**DATA MANAGEMENT PLAN**

The Data Management Plan of the DEMOS project will be revised and updated
annually.

#  Data Summary

DEMOS is built on the assumption that populism is symptomatic of a disconnect
between how democratic polities operate and how citizens perceive their own
aspirations, needs and identities within the political system. As such, DEMOS
explores the practical value of ’democratic efficacy’ as the condition of
political engagement needed to address the challenge of populism. The concept
combines attitudinal features (political efficacy), political skills,
knowledge, and democratic opportunity structures. In order to better
understand populism DEMOS addresses its hitherto under-researched aspects at
micro-, meso-, and macro-levels: its socio-psychological roots, social actors’
responses to the populist challenge, and populism’s effects on governance.
DEMOS focuses not only on the polity, but equally on citizens’ perspectives:
how they are affected by, and how they react to, populism. Politically
underrepresented groups and those targeted by populist politics are a
particular focus, e.g. youth, women, and migrants. As populism has varying
socially embedded manifestations, DEMOS aims at contextualising it through
comparative analysis on the variety of populisms across Europe, including
their historical, cultural, and socioeconomic roots, manifestations, and
impacts. DEMOS develops indicators and predictors of populism and elaborates
scenarios on the interactions of populism with social actors and institutions
both at the national and the EU levels.

DEMOS involves primary data collection through: 1) a cross-national survey
that particularly focuses on implicit and explicit measurement of various
emotions; 2) experiments and quasi- experiments to investigate the relation
between cognitive processing styles and populist attitudes, the effect of
framing political information, the role of anxiety, and the role of
information versus feelings in developing populist arguments; 3) interviews
and focus groups conducted in several countries with individuals that include
citizens with a favorable preference towards populist parties, and targets of
populist discourse (e.g., minorities, women, gay people); and; 4) deliberative
polling, a unique method that combines techniques of public opinion research
and public deliberation to construct hypothetical representations of what
public opinion on a particular issue might look like if citizens were given a
chance to become more informed. DEMOS will also implement content analysis,
data mining in social sciences, legal and policy analysis, statistical
analysis, qualitative and quantitative text analysis.

Data will be collected and stored using digital audio recording devices with
the permission of the interviewees and focus group participants. In the event
that respondents do not wish to be recorded, interviews and focus groups will
be undertaken in pairs to enable detailed note- taking. The necessary
documents will be prepared prior to fieldwork, including a letter with
information about the project, anonymity, confidentiality, data sharing, and a
separate letter of informed consent (translate into the languages which will
be used for the interviews and focus groups). To ensure that the content is
understood, the informed consent form will be explained both in writing and
verbally.

The data will be potentially utilized primarily by the scientific community,
but can be also useful for our further target groups: governmental bodies
(policy makers on the EU and the national level); affected professional
communities (journalists, teachers, students); and the civil society (NGOs,
think tanks, foundations) as well as the general public.

In order to ensure fair and transparent processing in respect of the data
subject, taking into account the specific circumstances and context in which
the personal data are processed, beneficiaries of DEMOS implement technical
and organisational measures appropriate to ensure, in particular, that factors
which result in inaccuracies in personal data are corrected and the risk of
errors is minimised, secure personal data in a manner that takes account of
the potential risks involved for the interests and rights of the data subjects
and that prevents, inter alia, discriminatory effects on natural persons on
the basis of racial or ethnic origin, political opinion, religion or beliefs,
trade union membership, genetic or health status or sexual orientation, or
that result in measures having such an effect.

#  FAIR data

2.1 All beneficiaries of DEMOS undertake the strict responsibility to follow
the Regulation (EU) 2016/679 of the European Parliament and of the Council of
27 April 2016 (General Data Protection Regulation, hereinafter GDPR).

Beneficiary from a third country required to ensure that all relevant
provisions in the GDPR shall be applied and provide appropriate safeguards,
and that enforceable data subject rights and effective legal remedies for data
subjects are available.

The definition of ’personal data’ used by this document is identical to the
definition used by GDPR.

The definition of ’research data’ means any research results generated by the
DEMOS project, excluding personal data.

_2.2 Data storage_

Personal data will be stored at the consortium leader’s (CSS) infrastructure,
except required otherwise by a Union or Member State law. The infrastructure
of CSS is adequate for conducting large-scale projects heavily dependent on
secure data storage and processing (i.e., 10+ TB storage, IBM blade server
cluster). In such cases the involved beneficiaries must agree about the
conditions of storing the personal data, and must ensure that the level of
protection of natural persons guaranteed by the GDPR is not undermined.

From the project’s inception, electronic files stored at the consortium
leader’s institution will be password protected and encrypted. In order to
create user-friendly and accessible data, the needed data descriptions,
annotations, contextual information and documentation, metadata labelling and
numeration will be made in all stages directly when data is uploaded onto our
server. Detailed instruction of the procedures for data and working paper
storage and curation will be shared after Month 7 with the consortium
partners. Anonymised data will be made available in a repository through the
aforementioned Documentation Center and through the project website. Except
for personal data and data classified as “sensitive” or “confidential,” all
data will be made available and accessible for re-use by other researchers.
RDC (Research Documentation Centre) of the CSS HAS. Metadata will be
harvestable through the Open Archives Initiative Protocol for Metadata
Harvesting system. The data will be identified by DOI. Version numbers will be
provided. Search keywords will be provided, all metadata (data of surveys,
methodology, research tools) and the textual information will be available and
searchable through an internal search engine at the RDC platform. DEMOS aims
to use standard naming conventions, including the following components:
partner name, date, Work Package and keywords. A detailed list of project
target audiences has been included in the Communication, Dissemination, and
Sustainability Plan (CDSP) deliverable.

_2.3. Making data openly accessible_

Research data stored at the consortium leader’s institution will be frequently
updated, backed up, and secured on the cloud system of CSS HAS.

Personal data will be stored exclusively on the cloud system of the consortium
leader and will be made accessible only for researchers working on the DEMOS
project, with two levels of accessibility:

  1. researchers: on this level the WP leaders will decide on the limitation of data sharing with the other DEMOS researchers, in agreement with the Principle Investigator and after consulting the Data Protection Officer of the project, always considering the basic principles of data management, especially purpose limitation, data minimization, accuracy, storage limitation, confidentiality and integrity. In order to enhance awareness on privacy and data security issues, the WP leaders and interested task-leaders will receive a privacy and data management awareness training, provided by the consortium leader. 

  

  2. different level of accessibility will be provided for the general public: protected research data will be accessible by the general public after being declared as final by the leader of the WP, in agreement with the Principle Investigator. 

  

  

The data subjects will be informed of the existence of research profiling, its
possible consequences and how their fundamental rights will be safeguarded.
LGBTI, ethnic minority and migrant participants will be identified via
national and local NGOs and associations and where possible via Facebook
groups. If the number of participants recruited through these strategies is
low, we will use snowballing to increase the number of potential participants.
That is, profiling will be based on the information the subjects themselves
provide by being members of Facebook groups and being in touch with NGOs. The
former include publicly available information, while the latter will make use
of the mediator role of the NGOs and personal contacts. Focus group
participation will be anonymised. The storage of any personal data will comply
with the GDPR regulations. Researchers will ensure that participants taking
part in the research have decided to do so by their own free will and
following sufficient information. Researchers will secure in advance the
consent of the persons who will take part in the research or of their legal
representatives. Researchers will fully ensure the protection of the
participants’ personal data, according to the national and European
legislation.

Personal data – with special emphasis on special categories of personal data,
as it is listed in Article 9 of GDPR – will be restricted and accessible to
DEMOS researchers only. As a default, all researchers will have access to the
data generated within the WP they are involved in. Access will be controlled
and managed by the Data Protection Officer (DPO) of DEMOS, who will permit and
oversee access to research data for the researchers, in agreement with the
Principle Investigator. The access of researchers to the different data sets
will be documented in an Excel table and managed by the DPO. Data management –
Emese Szilágyi, researcher of the DEMOS project, assistant researcher at the
Institute for Legal Studies, CSS HAS. Publicly accessibly research data will
be stored on the CSS HAS cloud and available upon request. Users can access
research data freely, with a login and a password. Each publication will have
a working paper version, which will be openly and freely accessible on the
DEMOS repository on the RDC, and will be made available before or latest on
the day of publication, upon agreement with the publisher. Though costs
related to Open Access publishing for scientific papers and publications
produced throughout DEMOS’ lifetime have not been budgeted, all partners will
engage in ‘green’ open access, i.e. self-archiving, whereby published articles
or final peer-reviewed manuscripts are archived by the researcher, or a
representative, in an online repository before, after, or alongside its
publication. Every author is responsible to check the criteria of working
paper versions with the publisher. The working papers will be accessible and
searchable in a readable text format.

  4. _Interoperable data_

  

  

The produced data will be interoperable. Research data – excluding personal
data – will be open for re-use after it has been declared final by the WP
leaders, in agreement with the Principle Investigator. The use of the RDC
repository at the CSS HAS is free. After the end of the project, all research
data will be stored at the RDC repository and will be accessible for 15 years.
Each partner is responsible for storing sensitive data during, and after the
end of the research. Sensitive data must not be stored in non-EU countries
after the end of the project.

  5. _Personal data stored at a beneficiary’s infrastructure:_

  

  

Data collected and processed under Task 3.3 (Democratic efficacy and the
youth: the role of schools) and Task 4.4 (Studies on the role of information
versus feelings in developing populist arguments) involves data of minors (age
13-16). Task leader in both cases is University of Hamburg (UHAM), who’s
Member State Law and local authorities requested the data to be stored
exclusively at the infrastructure of UHAM. Respecting the request of the
German authorities the consortium leader and UHAM agreed to proceed with this
exception. Concerned data will be saved on the UHH [UHAM] Share Server, and
access will be granted exclusively for DEMOS researchers concerned with the
task.

To ensure data safety and security, UHAM hands over a detailed description of
the UHAM IT-Architecture and servers as well as a risk evaluation of potential
threats from the perspective of the concerned researchers for the local
authorities, following the Article 30 requirements of GDPR.

#  Data safety and security

_3.1 Data Safety Summary_

Research data will be stored on the server of CSS, placed within the building
of CSS. Safety archiving takes place on IBM HSM magnetic tape system, with
weekly incremental saves beyond the daily saves. The cloud if stored on IBM
Blade servers, and uses a next cloud based application, which is being
regularly updated.

_3.2 Data Security and Cybersecurity Measures_

**Central servers:** All areas where there are IT resources for processing and
storing confidential data are considered as closed and protected areas, to
which only 3 people have access. There are cameras with facial identification
in the server rooms. The IT network is under professional control, anything
concerning the extension or modification of the central network can only be
done by professional staff, with the approval of the CSS board.

**Backup:** There is regular backup on the central IT system conducted
automatically, on a daily basis, archiving the data from the system. Should
any error occur, the system notifies the system administrator.

**VPN** is available only to those who have access to the CSS emailing system.
The CSS cloud is accessible through a CSS login and an individual password,
through the address https://file.tk.mta.hu/. The password must consist of at
least 7 characters, and must contain letters of lower case and upper case, and
a number. The passwords can be changed at the work stations of the CSS and
through the Webmail system. Expired passwords can only be changed at the CSS
workstation. If a password has expired, it is not possible to access any
subsystem (email, cloud, Intranet, VPN). Users get notified about the
expiration of the password.

**Redundant firewall system:** the firewall system provides regulated
connections between the internal user networks of the users, the networks of
the building and the Internet. There is a multi-layer network segmentation,
the systems of the research institutes are divided into separate units, which
are further divided into internal client and server networks. The hardware
basis is provided by 2 DELL T340 Xeon servers, with HA (keepalived) stateful,
VRRP synchronized netfilter firewall built on a Slackware LINUX basis. The
servers are provided with a 6x1GBit and a 4x10GBit physical interface each,
and they are connected to the DLink client network core switch stack and the
CISCO tools supporting the servers and securing the WAN connections. Important
parameters: 150 logical interface, 80 VLAN, VPN networks (PPTP, L2TP, SSTP,
OpenVPN for clients, IPsec site2site tunnels for external sites), appr. 500
firewall regulations. The VLANs are divided into 8 VRRP groups based on
function and organizational unit. They can be moved freely between the 2
firewalls. The physical connections have been build redundant in all
directions, with LACP or STP protocol.

**Local IT network of the building:** The networks within the system are
realized through VLAN segmentation. The service providing point for the
clients is realiyed through RJ45 plugs, and through virtual switch plugs on
the server’s side. The DHCP server (or relay) service is a centralized task
for each network segment.

**Server infrastructure:**

IBM BladeCenter H frame + 6 db IBM Blade HS22 server

Physical configuration of the storage system:

DS3524 storage+DS3524 expansion, 48*600GB 10k SAS disk – 24TB; BTK:12TB,
TK:12TB

DS3512 expansion+DS3512 expansion, 24*3TB 7,2k SAS disk – 60TB; BTK:50TB,

TK:10TB

VMware cluster infrastructure:

6 host VMware vSphere 6 with Operations Management Standard for software.

Backup (veeam) system: The backup system works in a virtual server system. The
system is capable of restoring data/ entire virtual servers for 30 days on a
daily basis.

Monitoring system: the permanent monitoring of the condition of the central IT
tools is part of the system. In case of an error, an automated alert message
is sent to the help desk service.

The server room and its infrastructure is part of the building. The monitoring
of its operation, the power supply, monitoring the temperature and humidity,
and managing the alert messages is the responsibility of the operators.

Archive data storage: CSS operates an archive data system, which has been
elaborated to store archive data combining a tape technology and a disk
technology.

**Other:**

The MailGateway spam and virus filter at CSS works separately from the other
centres. Similarly, CSS operates their own mail storing on the MS Exchange
platform.

3.3 Data security regarding the data stored at UHAM’s infrastructure:

**Server and Software for Backups:** Data is saved on the UHH Share Server. As
the central back-up system Tivoli Storage manager (TSM) is used.

**Safety archiving:** Data is saved by TSM incrementally overnight.

**Access:** For access two login credentials are needed, namely “user
credentials” to log in at the computer itself and one “UHH credentials” to
have access to UHH Share Server. As soon as all data we collected are stored
on UHH Share, UHAM will provide access for the involved DEMOS researchers.

9