Consortium policies.

This document is the first version of the DMP, delivered in Month 6 of the
project. It includes an overview of the datasets to be produced by the
project, and the specific conditions that are attached to them. The next
versions of the DMP will get into more detail and describe the practical data
management procedures implemented by the PROTAX project. At a minimum, the DMP
will be updated in Month 18 (October 2019) and Month 36 (April 2021)
respectively.

This document has been produced following the EC guidelines for project
participating in this pilot and additional consideration described in ANNEX I:
KEY PRINCIPLES FOR OPEN ACCESS TO RESEARCH DATA  3  .

#  1 Data Summary

  * _What is the purpose of the data collection/generation and its relation to the objectives of the project?_

  

  * _What types and formats of data will the project generate/collect?_

  

  * _Will you re-use any existing data and how?_

  

  * _What is the origin of the data?_

  

  * _What is the expected size of the data?_

  

  * _To whom might the data be useful ('data utility')?_

  

The purpose of the DMP is to provide an analysis of the main elements of the
data management that will be used by the Protax-Consortium in regard to the
project’s data.

The DMP covers the complete research data life cycle. It describes the types
of research data that will be generated or collected during the project, the
standards that will be used, how the research data will be preserved and what
parts of the datasets will be shared for verification or reuse. It also
reflects the current state of the Consortium agreements on data management and
must be consistent with exploitation and IPR requirements.

_Figure 1: Research Data Life Cycle_

For this first release of DMP, the data types that will be produced during the
project are focused on the Description of the Action (DoA) and on the results
obtained in the first months of the project.

Based on such consideration, Table 3 reports a list of indicative types of
research data that PROTAX will produce. These research data types have been
mainly defined in WP10, including data structures, sampling and processing
requirements, as well as relevant standards. This list may be adapted with the
addition or removal of datasets in the next versions of the DMP to take into
consideration the project developments. A detailed description of each dataset
is given in the following sections of this document.  
  
<table>  
<tr>  
<th>

Data

</th>  
<th>

Format

</th>  
<th>

Origin (WP, task)

</th>  
<th>

Expected size

</th>  
<th>

Utility

</th>  
<th>

Data users

</th>  
<th>

Access level

</th> </tr>  
<tr>  
<td>

Contact list (information obtained from PROTAX partners from publicly
available data)

</td>  
<td>

.xls

</td>  
<td>

WP 10

</td>  
<td>

variable

</td>  
<td>

For engagement, dissemination and communication

activities

</td>  
<td>

PROTAX

partners

</td>  
<td>

Currently restricted to

PROTAX

partners

</td> </tr>  
<tr>  
<td>

Focus Groups response data

</td>  
<td>

.doc,

.xls

</td>  
<td>

WP 2

</td>  
<td>

variable

</td>  
<td>

For research purposes, e.g., state- of-the-art reviews, socioeconomic impact
assessments, identification and analysis of ethical issues

</td>  
<td>

PROTAX

partners

</td>  
<td>

Currently restricted to

PROTAX

partners

</td> </tr>  
<tr>  
<td>

Data from interviews

</td>  
<td>

.doc,

.xls,

audio

</td>  
<td>

WP 2, 3, 4, 5, 6

</td>  
<td>

variable

</td>  
<td>

For research purposes, e.g., state- of-the-art reviews, socioeconomic impact
assessments, identification and analysis of ethical issues

</td>  
<td>

PROTAX

partners

</td>  
<td>

Currently restricted to

PROTAX

partners

</td> </tr>  
<tr>  
<td>

Data from legal research (e.g.

reviews, analyses)

</td>  
<td>

.doc,

.xls,

.pdf

</td>  
<td>

WP 1, 3, 4, 5, 6

</td>  
<td>

variable

</td>  
<td>

To inform the legal analysis

</td>  
<td>

PROTAX

partners

</td>  
<td>

Currently restricted to

PROTAX

partners, will be published via deliverables

</td> </tr>  
<tr>  
<td>

Reports (including deliverables)

</td>  
<td>

doc,

.xls,

.pdf

</td>  
<td>

All WPs

</td>  
<td>

variable

</td>  
<td>

Research and engagement

</td>  
<td>

PROTAX

partners

</td>  
<td>

Largely open access except where

restricted or of

</td> </tr>  
<tr>  
<td>

</td>  
<td>

</td>  
<td>

</td>  
<td>

</td>  
<td>

</td>  
<td>

</td>  
<td>

confidential nature

</td> </tr>  
<tr>  
<td>

Input of stakeholders; result of questionnaire

</td>  
<td>

doc,

.xls,

</td>  
<td>

WP 2

</td>  
<td>

variable

</td>  
<td>

To integrate the views from the stakeholder board and other stakeholders into
the development of the codes by sending out draft versions and questionnaires

</td>  
<td>

PROTAX

partners

</td>  
<td>

Currently restricted to

PROTAX

partners

</td> </tr>  
<tr>  
<td>

Communication materials

</td>  
<td>

.pdf,

.jpg, other audiovisual formats

(e.g. html, mp4,…)

</td>  
<td>

WP 2, 7, 8

</td>  
<td>

variable

</td>  
<td>

Communications with external audiences

</td>  
<td>

PROTAX

partners

</td>  
<td>

Open, post publication

</td> </tr>  
<tr>  
<td>

Codes and Frameworks

</td>  
<td>

.doc,

.xls

</td>  
<td>

WP 11

</td>  
<td>

variable

</td>  
<td>

Improvement and

enhancement of ethical and legal frameworks

</td>  
<td>

PROTAX

partners

</td>  
<td>

open

</td> </tr>  
<tr>  
<td>

Scientific publications

</td>  
<td>

.doc,

.docx,

.pdf

</td>  
<td>

WP 9

</td>  
<td>

variable

</td>  
<td>

Research, communication, impact

</td>  
<td>

PROTAX

partners, external audiences

</td>  
<td>

open

</td> </tr> </table>

_Table 3: PROTAX preliminary overview of Data Types (October 2018)_

Specific datasets may be associated to scientific publications (i.e.
underlying data), public project reports and other raw data or curated data
not directly attributable to a publication. The policy for open access are
summarised in the following picture.

We will conduct “Desktop-Research”, reviewliterature and use openly accessible
statistical data from various institutions (i.e. European Social Survey) to
help us substantiate our findings.

We will conduct case studies (about already judged cases – therefore their
content is publicly accessible), focus groups and interviews (in which notes
and records are taken and transcripted).

The expected size of the data varies by types. scientific documents and
(delivery) reports will rather be small in size – though delivery reports
might have short data appendices (which also won’t be significant in size).

Data received via qualitative (and quantitative) research will be a bit
bigger. The data will include photos, tapings of interviews and their
transcription. Also, data from other (public) sources may be included.

The PROTAX project data will be useful to:

  * Stakeholders 

  

  * Academics and University departments and Institutes that could use the PROTAX data for research and teaching purposes. 

  

  * Journalists and journalist practitioners 

  

  * International Organisations (UN, WTO, etc...) 

  

  * LEA, Tax Authorities 

  

  * Tax Practitioners (Lawyers, ‘Tax Advisors, Accountants, Corporations) 

  

  * NGOs 

  

  * Policy makers 

  

##  PROTAX personal data mapping

The table below identifies the activities which will involve collection
personal data and depicts the purposes of the collection, types of data that
will be processed, its storage formats, modes of collection, sharing,
location, accountability and access arrangements.  
  
<table>  
<tr>  
<th>

**Activity/task/ WP (and purpose)**

</th>  
<th>

**Type of personal data being processed**

</th>  
<th>

**Storage format**

</th>  
<th>

**Mode of**

**collection**

</th>  
<th>

**sharing**

</th>  
<th>

**Location (office, cloud, third parties)**

</th>  
<th>

**Accountability**

</th>  
<th>

**Access**

</th> </tr>  
<tr>  
<td>

Task 2.1, Stakeholder identificatio n and analysis (contact list)

Purpose: to develop contacts for PROTAX

project research and engagement

activities

</td>  
<td>

Name, title, organisation, e- mail id, gender, key activities/relev a nce to
PROTAX,

website, social media handles (optional) (information already in the public
domain)

</td>  
<td>

xls

</td>  
<td>

From project partner networks, from publicly available sources only and the
subscriptio n form on PROTAX website

</td>  
<td>

Internal only; restricted

</td>  
<td>

SharePoin

t

</td>  
<td>

CU

</td>  
<td>

Restricted to PROTAX core EU partners. Coventry

University

(John

Callen) will function as gatekeeper . Password protected.

</td> </tr>  
<tr>  
<td>

PROTAX

events

</td>  
<td>

Name, title, organisation, email

</td>  
<td>

xls,

doc, pdf

</td>  
<td>

From

PROTAX

contact list and public domain

</td>  
<td>

Internal only; restricted

</td>  
<td>

SharePoin

t

</td>  
<td>

Partner managing the event

</td>  
<td>

Partners organising the event

</td> </tr>  
<tr>  
<td>

Focus

Groups (WP

2)

</td>  
<td>

Participants anonymised, voice recordings taken

</td>  
<td>

Audi o

files, .doc,

.docx

, .xls

</td>  
<td>

Focus Groups

</td>  
<td>

Internal, restricted

</td>  
<td>

SharePoin

t

</td>  
<td>

CU

</td>  
<td>

Restricted to PROTAX core EU partners. Coventry

University

(John

Callen) will function as gatekeeper . Password protected.

</td> </tr>  
<tr>  
<td>

Interview- related personal data interviews in

WP2, WP3, WP4, WP5 and WP6

</td>  
<td>

Email, first name, last name, email, expertise,

position,

phone number or virtual id.

</td>  
<td>

.docx

, .doc

</td>  
<td>

PROTAX

contact list and publicly available information

</td>  
<td>

PROTAX

partners carrying out interview s only

</td>  
<td>

CU

Sharepoin

t

</td>  
<td>

Partners carrying out

interviews

.

</td>  
<td>

PROTAX

partners only

</td> </tr> </table>

_Table 4: PROTAX personal data mapping_

PROTAX partners will adhere to their own institutional policies and procedures
on data management. The table below illustrates this further.  
  
<table>  
<tr>  
<th>

Partner

</th>  
<th>

Institutional policy and procedures on research data management

</th> </tr>  
<tr>  
<td>

Coventry

University - UK

</td>  
<td>

Their policies are available via these links:

_https://www.coventry.ac.uk/legal-documents/information-security-policy/_ and

_https://www.coventry.ac.uk/Global/09-aboutus/GDPR/Data%20Protection%20Policy%20V4.pdf_

_John Callen will be the lead person responsible for research data management
and management of compliance in PROTAX._

</td> </tr>  
<tr>  
<td>

Trilateral

Research - UK

</td>  
<td>

Trilateral Research’s institutional policies and procedures are specified in
its internal Policies and Procedures document (last update, October 2017).
Trilateral follows established guidelines in relation to any project work
undertaken, which involves data collection, storage and transfer. Any personal
data collected is stored on a secure, private, cloud-based server that is
maintained on a routine basis. Any personal data collected is anonymised and
data subjects are provided with a pseudonymisation number. All access to
cloud-based server files is granted by invitation only; there is a log
register and related licences for each person on the cloud. Trilateral
encrypts access to the network via state-of-the-art network management tools,
ensuring that only authorised Trilateral staff may access the shared network
environment and assets on the network. Trilateral project members store their
laptops (and any other device used for PROTAX) securely when unattended (at
home or during travel); complete regular backups of locally-stored data;
password protect any sensitive files, including any that may include company
financial or banking information, or personal data for staff or customers;
encrypt home office network access; and install and regularly update anti-
virus software. No project data will be stored locally on Trilateral members’
devices. Any transfer of

</td> </tr> </table>  
<table>  
<tr>  
<th>

</th>  
<th>

sensitive data only takes place over encrypted connections, using password
protections and access controls in the case of uploads and downloads to and
from repositories. Trilateral is completing the process of becoming GDPR-
compliant, which will be finalised before the deadline. Trilateral Research is
accredited under the UK government Cyber Essentials scheme.

_David Wright will be the lead person responsible for research data management
and management of compliance in PROTAX._

</th> </tr>  
<tr>  
<td>

Vienna Centre of Societal Security

(VICESSE) - AT

</td>  
<td>

Vicesse’s institutional policies and procedures are specified in its internal
Policies and Procedures document (last update, September 2018). Vicesse
follows established guidelines in relation to any project work undertaken,
which involves data collection, storage and transfer. Any personal data
collected is stored on a secure, private, cloud-based server that is
maintained on a routine basis. Any personal data collected is anonymised and
data subjects are provided with a pseudonymisation number. All access to
cloud-based server files is granted by invitation only; there is a log
register and related licences for each person on the cloud. Vicesse encrypts
access to the network via state-of-the-art network management tools, ensuring
that only authorised Vicesse staff may access the shared network environment
and assets on the network. Vicesse project members store their laptops (and
any other device used for PROTAX) securely when unattended (at home or during
travel); complete regular backups of locally-stored data; password protect any
sensitive files, including any that may include company financial or banking
information, or personal data for staff or customers; and install and
regularly update anti-virus software. Any transfer of sensitive data only
takes place over encrypted connections, using password protections and access
controls in the case of uploads and downloads to and from repositories.

_Regina Kahry will be the lead person responsible for research data management
and management of compliance in PROTAX._

</td> </tr>  
<tr>  
<td>

Austrian

Ministry of

Finance (BMF)

\- AT

</td>  
<td>

Their policy I available via this link:

_https://www.bmf.gv.at/services/datenschutz.html_

</td> </tr>  
<tr>  
<td>

Austrian

Ministry of

Justice

(BMVRDJ) - AT

</td>  
<td>

The Austrian Ministry of Constitutional Affairs, Deregulation, Reforms and
Justice (BMVRDJ) has recently established new rules on data management and
data protection (“Erlass vom 24. April 2018 über die allgemeine Gewährleistung
des Datenschutzes im BMVRDJ und in den nachgeordneten Dienststellen
(Datenschutzerlass)”). Any personal data collected is stored on a secure,
private server that is maintained on a routine basis. BMVRDJ encrypts access
to the network via stateof-the-art network management tools, ensuring that
only authorised staff may access the network environment and assets on the
network. Laptops (and any other device used for PROTAX) are secured by
multiple passwords and are only accessible via use of ID cards. No project
data will be stored locally on BMVRDJ’s members’ devices. Any transfer of
sensitive data only takes place over encrypted connections.

</td> </tr>  
<tr>  
<td>

Ministry of

Finance

(MFIN) - MT

</td>  
<td>

You appreciate that the Financial Intelligence Analysis Unit (FIAU) as an
intelligence agency is prohibited by law from divulging information relation
to the affairs of the Unit (Article 34(1) of the Prevention of Money
Laundering Act - Cap. 373 of the Laws of Malta). This would include specific
details of its data management (such as collection, storage and dissemination

</td> </tr> </table>  
<table>  
<tr>  
<th>

</th>  
<th>

channels used by the Unit). Having said that below please find an extract from
the Scope of the FIAU's Information Security Policy (v2.0 effective as from
14.09.2015):

The Financial Intelligence Analysis Unit (FIAU) maintains information that is
secret and sensitive. It relies on the information it collects, stores and
processes to carry out its legal obligations and activities effectively and
efficiently in the area of the prevention of money laundering, prevention of
funding of terrorism and the carrying out of compliance monitoring relating to
such activities. The confidentiality of the information is also protected by
virtue of the Prevention of Money Laundering Act (Cap. 373 of the Laws of
Malta). The preservation of the integrity, confidentiality and availability of
its information and systems underpin the Agency’s ability to carry out its
legal obligations and to safeguard its reputation. The exposure of secret and
sensitive information to unauthorised individuals could cause irreparable harm
to the FIAU and its employees. Additionally, if the FIAU information were
tampered with or made unavailable, it could impair its ability to carry out
its operations.

_Daniel Frendo will be the lead person responsible for research data
management and management of compliance in PROTAX._

</th> </tr>  
<tr>  
<td>

Estonian Tax and Customs

Board (ETCB) -

EE

</td>  
<td>

Section 26 of the Estonian Taxation Act imposes the protection of tax secrecy.
The tax authorities and officials and other staff thereof are required to
maintain the confidentiality of information concerning taxable persons,
including all media (decisions, acts, notices and other documents) concerning
the taxable persons, information concerning the existence of media, business
secrets and information subject to banking secrecy, which is obtained by the
authorities, officials or other staff in the course of verifying the
correctness of taxes paid, making an assessment of taxes, collecting tax
arrears, conducting proceedings concerning violations of tax law or performing
of other official or employment duties (hereinafter tax secrecy). The
obligation to maintain tax secrecy continues after the termination of the
service or employment relationship.

According to subsection 6 (7) of Personal Data Protection Act concerning
physical persons there is a general obligation to notify the person concerned
of the data collected. The principle of individual participation requires that
the data subject shall be notified of data collected concerning him or her,
the data subject shall be granted access to the data concerning him or her and
the data subject has the right to demand the correction of inaccurate or
misleading data. This is not specifically applicable in tax matters.

Taxation Act does not require the consent of the person who is the object of a
request for information. In accordance with section 30 of Taxation Act, the
tax authority may disclose information subject to tax secrecy without the
consent of a taxable person:

1.to the competent bodies of a foreign state in respect of a resident taxpayer
in that state concerning information relevant to tax proceedings under the
conditions provided for in an international agreement;

  2. to bodies of the European Union and Member States thereof which are competent to exchange information relating to taxable persons pursuant to the procedure prescribed in the legislation of the European Union 

  

  3. Processing of personal data for scientific research is regulated by section 16 of the Personal Data Protection Act. Permission for conducting scientific research must be requested from the Data Protection Inspectorate if in the process of the scientific research data that are not non-personalized are used without the content of the 

  

  

</td> </tr> </table>  
<table>  
<tr>  
<th>

</th>  
<th>

person. If in the process of scientific research also sensitive personal data
are processed, processing of sensitive personal data must be registered with
the inspection separately. No permission by the inspection is required if
personal data are processed in scientific research with the consent of the
person. Even so, with scientific research carried out on the basis of a
consent, in the process of which sensitive personal data are processed,
processing of sensitive data must be registered with the inspection. If
scientific research is carried out with non-personalized data (i.e., a person
is marked with a feature which does not allow identification of the person),
the data are not deemed to be personal data for the purposes of the law and,
therefore, use of such data does not require consent of the person, permission
of the inspection or registration of processing of sensitive personal data.
For the implementation of this provision, personal data must be coded before
these are handed over to the person carrying out the scientific research.
Permission for scientific research can be requested by submitting an
application in Estonian to the inspection.

• Relevant legal Act`s:

  1. Taxation Act 

  

  2. Public Information Act 

  

  3. Personal Data Protection Act 

  

  4. Electronic Communications Act 

  

  5. EU General Data Protection Regulation **Standards we implement**

  

  

ISKE (Three-Level IT Baseline Security System) the information security
standard that is developed for the Estonian public sector. According to the
Government of the Republic Regulation no. 273 of 12 August 2004- ISKE is
compulsory in organizations of state and local administration who handle
databases/ registers. The goal of ISKE implementation is to ensure the
security Level sufficient for the data processed in IT systems. The necessary
security level is achieved by implementing the standard organizational,
infrastructural/physical and technical security measures. The preparation and
development of ISKE is based on a German information security standard - IT
Baseline Protection Manual (IT-Grundschutz in German), which has been adapted
to match the Estonian situation. Estonia’s regulatory authority that manages
ISKE, has added some Estonia-specific content. In particular, ISKE contains
additional content that is relevant to Estonia’s national identification cards
and X-road and new cloud module.

Framework documents:

  1. Information security policy (06.08.2015 No 103) 

  

  2. IT Services agreement between ETCB and Information Technology Centre fort he Ministry of 

  

  

Finance

  3. General security rules 

  

  4. Data processing overview 

  

  

Security measures:

  1. Confidentiality and non-disclosure agreements are signed by all employees. 

  

  2. "Ordinary users do not have admin. rights and can`t install software. 

  

  

All changes made by sys admin are stored in log file. Before implementing
changes it needs to be approved by different parties and notified before
actual upgrade takes place."

</th> </tr> </table>  
<table>  
<tr>  
<th>

</th>  
<th>

  3. Different roles have different access rights depending on the duties 

  

  4. Access rights are centrally managed and provided after approval by the manager. 5. All incidents must be reported to our Helpdesk. Helpdesk manages the incident solving process. 

  

  

  6. Errors and faults are reported to helpdesk and registered in our online application, converted to problems if needed. Risk assessment is conducted 2 times a year. 

  

  7. Removable computer media is marked accordingly when taken into usage. Media is erased securely or destroyed physically when not used any more depending on the media type. 

  

  8. No shared networks 

  

  9. Network communications are secured using TLS and VPN. In case of VPN all traffic is encrypted as opposite to TLS encrypting just specific traffic. 

  

  10. Here is process in place and Tax and Customs Board, Internal Control Department is reviewing user’s access rights on regular basis and using expert models to analyze audit log fails. 

  

  11. Network is segregated by using firewalls 

  

  12. Remote computer - nodes are authenticated by VPN and logon mechanisms. 

  

  13. Users must report all incidents to helpdesk either by email or phone. Helpdesk then registers the incident and coordinates the resolution. 

  

  14. In case of incident helpdesk co-ordinates the resolution of the incident using the resources required, working close with security officer. Procedures are documented in corresponding plan. 

  

  15. Risk assessment is conducted 2 times a year. Based on that assessment risk are registered in our risk management/planning application. Then mitigation steps are planned, scheduled and conducted. There are also plans for equipment and software life cycles and replacement. 

  

  16. Continuity plan is defined and documented in our internal information system. 

  

  

Continuity plan is periodically analyzed. Tolerance is 1 week.

</th> </tr>  
<tr>  
<td>

Policia

Judiciaria (PJ)

\- PT

</td>  
<td>

Polícia Judiciária collaborates in PROTAX as an end-user. We will support
other partners while defining requirements, supporting the development phase
and validating results.

PJ does not collect, process, store or even supply to the consortium any data
respecting to ongoing investigations due to judicial confidentiality.

If any data will be supplied by PJ it will be simulated, fictional or
anonymized.

</td> </tr>  
<tr>  
<td>

An Garda

Siochana

(AGS) - IE

</td>  
<td>

Appropriate security measures are taken against unauthorised access to, or
alteration, disclosure or destruction of, personal data and against their
accidental loss or destruction. The security of personal information is all-
important. High standards of security are essential for all personal
information. The nature of security used may take into account the sensitivity
of the data in question.

  * Access to information is restricted to authorised staff on a “need-to-know” basis, 

  

  * Computer systems are password protected, 

  

  * Information on computer screens and manual files is kept hidden from the public, 

  

  * Back-up procedures are in operation for computer held data, including off-site back-up, 

  

  * All waste papers, printouts, etc. disposed of carefully by shredding, 

  

  * All employees must lock their computer on each occasion when they leave the workstation, 

  

  * Personal security passwords are not disclosed to any other employee of An Garda 

  

Síochána,

</td> </tr>  
<tr>  
<td>

</td>  
<td>

• All Garda Síochána premises are secure when unoccupied,An Garda Síochána
complies fully with the provisions of the Data Protection Act, 2018

</td> </tr> </table>

_Table 5: Institutional Policies_

#  2\. FAIR data

The European Commission recommends that Horizon 2020 beneficiaries “make their
research data findable, accessible, interoperable and reusable (FAIR), to
ensure it is soundly managed”  4  . Based on this guidance, this section
outlines how PROTAX will operationalise this.

The figure below illustrates the FAIR Guiding principles:

_Figure 2: The FAIR guiding principles_

##  2.1 Making Data findable, including provisions for metadata

###  Internal provisions

PROTAX project documents and administrative data are stored in a centralised
online repository – SharePoint – provided by the University of Coventry that
is accessible to all the partners working on the project. The manager of
PROTAX (John Callen) is the repository owner. Administrative access rights are
given to additional members of the University of Coventry staff (Umut Turksen,
hereafter referred to as SharePoint administrator). SharePoint administrators
will manage access rights and monitor folders and file names to ensure the
data repository is consistent. To make data findable and reusable, the
following measures are put in place:

  * **Location:** All documents will be stored in relevant folders. There are ten master folders: 

  

Work Packages, Contractual Guidance, Project Governance, Project Reporting,
Project

Meetings, Partner Details, Project Management, Deliverables, PROTAX evolution
and

Templates. Each of these folders have sub-folders (e.g., the WP folder has a
folder each for WPs 1- 10) where related documents can be stored in a variety
of formats e.g., Word documents, PDFs, Excel spreadsheets, PowerPoints or
other standard data formats. Each PROTAX partner is responsible for storing
documents related to their work in the project in the correct location.

  * **Naming of files** : The file names will include a short title of the document and version number (of creation or revision) to make them uniquely identifiable and distinguishable. This will ensure any partner requiring to the information can easily find it (see further below). 

  

  * **Reports and documents** : All reports and documents will also contain information on: authors and contributors, clear version numbering, and key words. 

  

  * **Search functionality** : SharePoint has a search functionality that enables users to search and find documents with ease. 

  

  * **Survey data (Focus Groups)** : Participants in the Focus Groups will remain anonymous. Contact Details or any other personal information is to be stored with the contents oft he focus groups. 

  

###  External provisions

The following provisions will ensure that PROTAX outputs are findable
externally:

  * All public deliverables (in some cases redacted versions) and outputs will be published on the PROTAX website and in agreed institutional or other repositories. 

  

  * A digital object identifier (DOI) will be assigned to datasets for effective and persistent citation when it is uploaded to an institutional repository. This DOI can be used in any relevant publications to direct readers to the underlying dataset. 

  

  * Search keywords will be provided for every deliverable and report. 

  

  * All partners will be advised of the availability of data, changes to data and their location to facilitat access and wider sharing (as deemed fit). 

  

  * _Naming Convention_

  

For report deliverables (document code: D), the document identifier will have
the following format:

PROTAX_WPX.X_DX.X_<DocumentName>

All other documents, the document identifier will have the following format:

PROTAX_WPX.X_<DocumentName>

  * _Version numbers_

  

We will also provide clear version numbers for continuous updated Deliverables
(i.e. the DMP, as it will be updated in Month 18 and 30). The updated versions
will be named as follows:

PROTAX_WPX.X_DX.X_<DocumentName>_V<NumberAndDateOfVersion>

##  2.2 Making data openly accessible

###  Open access to scientific publications

Per clause 25 of the PROTAX Grant Agreement (GA), each PROTAX beneficiary will
ensure open access (free of charge online access for any user) via gold open
access routes  5  to all peer-reviewed scientific publications relating to its
results. Per the GA  6  , beneficiaries will:

  * as soon as possible and at the latest on publication, deposit a machine-readable electronic copy of the published version or final peer-reviewed manuscript accepted for publication in a repository for scientific publications; the beneficiary will also aim to deposit at the same time the research data needed to validate the results presented in the deposited scientific publications. 

  

  * ensure open access to the deposited publication — via the repository — at the latest: (i) on publication, if an electronic version is available for free via the publisher, or (ii) within six months of publication (twelve months for publications in the social sciences and humanities) in any other case. 

  

  * ensure open access — via the repository — to the bibliographic metadata that identify the deposited publication. The bibliographic metadata must be in a standard format and must include all of the following: - the terms “European Union (EU)” and “Horizon 2020”; - the name of the action, acronym and grant number; - the publication date, and length of embargo period if applicable, and - a persistent identifier. 

  

PROTAX partners will discuss governance of open access requirements and their
implementation further in 2018 (refer to _PROTAX deliverables D9.1
Dissemination and exploitation Plan and D9.2: Communication plan_ ).

###  Open access to research data

In line with PROTAX GA  7  clause 25, PROTAX will provide open access to
research data (unless an exception to its open access applies, e.g., if the
achievement of the project’s main objective would be jeopardised by making
those specific parts of the research data openly accessible, it is not in line
with data protection requirements or does not constitute a trade secret).

The raw data from the focus groups will not be made publicly accessible.
Before sharing any data – either with the consortium or externally – we will
ensure that no disclosive  8  information is included.

The raw data from the focus groups (i.e., audio recordings and note-takers’
notes) will not be made publicly available. This decision is based on the
difficulty in truly anonymising audio recordings. If we were to make these
publically available, we would need participants to give explicit consent
(acknowledging that their data could be used to identify them). This is not
considered ideal as it could affect engagement with the study, both at
recruitment and during fieldwork. The raw data from the panels will be used to
produce reports (i.e., deliverables in WP’s 1-8) that will be publicly
available and used more widely by the PROTAX partners to support their work on
the project.

Public deliverables and outputs (redacted, if needed) will be published on the
PROTAX website.

After EC approval of deliverables (and not before the relevant interim and
final reviews) and/or the end of the project, PROTAX will deposit its
deliverables on the Protax Homepage and take measures to make it possible for
third parties to access, mine, exploit, reproduce and disseminate, free of
charge for any user.

Within the consortium we will share our Deliverables, Contributions and other
relevant information and data via the Coventry University SharePoint. This
share point is primarily a document management and storage system which is
highly configurable. To access this, all project partners have to be invited
to the platform by the Project Manager (John Callen) and are able to log in
with a personal pin or password. Within the PROTAX project all partners have
read/write rights to the root (all folders) and each partner has their own
private space which only they can access.

Nevertheless, data sharing in the open domain can be restricted as a
legitimate reason to protect results that can reasonably be expected to be
commercially or industrially exploited. Strategies to limit such restrictions
will include anonymising or aggregating data, agreeing on a limited embargo
period or publishing selected datasets.

As we use Office-Applications (like MS office or Open Office) no specification
about software tools or documentation is needed. In rare cases where data is
statistically utilized, easily accessible tools or software will be used (i.e.
SPSS, R).

There is no need for a Data Access Committee, as we don’t use personal data
for publications, reports and deliverables and the data we get via the focus
groups are anonymised.

##  2.3 Making data interoperable

PROTAX partners will exchange information using a variety of means, e.g.,
e-mail, SharePoint and password-protected local storage and will select the
sharing plateform as appropriate for the purpose.

To allow data exchange and reuse between researchers, institutions,
organisations, countries, etc., PROTAX ensures data interoperability through
the consistent use of common, standardised file formats [See Table 3,
Preliminary overview of data types]. The consortium uses file formats that,
even when originating in or primarily used with propriety software and/or
code, are accessible with open source software. When available and not
otherwise in conflict with data security, data protection or processing
measures and requirements, the consortium will use open source software
applications. Through its use of common, standardised file formats and
software, PROTAX aims to facilitate any legitimate and lawful data re-
combinations with different datasets from different origins.

As we use standard office Software (mainly MS Office and Open Office) we will
not seek to make our data interoperable any further with other research data
sets. Standard Office Software will enable data exchange and re-use between
researcher, institution, organizations, stakeholders and countries. The
project will avoid generating its own ontologies and vocabularies.

**2.4 Increase data re-use (through clarifying licenses** )

_Re-use of existing data_

Some of PROTAX‘ work may, if appropriate and needed, re-use (aggregate,
synthesise or analyse) existing materials (e.g., figures, tables, quotations)
from existing literature (academic, policy or other documents); in such cases,
they will be properly referenced and acknowledged) and any necessary
permissions for re-use will be obtained. We will use literature (both academic
and press articles) relevant to the tasks.

_Increasing re-use of PROTAX results_

The deliverables developed during the project will be publicly accessible via
the PROTAX website and the institutional open access repositories.

PROTAX deliverables use a Creative Commons Attribution 4.0 International
License  9  . According to this, a user can share (i.e., copy and redistribute
the material in any medium or format) or adapt (remix, transform, and build
upon the material for any purpose, even commercially), under the following
terms:

  * The user must give appropriate credit, provide a link to the license, and indicate if changes were made. A user may do so in any reasonable manner, but not in any way that suggests the licensor endorses the user or their use. 

  

  * The user may not apply legal terms or technological measures that legally restrict others from doing anything the license permits. 

  

In line with the PROTAX Consortium Agreement, the results of work performed
within Work Packages in the Project are owned by the party that generate(s)
them. Data delivered by the subcontracting party to one or more Parties shall
be exclusively owned jointly by the beneficiaries. The former parties shall
require their subcontracting parties concerned to assign ownership to them on
any results achieved including intellectual property rights on such results or
to be vested on such results within the framework of any research assignment
by the former Parties. Joint ownership is governed by GA Article 26.2 and
unless otherwise agreed:

  * each of the joint owners shall be entitled to use their jointly owned results for non-commercial research activities and academic teaching on a royalty-free basis, and without requiring the prior consent of the other joint owner(s), and 

  

  * each of the joint owners shall be entitled to otherwise exploit the jointly owned results and to grant non-exclusive licenses to third parties (without any right to sub-license), if the other joint owners are given:(a) at least 45 calendar days’ advance notice; and (b) fair and Reasonable compensation. 

  

Intellectual property issues will be re-visited (if needed) in the next update
to this plan and the final version of the DMP and will be monitored together
with the PROTAX Project Management Committee (PMC).

The PROTAX consortium has internally specified data quality assurance policy
and processes under the ambit of Task 10.3 which is devoted to quality
assurance  10  .

#  3\. Allocation of resources

  * What are the costs for making data FAIR in your project? 

  

For the whole project, there is a total of €22.500 dedicated to providing FAIR
data. Each partner is allocated €2.500.

  * How will these be covered? Note that costs related to open access to research data are eligible as part of the Horizon 2020 grant (if compliant with the Grant Agreement conditions). 

  

This is included as service purchase in the grant agreement with € 2500 for
each partner (total €22.500)

  * _Who will be responsible for data management in your project?_

  

Vicesse (Vienna Centre for Societal Security) is in charge of administrating
the Data Management Plan for the PROTAX-Project.

  * _Are the resources for long term preservation discussed (costs and potential value, who decides and how what data will be kept and for how long)?_

  

The data from the PROTAX-Project will be stored for long term in the
institutional repositories of the partners.

The PROTAX project has a specific task dedicated to data management - “Task
10.3: Adminisiter the projects data management.” This task is led by Vicesse
and supported by contributions from the University of Twente and Uppsala
University. A total of 0,5 Person-month has been allocated to this task
(including D.10.3 Quality Assurance Plan) over the duration of the project.
The first deliverable, _D10.2 Data management plan_ (i.e., this deliverable),
will be submitted in October 2018 (month 6 of the project) to the European
Commission.

This deliverable will be updated and a revised version, i.e., _D10.2 Final
revised data management plan_ will be delivered in April 2021 (month 36 of the
project) to the European Commission. The plan will be reviewed prior to the
project’s interim review (currently scheduled for month 18) and final review
(month 36) of the project; updates will be made to take into account new data,
changes in consortium policies, and changes in consortium composition and
external factors (e.g., new consortium members joining or old members
leaving).

The final version of the DMP (i.e., D10.2) will further describe how data from
the PROTAX project will be managed in a sustainable manner.

#  4\. Protection of personal data

_Purposes and legal basis of personal data processing_

The project will collect and process personal data only if, and insofar as, it
is necessary for its research and engagement activities i.e., research,
consultations, interviews and events, and to share its findings and results
with stakeholders via mailings, the website and newsletters. Our primary legal
basis for processing personal data will be an individual’s consent.
Individuals will have the right to withdraw consent at any time without any
negative consequences.

PROTAX activities which will collect personal data, purposes of the
collection, types of data that will be processed, its storage formats, modes
of collection, sharing, location, accountability and access arrangements.
PROTAX will mostly collect personal data that is largely available in the
public domain. Project partners and the project subcontractor will collect
such data from respondents from EU and non-EU countries.

Personal data may be collected from members of the consortium, members of
external organisations or individuals in their capacities as experts,
respondents or participants. Use of such data will be in line with legal and
ethical standards described in _D11.1 Ethical, social and privacy issues in
PROTAX_ and this deliverable.

_Data minimisation, storage and retention_

PROTAX will minimise the amount of data collected and processed, and the
length of time it retains the data. According to GDPR requirements, the
personal data collected in PROTAX will be adequate, relevant and limited to
what is necessary in relation to the purposes for which they are processed.
PROTAX partners will ensure that personal data about an individual is
sufficient for the purpose it holds it for in relation to that individual, and
PROTAX will not hold any more information than what is properly needed to
fulfil that purpose.

PROTAX will store personal data securely on password-protected computers.
Personal data will only be used for the specific purpose for which it was
collected (e.g., workshop management, travel arrangements) and will be deleted
immediately after that purpose is fulfilled, unless legally required to be
retained (noting here that the PROTAX Grant Agreement requires project data to
be archived correctly at least five years after the balance project payment is
paid). Published interviews, survey and panel reports will not contain any
personal data or reference to personal data.

PROTAX will comply with ethical principles and applicable international, EU
and national law (in particular, Directive 95/46/EC and, once it applies, the
EU General Data Protection Regulation 2016/679). For activities for which
informed consent is required, we will provide research participants with a
clear description of PROTAX activities and clear information on the procedures
that will be used for data control and anonymisation.

Using the PROTAX participant information sheet and informed consent form [see
Annex] and GDPRcompliant data protection notices [see Annex], PROTAX will give
participants information about how the project will collect, use, retain and
protect their data during the project.

_Rights of individuals_

Individuals will have the following rights:

  * Right to request from the PROTAX data controllers’ access to the personal data PROTAX has that pertains to them. 

  

  * Right to request the controllers to rectify any errors in personal data to ensure its accuracy. 

  

  * Right to request the controllers to erase their personal data. 

  

  * Right to request the controllers to restrict the future processing of their personal data, or to object to its processing. 

  

  * Right to data portability - upon request the data controller will provide a data subject with a copy of the data PROTAX has regarding them in a structured, commonly used and machine- readable format. 

  

  * As the processing of your personal data occurs based on their consent, individuals will have the right to withdraw their consent at any time and PROTAX will cease further processing activities involving their personal data. (However, this will not affect the lawfulness of any processing already performed before consent has been withdrawn). 

  

  * Right to lodge a complaint with a supervisory authority, such as their national data protection authority. 

  

If partners consider a plan to re-use personal data, they will give
participants information about this as soon as it becomes available and give
them the opportunity to consent or withdraw their data. During the project,
PROTAX will give participants the option to withdraw themselves and their data
at any time. As part of each communication the participant receives, PROTAX
will give her or him the opportunity to opt out of further communications and
have their data deleted from the project’s records.

If the project uses secondary personal data, it will only do so from a public
source or such source as is authorised for such use (either specifically for
our research and engagement activities or generally for any secondary use).

All partners of the consortium will adopt good practice data security
procedures. This will help avoid unforeseen usage or disclosure of data,
including the mosaic effect (i.e., obtaining identification by merging
multiple sources). Measures to protect data include access controls via secure
log-ins, installation of up-to-date security software on devices, regular data
backups, etc. Section 6 of this document further covers data security aspects.

Recorded information (audio and/or visual) will be given special consideration
to ensure that privacy and personal identities are protected. Participants
will be provided with a consent form [see Annex] to read and sign if they will
be photographed or recorded visually (e.g., video) during PROTAX activities.
The signed forms will be kept on file for inspection.

The PROTAX consortium will carefully assess the benefits and burdens of
collecting and processing sensitive personal data  42  before conducting the
public opinion surveys and panels of citizens.  43  If the need to collect and
process such data arises (e.g., to establish eligibility for participation
according to recruitment criteria), PROTAX will seek the explicit consent of
data subjects. Data subjects will be able to opt out of the focus groups at
any stage.

In keeping with best practices for data security, Coventry University
SharePoint will store focus groups responses in a secure location in the file
system that only project staff can access. There will be no disclosive
information in data files, meaning there is no risk of individual respondents
being identified.

_International data transfers_

The PROTAX consortium does not expect to transfer personal data outside the
EU. In the case this position changes, we will comply with the GDPR
requirements and ensure that personal data is only transferred outside of the
EU in compliance with the conditions for transfer set out in Chapter V of the
GDPR  11  .

_Data controllers_

The project’s data controllers will make the necessary notifications and/or
obtain the necessary authorisations for collecting and processing data. Upon
request, the project co-ordinator will provide copies of these authorisations
to the European Commission. For the purpose of personal data processing from
data subjects involved in PROTAX research and engagement activities, the data
controllers for PROTAX are:

  * Umut Turksen, Coventry University, aa8628@coventry.ac.uk 

  

  * David Wright, Trilateral Research Ltd, david.wright@trilateralresearch.com 

  

  * John Callen, Coventry University, bux019@coventry.ac.uk 

  

  * Regina Kahry, Vienna Centre for Societal Security, regina.kahry@vicesse.eu 

  

#  5\. Data security

For the duration of the project, PROTAX partners will store PROTAX project
data in a SharePoint repository, hosted by Coventry University. The SharePoint
repository is password protected and only current project invited members with
passwords may access it. All incoming and outgoing network communication with
SharePoint is encrypted using a Quovadis-verified certificate  12  . When
partners leave PROTAX, their access to the PROTAX's repository will be still
be available but changed from Read/Write to Read only _._

We do the DB back up every 30 minutes (incremental) and full back up every
day.

We have a separate Disaster Recovery system in place and more detail regarding
this can be seen below.

Figure 3: Disaster Recovery  13

In addition to the SharePoint repository, partners may store local copies of
research data on their institutional servers and or business cloud-based
servers with access controls, encryption or password protection. Partners will
follow their institutional security safeguards.

All partners will as a minimum:

  * ensure PROTAX research data stored with them on their institutional servers is regularly backed up. 

  

  * ensure devices and data are safely and securely stored, and access controls are defined (e.g., via encryption, password protection, restriction of number of persons with access) at the user level. 

  

  * support good security practices by protecting their own devices and installing and updating antimalware software, anti-virus software and enabling firewalls. 

  

  * (In case personal data is processed), ensure appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or use of personal data and the equipment used for the processing (GDPR). 

  

  * where necessary, the controller or processor of personal data will evaluate the risks inherent in the processing and implement measures to mitigate those risks (e.g., encryption) and ensure an appropriate level of security, including confidentiality, taking into account the state of the art and the costs of implementation in relation to the risks and the nature of the personal data to be protected (GDPR). 

  

After PROTAX ends, the responsibility concerning data security of the PROTAX
datasets will lie with the owners/managers of the repositories where these are
stored.

#  6\. Ethical aspects

  * _Are there any ethical or legal issues that can have an impact on data sharing? These can also be discussed in the context of the ethics review. If relevant, include references to ethics deliverables and ethics chapter in the Description of the Action (DoA)._

  

All ethical, social and privacy issues in PROTAX are discussed and stated in
D11.1. The latter is put on the public dissemination level and is therefore
accessible for all partners.

  * _Is informed consent for data sharing and long-term preservation included in questionnaires dealing with personal data?_

  

We will include information about data sharing and long-term preservation in
our questionnaires.

The _D11.1 Ethical, social and privacy issues in PROTAX_ sets out in detail
how the consortium will manage potential ethical issues according to
applicable regulatory frameworks, ethical and data protection standards and
other ethics requirements. All partner-organisations signed letters of
compliance, confirming their adherence to the EMP. Even so, certain
regulations, principles, standards and requirements merit special emphasis in
this deliverable.

_PROTAX_ partners will comply with Article 34 of the Grant Agreement 787098 —
_PROTAX_ , which states that all activities must be carried out in compliance
with ethical principles. Consequently, partners will conduct research in
accordance with fundamental principles of research integrity, such as those
described by ALLEA in its _European Code of Conduct for Research Integrity 14
_ .These principles

1\.  14  All European Academies, _European Code of Conduct for Research
Integrity_ , Revised Edition, May

2017\. http://www.allea.org/wp-content/uploads/2017/05/ALLEA-European-Code-of-
Conduct-forResearch-Integrity- 2017.pdf

are reliability, honesty, respect and accountability. Furthermore, the
partners will avoid misconduct, namely, fabrication, falsification or
plagiarism.

In keeping with the highest standards of research integrity, and to ensure the
privacy, safety and dignity of data subjects, PROTAX partners and the project
subcontractor will provide participants with project information sheets and
consent forms in a language and in terms fully understandable to them [See
Annex]. These forms will describe the aims, methods and implications of the
research, the nature of the participation and any benefits or risks (e.g., to
privacy) that might be involved. The forms will explicitly affirm that
participation is voluntary and that participants have the right to refuse to
participate and to withdraw their participation, or data, at any time, without
any consequences. The forms will outline how partners will collect and protect
data during the project (e.g., use of anonymisation), and then destroy it or
reuse it (with consent). The form will indicate the procedures to be
implemented in the event of unexpected findings. Researchers will ensure that
potential participants have fully understood the information and do not feel
pressured or forced to give consent.

In addition to the preceding ethical safeguards, PROTAX partners will conform
to the applicable rules and aims of Data Protection Directive 95/46/EC and the
EU General Data Protection Regulation 2016/679, its successor. These
regulations are complemented by PROTAX partners acting in accordance with
applicable national legislation and data protection-related regulations.

#  7\. Responsibilities

The planning and overall co-ordination of the data management task will be the
responsibility of Trilateral Research. Each project partner who handles and is
responsible for data collected, stored or used will ensure compliance with the
strategy outlined in this document.

VICESSE will review and revise this plan, consult with partners and implement
any corrective actions, if required. Revisions to the DMP may become necessary
in the following cases: new or unanticipated datasets become available,
existing datasets are re-classified into a different data sharing category due
to emerging/newly discovered data privacy or commercial concerns, or external
factors, including changes to data protection law, the removal of a project
partner, or technological advancements that could impact data security. PROTAX
partners should notify Trilateral Research if any such cases arise and advise
of any updates to their institutional data management policies and procedures
that might have an impact on PROTAX‘ data management.

#  8\. Management of compliance

VICESSE will oversee compliance with the data management plan along with the
University of Coventry (project co-ordinator) and Trilateral Research. Each
PROTAX partner will be responsible for adhering to the strategy and procedures
outlined in this document and other relevant documents, (e.g., the PROTAX
ethical monitoring protocol).

#  9\. Other issues

⮚ _Do you make use of other national/funder/sectorial/departmental procedures
for data management? If yes, which ones?_

We do not make use of other procedures for data management.

#  10\. Summary and Outlook

This deliverable presented the PROTAX consortium’s plan to manage the
production, collection and processing of its research data and scientific
publications.

This deliverable will be reviewed by the consortium in the final year of the
project, and an updated version will be generated in March 2021. Updates will
be made to the plan to take into account new data, changes in consortium
policies, and changes in consortium composition and external factors (e.g. new
consortium members joining or old members leaving).

Each project partner handling and responsible for data collected, stored or
used in PROTAX will ensure compliance with the strategy outlined in this
document.

Annex

**Participant Information Sheet**

This project is funded by the EU. This publication has been produced with the
financial support of the

European Union’s H2020 research and innovation programme under grant agreement
No

787098

.

The

contents of this publication are the sole responsibility of

the authors

and can in no way be taken to reflect

the views of the European Commission.

©PROTAX, 2018 - 2021

This work is licensed under a Creative Commons Attribution 4.0 International
License

787098

P

RO

TAX

–

D

10.3

Deliverable Report

–

DMP

30

787098

P

RO

TAX

–

D

10.3

Deliverable Report

–

DMP