Data Management Plan (DMP) for Language Data under the New General Da-ta Protection Regulation (GDPR)

Data Management Plan (DMP) for Language Data under the New General Data Protection Regulation (GDPR) Pawel Kamocki, Valérie Mapelli, Khalid Choukri ELDA 9 rue des Cordelières, 75013 Paris {kamocki | mapelli | choukri} @elda.org Abstract The EU’s General Data Protection Regulation (GDPR) of 27 April 2016 will apply from 25 May 2018. It will reinforce certain principles related to the processing of personal data, which will also affect many projects in the field of Natural Language Processing. Perhaps most importantly, the GDPR will introduce the principle of accountability, according to which the data processor shall be able to demon- strate compliance with the new rules, and that he applies ‘privacy by design and by default’. In our opinion, a well-drafted Data Man- agement Plan (DMP) is of key importance for GDPR compliance; indeed, the trend towards the adoption of a DMP, particularly in EU- funded research projects, has been more vivid since 2017, after the extension of the Horizon 2020 Open Data Pilot. Since 2015, ELRA also proposes its own template for the Data Management Plan, which is being updated to take the new law into account. In this paper, we present the new legal framework introduced by the GDPR and propose how the new rules can be integrated in the DMP in order to increase transparency of processing, facilitate demonstration of GDPR compliance and spread good practices within the community. Keywords: data management plan, data protection, anonymisation, personal data 1. Introduction In the years 2017-2018, the language resources commu- nity, especially in the European Union, has been confronted with certain important changes. First of all, the Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with re- gard to the processing of personal data and on the free movement of such data (General Data Protection Regula- tion, hereinafter: GDPR) will apply from 25 May 2018. This new legislative act will repeal the Directive 95/46/EC and unify data protection laws across the whole European Union. Unlike a directive, a regulation applies directly in all the Member States, it is therefore essential for research- ers and companies established in the EU1 and processing language data to comply with the GDPR. Secondly, the trend towards the adoption of Data Manage- ment Plans has recently been more visible. This is partly due to the extension of the Open Research Data Pilot to all the thematic areas of the Horizon 2020 Programme (here- inafter: H2020). Indeed, from 2017 on, all the research data in the H2020-funded projects is open by default (with opt- outs still possible); these projects are therefore obliged to adopt a Data Management Plan (DMP) addressing the is- sues of Findability, Accessibility, Interoperability and Re- usability (FAIR) of the data (see art. 29.3 of the H2020 Model Grant Agreement). A template for a DMP is availa- ble on the European Commission’s web portal2. Of course, the importance of a DMP is not limited to H2020-funded projects — in fact, many …

Content truncated to 500 words