Full Version

The project consortium of the ITFLOWS project (hereinafter ‘ITFLOWS’) aims to research, develop, and validate novel data-driven techniques and solutions to support NGOs and municipalities with important information on migration flows. The information generated in this context will help to adapt necessary organizational measures to handle migration flows and is hence particularly aimed at NGO and municipalities. The available information can be used to in- or decrease aid at a certain location, where migrants are expected to arrive (e.g. after a drought or another catastrophic event.) The project consortium primarily processes anonymous data that are available on publicly available sources in an aggregated form (e.g. statistical data). However, in order to achieve the abovementioned goals, ITFLOWS also processes personal data. Where personal data is involved ITFLOWS adheres to the applicable European and national data protection frameworks. In this context, we provide data subjects concerned by our research with information on our data processing pursuant to the transparency requirements laid down in Articles 12 ff. GDPR. Where data is obtained from data subjects directly (e.g. Interviews), the project consortium provides them with the necessary information pursuant to Article 13 GDPR and obtains their informed consent previously.For the processing of such data that is not obtained from the data subjects, by this statement, the project consortium makes information on the data processing publicly available in accordance with Article 14 (5) (b) GDPR.

Easy Language

We (the ITFLOWS consortium) process personal data to research of migration flows. This includes the sentiments revolving around migration and the prediction of potential future migration flows (e.g. after an event in country X, it is expected that more migrants will arrive at a European border.) To know this, is important to put in place the necessary organisational measures to support and protect refugees at the respective point of arrival. We put particular emphasis on privacy-awareness and legal compliance of the research and development. This includes the provision of information to the data subjects where necessary and possible. We mostly process anonymous, publicly available and pseudonymous data. This means we are not able and will not try to identify the person behind this data without recourse to additional information.
Below are the contact details of the Data Protection Advisor (DPA) and the project coordinator, as well as information and your specific rights relating to the processing of your personal data by ITFLOWS.

1. Contact Details

Project Coordinator (Controller)

Dr. Cristina Blasi Casagran
Mail: cristina.blasi@uab.es
Universidad Autónoma de Barcelona
Calle Campus Universitario Sn Cerdanyola V,
08290 Cerdanyola Del Valles, Spain

External Data Protection Advisor (DPA)

Dr. Jonathan Andrew
Mail: dpa@ITFLOWS-project.eu
Geneva Academy
Villa Moynier, Rue de Lausanne 120B
CP 1063
1211 Geneva 1, Switzerland
 

Personal data received through these channels will be processed as far as necessary to effectively handle your requests. This data will not be shared with others and deleted when it is no longer required to handle your requests. The rights described in section 5 also apply to this personal data. Please note that requests regarding interview data must be directed directly to the conducting NGOs as only these partners will be able to identify participants as describe in the related informed consent forms.

1. Contact Details

Project Coordinator (Controller)

Dr. Cristina Blasi Casagran
Mail: cristina.blasi@uab.es
Universidad Autónoma de Barcelona
Calle Campus Universitario Sn Cerdanyola V
08290 Cerdanyola Del Valles, Spain

External Data Protection Advisor (DPA)

Dr. Jonathan Andrew
Mail: dpa@ITFLOWS-project.eu
Geneva Academy
Villa Moynier, Rue de Lausanne 120B
CP 1063
1211 Geneva 1, Switzerland
 

Personal data received through these channels will be processed as far as necessary to effectively handle your requests. This data will not be shared with others and deleted when it is no longer required to handle your requests. The rights described in section 5 also apply to this personal data. Please note that requests regarding interview data must be directed directly to the conducting NGOs as only these partners will be able to identify participants as describe in the related informed consent forms.

2. Joint controllers

The main controller of project data is the Universidad Autónoma de Barcelona. However, the ITFLOWS project connects 14 partners from various fields who jointly determine the purposes and means of processing within the project (joint-controllers). Each partner fulfills specific tasks in the project. The specific tasks and goals are defined in an agreement between the European Union and the partners (‘Grant Agreement’). You can find a short description of the tasks and the influence on the purposes and means of processing below.

2.1. Research organisations

Research organizations in ITFLOWS cover a broad spectrum of activities in the project. Most partners research technological possibilities to meet the requirements of NGOs and municipalities in their respective field of expertise. Others research the legal and ethical implications of the developed tools. All fields (tech, legal, ethics) are put into consideration when determining purposes and means of the processing.The following research organisations participate in the project: 

• Universidad Autónoma de Barcelona, ES
• European University Institute, IT
• The Centre for Research and Technology, GR
• Centre for European Policy Studies, BE
• Kiel Institute for the World Economy, GER
• Instituto Affari Internazionali, IT
• FIZ Karlsruhe – Leibniz Institut für Informationsinfrastruktur GmbH, GER
• Cork Institute of Technology, IE
• Brunel University London, UK

2.2. Non-governmental Organizations (NGO)

NGOs are an important part of the project and will provide concrete insights on reasons for migration based on interviews that will be conducted at multiple locations in Spain, Greece and Italy. The following NGOs participate in the project: 

• OXFAM Italia, IT
• Associazione Della Croce Rossa Italiana, IT
• Center for the Study of Democracy, BG
• Open Cultural Center, ES

2.3. Small & Medium Enterprises (SME)

SMEs in ITFLOWS bring in practical knowledge as well as previously developed tools. The knowledge brought in by this partner will be used to develop the so called “EUMigraTool” which will provide a gateway for end-users (NGOs & municipalities) to access the technology developed in the project. The following SMEs participate in the project: 

• Terracom Informatics Ltd., GR

2.4. External parties

Various associated partners also support ITFLOWS, who are not part of the project consortium. These parties are part of the User Board (UB) or the Independent Ethics Board (IEB) or the Independent Gender Committee (IGC) and support the project (e.g. by answering questions, monitoring ethical compliance, providing feedback on tools) but do not determine the purposes of processing. They are hence no ‘joint controllers’ within the meaning of Article 26 GDPR and will not get access to any personal data. Whenever such parties get involved in the determination of purposes and means of the processing, this statement will be updated accordingly.

2. Joint controllers

The ITFLOWS project comprises 14 partners from various fields who jointly determine the purposes and means of processing within the project (joint-controllers). These partners can be split up into groups with different tasks in the project. The specific tasks and goals are defined in an agreement between the European Union and the partners. Each partner fulfills a specific task based on the respective expertise. You can find a short description of the tasks and the influence on the purposes and means of processing below.

3. Purposes of processing

The project consortium of the ITFLOWS project (hereinafter ‘ITFLOWS’) aims to research, develop, and validate novel data-driven techniques and solutions to fulfil four main purposes:

• providing accurate predictions on migration,
• providing policy solutions for the management irregular arrivals and asylum systems in the EU,
• proposing solutions for reducing potential conflict/tensions between migrants and EU citizens, by taking into account a wide range of human factors and using multiple sources of information, and
• providing policy solutions for optimising refugee integration in the EU.

3. Purposes of processing

ITFLOWS aims to develop a software-tool (“EUMigraTool”) that helps NGOs and municipalities to better handle incoming migration flows. To this end, the tool will provide predicitions on migration flows as well as information on public sentiments towards migration. With this information NGOs and municipalities can, for example, plan to recruit additional personnel to provide sufficient support to refugees in a timely manner or start communication campaigns to increase public awareness.

4. Limitations to the provision of information and updates to this statement

Pursuant to Article 14 GDPR, where personal data have not been obtained from the data subject, the controller is generally obliged to provide the data subject with information such as the identity and the contact details of the controller and the data protection advisor (DPA), and various details on the processing. The ITFLOWS consortium provides this information within this statement.
Nonetheless, pursuant to Article 14 (5) (b) GDPR the extent to which information has to be provided can be limited where the provision proves impossible or would involve a disproportionate effort, in particular for processing for scientific purposes. Where ITFLOWS does not obtain data from the data subject and carries out scientific research, it falls under the scope of this article. ITFLOWS only processes pseudonymous data and does not identify individuals. Identification (de-pseudonymization) of the data subjects would be necessary to provide specific individuals with information. De-pseudonymization is only possible by connecting pseudonymous data with further information, though. Pursuant to Article 11 (1) GDPR the project consortium is not obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with the GDPR.
Pesudonymous personal data in ITFLOWs is most likely to arise during the processing of publicly available Twitter data and during interviews with refugees and asylum seeker. In the first case, ITFLOWS partners automatically erase personal indentifiable information (PII) from the Twitter data (e.g Names, Locations) or – where possible – do not collect it in the first place. The provision of information to individuals would require a deviation from the intended anonymization process and could hence result in a increased risk for the data subjects. Moreover, the identification and information of affected users would require connection with additional information sources and would hence result a disproportionate effort. The project consortium is hence currently not obliged to directly provide data subjects with information on the processing of the data on its own accord. If specific information is required, you can still reach out to the consortium to excert your rights, of course. However, ITFLOWS takes appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including the publication of information on the processing within this statement.

Over the course of the project, this statement will be updated, in order to cover further data processing procedures not yet defined and carried out.

4. Limitations to the provision of information and updates to this statement

We do not expect any legal limitations to the provision of information at this point. ITFLOWS pursues a full transparency approach and will publish all information in a publicly available and aggregated form. The project will not identify any individuals and we are hence not able to provide information to individuals on our own accord. You can, of course, reach out to us to ask if we process your data (e.g. ask if a specific tweet of yours was processed).

5. Data subjects’ rights and limitations

ITFLOWS processes pseudonymous data from the sources stated below. Some sources may contain data, which makes the identification of individuals potentially possible (e.g. where user names match real names in Tweets). ITFLOWS uses technical approaches (e.g. named entity recognition) to erase this information prior to any further processing. Where such technical approaches result in false negatives, the project consortium is not in a position to detect these bits of information without additional data. Data subjects generally have the right to request access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability. These rights may be restricted under the conditions described below. However, any requests to the abovementioned points of contact will be carefully assessed on a case-by-case basis and replied to.
Pursuant to Article 11 (1) GDPR the project consortium is not obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with the GDPR. However, pursuant to Article 11 (2) GDPR where data subjects provide additional information in order to exercise their rights under Articles 15–22 GPDR, the ITFLOWS consortium will handle the request compliant with technical and legal requirements. In this regard, the identity of the data subject, as well as the relation to the data referred to in the request has to be sufficiently verified.
The exertion of some of the data subjects’ rights (4.1 – 4.4) may be further restricted pursuant to Article 89 (2) in conjunction with the respective national legislation. The following rights are generally available to the data subjects.

5.1. Right to access (Article 15 GDPR)

The data subject has the right to obtain confirmation as to whether or not processing of personal data concerning them takes place in the ITFLOWS project. If this is the case the data subject can request access to his/her data. Granting the right to access only occurs where the identification of the data subject is possible.

5.2. Right to rectification (Article 16 GDPR)

The data subject has the right to obtain the rectification of inaccurate personal data concerning them. The exercise of this right is only possible where the data subject can be identified and the inaccuracy of data is verified.

5.3. Restriction of processing (Article 18 GDPR)

The data subject has the right to obtain the restriction of processing, where

• the accuracy of the personal data is contested;
• the processing is unlawful, the data subject opposes the erasure of personal data and requests the restriction of processing instead;
• the controller no longer needs the personal data, but they are required by the data subject for the establishment, exercise or defense of legal claims;
• the data subject has objected to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject. (see 4.4.)

The exertion of this right may require provision of further information to allow identification of the data subject as described in section 4.

5.4. Right to object (Article 21 GDPR)

The legal basis for the processing of personal data in the ITFLOWS project is Article 6 (1) (f). The data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning them unless the ITFLOWS consortium demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.
The exertion of this right may requires provision of further information to allow identification of the data subject as described in section 4.

5.5. Right to erasure (’Right to be forgotten’) (Article 17 GDPR)

The data subject has the right to obtain erasure of personal data concerning them, if

• the data subject objects to the processing pursuant to Article 21 (1) and there are no overriding legitimate grounds (see 4.4);
• the personal data have been unlawfully processed;
• the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.

Pursuant to Article 17 (3) (d) GDPR the right to erasure may be restricted to the extent that the processing is necessary for scientific purposes and would render impossible or seriously impair the achievement of objectives of the processing. The ITFLOWS consortium will assess the possibilities to erase personal data under the conditions stated in section 4.

5.6. Right to lodge a complaint with a supervisory authority (Article 77 GDPR)

The data subject has the right to lodge a complaint with a data protection supervisory authority in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes the GDPR.
A list of national supervisory authorities can be found here.

5. Your rights

Although there are some exceptions, you can generally exercise specific rights related to your personal data if you disagree with the processing of it. If you are concerned about your rights or how we process your data you can contact our Data Protection Advisor (dpa@itflows.eu), so we can find a solution. Please keep in mind, that due to the specific research purposes and setup of the project, some rights may be restricted. However, any requests to the abovementioned points of contact will be carefully assessed on a case-by-case basis and replied to.

5.1. Right to access (Article 15 GDPR)

You can ask us to provide you information if we process personal data related to you. If that is the case you have a right to access the data. As all data are in ITFLOWS are pseudonymous, though, we may ask for further information from your side to demonstrate you are affected and to verify your identity.

5.2. Right to rectification (Article 16 GDPR)

You have the right to request rectification of any errors in your personal data to ensure its accuracy. As all data are in ITFLOWS are pseudonymous, though, we may ask for further information from your side to demonstrate you are affected and to verify your identity.

5.3. Restriction of processing (Article 18 GDPR)

You also have the right to restrict the processing of your personal data, in particular, if personal data is inaccurate, or the lawfulness of the processing is in question. As all data are in ITFLOWS are pseudonymous, though, we may ask for further information from your side to demonstrate you are affected and to verify your identity.

5.4. Right to object (Article 21 GDPR)

ITFLOWS processes data for research purposes in the public interest. Therefore, you have the right to object on grounds relating to your particular situation. We will assess if it is possible to avoid processing your data. If this is the case, your data will be excluded from the processing. As all data are in ITFLOWS are pseudonymous, though, we may ask for further information from your side to demonstrate you are affected and to verify your identity.

5.5. Right to erasure (’Right to be forgotten’) (Article 17)

If you successfully objected, the processing was unlawful or there is another legal obligation, you have the right to obtain erasure of your personal data. This right may be restricted if your data is necessary for the purposes of the processing. We will carefully assess if this is the case and delete any data related to you as far as possible.

5.6. Right to lodge a complaint with a supervisory authority

You can also at any time lodge a complaint with the data protection supervisory authority of the country you live or work in or where the alleged infringements of your rights took place (i.e. the respective countries of the project partners). A list of national supervisory authorities can be found here.

6. Legal basis of the processing

The processing of personal data by the ITFLOWS project is based on Article 6 (1) (f).

Article 6 (1) (f) GDPR allows processing where it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

The common legitimate interest of all partners in ITFLOWS goes along with the project goals that have been clearly articulated in the contract between the project partners and the Research Executive Agency (REA) under the powers delegated by the European Commission. The partners aim to effectively participate in the project, development and research of novel data driven techniques to predict and analyse migration flows to create an end-user tool (EUMigraTool) to support NGOs and municipalities. Processing of interview data is based on informed consent of the participants (Article 6 (1) (a) GDPR). ITFLOWS is controlled by the UAB (see above), however in some processing scenarios the partners jointly determine and specify the specific purposes and conditions of the processing in the project(see Article 26 GDPR ‘Joint controllers’) within the contractually agreed borders of the Grant Agreement. For some partners (e.g. Terracom) the processing of data can be a key element of their business model. Therefore, their legitimate interest within the ITFLOWS project may also extends to be able to run and strengthen these business models in particular by developing their technical capabilities through research. Research partners in ITFLOWS (i.e. UAB, EUI, CERTH, CEPS, IfW, IAI, FIZ, CIT, BUL) have a legitimate interest to study, analyze and understand novel technologies such as migration flows, migration drivers or public sentiments towards migration. While some of these partners solely focus on scientific research, others additionally pursue economic interests similar to the private companies mentioned above. Business interests are protected by Article 15 and Article 16 of the Charter of Fundamental Rights of the European Union. Scientific research is protected under Article 13 of Charter of Fundamental Rights of the European Union. Although some of the interests of the partners differ, they all pursue the goal to make underground investigations more effective through development and research of novel data driven techniques thereby helping making societies more secure and following legitimate interests.

The ITFLOWS consortium conducts a continuous data protection impact assessment and is aware of the risks to fundamental rights and freedoms of the data subjects. These risks may result in interests overriding the interests of the ITFLOWS consortium. Those interests go along with the protection of personal data and the right to privacy protected under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. The ITFLOWS carefully weighs these different interests to ensure full protection of the fundamental right and freedoms of EU citizens.

In some countries processing in ITFLOWS may be based on specific research clauses in national law. Where this is the case, the processing is based on Article 6 (1) (e) GDPR in conjunction with these specific research clauses. Where such clauses do not exist, the processing is based on Article 6 (1) (f) GDPR as described above.

6. Legal basis of the processing

The data processing in ITFLOWS is based on the legitimate interest of the partners to conduct research on migration flows (Article 6 (1) (f) GDPR). ITFLOWS is a scientific research project. The main interest of the projects is to develop models to analyse and predict migration flows. This interest is partly complemented by business and scientific interests of some ITFLOWS partners, all of which are legitimate interests under the GDPR. We carefully put into consideration contrary interests of the people concerned by our data processing (data subjects), in particular their rights to data protection and privacy. We implemented high safeguards to protect your interests and rights (e.g. technical measures to restrict access to potentially risky data, incidental findings policies, continuous data protection impact assessment, continuous legal and ethical guidance).

7. Categories of personal data

ITFLOWS processes the following categories of personal data:

• Tweets from the Twitter API (geolocation, communication)
• Interview data collected in interviews with migrants, refugees and asylum seekers in Italy, Greece and Spain

Beyond these sources, currently no other personal data is collected by the project. ITFLOWS will anonymize personal data prior to any connection with other datasets to ensure full protection of the data subjects fundamental rights. All databases/sources are publicly available and the specific processing procedures performed on them are subject to previous evaluation by the projects data protection officer, the legal and ethics team and ethical advisory boards.

7. Categories of personal data

ITFLOWS processes the following categories of personal data:

• Tweets from the Twitter API
• Interview data collected in interviews with migrants, refugees and asylum seekers in Italy, Greece and Spain

All personal data will be removed from these sources prior to any further processing (e.g. analysis or connection with other datasets). All sources are publicly available and the specific processing procedures performed on them are subject to prior evaluation by the project’s legal experts as well as external advisory bodies (e.g. Data Protection Advisor).

8. Processing details

ITFLOWS focuses on the analysis of data from publicly available sources, (e.g. Twitter data, Google Trends, aggregated statistical data). The project implements state-of-the-art practices to erase any personal data as far as possible. The findings of the research will be used to create models to predict future migration flows that act privacy-preserving and independently of the initially collected research data.

8.1. Twitter analysis

In order to develop models that help predicting migration flows and their impacts, ITFLOWS processes publicly available data from the Twitter API. To this end, the research aims to detect sentiments and emotions reflected by tweets worldwide. This information can then be, for example, compared to actual migration data to show how public sentiments towards migration may shape the individual decisions to leave or enter a country. An exemplary approach on the methods used in this context can be found here.

8.2. Interview data

The NGOs in ITFLOWS will conduct interviews with refugees and asylum seekers over the course of the project in Italy, Spain and Greece. The goal of these interviews is to identify migration drivers and gain a better understanding of the reasons that lead individuals to migrate. The findings of this research activity will help other parts of the project (e.g. software development, quantitative analysis) to evaluate the outcomes of their research and thereby also foster data accuracy in the whole project. At the same time, the outcomes of the interviews provide valuable information to check the findings of the technical approaches in the project. Personal data (e.g. transcripts) will remain on the premises of the NGOs. Only anonymized data will be made available to the other project partners.

8. Processing details

ITFLOWS focuses on the analysis of data from publicly available sources (e.g. Twitter data, Google Trends, aggregated statistical data) but erases all personal data as far possible prior to any further processing.

8.1. Twitter analysis

ITFLOWS tries to detect emotions in Twitter data (e.g. anger or hate) to identify public sentiments related to migration. It is researched if the public sentiment has an impact on migration behavior. A simple example could be to research if an increased amount of hate-speech towards a vulnerable group in a country leads to increased migration activity of that very group.

8.2. Interviews

ITFLOWS conducts interviews with refugees and asylum seekers in Italy, Greece and Spain. The outcomes of these interviews are particularly aimed to check if the technical analysis was correct.

9. Recipients or categories of recipients of the personal data

Research findings of ITFLOWS will be shared with the public in anonymous form. ITFLOWS does not intend to share personal data with any third party. In addition, an incidental findings policy was developed within the project to specify how the identification of potentially criminal behavior is handled. To this end, personal information may only be shared with authorities if there is a legal obligation to do so.

9. Recipients or categories of recipients of the personal data

We do not share any personal data with third parties. Information will only be shared with authorities if there is a specific legal obligation to do so.

10. Storage and retention

Personal data are not intended to be stored longer than necessary for the research purposes pursued by the ITFLOWS project. At the end of the project in August 2023, it will be reassessed for each partner individually, if further storage is necessary and lawfully possible. In this regard, the differences between research institutions, SMEs and NGOs have to be taken into account. In order to assess the necessity of further storage, data review takes place periodically over the course of the project. Personal data from research participants will be erased after the end of the project. Except those data needed for auditing purposes in front of the European Commission, which must be retained for 5 years after the end of the project. Data which are not necessary to achieve the projects purposes will be anonymized or deleted as soon as possible. Each individual partner is responsible to ensure secure storage and timely destruction of data. All partners are supported in this task by the legal team of the project as well as external advisory bodies (e.g. IEB, DPA). Clear data retention procedures are implemented to ensure all partners delete personal data that is not necessary.

10. Storage and retention

Personal data are not stored longer than necessary for the respective research purposes pursued by the ITFLOWS project. With the end of the project in August 2023. It will be re-assessed for each partner individually, if further storage is necessary and lawfully possible. Moreover, data will be reviewed periodically over the course of the project to assess the necessity of ongoing storage. Data which are not necessary anymore will be anonymized or deleted as soon as possible.