1

Reference managers are software products that record the details of scientific papers that one interacts with. All academics and many others use them as a crucial tool of their work. Common examples are Zotero and EndNote. Ones reference manager database is usually viewed as a possession of the individual rather than the employer.

They record the details of the papers you have read, including details of the authors, such as their names, employer and for the corresponding authors the contact details. All this information is publically available, one is required to release this data to publish in peer reviewed journals and the reference managers collate it all at the click of a button when one is viewing the document.

I can think of no reason why the GDPR would not apply to reference managers, therefore I would assume it does. While I would also assume that the legitimate interest basis for processing would allow one to use such software, one would have to consider the requirements that the GDPR places on the processing of data, perhaps the time or export constraints.

Improve this question
2
  • You may want to consider Art 89, "Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes". That's a more explicit approach than "Legitimate interest". It also links back to "public interest", which I consider a stronger basis than "legitimate interest".
    – MSalters
    Apr 5, 2022 at 23:15
  • @MSalters I considered that, but I assumed it meant doing research using PII as the subject of the research, rather than keeping PII of other people who did research.
    – User65535
    Apr 6, 2022 at 6:40

1 Answer 1

Reset to default
1

Yes

  1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.

  2. This Regulation does not apply to the processing of personal data:

  • in the course of an activity which falls outside the scope of Union law;

  • by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU;

  • by a natural person in the course of a purely personal or household activity;

  • by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

Names are personal data and reference managers are a filing system.

This doesn’t mean that you can’t keep such information in such a database. It just means that you must comply with the GDPR when doing so.

Improve this answer
3
  • 1
    I'm confused by comparison to, e.g., law.stackexchange.com/questions/78685/… particularly the "This condition is met if the processing relates to personal data which is manifestly made public by the data subject." part - the authors of a paper have intentionally placed names (or pseudonyms) and contact information on their papers.
    – Jon Custer
    Apr 6, 2022 at 14:40
  • @JonCuster when did these authors act “in a criminal fashion” and make things public in court? Be careful of trying to widen a precedent that specifically related to public disclosure through a legal process with any other type of public disclosure.
    – Dale M ♦
    Apr 6, 2022 at 22:27
  • 1
    the 'manifestly made public by the data subject' comes out of Article 9, where even 'special categories of personal data' are not covered by the GDPR under those conditions. It is not a precedent - it is in the Regulation.
    – Jon Custer
    Apr 8, 2022 at 12:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .