#  Executive summary

This document is the deliverable **“D1.3 – Data management plan v.1”** of the
European project “SIMPATICO - SIMplifying the interaction with Public
Administration Through Information technology for Citizens and cOmpanies”
(hereinafter also referred to as **“SIMPATICO”** , project reference: 692819).

The **Data Management Plan (DMP)** describes the types of data that will be
generated and/or gathered during the project, the standards that will be used,
the ways in which data will be exploited and shared (for verification or
reuse), and in which way data will be preserved. This DMP has been prepared by
taking into account the template of the **“Guidelines on Data Management in
Horizon 2020”** [Version 2.1. of 15 February 2016]. The elaboration of the DMP
will allow SIMPATICO partners to address all issues related with data
protection, including ethical concerns and security protection strategy.
SIMPATICO takes part in the **Open Research Data Pilot (ORD pilot)** ; this
pilot aims to improve and maximise access to and re-use of research data
generated by Horizon 2020 projects, such as the data generated by the
SIMPATICO platform during its deployment and validation. Moreover, under
Horizon 2020 each beneficiary must **ensure open access to all peer-reviewed
scientific publications** relating to its results: these publications shall be
made also available through the public section of the SIMPATICO website. All
these aspects have been taken into account in the elaboration of the DMP.

A first version of the deliverable “D1.3 – Data management plan v.1” has been
released at the beginning of the project (M6). **This version is an update of
D1.3 produced at project month M16** , after the detailed definition of the
project use-cases and the revision of the ethics-related aspects of the
project by the Ethics Advisory Board, and taking into account the feedback
collected during the 1  st  year project review. A revised deliverable is
expected at the end of the project (“D1.4 – Data management plan v.2”, at
M36). However, the DMP will be a **living document** throughout the project,
and these initial versions will evolve during the SIMPATICO lifespan according
to the progress of project activities.

Starting from a brief illustration of the SIMPATICO project, and of the
ethical concerns raised by the project activities, this report describes **the
procedures of data collection, storing and processing** , with a final
overview on **SIMPATICO security protection strategy** . This report does not
cover the general concerns related to ethics and data protection, as they are
the focus of dedicated deliverables already submitted – namely reports “D1.5 –
Ethics compliance report”, “D8.1 – H – Requirement no. 1”, and “D8.2 – POPD –
Requirement no. 2”.

#  Introduction

The research activities undertaken in the SIMPATICO project have important
data protection aspects, in particular due the foreseen involvement of
public/private stakeholders and citizens and due to the necessity to collect,
store and process personal data. This deliverable analyses the **data
management implications** of the activities undertaken in the project, and
describes the guidelines and procedures put in place in order to ensure
compliance with data management requirements.

The rest of this section provides **background information on the SIMPATICO
project** (Subsection 1.1) and identifies in brief the **ethical issues**
raised by the project activities (Subsection 1.2). The project aims **to
maximise access to and re-use of research data** , also ensuring **open access
to all peerreviewed scientific publications** relating to its results, in
order pave the path for its data management plan according to the signed Grant
Agreement - GA (Subsection 1.3.). Section 2 concerns the detailed
**description of SIMPATICO datasets** , according to the requirements set out
in Annex 1 - Data Management Plan template of the “Guidelines on Data
Management in Horizon 2020” [1]: (a) the handling of research data during and
after the project; (b) what data will be collected, processed or generated;
(c) what methodology & standards will be applied; (d) whether data will be
shared/made open access and how; (e) how data will be curated and preserved.
Finally, Section 3 presents the **SIMPATICO security protection strategy** .

##  SIMPATICO in brief

SIMPATICO's goal is **to improve the experience of citizens and companies in
their daily interactions with the public administration** by providing a
**personalized delivery of** **e-services** based on advanced **cognitive
system technologies** and by promoting an **active engagement of people** for
the continuous improvement of the interaction with these services. The
SIMPATICO approach is realised through a platform that can be deployed on top
of an existing PA system and allows for **a personalized service delivery**
without having to change or replace its internal systems: a process often too
expensive for a public administration, especially considering the cuts in
resources imposed by the current economic situation.

The goal of SIMPATICO is accomplished through a solution based on the
**interplay of language processing, machine learning and the wisdom of the
crowd** (represented by citizens, business organizations and civil servants)
**to change for the better the way citizens interact with the PA. SIMPATICO
will** **adapt** **the interaction process** to the characteristics of each
user; **simplify** text and documents to make them understandable; **enable
feedback for the users** on problems and difficulties in the interaction;
**engage** **civil servants, citizens and professionals** so as to make use of
their knowledge and integrate it in the system (Fig. 1).

Figure 1: SIMPATICO concept as a glance

The project aims can be broken down into the following **smaller research
objectives (ROs)** .

**RO1. Adapt the interaction process with respect to the profile of each
citizen and company** (PA service consumer), in order **to make it clear,
understandable and easy to follow** .

  * A **text adaptation** framework **,** based on a **rich** **text information layer** and on machine learning algorithms capable of **inducing general text adaptation operations** from **few examples, and of customizing these adaptations to the user profiles.**

  

  * **A workflow adaptation engine** that will take user characteristics and tailor the interaction according to the user’s profile and needs. 

  

  * A feedback and annotation mechanism that **gives users the possibility to visualize, rate, comment, annotate, document the interaction process** (e.g., underlying the most difficult steps), so as to provide valuable feedback to the PA, further refine the adaptation process and enrich the interaction. 

  

**RO2. Exploit the wisdom of the crowd to enhance the entire e-service
interaction process.** An **advanced web-based social question answering
engine (Citizenpedia)** where citizens, companies and civil servants will
**discuss and suggest potential solutions and interpretation for the most
problematic procedures and concepts.**

  * A **collective knowledge** database on e-services that will be used to simplify these services and improve their understanding. 

  

  * An **award mechanism** that will **engage users and incentivize them to collaborate** by giving them **reputation** (a valuable asset for professionals and organizations) and **privileges** (for the government of Citizenpedia – a new public domain resource) according to their contributions. 

  

**RO3. Deliver the SIMPATICO Platform, an** **open software system that can
interoperate with PA legacy systems.**

  * A platform that **combines consolidated e-government methodologies with innovative cognitive technologies** (language processing, machine learning) at different level of maturity, enabling their experimentation in more or less controlled operational settings. 

  

  * An interoperability platform that enables an **agile integration of SIMPATICO’s solution with** PA legacy systems and that allows the exploitation of data and services from these systems with the SIMPATICO adaptation and personalization engines. 

  

**RO4. Evaluate and assess the impact of the SIMPATICO solution**

  * Customise, deploy, operate and evaluate the SIMPATICO solution on **three use-cases in two EU cities** – Trento (IT) and Sheffield (UK) – **and one EU region** – Galicia (ES). 

  

  * **Assess the impact** of the proposed solution in terms of **increase in competitiveness, efficiency of interaction and quality of experience.**

  

###  SIMPATICO technical framework and infrastructure

The SIMPATICO project intends to provide a **software platform** incorporating
technical innovations to enhance **the efficiency, effectiveness and
inclusiveness of public services** . To this aim, SIMPATICO collects,
generates and utilizes both personal and other data in a complex way. For what
concerns this deliverable (consumption, production and storage of data), the
key SIMPATICO components are the following:

  1. **Citizen Data Vault** : it represents the component that will take care of personal data exchange between a user and SIMPATICO components. It is a distributed repository of the citizen (or company) profile and related information. It is continuously updated through each interaction and is used to automatically pre-fill forms. In this way, the citizen will give to the PA the same information only once, as the information will be stored in the vault and used in all the following interactions; 

  

  2. **Human Computation (Citizenpedia):** SIMPATICO fosters citizens’ involvement, by providing Citizenpedia, a hybrid of Wikipedia and a collaborative question answering engine, and sharing improvements on public resources in a semi-automatic basis. Citizens, companies and civil servants will discuss and suggest potential solutions and interpretation for the most problematic procedures and concepts. In addition, the user will be able to highlight portions of text that he/she considers unclear and ask for a simplified version. These interaction actions will further refine the user profile and will be stored in the citizen data vault to serve as the basis for the adaptation of future interactions. Public servants are able to moderate comments and suggestions of citizenships to prevent crowd’s wisdom bias. The knowledge collected by a user on a specific e-service (e.g., a request of clarification or the explanation of a concept) can propagate and improve the understanding and interaction of potentially all users and e-services. An award mechanism that engages users and incentivize them to collaborate by giving them reputation (a valuable asset for professionals and organizations) and privileges is designed. 

  

  3. **SIMPATICO Adaptation Engine:** it is a cognitive system that will make use of innovative text processing and machine learning algorithms to adapt the text and the workflow of the interaction according to the user profile. The text adaptation engine will adapt the text of the forms and of the other documents to make it more understandable and to clarify complex elements, while the workflow adaptation engine will adapt the interaction process itself by presenting the citizen only the elements that are relevant for his/her profile (e.g., if the citizen is not a foreigner he/she will not be presented the section of a form reserved for foreigners). The adaptation engine exploits data collected on the interactions of the users, exploiting both implicit and explicit techniques; these data are stored in the “User Profile” and “Log” components of SIMPATICO. 

  

  

These components are highlighted in Figure 2, depicting SIMPATICO conceptual
architecture.

Figure 2: SIMPATICO Platform conceptual architecture and main components

###  SIMPATICO pilots

The piloting of the SIMPATICO platform is planned in two European cities (
**Trento and Sheffield** ) and one region ( **Galicia** ) in Italy, Spain and
the United Kingdom (UK), through a **two-phase use-case validation.** The
stakeholders engaged in the **three use-cases** were selected for their
experience and interest in e-services, as well as for the different socio-
cultural backgrounds of the three regions. In this way, the Consortium have
the opportunity to validate the effectiveness of the project results in
**contexts which differ on the number and heterogeneity of citizens and their
social and cultural background** . There are indeed important **differences in
the technological ecosystems** , with Trento and Sheffield having just started
the process of digitalization of their services to citizens and businesses
(this process will actually happen in alignment and integration with the
SIMPATICO activities), and Galicia having a mature and consolidated e-service
delivery infrastructure (thus allowing to study the deployment of SIMPATICO on
top of an already operating system). The contexts also **differ for the point
of view of the number and heterogeneity of end-users and for the variety and
maturity of e-services** ( **see deliverable “D6.1 – Use-case planning &
evaluation v1” ** ).

The tables below provide a short description of the SIMPATICO pilots
summarising the general background and purpose of the use cases, as well as
information on recruitment procedures, personal and sensitive data processing,
and vulnerable groups involved in the experimentations.  
  
<table>  
<tr>  
<th>

**TRENTO PILOT**

</th> </tr>  
<tr>  
<td>

**General background**

Trento is the capital of the Autonomous Province of Trento in Italy. It is a
cosmopolitan city of 117.317 inhabitants. The digitalization of all
interactions between the PA and its citizens is a priority for Trento, and the
city is currently working on a strategic project in this area. Trento has
already done much to improve interactions with its citizens. Trento has
already supported submitting applications through certified e-mail, by sending
the filled application documents and a scan of identity document and
signature. As part of its “smart city” strategy, Trento is working to realize
a new e-service portal: it will serve as a “one-stop shop” or unique access
point that offers integrated and facilitated access to all the various
services. With this new portal, it will be possible for citizens and
businesses to authenticate using smart service cards or one-time password
devices, and to complete the interaction online.

The Municipality of Trento has adopted “Sportello Telematico”, an end-to-end
solution provided by the GLOBO srl company, specifically targeting the
digitalization of modules for service provision by PA. Within this solution,
the digital module is a composition of sections of organic information (e.g.,
birth data section, residence data section, real estate registry data
section). The logic of the interaction with an information section is
explicitly mapped by the module designer. The integrations with legacy systems
are handle via a centralized REST web service, which routes the proper service
request to the right data source service. Finally the solution supports module
hierarchy, which guarantees the definition of a well organized digital module
library.

**Purpose of the use case**

The main specific purpose of the first SIMPATICO experiment phase in Trento is
to validate the integration between the Trento e-service portal and SIMPATICO
solution, with the final aim to evaluate the SIMPATICO solution usability. The
experiment will be based on two different eservices:

  * Childcare services: enrolment to day-nursery services; 

  

  * Environment quality: acoustic derogation for temporary activities (e.g., regarding musical entertainment at public premises or other cultural events). 

  

**Recruitment procedures**

The experimentation is structured in two phases: (1) a pre-evaluation phase,
where the e-services and the SIMPATICO solution will be evaluated in a
controlled environment from a citizen panel representative of the e-service
user community; (2) an evaluation phase, where the e-services and the
SIMPATICO solution will be evaluated in a production environment and open to
everyone.

**Personal and sensitive data processing**

For both the above-mentioned e-services the project will collect demograhic
information from the participants (e.g., gender, age). More specifically, the
digital module of the childcare service will require to specify further
personal data (i.e., parent/custodial records, child records, family work
conditions, family economic conditions) and sensitive information (i.e., if
the family is in charge of the social care service; if the child has some form
of disability).

**Vulnerable groups**

Children, persons with disabilities, and immigrant or minority communities.

Please note that:

the use case will involve only participants capable to give consent (e.g., we
will involve only the

</td> </tr>  
<tr>  
<td>

legal guardians and/or carers of children);

the Informed Consent Form has been translated in Italian;

appropriate efforts will be made to ensure fully informed understanding of the
implications of participation (i.e., participants shall understand all the
proceedings of the research, including risks and benefits).

</td> </tr> </table>  
<table>  
<tr>  
<th>

**GALICIA PILOT**

</th> </tr>  
<tr>  
<td>

**General background**

Galicia is an autonomous community of Spain and historic nationality under
Spanish law. It has a population of 2.717.749 inhabitants and has a total area
of 29.574,4 km. The Xunta de Galicia is the collective decision-making body of
the government of the autonomous community of Galicia. The Xunta has at its
disposal a vast bureaucratic organization based at Santiago de Compostela, the
galician government capital. According to data provided by IGE (Instituto
Galego de Estatistica), the number of Galician elderly inhabitants is
alarmingly increasing. Furthermore, the socioeconomic indicators for Galicia
show a number of particular needs that make it suited for eservices
improvement: a sparse distribution of the population, especially in the rural
parts of the region. In that regions people often migrate to the richer
coastal areas and other Spanish regions. This has resulted in large rural
areas with low population density, where the access to public services is
harder. Consequently, there is a big gap in the usage of e-services in Galicia
in the segment of population older than 55.

**Purpose of the use case**

The main specific purpose of the use case is to analyse and validate the
technological acceptance of elderly groups using the selected Xunta
("Government of Galicia") e-services and SIMPATICO solution. This analysis and
validation will assess both (1) discretionary usage and satisfaction to
measure the acceptance, and (2) the effectiveness and efficiency of the
e-service usage improved by SIMPATICO. The main target audience are the
elderlies, and two e-services have been selected:

  * Grants for the attendance to wellness and spas program; 

  

  * Individual grants for personal autonomy and complimentary personal assistance for disabled people. 

  

**Recruitment procedures**

This use case will be a closed experimentation. The participants will be
recruited by three associations:

  * FEGAUS (Federation of Associations of alumni and ex alumni of the Senior University Programs) will provide elder users. These users will be between 55 and 75 years old. They have medium-high technological profile, i.e., they are able to autonomously access the internet and use modern devices such as smartphones and tablets. 

  

  * ATEGAL (Association for Lifelong Learning) will provide elder users. These users will be adults with age over 55 years, and with a medium cultural level. The technical level of the ATEGAL members is lower than that of the FEGAUS members. 

  

  * COGAMI is an association for people with disabilities of all ages. The technical level of the COGAMI members is heterogeneous, from entry-level users to experienced ones. 

  

**Personal and sensitive data processing**

The project will collect demographic information from the participants (e.g.,
gender, age) and

</td> </tr>  
<tr>  
<td>

whether they have physical disabilities (especially in the case of COGAMI
users).

**Vulnerable groups**

Elderly people and persons with disabilities. Please note that:

  * the use case will involve only participants capable to give consent (e.g., we will involve only persons with physical disabilities); 

  

  * the Informed Consent Form has been translated in Spanish; 

  

  * appropriate efforts will be made to ensure fully informed understanding of the implications of participation (i.e., participants shall understand all the proceedings of the research, including risks and benefits). 

  

</td> </tr> </table>  
<table>  
<tr>  
<th>

**SHEFFIELD PILOT**

</th> </tr>  
<tr>  
<td>

**General background**

Sheffield is a city and metropolitan borough in South Yorkshire, England (UK).
It is England’s third largest metropolitan authority with 551.800 people.
Sheffield is an ethnically diverse city, with around 19% of its population
from minority ethnic groups. The largest of those groups is the Pakistani
community, but Sheffield also has large Caribbean, Indian, Bangladeshi,
Somali, Yemeni and Chinese communities. More recently, Sheffield has seen an
increase in the number of overseas students and in economic migrants from
within the European Union. It is estimated that migrants living in Sheffield
actively speak at least 40 languages. Although a significant volume of
information is openly available on the Sheffield City Council (SCC)'s website
(http://www.sheffield.gov.uk/), current interactions between migrants and
Sheffield City Council are mostly done in person or over the phone. An
intended outcome is that more users of council services will prefer to use
digital channels rather than traditional face to face, email and telephone
contact.

**Purpose of the use case**

The main specific purpose of the first SIMPATICO experiment phase in Sheffield
is to validate the implementation of the SIMPATICO technologies into the
Sheffield City Council website, with the final aim to evaluate the SIMPATICO
solution usability. The experiment will be based on three different
e-services:

  * School Attendance (i.e., it aims to inform parents, education workers and general citizens about the importance of school attendance by children. The following tasks presented in the page: information advising why school attendance is important; form to report suspected truancy; pay term time absence fine); 

  

  * Parenting Skills Course (i.e., it aims to inform parents about the support provided by the city council and external partners to equip them with better parenting skills); 

  

  * Young Carers (it aims to support and provide information for people under 21 who look after someone else. All young carers under 18 have the right to an assessment). 

  

**Recruitment procedures**

The experimentation is structured in two phases: (1) a pre-evaluation phase,
where the e-services and the SIMPATICO solution will be evaluated in a
controlled environment from a citizen panel representative of the e-service
user community; (2) an evaluation phase, where the e-services and the
SIMPATICO solution will be evaluated in a production environment and open to
everyone.

</td> </tr>  
<tr>  
<td>

**Personal and sensitive data processing**

The project will collect demographic information from the participants (e.g.,
gender, age) including sensitive information on ethnic or racial origin.

**Vulnerable groups**

Immigrants or minority communities, minors, possible persons with
disabilities.

Please note that:

  * the use case will involve only participants capable to give consent (e.g., we will involve only the legal guardians and/or carers of minors); 

  

  * the Informed Consent Form has been translated in English; 

  

translation services for immigrants or minority communities will be provided
(if needed);  appropriate efforts will be made to ensure fully informed
understanding of the implications of participation (i.e., participants shall
understand all the proceedings of the research, including risks and benefits).

</td> </tr> </table>

##  SIMPATICO ethical issues

The SIMPATICO consortium is committed to **perform a professional management
of any ethical issue** that could emerge in the scope of the activities of the
project, also through the support of its **Ethics Advisory Board** (see
deliverable “D1.5 – Ethics compliance report”). For this reason, the
consortium has identified relevant ethical concerns already during the
preparation of the project proposal and, then, during the preparation of the
Grant Agreement. During this phase, the European Commission has also carried
out an ethics scrutiny of the proposal, with the objective of verifying the
respect of ethical principles and legislation. With regard to SIMPATICO, the
research entails specific ethical implications, involving human subjects and
risks for the protection of personal data [2] [3]. In particular, the
**SIMPATICO ethical issues (requirements)** , as reported in the European
Commission ethics scrutiny report and acknowledged by the SIMPATICO project,
are the following:

####  _Protection of personal data – “D8.2 – POPD – Requirement no. 2”_

  1. _Copies of ethical approvals for the collection of personal data by the competent University Data Protection Officer/National Data Protection authority must be submitted by the coordinator to REA before commencement of data gathering._

  

  2. _Clarification and if relevant justification must be given in case of collection and/or processing of personal sensitive data. Requirement needs to be met before commencement of relevant work._

  

  3. _The applicant must explicitly confirm that the existing data are publicly available._

  

  4. _In case of data not publicly available, relevant authorisations must be provided, requirements to be met before grant agreement signature._

  

  

SIMPATICO involves **collecting and processing personal data** (i.e., any
information which relates to an identified or identifiable natural person,
such as name, address, email) and **sensitive data** (e.g., health, sexual
life, ethnicity). The **Citizen Data Vault** represents the component that
will take care of personal and sensitive data exchange between a user and
SIMPATICO components. Personal and sensitive data will be made **publicly
available** (e.g., for the data of **Citizenpedia** ) only after an **informed
consent** has been collected and suitable **aggregation and/or
pseudonymization techniques** have been applied. Mechanisms for encryption,
authentication, and authorization (e.g., TLS protocol, Single-Sign-On
implementations, Policy Enforcement Point for XACML) will be exploited in the
processes, so to ensure the satisfaction of core **security and data
protection requirements** , namely confidentiality, integrity, and
availability. For further details, please see sections below and deliverables
**“D1.5 – Ethics compliance report”** and **“D8.2 – POPD – Requirement no.
2”** .

The Consortium will comply with the requirements of:a) the **Directive
95/46/EC** of the European Parliament and of the Council of 24 October 1995
(and subsequent modifications and supplements) on the protection of
individuals with regard to the processing of personal data and on the free
movement of such data; b) the **Regulation (EU) 2016/679** (General Data
Protection Regulation – GDPR) of the European Parliament and of the Council of
27 April 2016 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data, and
repealing Directive 95/46/EC; ; c) the **national legislation** of SIMPATICO
pilots (i.e., Italy, Spain, and the United Kingdom) in the field  1  [4] (see
also “D1.5 – Ethics compliance report”).

In the context of the SIMPATICO project, Fondazione Bruno Kessler is the data
controller (i.e., the entity that is in control of the processing of personal
data and is empowered to take the essential decisions on the purposes and
mechanisms of such processing). Data processors (i.e., any partner other than
an employee of the data controller who processes the data on behalf of the
data controller) are all the other members of the SIMPATICO Consortium.

According to the new EU Regulation 2016/679, data subjects have a **right to
access and port data, to rectify, erase and restrict his or her personal data,
to object to processing** and, if processing is based on consent, **to
withdraw consent** . In particular, SIMPATICO will comply with the GDPR as
follows:

  1. **Subject access, rectification and portability:**

     * FBK, as data controller, will, on request: confirm if they process an individual’s personal data; provide a copy of the data (in commonly used electronic form); and provide supporting explanatory materials; data subjects can also demand that their personal data be ported to them or a new provider in machine readable format; the request will be met within one month and any intention not to comply must be explained to the individual. Access rights are intended to allow individuals to check the lawfulness of processing and the right to a copy should not adversely affect the rights of others. 

  

     * For what concerns the personal data submitted by the user in the interaction with the eservices, the Citizen Data Vault will provide users with explanations on how and which personal information will be collected during their interaction with e-services. At the first usage of CDV, users will be informed that at any moment, during their interaction with eservices, they can, by clicking appropriated buttons, withdraw the collection of data and export a copy of the collected data in an open format. Currently users will be asked to choose from two types of open format: CSV and JSON. 

  

  

  2. **Right to erasure (“right to be forgotten”) and right to restriction of processing:**

     * Individuals can require data to be "erased" when there is a problem with the underlying legality of the processing or where they withdraw consent; the individual can require the controller to "restrict" processing of the data whilst complaints (for example, about accuracy) are resolved, or if the processing is unlawful but the individual objects to erasure; FBK, as SIMPATICO data controller, who has made data available to other subjects, which is then subject to a right to erasure request, is required to notify others who are processing that data with details of the request. 

  

     * The Citizen Data Vault module has been designed to enable individuals to require data to be erased. Furthermore according to the "consent based" approach the user can at any moment withdraw the consent or to restrict the type of data stored by CDV during the interaction with e-services forms. 

  

  

  3. **Rights to object:**

     * There are rights for individuals to object to specific types of processing, such as processing for research or statistical purposes; 

  

     * SIMPATICO will meet the obligations to notify individuals of these rights at an early stage through the informed consent form and its information sheet; 

  

     * Online services provided by the Pas involved in the project, and extended by the advanced techniques developed by SIMPATICO, will offer their own methods of objecting. More information can be found in **D1.5 – Ethics compliance report.**

  

  

  

####  _Humans \- “D8.1 – H – Requirement no. 1”_

  1. _Details on the procedures and criteria that will be used to identify/recruit research participants must be provided._

  

  2. _Detailed information must be provided on the informed consent procedures that will be implemented._

  

  

SIMPATICO involves **work with humans** (‘research or study participants’):
according to the EC, collection of personal data, interviews, observations,
tracking or the secondary use of information provided for other purposes. End-
users (i.e., citizens and businesses) are **engaged in the project usecases**
to test the functionalities provided by the SIMPATICO solution for the usage
of e-services. Specific **engagement campaigns** are defined and executed for
each use-case. The use-cases involve **only voluntary participants** **aged 18
or older and capable to give consent** , who will be informed on the nature of
their involvement and on the data collection/retention procedures through an
**informed consent form** before the commencement of their participations.
**Terms and conditions** will be transparently communicated to the end-users
by means of an **information sheet** including descriptions of e.g., purpose
of the research, adopted procedures, data protection and privacy policies.
SIMPATICO pilots may involve certain **vulnerable groups** , **e.g., elderly
people, persons with physical disabilities, and immigrants.** For further
details, please see deliverables **“D1.5 – Ethics compliance report”** and
**“D8.1 – H – Requirement no. 1”** .

####  _Vulnerable groups_

In addition to the above-mentioned ethical requirements, in the context of
this deliverable it is also important to specify that SIMPATICO pilots may
involve certain **vulnerable groups** : **e.g., elderly people, persons with
physical disabilities, and immigrants** . Please note that all the research
participants will have the **capacity to provide informed consent** :
individuals who lack capacity to decide whether or not to participate in
research will be appropriately excluded from research. Anyway taking into
account the scope and objectives of the research, researchers should be
**inclusive in selecting participants** . Researchers shall not exclude
individuals from the opportunity to participate in research on the basis of
attributes such as culture, language, religion, race, sexual orientation,
ethnicity, linguistic proficiency, gender or age, unless there is a valid
reason for the exclusion. Vulnerable groups could be misapplied for
stigmatisation, discrimination, harassment or intimidation. Concern for **the
rights and wellbeing of research participants** lies at the root of ethical
review. The perception of subjects as vulnerable is likely to be influenced by
diverse cultural preconceptions and so regulated differentially by localised
legislation. It is likely to be one of the areas where researchers **need
extra vigilance to ensure compliance with laws and customs** . Some
vulnerabilities may not even be obvious until research is actually being
conducted.

To reduce the risk of enhancing the vulnerability/stigmatisation of the above-
mentioned individuals, the SIMPATICO **Ethics Advisory Board** (see below)
provides **specific assessment on vulnerable groups** that may be involved,
prior of the commencement of the pilots’ activities. For further details,
please see deliverables **“D1.5 – Ethics compliance report”** and **“D8.1 – H
– Requirement no. 1”** .

####  _SIMPATICO Ethics Advisory Board_

All the above-mentioned deliverables will be assessed and validated during the
first meeting of the **SIMPATICO Ethics Advisory Board (EAB)** (see “D1.5 –
Ethics compliance report”). It is **competent to provide the necessary
authorizations** when the collection and processing of personal (or sensitive)
data is part of the planned research, with the validation of national and/or
local Data Protection Authorities if needed. This board is led by an **ethics
adviser** external to the project and to the host institution, totally
independent and free from any conflict of interest. In addition to the
external ethics adviser, the EAB is composed of **one expert representative
from all members of the SIMPATICO Consortium** [5]. Members of the Ethics
Board are listed in “D1.5 – Ethics compliance report” with the name and
contact information for persons appointed, the terms of reference for their
involvement, and their declarations of no conflict of interest. The
**reference national and/or local Data Protection Authorities** competent to
provide the above-mentioned SIMPATICO EAB with the necessary
**instructions/authorizations/notifications** for each pilot are the following
[6] [7] [8]:

**Trento pilot (Italy):** **the Italian Data Protection Authority (DPA** **-**
**_http://www.garanteprivacy.it/_ ) ** **.**

According to the “Italian Data Protection Code” (Legislative Decree no.
196/2003), an authorisation by the Italian DPA is required to enable private
(and public) bodies to process specific typologies of personal and sensitive
data (see Section 26 of the Italian Data Protection Code). More precisely, the
DPA needs to be notified (also thorough an electronic form) whenever a public
or private body undertakes a personal data collection, or personal data
processing activity, as data controller. A data controller is required under
the law to only notify the processing operations that concern e.g., data
suitable for disclosing health and sex life, data processed with the help of
electronic means aimed at profiling the data subject and/or his/her
personality, analysing consumption patterns and/or choices. In such context,
the DPA is also responsible for evaluating and expressing opinions on specific
arguments concerning data protection (see “Simplification of Notification
Requirements and Forms. Decision of the DPA dated 22 October 2008, as
published in Italy's Official Journal no. 287 of 9 December 2008”).

In the case of Trento pilot, we consider this public authority appropriate for
providing the SIMPATICO EAB with the necessary
instructions/authorizations/notifications.

**Sheffield pilot (United Kingdom): the University Research Ethics Committee
(UREC) of the University of Sheffield (
_https://www.sheffield.ac.uk/ris/other/committees/ethicscommittee_ )  . ** The
University Research Ethics Committee (UREC) of the University of Sheffield is
an independent, unbiased and interdisciplinary university-wide body that
scrutinizes any potential issues related to research ethics for staff and
students of the University of Sheffield, including collaborative research
deriving from external funding. The key tasks this committee is in charge of
are:

Advise on any ethical matters in research that are referred to it from within
the University; Keep abreast of the external research ethics environment and
ensure that the University responds to all external requirements.

In the case of the Sheffield pilot, we consider this committee appropriate for
providing the SIMPATICO EAB with the necessary guidance. We remark that all
entities involved in the Sheffield pilot – Sheffield Council, Sheffield
University and Sparta Technologies Ltd – comply with the UK data protection
regulations and each will ensure that this act is enforced when it comes to
their participation in the pilot. Only if necessary, the AEB will engage the
UK Information Commissioner's Office (ICO -  _https://ico.org.uk/_ )  .

**Galicia pilot (Spain): the Research Ethics Committee of the University of
Deusto (
_http://research.deusto.es/cs/Satellite/deustoresearch/en/home/research-
ethics-comittee_ )  . **

This committee is an independent, unbiased and interdisciplinary body that is
both consultative and advisory in nature, and reports to the Vice-Rector’s
Office for Research. This committee will assess SIMPATICO compliance with the
Spanish legal framework on privacy and data protection. This includes the
**Spanish Data Protection Act** 15/1999 ( **Law 15/1999 of 13 December 1999**
on Protection of Personal Data, last updated on 5 March 2011) and the **Royal
Decree 1720/2007** of 21 December 2007, approving the regulations implementing
Law 15/1999 (“Data Protection Regulations”; Last updated: 8 March 2012). Among
other responsibilities, this committee is in charge of:

  * Conducting the ethical assessment of research projects and drawing up the ethical suitability reports requested by institutions and researchers. 

  

  * Ensuring compliance with best research and experimentation practices with regard to individuals’ fundamental rights and the concerns related to environmental defense and protection. 

  

  * Supervising assessment processes or ethical requirements in research carried out by institutions and public bodies. 

  

  * Preparing reports for the University’s governing bodies on the ethical problems that may arise from R+D+I activities. 

  

  * Ensuring compliance with the Policy on Scientific Integrity and Best Research Practices of the University of Deusto. 

  

Providing guidance on laws, regulations and reports on research ethics.

Reviewing procedures that have already been assessed, or proposing the
suspension of any experimentation already started if there are objective
reasons to do so.

In the case of the Galicia pilot, we consider this committee appropriate for
providing the SIMPATICO EAB with the necessary
instructions/authorizations/notifications. Only if necessary, the AEB will
engage the Spanish Data Protection Authority, i.e., Agencia Española de
Protección de Datos (AEPD -  _http://www.agpd.es/_ )  .

##  Open access and data management

The Consortium adheres to **the pilot for open access to research data (ORD
pilot)** adopting an open access policy of all projects results, guidelines
and reports, providing on-line access to scientific information that is free
of charge to the reader [9]. Open access typically refers to two main
categories: **scientific publication** (e.g., peer-reviewed scientific
research articles, primarily published in academic journals) (Subsection
1.3.1) and **research data** (Subsection 1.3.2).

###  Open access to scientific publications

According to the European Commission, “under Horizon 2020, each beneficiary
must ensure open access to all peer-reviewed scientific publications relating
to its results” (see also Article 29.2 of the GA). The SIMPATICO Consortium
adheres to the EU open access to publications policy, choosing as most
appropriate route towards open access **self-archiving** (hereinafter also
referred to as **'green' open access** ), namely “a published article or the
final peer-reviewed manuscript is archived (deposited) in an online repository
before, alongside or after its publication. Repository software usually allows
authors to delay access to the article ('embargo period')”. The Consortium
will ensure open access to the publication within a maximum of six months.

The dissemination of SIMPATICO results will occur by mean of the activities
identified in the implementation plan, such as international publications,
participation in international events (exhibitions, conferences, seminars,
courses, etc.). In compliance with the Consortium Agreement, **free-online
access will be privileged for scientific publication** , following the above-
mentioned rules of ‘green’ open access. All relevant information and the
platform textual material (papers, deliverables, etc.) will be **also freely
available on the project website** . In order to guarantee that also people
who are visually impaired have access to all textual materials we will provide
also **accessible PDF files** . In specific cases and according to the rules
on open access, the dissemination of research results will be managed by
**adopting precautionary IPR protection tools** , in order not to obstacle
with preventive disclosures the possibility of protecting the achieved
foreground.

###  Open access to research data (Open Research Data Pilot)

According to the European Commission, “research data is information
(particularly facts or numbers) collected to be examined and considered, and
to serve as a basis for reasoning, discussion, or calculation”. Open access to
research data is **the right to access and reuse digital research data** under
the terms and conditions set out in the Grant Agreement.

Regarding the digital research data generated in the action, according to the
Article 29.3 of the GA, the SIMPATICO Consortium will:

_**Deposit in a research data repository** and take measures to make it
possible for third parties to access, mine, exploit, reproduce and disseminate
— free of charge for any user — the following: _

  1. _the data, including associated metadata, needed to validate the results presented in scientific publications;_

  

  2. _other data, including associated metadata, as specified and within the deadlines laid down in this data management plan;_

  

  

_(i) provide information — via the repository — about tools and instruments at
the disposal of the beneficiaries and necessary for validating the results._

Please note that a portion of the relevant data for SIMPATICO comes from
**existing data sets of the PAs** (e.g., service usage data, citizens’ data),
while **new data sources** will be defined by this deliverable and will be
identified as a result of requirements analysis in SIMPATICO. **Whenever
possible** , these additional data sources will also be made available **as
open data or through open services** . However, some of the collected data, in
particular that concerning **user profiles and personal data** , is highly
sensitive and will not be made available. More precisely, in order to discuss
the **public availability of data** , there are three different types of
datasets within the SIMPATICO project: 1. not publicly available personal and
sensitive data; 2. data treated according to open access policy of all project
results; 3. data connected to Citizenpedia. These datasets will be discussed
in detail in Section 2 below.

##  Data management policies

###  Data set reference and names

In order to be able to distinguish and easily identify data sets, each data
set is assigned with a unique name. This name can also be used as the
identifier of the data sets. In order to design the data set names, we use the
following practice. Each data set name consists of _four_ different parts
separated with a ”.” character:

_ProjectName.CountryCode.DatasetName.Version,_ where

  1. The _ProjectName_ is _SIMPATICO_ , in order to clearly identify for all datasets the origin. 

  

  2. The _CountryCode_ part represents the country associated with the dataset using ISO Alpha-2 country codes: 

    1. _IT_ for Italy ii. _ES_ for Spain iii. _UK_ for the United Kingdom 

  
  

  

  3. The _DatasetName_ represents the full name of the dataset. 

  

  4. The _Version_ of the dataset represents in which phase of the project the dataset was released: 

    1. _DB_ the live database during project lifetime ii. _InterimExport_ export of the database at M22 

  
  

  

  

iii. _FinalExport_ export of the database at the end of the project

An example of a data set’s name could be the following:
_SIMPATICO.IT.Citizenpedia.InterimExport._

###  Standards and metadata

This field will describe suitable standards that will be used to describe the
data as well as the metadata of the data sets. Metadata are “data that
provides information about other data”, describe the contents of data files
and the context in which they have been established. Several metadata
standards exist (see  _https://en.wikipedia.org/wiki/Metadata_standards_ )  .
Proper metadata facilitates use of the data by others, makes it easier to
combine information from different sources, and ensures transparency.

All SIMPATICO datasets will use a standard format for metadata. Each dataset
description will specify the Data and metadata standards used.

###  Archiving and preservation

The SIMPATICO partners agreed on the procedures that will be used in order to
ensure long-term preservation of the data sets.

In particular, datasets will be stored on Zenodo (  _https://zenodo.org/_ )  a
catch-all repository for EC funded research developed by CERN and launched in
May 2013\. To be an effective catch--all, that eliminates barriers to adopting
data sharing practices, Zenodo does not impose any requirements on format,
size (currently accepts up to 50GB per dataset), access restrictions or
license.

In addition, datasets stored on Zenodo are automatically part of OpenAIRE

( _https://www.openaire.eu/_ )  , the EC-funded initiative which aims to
support the Open Access policy of the European Commission via a technical
infrastructure, thus integrating them into existing reporting lines to funding
agencies like the European Commission.

Archiving on Zenodo is free, thus eliminating the costs

###  Data quality assurance

SIMPATICO is committed to deliver quality data, and adopts data quality
assurance procedures to achieve this goal. Quality control of each dataset is
the responsibility of the relevant WP leader, supported by Project Manager and
Project Coordinator. Depending on the case, “quality” might have different
meanings, depending on the utility and on the re-usage scenarios of the
dataset: for instance, editing a question submitted by a citizen through the
SIMPATICO platform improves data quality if the goal is to provide an “FAQ” or
a knowledge base on public services; it is detrimental if the intended usage
is the analysis of interaction skills and languages of the platform users.
Data quality insurance might hence imply editing and moderation, cleaning,
pre-processing, adding metadata, transforming to a more convenient format or
providing easier access. Information about the consortium's efforts to address
data quality issues is hence provided for each type if dataset.

#  SIMPATICO datasets

This **Data Management Plan (DMP)** has been prepared by taking into account
the current template of the “Guidelines on Data Management in Horizon 2020”
[1]. The elaboration of the DMP allows to SIMPATICO partners to address all
issues related with data. A first version of the DMP has been released at the
beginning of the project (M6). **This version is an update with the status of
the DMP at project month M16** , after the detailed definition of the project
use-cases and the revision of the ethics-related aspects of the project by the
Ethics Advisory Board, and taking into account the feedback collected during
the 1  st  year project review. A revised deliverable is expected at the end
of the project (“D1.4 – Data management plan v.2”, at M36). However, the DMP
will be a **living document** throughout the project, and this initial version
will evolve during the SIMPATICO lifespan according to the progress of project
activities.

In order to discuss the **public availability of data** , as outlined above,
it is convenient to distinguish three different types of datasets within the
SIMPATICO project:

  1. **Not publicly available personal and sensitive data** **will be collected and processed as part of the execution of the SIMPATICO use-cases** , more specifically for the execution of the eservices. Specifically, the use-cases will involve only voluntary participants aged 18 or older and capable to give consent, who will be informed on the nature of their involvement and on the data collection/retention procedures through an informed consent form before the commencement of their participations. Informed consent will follow procedures and mechanisms compliant with European and national regulations in the field on ethics, data protection and privacy (see also deliverables “D1.5 – Ethics compliance report”, “D8.1 – H – Requirement no. 1”, and “D8.2 – POPD – Requirement no. 2”). 

  

  2. **SIMPATICO adheres to the open access policy of all project results.** Specifically, we are committed to make available, whenever possible, the data collected during the execution of SIMPATICO, in particular data collected during the use-cases, also to researchers and other relevant stakeholders outside the project Consortium. Whenever possible, these additional data sources will also be made available as open data or through open services. In this context, any personal data will only be published after suitable aggregation and/or pseudonymization techniques have been applied, and after an informed consent that explicitly authorize this usage has been collected. 

  

  3. **SIMPATICO intends to build an open knowledge base on public services and processes** **through Citizenpedia** , released as a new public domain resource co-created and co-operated by the community (i.e., citizens, professionals and civil servants). The initial content of Citizenpedia will be based on datasets and other digital goods that are publicly available. In the case of datasets and other digital goods owned by the PAs and not already publicly available, the Consortium will pursue to obtain an authorization for public release, as open content, before inclusion in the Citizenpedia. For what concerns the data contributed to Citizenpedia by the community, SIMPATICO will require that they are made available as open content (e.g., with licenses such as Creative Commons). 

  

  

This Data Management Plan and its updated versions describe **datasets
characteristics** and **define principles and rules for the distribution of
data** within SIMPATICO. In particular, in this first version of the DMP we
present in details the procedures of creating **‘primary data’** (i.e., data
not available from any other sources) and of their management. As such, only
the datasets corresponding to “Citizenpedia” (Section 2.1), “Logging/Feedback”
(Section 2.2), and “Citizen Data Vault (CDV) Dataset” (Section 2.3) are
described in detail in the following sections, as any other datasets already
exist and their creation is not foreseen in the GA.

##  Citizenpedia Datasets

###  Description

Citizenpedia is the **human computation framework** inside the SIMPATICO
platform. Its aim is to be a place where citizens can find useful information
regarding e-services and public administration. Thus, **most of the content
will be created and consumed by humans** . It will be mainly stored in JSON
format.

Citizenpedia is composed of **two main interactive parts** for the users, a
Question Answering Engine and a Collaborative Procedure Designer. Thus, the
typology of data is twofold:

  1. **Question Answering Engine:** questions, answers, comments and terms/definitions, generated in the Question Answering Engine. All of them will be created, stored and retrieved in JSON format. 

  

  2. **Collaborative Procedure Designer:** diagrams representing procedures, and comments to these diagrams. The diagrams will be stored and encoded, in a computer processable manner, and not as a bitmap. Comments will be stored in JSON format. 

  

  

Both types of data will be stored in the **same database** , within
Citizenpedia; for this reason, a unique datatset will be generated for both
data typologies.

Citizenpedia, along with the SIMPATICO platform, is intended to be deployed in
**three different cities/regions of different countries** (i.e., Italy, Spain,
and the United Kingdom). Each country speaks its own language (i.e., Italian,
Spanish and English), and the human-generated data in each Citizenpedia will
be in **different languages** . For that reason, we are using a different
dataset in each pilot.

###  Standards and Metadata

DEUSTO team, after an initial investigation, did not find a standard format
for the storage/management of the generated data/metadata. We have followed
the **structure used in already deployed human-computation platforms** , such
as the ones reviewed in the deliverable “D4.1 Citizenpedia framework
specification and architecture”. The resulting representation of gathered
information is centered on the User and e-service concepts. A User can create
or review Questions which may have associated Terms and Answers, belong to a
Category, be annotated with Tags or have associated several Comments.
Questions are always associated to a given e-service. On the other hand a User
can create or review the procedure associated to a e-service which is composed
of several Diagram Elements and might also have associated several comments. A
simplified diagram of the Citizenpedia database is provided in Figure 3.

Currently, the Citizenpedia collective knowledge base is stored as a MongoDB
database. In MongoDB entities are stored as collections, i.e. a concept
equivalent to tables in SQL. Consequently, each of the above mentioned
entities’ information is gathered in their corresponding MongoDB collections.
Since MongoDB is a NoSQL database, foreign keys are not enforced by the
underlying database management system. However, data integrity and cross-
references among entities are managed by the Citizenpedia’s business logic in
a programmatic manner. MongoDB offers several utilities that enable to easily
extract the stored information in JSON format, namely mongodump and
mongoexport.

**Figure 3 Simplified Citizenpedia database model**

We consider **two types of additional metadata** to be generated in
Citizenpedia, apart from the core entities metadata mentioned above:

  1. **Usage statistics:** this information will be created under demand. E.g. as an answer to the query “number of registered questions related to the Law XYZ/2015”. Currently, the Citizenpedia communicates with the LOG module to issue a new log every time a user performs a CRUD (Created, Read, Update, Delete) operation over any of the entities modeled by Citizenpedia. The LOG module offers an API from which usage statistics about Citizenpedia contents can be extracted. 

  

  2. **Indexing engine metadata:** an indexing engine included inside Citizenpedia, i.e. ElasticSearch or Apache SolR creates this data. This metadata is consumed by ElasticSearch to provide better searching capabilities over plain-text data. In upcoming releases of Citizenpedia, we will configure and parameterize the selected search engine in order to aim to optimize its searching capabilities. 

  

  

###  Data capture

As regards data capture methods, there are **two ways of creating content** in
Citizenpedia:

  1. **Using the web interface:** citizens/civil servants will use the platform and write the information using their browsers. Then, data will be stored in the Citizenpedia database. 

  

  2. **Programmatically, via a REST interface:** Citizenpedia exposes a REST API for other SIMPATICO components/third party applications to query/insert data in the system. 

  

  

###  Data storage

All the information related to Citizenpedia (i.e., both user-generated data
and metadata) is stored in the **Citizenpedia internal database** . DEUSTO, as
responsible of WP4 within the SIMPATICO Consortium, ensures to handle security
and privacy issues, enforcing access to the internal database only via
**secure connections** and using **access control systems** .

###  Data quality assurance

Data collection is undertaken mainly through forms filling through the QAE or
CPD. Both tools undertake validation against their type, semantics and
completeness. It is also possible to create data associated to the entities
managed by the Citizenpedia, namely User, Question, Answer, Comment,
Definition, Category, Tag, e-service, Procedure and Diagram Element, through
the provided RESTful

API. Again, the same validation as when filling form fields is carried out.
For the next release of the Citizenpedia the following two new features are
envisaged to further assure the quality of the data managed. Firstly, a _spam
analyser module_ will be included which assesses whether the introduced
contents can be regarded as spam, i.e. mainly for questions and answers.
Secondly, the _moderator role_ will be introduced, which will be introduced in
the Citizenpedia to ensure that some users can monitor, review and edit
available updates, correcting or even removing them in case that they are
polluting rather than enriching the Citizenpedia knowledgebase.

###  Utility and re-use

Data collected will be useful for Citizens and PA representatives. Citizens
can encounter answers regarding the contents and procedures associated to the
e-services that they interact with it. PA representatives can spot areas,
which are unclear for e-service consumers when gathering comments or new
questions associated to e-service concepts or procedure steps. Both QAE and
CPD can be used to ensure that a common understanding of e-service operation
is reached among PA representatives and with the e-service consuming citizens.

###  Data sharing

Method for data sharing is twofold:

  1. **Human generated data:** first, human generated data (such as questions/answers/comments) will be shared publicly. It could be checked using the web interface or programmatically through a REST API. Given that this data is created by users, they will be warned in their first time using Citizenpedia that any content they make will be publicly available. 

  

  2. **Metadata:** second, as regards the metadata generated from the usage of data (such as statistics), some of the statistics (aggregated data) will be publicly available through the REST API, e.g., the number of questions related to a certain topic. The entire metadata will only be used for research purposes: in the case of the releasing some scientific publication from the usage data of Citizenpedia, information will be completely aggregated and/or pseudonymized. 

  

  

###  Archiving and preservation

The SIMPATICO Consortium and, in particular, DEUSTO (as responsible of this
WP) consider **to** **retain generated data** during the length of the
project. Statistical data can be retained longer, after the end of the project
lifespan, for research purposes. If so, DEUSTO estimates no additional cost
for this. If collected metadata and statistical data will be retained after
the length of the project, DEUSTO has the infrastructure **to retain data
safely** .

###  Datasets  
  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIMPATICO_ES_Citizenpedia_DB

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Live database of Citizenpedia adopted by the Galician pilot

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

DEUSTO

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

JSON database (MongoDB)

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

500 Kb ~ 1 Mb

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Open

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

Contents of this dataset can be accessed through Mongo binary API which can
only be used if proper credentials are supplied.

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

Project duration

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Trento deployment of SIMPATICO platform

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

No additional cost

</td> </tr> </table>  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIMPATICO_ES_Citizenpedia_InterimExport

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Export of SIMPATICO_ES_CITIZENPEDIA_DB at the end of the first pilot phase
(M20).

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

DEUSTO

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

JSON

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

500 Kb ~ 1 Mb

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Open

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

OpenAIRE

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

5 years after project end

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Zenodo

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

No additional cost

</td> </tr> </table>  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIMPATICO_ES_Citizenpedia_FinalExport

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Export of SIMPATICO_ES_CITIZENPEDIA_DB at the end of the project (M36).

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

DEUSTO

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

JSON

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

500 Kb ~ 1 Mb

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Open

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

OpenAIRE

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

5 years after project end

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Zenodo

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

No additional cost

</td> </tr> </table>  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIMPATICO_UK_Citizenpedia_DB

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Live database of Citizenpedia adopted by the Sheffield pilot

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

SPARTA

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

JSON database (MongoDB)

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

500 Kb ~ 1 Mb

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Open

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

Contents of this dataset can be accessed through Mongo binary API which can
only be used if proper credentials are supplied.

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

Project duration

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Trento deployment of SIMPATICO platform

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

No additional cost

</td> </tr> </table>  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIMPATICO_UK_Citizenpedia_InterimExport

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Export of SIMPATICO_UK_CITIZENPEDIA_DB at the end of the first pilot phase
(M20).

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

SPARTA

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

JSON

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

500 Kb ~ 1 Mb

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Open

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

OpenAIRE

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

5 years after project end

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Zenodo

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

No additional cost

</td> </tr> </table>  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIMPATICO_UK_Citizenpedia_FinalExport

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Export of SIMPATICO_UK_CITIZENPEDIA_DB at the end of the project (M36).

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

SPARTA

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

JSON

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

500 Kb ~ 1 Mb

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Open

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

OpenAIRE

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

5 years after project end

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Zenodo

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

No additional cost

</td> </tr> </table>  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIMPATICO_IT_Citizenpedia_DB

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Live database of Citizenpedia adopted by the Trento pilot

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

Fondazione Bruno Kessler

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

JSON database (MongoDB)

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

500 Kb ~ 1 Mb

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Open

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

Contents of this dataset can be accessed through Mongo binary API which can
only be used if proper credentials are supplied.

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

Project duration

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Trento deployment of SIMPATICO platform

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

No additional cost

</td> </tr> </table>  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIMPATICO_IT_Citizenpedia_InterimExport

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Export of SIMPATICO_IT_CITIZENPEDIA_DB at the end of the first pilot phase
(M20).

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

Fondazione Bruno Kessler

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

JSON

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

500 Kb ~ 1 Mb

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Open

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

OpenAIRE

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

5 years after project end

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Zenodo

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

No additional cost

</td> </tr> </table>  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIMPATICO_IT_Citizenpedia_FinalExport

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Export of SIMPATICO_IT_CITIZENPEDIA_DB at the end of the project (M36).

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

Fondazione Bruno Kessler

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

JSON

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

500 Kb ~ 1 Mb

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Open

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

OpenAIRE

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

5 years after project end

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Zenodo

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

No additional cost

</td> </tr> </table>

##  Logging/Feedback Datasets

###  Description

The SIMPATICO project provides a series of interactive front-end components as
depicted in the yellow blocks in the diagram below, i.e., the user interaction
and feedback analysis layer of the SIMPATICO Platform (see Figure 2). The
components are as follows:

_Session Feedback (SF)_ : which presents users with a feedback gathering form
after each session.

_Data Analysis (DA)_ : which gets data from the LOG coming from a variety of
sources connected to interaction and provides extra analysis layers on top.

  * _Interaction Log (LOG)_ : which collects all the interaction information in the system. 

  

These modules generate valuable information coming from the interaction of the
users. This happens by two different mechanisms:

  * **Explicit information gathering** , e.g., asking users directly to assess their interaction after it has happened. This is widely done in the industry and can be performed by a number of different mechanisms. 

  

  * **Implicit information collection** , e.g., analysing metrics of interest in the interaction without requiring the users to be providing any extra information. As an example, upon the execution of a e-service request information about the time spent for each step may be collected and then analysed to find insights such as bottlenecks. 

  

Both of these data generation sets were conceptualized in the platform’s
architecture in the cited modules. These includes **two data storage modules**
such as the LOG for explicit and implicit data plus a data analysis step in
the DA to generate new insights (e.g., statistics) from gathered data
elements.

###  Standards and Metadata

The SIMPATICO team has not found relevant dedicated standards about the
representation of these metadata. There is a model of the interaction (see
deliverable D3.2) which is the basis of the interaction in the project’s
results. Inspiration for this and other of the interaction elements such as
questionnaires, etc. is from common representation data models of usability
evaluation such as the System Usability Testing (SUS) [10], and standards such
as the ISO 9241  2  for desktop application ergonomics.

The metadata are generated from the data in the section above using the
following analysis steps:

**_Explicit information analysis:_ ** Statistics about general feelings or
ratings for particular areas or topics identified in the first stage of
analysis. This is chiefly generated by the Session Feedback component.
**_Implicit information analysis:_ ** Statistical analysis of the data
captured: average time spent by users, segmentation by age groups or target
groups, etc. This is captured in the front-end of the system and further
processed by the Data Analysis component.

###  Data capture

The data is collected in different ways according to the mechanism of
information gathering (i.e., implicit/explicit), as explained above:

**_Explicit information gathering (gathered in the Session Feedback
component)_ **

  * Questionnaires to the users with predefined (‘canned’) responses such as emoticons or “Likert scale” values. 

  

  * Open ended questions and free form responses. This can then be further analysed using NLP tools or human experts, to search for elements such as: 

    * Sentiment analysis to capture the general sentiment generated by the system. 

  

    * Topic clustering to detect potential pain points or concerns of the users. 

  

  

**_Implicit information gathering (gathered by the front-end and processed in
the Data Analysis_ _component)_ **

  * Capture metrics such as click areas, time spent in different steps of the process. For this matter a mixture of handcrafter trackers and the open web analytics tool Piwik are used. 

  

###  Data storage

The storage of these components (LOG, SF, DA and EE) is centralized at the
interaction LOG component which stores metadata of the interaction. This
component is constructed on top of an instance of the ElasticSearch.
Internally, ElasticSearch uses a document-oriented storage solution with an
associated Lucene indexing and search engine.

###  Data quality assurance

The results stored in the feedback analysis storage are stored as JSON
documents (Javascript objects in plain text). Internally, the data is
represented in manners which are specific to the application (e.g., feedback
logs from session feedback contain data that can be mapped to the specific
questions asked by the component).

The data stored can be related to individual users (linked to the ones in the
CDV by alphanumerical user IDs that mean the data is effectively anonymized if
the CDV profile is erased) or to aggregate results by a group of users (e.g.,
average times by all users to complete a step in the e-service).

The access to the LOG is securized by means of the use of the AAC component so
that arbitrary HTTP connections cannot be opened against the component.

###  Utility and re-use

By their nature, the feedback results compiled in this part of SIMPATICO, are
tightly connected to the particular usages and roles of the components. Thus,
their reuse can be difficult for other applications.

One result which can be of wider use is the global collection of
simplification requests, the simplification results and the feedback of the
users on the quality of the simplification as captured by the Session Feedback
component. This will be thus selected for further detailing and explanation in
the release of the data.

###  Data sharing

The data and metadata generated by the module expected to be useful beyond
SIMPATICO mainly to researchers due to the particularities of the application.
**The sharing of corpora of the data** is envisaged at the end of the project
as open data. Specific scientific data will also be used for **publications**
of the Consortium members.

###  Archiving and preservation

**All storing and preservation procedures is carried out internally** to the
project (e.g., in servers physically located at the partners premises and
under their full control). The captured interaction data will shared as open
data.

As discussed at a project level, it is expected that data sets will be shared
using the Zenodo platform. This will provide the means for long-term storage
and sharing.

###  Datasets  
  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIPATICO_ES_LOGDataset_DB

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Live database of logs of the usage of SIMPATICO platform adopted by the
Galicia pilot

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

HIB

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific data

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

JSON (JavaScript Object Notation) and binary ElasticSearch dumps

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

10 KB /session /user (approximately). Totals: _Data size:_ 20 persons, 1
session 🡪 200 KB

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Open

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

Contents of this dataset can be accessed through swagger API

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

Project duration

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Galicia deployment of SIMPATICO platform

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

No additional cost

</td> </tr> </table>  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIPATICO_ES_LOGDataset_InterimExport

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Released at the end of the first validation phase at Galicia (M20) and
including data from the interaction captured in the LOG.

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

HIB

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific data

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

JSON (JavaScript Object Notation) and binary ElasticSearch dumps

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

10 KB /session /user (approximately). Totals:

</td> </tr>  
<tr>  
<td>

</td>  
<td>

_Data size:_ 150 persons, 1 session 🡪 1500 KB

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Open

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

OpenAIRE

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

5 years

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Zenodo open data repository

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

Zenodo is free for the data sizes envisaged in SIMPATICO.

</td> </tr> </table>  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIPATICO_ES_LOGDataset_FinalExport

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Released at the end of the second project validation and the project end (M36)
and including data from the interaction captured in the LOG.

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

HIB

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific data

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

JSON (JavaScript Object Notation) and binary ElasticSearch dumps

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

10 KB /session /user (approximately). Totals:

_Data size:_ 150 persons, 1 session 🡪 1500 KB

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Open

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

OpenAIRE

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

5 years

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Zenodo open data repository

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

Zenodo is free for the data sizes envisaged in SIMPATICO.

</td> </tr> </table>  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIPATICO_IT_LOGDataset_DB

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Live database of logs of the usage of SIMPATICO platform adopted by the Trento
pilot

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

Fondazione Bruno Kessler

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific data

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

JSON (JavaScript Object Notation) and binary ElasticSearch dumps

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

10 KB /session /user (approximately). Totals: _Data size:_ 20 persons, 1
session 🡪 200 KB

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Open

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

Contents of this dataset can be accessed through swagger API

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

Project duration

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Trento deployment of SIMPATICO platform

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

No additional cost

</td> </tr> </table>  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIPATICO_IT_LOGDataset_InterimExport

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Released at the end of the first validation phase at Trento (M20) and
including data from the interaction captured in the LOG.

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

Fondazione Bruno Kessler

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific data

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

JSON (JavaScript Object Notation) and binary ElasticSearch dumps

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

10 KB /session /user (approximately). Totals:

_Data size:_ 300 persons, 1 session 🡪 3000 KB

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Open

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

OpenAIRE

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

5 years

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Zenodo open data repository

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

Zenodo is free for the data sizes envisaged in SIMPATICO.

</td> </tr> </table>  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIPATICO_IT_LOGDataset_FinalExport

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Released at the end of the final validation phase at Trento and project end
(M36) and including data from the interaction captured in the LOG.

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

Fondazione Bruno Kessler

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific data

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

JSON (JavaScript Object Notation) and binary ElasticSearch dumps

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

10 KB /session /user (approximately). Totals:

_Data size:_ 300 persons, 1 session 🡪 3000 KB

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Open

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

OpenAIRE

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

5 years

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Zenodo open data repository

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

Zenodo is free for the data sizes envisaged in SIMPATICO.

</td> </tr> </table>  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIPATICO_UK_LOGDataset_DB

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Live database of logs of the usage of SIMPATICO platform adopted by the
Sheffield pilot

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

SPARTA

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific data

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

JSON (JavaScript Object Notation) and binary ElasticSearch dumps

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

10 KB /session /user (approximately). Totals: _Data size:_ 20 persons, 1
session 🡪 200 KB

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Open

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

Contents of this dataset can be accessed through swagger API

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

Project duration

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Sheffield deployment of SIMPATICO platform

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

No additional cost

</td> </tr> </table>  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIPATICO_UK_LOGDataset_InterimExport

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Released at the end of the first validation phase at Sheffield (M20) and

</td> </tr>  
<tr>  
<td>

</td>  
<td>

including data from the interaction captured in the LOG.

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

SPARTA

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific data

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

JSON (JavaScript Object Notation) and binary ElasticSearch dumps

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

10 KB /session /user (approximately). Totals:

_Data size:_ 100 persons, 1 session 🡪 1000 KB

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Open

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

OpenAIRE

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

5 years

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Zenodo open data repository

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

Zenodo is free for the data sizes envisaged in SIMPATICO.

</td> </tr> </table>  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIPATICO_UK_LOGDataset_FinalExport

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Released at the end of the second validation phase at Sheffield (M36) and
including data from the interaction captured in the LOG.

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

SPARTA

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific data

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

JSON (JavaScript Object Notation) and binary ElasticSearch dumps

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

10 KB /session /user (approximately). Totals:

_Data size:_ 100 persons, 1 session 🡪 1000 KB

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Open

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

OpenAIRE

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

5 years

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Zenodo open data repository

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

Zenodo is free for the data sizes envisaged in SIMPATICO.

</td> </tr> </table>

##  Citizen Data Vault (CDV) Datasets

###  Description

The **Citizen Data Vault** **(CDV)** is a **repository of the citizen personal
data** . It is continuously updated through **each citizen interaction** and
is used mainly to automatically fill e-service forms. In this way, citizens
will give to the PA each information only once, as the information will be
stored in the vault and used in all the following interactions and among
different PA e-services. As regards the CDV, for personal data we will use the
**definition provided by the** **World Economic Forum (June 2010)** , namely
[11]:

**"Personal data is defined as data (and metadata) created by and about
people”** , encompassing:

**Volunteered data** – created and explicitly shared by individuals, e.g.,
social network profiles. **Observed data** – captured by recording the actions
of individuals, e.g., location data when using cell phones.

**Inferred data** – data about individuals based on analysis of volunteered or
observed information, e.g., credit scores."

Personal data is also very broadly defined in Article 2 of the European Data
Protection Directive as: "... any information relating to an identified or
identifiable natural person ("data subject")...". This definition is, for the
most part, unchanged under the new GDPR.

According to these definitions, through the CDV **citizens have a practical
mean to manage their personal data** with the ability to grant and withdraw
**consent** to third parties for access to data about themselves (see “D1.5 –
Ethics compliance report” – Annex I “Informed consent form”).

In summary, data collected by the means of CDV is referring on the context of
personal data. In a first stage, we have identified a **first categorization
of such personal data** , referring to:

  1. Government Records 

  

  2. Profile 

  

  3. Education 

  

  4. Relationship 

  

  5. Banking and Finance 

  

  6. Health 

  

  7. Communication & Media 

  

  8. Energy 

  

  9. Mobility 

  

  10. Activities 

  

  

For each category, **several data fields** have been defined. Starting from
these categories, we have grouped the actual personal data that each citizen
could manage by the means of CDV against the **three use cases** identified by
the three SIMPATICO pilots (i.e., Trento, Sheffield, and Galicia). The only
data that will be stored in CDV are those related of a subset of the fields of
PA e-service forms indentified for the validation phases in the three pilots
use cases.

We remark that the personal data collected or linked by the CDV will **never
be shared at any time** . **Each citizen** has the control and the ability to
have **a copy or** **removing all data from CDV** .

###  Standards and Metadata

CDV will collect personal data with a reference to a specific element of
**Personal Data Taxonomy** . In order to assure semantic interoperability
several options and tools are going to be considered, in particular **RDF and
Linked Data** [12], **XML and JSON** . In order to facilitate and promoting
interoperability among public public services, in the context of CDV a working
in progress activity is standardize the Personal Data and Service Model taking
into account the e-Government Core Vocabularies created by ISA2 Programme.

###  Data capture

Personal data will be collected in two ways:

  1. **Data will be inserted by citizens by the means of the CDV dashboard.** The user will be able to insert, collect and modify personal data fields by the means of interactive web forms provided by the CDV. 

  

  2. **Data will be collected during the interactions of the user with the e-service forms provided by the PAs.** The e-services and the related types of data will be the ones identified by the three pilots. During each interaction, users decide if the data inserted in the e-service forms can be stored in the CDV. 

  

  

At any time, users can **view (through the dashboard)** , and possibly
**remove the data collected** . No version of data collected is provided.
Thanks to the approach used to collect data, the stored information can be
**retrieved by using Personal Data Taxonomy** .

###  Data storage

The CDV will provide an **ad-hoc repository to collect personal data** ,
adopting a **multiple key based data encryption** . According to the specific
deployment strategy and the e-services that will be adopted in each use case,
the CDV could refer to **multiple data stores** (i.e., legacy systems just
provided by the PAs). Separated instances of CDV Data Store will be deployed
for each use case and hosted by each Pilot.

###  Data quality assurance

Data collection is based mainly on the e-services filling forms, provided by
PA and according its procedures and regulations. According to this, data
fields are validated against its type, semantics and completeness.

###  Utility and re-use

Data collected will be useful for Citizen and PA. Citizen can collect personal
data during the interaction with e-services form, in order to reuse in all the
following interactions and among different PA e-services. PAs can facilitate
and enhance the interactions with citizen in their e-services.

###  Data sharing

The personal data collected or linked by the CDV will **never be shared at any
time** .

###  Archiving and preservation

SIMPATICO Project considers **to retain the collected personal data only for
the lifetime of the grant** .

In principle, the results are expected to be very use-case specific and **no
long-term storage is envisaged** beyond the needs for the SIMPATICO project
execution.

In principle, the results are expected to be very use-case specific and **no
long-term storage is envisaged** beyond the needs for the SIMPATICO project
execution.

###  Datasets  
  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIMPATICO_IT_CDVTrento_DB

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Live database of CDV adopted by the Trento Municipality

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

Trento Municipality

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific (JSON based)

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

RDF/JSON , ISA2 Core Vocabulary (WIP)

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

4 Mb per User

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Private/Personal - no sharable

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

N/A

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

Project duration

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Pilot hosting systems of SIMPATICO platform.

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

No additional cost

</td> </tr> </table>  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIMPATICO_EN_CDVSheffield_DB

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Live database of CDV adopted by the Sheffield Council

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

Sheffield Council

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific (JSON based)

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

RDF/JSON , ISA2 Core Vocabulary (WIP)

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

4 Mb per User

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Private/Personal - no sharable

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

N/A

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

Project duration

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Pilot hosting systems of SIMPATICO platform.

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

No additional cost

</td> </tr> </table>  
<table>  
<tr>  
<th>

**Dataset ID**

</th>  
<th>

SIMPATICO_ES_CDVGalitia_DB

</th> </tr>  
<tr>  
<td>

**Description**

</td>  
<td>

Live database of CDV adopted by the Galitia Region

</td> </tr>  
<tr>  
<td>

**Data manager**

</td>  
<td>

Galitia Region

</td> </tr>  
<tr>  
<td>

**Data standard**

</td>  
<td>

Project specific (JSON based)

</td> </tr>  
<tr>  
<td>

**Metadata standard**

</td>  
<td>

RDF/JSON , ISA2 Core Vocabulary (WIP)

</td> </tr>  
<tr>  
<td>

**Volume**

</td>  
<td>

4 Mb per User

</td> </tr>  
<tr>  
<td>

**Sharing level**

</td>  
<td>

Private/Personal - no sharable

</td> </tr>  
<tr>  
<td>

**Sharing medium**

</td>  
<td>

N/A

</td> </tr>  
<tr>  
<td>

**Preservation duration**

</td>  
<td>

Project duration

</td> </tr>  
<tr>  
<td>

**Preservation medium**

</td>  
<td>

Pilot hosting systems of SIMPATICO platform.

</td> </tr>  
<tr>  
<td>

**Preservation costs**

</td>  
<td>

No additional cost

</td> </tr> </table>

#  SIMPATICO security protection strategy

This final section is dedicated to the **SIMPATICO security protection
strategy** and will develop as the project progresses. It reflects the current
status within the Consortium about the security of data that will be collected
and produced. In the SIMPATICO project **we do not perform activities, neither
produce results, raising any large scale security issues** . The project does
not have the potential for military applications, and also does not involve
the use of elements that may cause any harm to humans, animals, plants or
environment. However, the process of collecting, processing, storing data
might hide some pitfalls. To reduce the **risk of potential malevolent,
criminal and/or terrorist abuse** , which might be perpetrated also by
malicious people authorized to access the information, the SIMPATICO
Consortium is examining the deployment of a **twofold security protection
strategy** :

  1. by ensuring that the employed **security layers and privacy-preserving measures** will work properly, keeping access logs and following best practices for system administration; 

  

  2. by employing techniques to prevent information leakage “on-the-fly”, i.e., through the adoption of the **aggregation and** **pseudonymization approach** of personal and sensitive information at collection, communication, and storage time (e.g. via an encryption scheme, hash functions, and/or tokenization). Such an approach will neutralise eavesdropping and/or similarly dangerous hack attempts in the unlikely event of successful retrieval, since it will secure data, making them completely meaningless to the possible attacker. 

  

  

##  Authentication, authorization, and encryption

State-of-the-art mechanisms for **authentication, authorization, and
encryption** will be exploited in the implemented processes (concerning data
collection, storage, protection, retention and destruction), so to ensure the
satisfaction of core security and data protection requirements, namely
**confidentiality, integrity, and availability** . In context of SIMPATICO,
the crucial legal challenges are primarily the security measures concerning
authentication and authorization issues: pursue to the above-mentioned
**Directive 95/46/EC** the implementation of both computerized authentication
and procedures for managing authorization credentials is required. To assure
the security of and the trust in the system, it is fundamental to provide
technical solutions aimed at allowing the **circulation of digital
identities** and the **access to the e-services** . For identity management
and data protection mechanisms, SIMPATICO will follow the standard practice in
the security research community.

**Identity management** deals with identifying individuals (
**authentication** ) and controlling access ( **authorization** ) to resources
in a system. All the Privacy Enhancing Technologies associated with identity
management aim at identity verification with minimum identity disclosure, and
protection against identity theft. Due to internetworked services and in
general to Cloud technology, the need of a secure identities management has
grown increasingly. Identity and access management (IAM) is the security and
business discipline that “enables the right individuals to access the right
resources at the right times and for the right reasons”. It addresses the need
to ensure appropriate access to resources across increasingly heterogeneous
technology environments and to meet increasingly rigorous compliance
requirements. Technologies, services and terms related to identity management
will be exploited including  Directory services,  Digital Cards,  Service
Providers,  Identity Providers,  Digital  Password Managers,  Single Sign-on,
JSON Web Token and JSON Web Key from OpenID Connect’s model,  OpenID  Connect
,  OAuth  and  XACML.  In particular SIMPATICO’s solutions fo IAM are, and
will be, influenced by many existing and upcoming standards: OAuth 2.0, User
Managed Access (UMA) and OpenID Connect as well as the upcoming Minimum Viable
Consent Record (MVCR) specification from Kantara Initiative.

More specifically, following the “ **Privacy by default and by design** ”
principles, the SIMPATICO platform will adopt an integrated and multilevel
approach to protect the user information from the fraudulent access and
consumption. This will be achieved using a dedicated Authentication and
Authorization Control component (AAC). As for the identity management, the AAC
component will be made compatible with the state of art identity provisioning
technologies (including OpenID Connect, Shibboleth, SAML, OAuth2.0). This will
allow for integration of the SIMPATICO platform with the identity provisioning
solutions adopted locally by the pilots in a federated ecosystem. In this
integration, AAC will be configured in a way to obtain minimal amount of
personal information necessary to unambiguously and uniquely identify the
user. Note that this data will not be used by the platform components directly
to refer to the user. Instead, those components will use a generated
identifier that will be provided by AAC. Such an approach will simplify the
realization of the “right to be forgotten” policy, as it is sufficient to
remove the association of the user personal data and the user identifier to
make anonymous the data stored in different components of the platform and
associated to the user.

In order to ensure the data consumption is performed only by authorized
applications and users, AAC will exploit the open standard for authorization,
namely OAuth2.0 protocol. This protocol not only ensures the exchange of
personal data in a trusted context, but also enables controlled access to the
platform services and APIs. In that context, AAC will operate as the OAuth2.0
**Authorization Server** for the platform components that expose various APIs
and resources over the network. Furthermore, In order to allow the secure
transmission of personal data, the SIMPATICO APIs support the HTTPS
communication protocol. The input and output data are transmitted as “plain
text” over HTTPS and encrypted by the TSL (Transfer Security Layer), or by the
SSL (Security Socket Layer). HTTPS is based over certificates and ensure the
client and server mutual authentication.

For the CDV component of SIMPATICO, which is the main storage of personal data
in the project, particular attention is dedicate to reduce the **server side
vulnerabilities,** applying all the best **security practices and policies**
about the configuration of the user privileges, remote access and connections.
In order to get the database unreadable by unauthorized users/applications,
the CDV architecture includes a module named Data Security Manager (DSM) that,
implementing the Transparent Data Encryption (TDE) approach, enables the
encryption/decryption of the CDV data in transparent way from users and
application point of view. In order to distribute the security knowledge about
the encryption keys and increase the data security, the CDV keys and encrypted
data will be periodically backuped and stored in different places. According
to the best practice and the architectural solution adopted by the most
important DBMS, see Oracle  3  and Microsoft SQL Server  4  , the CDV TDE
implementation is based on the following concepts:

  * **Master Key** : a key adopted to encrypt the Keys Table. It will be stored into a read only file in the filesystem and access restricted exclusively to each single user registered in the CDV.  **User Key** : a key associated to a single CDV user. 

  

  * **Keys Table** : a table to store the User Keys. It will be located in a different server than the Master Key and the Personal Data Table one. 

  

**Encryption Key** : a key generated using the Master Key and the User Key.

**AES Cipher Algorithm** : the CDV adopts the Advanced Encryption Standard
(AES) at 192 bit, defined in the Federal Information Processing (FIPS)
standard no. 197  5  .

  * **Personal Data Table** : it will contain the personal data encrypted/decrypted applying the AES and the Encryption Key. 

  

##  Focus on data aggregation and pseudonymization techniques

Personal and sensitive data will be made publicly available only after an
**informed consent** has been collected and **suitable aggregation and/or
pseudonymization techniques** have been applied. Before starting the project
activities that require user involvement, a careful investigation on privacy
and security issues has been and will be undertaken, covering in particular
**Italian, Spanish and UK privacy laws** , according to the procedures stated
in deliverable “D1.5 – Ethics compliance report”. In this Data Management
Plan, data pseudonymization and aggregation techniques will be identified and
applied to personal/sensitive data before their public release.

As regards aggregation techniques, data confidentiality, integrity and privacy
will be assured **when collecting and processing data** . The information for
each person contained in the release cannot be distinguished from a given
number of other individuals whose information also appear in the release.
Moreover, the pseudonymization of data is another method of ensuring
confidentiality, according to **the Article 29 Working Party Opinion on
Anonymization Techniques** and in relation to the upcoming EU General Data
Protection Regulation [13]. Where data are particularly sensitive (e.g. data
using detailed personal narratives) then risks to confidentiality increase. In
this case, participants will be carefully informed of the nature of the
possible risks. This does not preclude the responsibility of the applicant to
ensure that maximal pseudonymization procedures are implemented. A detailed
description of the measures that will be implemented to prevent improper use,
improper data disclosure scenarios and ‘mission creep’ (i.e., unforeseen usage
of data by any third party), within the above-mentioned security protection
strategy, will be provided before the commencement of validation activities as
update of this deliverable.

**The optimal solution will be decided by using a** **combination of different
techniques** , while taking into account the practical recommendations
developed in the above-mentioned **Article 29 Working Party Opinion on
Anonymization Techniques** . Pseudonymization approaches reduces the
linkability of a dataset with the original identity of a data subject, and is
accordingly a useful security measure. These techniques have to adhere certain
requirements to comply with data protection and privacyrelated legislation in
the EU [14]. The following set of requirements (among others) has been
extracted from the Directive 95/46/EC and the Article 29 Working Party Opinion
on Anonymization Techniques and will be the guidelines for security protection
strategy drafting [13] [15]:

  * **User authentication:** the system has to provide adequate mechanisms for user authentication. 

  

  * **Limited access:** the system must ensure that data is only provided to authenticated and authorized persons. 

  

5

National Institute of Standards and Technology (NIST) , Federal Information
Processing (FIPS) standard no.

197, http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf

  * **Protection against unauthorized and authorized access:** the records of an individual have to be protected against unauthorized access. 

  

**Notice about use of data:** the users should be informed about any access to
their records. **Access and copy users’ own data:** the system has to provide
mechanisms to access and copy the users’ own data.

  * **Fall-back mechanism:** the system should provide mechanisms to back up and restore the security token used for pseudonymization. 

  

  * **Unobservability:** pseudonymized data should not be observable and linkable to a specific individual in the system. 

  

  * **Secondary use:** the system should provide a mechanism to export pseudonymized data for secondary use and a possibility to notify the owner of the exported data. 

  

  * **Modification of the database:** if an attacker breaks into the system, the system must detect modifications and inform the system administrator about this attack. 

  

The above-mentioned potential “unforeseen usage” implications of this project
will be examined by the SIMPATICO Ethics Advisory Board (see “D1.5 – Ethics
compliance report”).

##  Internal threats and human errors

Most organisations focus on data management risk from external threat but most
breeches occur from internal vulnerabilities. These can be thought of as part
of the same risk continuum. This section looks at internal vulnerabilities and
how to reduce them. There are two main types of internal threats.

  * Security may fall victim to **human error** . For example, an employee may copy information from an entire database table into an email for troubleshooting purposes and accidentally include external email addresses in the recipient list. 

  

  * **Internal Attacks** . While internal accidents often compromise databases, wilful attackers on the inside commit a large portion of database breeches. Many are disgruntled employees who use their privileged access to damage. 

  

Most of these attacks came using the numerous outlets for data on the modern
PC, including USB and Firewire ports, CD and DVD recorders and even built-in
storage media slots. Combined with the fact that storage space on portable
devices has rapidly increased, business professionals can now use personal
storage devices, such as USB memory sticks, iPods, digital cameras and smart
phones, to remove or copy sensitive information either for malicious intent or
personal gain.

**Internal threat prevention**

The implementation of a strong and flexible security policy is essential for
SIMPATICO. A security policy can provide rules and permissions that are
understandable to both the employee of SIMPATICO partner organizations and
those implementing them so that personal data is prevented from leaving the
office. SIMPATICO policy is based on the security policies in the EU, that are
often enough if enforced to prevent such breeches, and are summarized in the
following 5 points methodology:  
  
<table>  
<tr>  
<th>

1

</th>  
<th>

Data Protect Policies

</th>  
<th>

Using national a or local legal guidelines for data protection and privacy
policies (DP)

</th> </tr>  
<tr>  
<td>

2

</td>  
<td>

Internal data

</td>  
<td>

Written policies and procedures for all staff to sign in and agree to

</td> </tr>  
<tr>  
<td>

</td>  
<td>

protection policies

</td>  
<td>

</td> </tr>  
<tr>  
<td>

3

</td>  
<td>

Clear staff role definition and responsibilities

</td>  
<td>

Staff training, awareness and clear roles and staff responsibilities on data
for access to data with checklists (see attached)

</td> </tr>  
<tr>  
<td>

4

</td>  
<td>

Access control

</td>  
<td>

Managing change in staff and have leave processes in place

</td> </tr>  
<tr>  
<td>

5

</td>  
<td>

Sanctions and audits

</td>  
<td>

Disciplinary action for breach of DP and process guidelines by staff and
threat of audits

</td> </tr> </table>

SIMPATICO management team is currently evaluating security policies based on
its needs, restrictions and pilot requirements. After this evaluation an
internal security policy will be adopted by M22 and will be attached to the
updates of the Data Management Plan released after that date.