CONNEXIONS Data Protection Notice
for the processing of personal data not obtained from the data subject (art. 14(5)(b) GDPR)

The purpose of this data protection notice is to inform data subjects from whom consent cannot be obtained about the processing of their personal data. In accordance with art. 14(5)(b) GDPR this information is made publicly available via the project’s website. This notice refers to one module of the CONNEXIONS platform which is responsible for collection of data from online sources.

Data will be collected from:
i. Twitter and will include the following categories of information: Twitter posts (i.e., tweets), Twitter account information, and Twitter user interactions; and
ii. YouTube and will include the following categories of information: YouTube video information and YouTube account information.

Considering the technical nature of the module and limitations imposed by the research design (i.e. scale), it is considered that informing those data subjects directly would involve a disproportionate effort.

1. The Project

CONNEXIONS’s (EC Horizon 2020 Project CONNEXIONS, GA Nr. 786731) overall objective is to improve the effectiveness and efficiency of law enforcement intelligence, operation, and investigation capabilities. These services are built upon the concept of multidimensional integration and correlation of heterogeneous multimodal data streams and delivery of pertinent information to different stakeholders in an interactive manner tailored to their needs.

The CONNEXIONS solution encompasses the entire lifecycle of law enforcement operations including intelligence gathering and operation planning, as well as mission execution, and investigation. CONNEXIONS will enhance the operational and (near) real-time situational awareness by developing an innovative prediction, prevention, operation, and investigation platform equipped with tools for the automated detection, identification, assessment, fusion, and correlation of evidence acquired from heterogeneous multimodal data streams. Such data streams include Surface/Deep/Dark Web and social media sources and interactions, IoT-enabled devices, surveillance cameras (fixed or wearable), as well as seized devices and hard disks. CONNEXIONs will also support the path-to-court.

CONNEXIONS will be validated in field test and demonstrations in three Pilot Use Cases (PUCs):

• PUC1: Counter-terrorism security in large scale public events;
• PUC2: Human trafficking investigations and mitigation;
• PUC3: Crime investigation and training through 3D scene reconstruction

In these three PUCs, data will be collected by simulating real-world events. This data will then be used to assist the development and validation of the CONNEXIONS platform. To demonstrate the applicability, validity and usability of the CONNEXIONS platform, each PUC will be tested in three pilot demonstrations taking place in: October & December 2020 (1st iteration), May & June 2021 (2nd iteration), and January & February 2022 (3rd iteration).

2. Key Contacts

The following table provides a detailed list of the primary contacts for the CONNEXIONS PUCs: 

Name	Organisation	e-mail	Role
Dr. Stefanos Vrochidis	CERTH		Project Coordinator; Ethics Advisory Board Chairman
Dr. Theodora Tsikrika	CERTH		Scientific Manager & DPOs Manager

Each of the PUCs has a dedicated leader and DPO; for further details on the applicable DPO to your data request, please contact Dr. Theodora Tsikrika ( ) as the project’s Scientific Manager & DPOs Manager.

3. Data Processing

The purpose of data collection in this project is to help improve law enforcement operation and investigation through research in the development of the CONNEXIONS platform. The legal basis under which the data shall be processed is article 6(1)(f) GDPR. The legitimate interest of the controllers lies with the pursuit of scientific research purposes confirmed by the European Commission. Such data will be collected by the social media crawling methods that will be tested in the context of the CONNEXIONS pilots.

Within this Data Protection Notice you have been given the contact details of the relevant project representatives (see Section 2) should you have any questions regarding the processing of your personal data.

What personal data is being processed?

The following categories of personal data publicly available on social media will be collected and processed:

• Twitter posts (i.e., tweets), including the language, textual content, hashtags, images and videos, whether the post is a reply to another post, as well as the number of retweets and the number of likes;
• Twitter account information, including the username¹, description, location, as well as the number of friends, followers and favourites;
• Twitter account interactions, including user mentions;
• YouTube video information, including the video id, the video URL, the thumbnail image URL, the publication timestamp, the title, and the description (if any); and
• YouTube account information, including the id (username²) and the title of the channel related to the posted video.

No special categories of personal data (art. 9(1) GDPR) will be collected, nor will data relating to criminal convictions (art. 10 GDPR). All data will be collected in accordance with the licenses and terms & conditions of the data providers. All data will be gathered only from public accounts, with the permission defined by the social media platforms/Web forum communities and in compliance with the respective terms of use, thus in accordance with user expectation of privacy. All collected data will be pseudonymised. Data minimisation will also be applied, i.e., only data that are necessary for the purposes of the project will be processed. Further, details are provided in the “What is the purpose of the processing” section.

What is the purpose of the processing?

All PUC pilots will include the validation of proof-of-concept tools that aim to crawl the Twitter and YouTube platforms to simulate the gathering of online material relevant to an investigation. In particular, online social media keyword-based searches will take place in the context of the CONNEXIONS pilots, where content posted by real users will be collected. The scope of keyword-based searches cannot be technically limited to the point where it would exclude real users; therefore for testing this functionality it is necessary to involve participants who have not signed a consent form.

The data collected from identified social media will be pseudonymised. The username will be hashed during collection (implementing the privacy by design principle) based on a one-way cryptographic hash function (e.g., SHA 256), ensuring that from the derived hash value it is infeasible to obtain the original username, while the content of the social media posts will remain as is. In accordance with the data minimisation principle, only the parts of the social media posts that are deemed necessary for the project’s objectives will be processed subject to a privacy-by-design technique, while the majority will be deleted immediately. These data will be required for the duration of the project: (i) for scientific research purposes, (ii) to facilitate the functionality of other modules of the project, and (iii) for demonstration purposes. After the end of that period (February, 2022), secure deletion tools will be applied by the members of the CONNEXIONS Joint Controllership agreement (see section “Will the collected data be shared?” for more details), that will make the data irretrievable.

All data will be collected in accordance with the licenses and terms & conditions of the data providers. All data will be gathered only from public accounts, with the permission defined by the social media platforms and in compliance with the respective terms of use, thus in accordance with user expectation of privacy.

Will the collected data be shared?

The information collected will be jointly shared with members of the CONNEXIONS Consortium, with the exception of the University of Vienna (UNIVIE), Ministere de l'interieur (FMI), IDRYMA TECHNOLOGIAS KAI EREVNAS (FORTH), and Serviciul de Protecţie şi Pază de Stat (SPPS). All other members of the Consortium (as listed in the following table) are part of a Joint Data Controllership Agreement. This is in accordance with Article 26 of the GDPR and any interested party may contact the Project Coordinator Dr. Stefanos Vrochidis ( ) for further information. The collection and sharing of this data is necessary for the evaluation process and assessing the validity of the results, and using the results will help develop the CONNEXIONS platform. Collected data will be shared with joint controllers based outside the EU, i.e. in Israel (MSIL) and the UK (SHU). The transfers will be based on either an adequacy decision (MSIL) or Standard Contractual Clauses (SHU). A copy of Standard Contractual Clauses can be obtained via the CONNEXIONS Coordinator. 

Participant no.	Participant organisation name	Participant short name	Country
1 (CO)	ETHNIKO KENTRO EREVNAS KAI TECHNOLOGIKIS ANAPTYXIS	CERTH	Greece
2	MOTOROLA SOLUTIONS ISRAEL LTD	MSIL	Israel
3	SHEFFIELD HALLAM UNIVERSITY	SHU	UK
4	NUROMEDIA GMBH	NURO	Germany
5	UNIVERSIDAD POMPEU FABRA	UPF	Spain
7	POLICE SERVICE OF NORTHERN IRELAND	PSNI	UK
8	HOCHSCHULE FUR DEN OFFENTLICHEN DIENST IN BAYERN	BHP	Germany
9	MINISTÉRIO DA JUSTIÇA	PJ	Portugal
10	ENGINEERING – INGEGNERIA INFORMATICA SPA	ENG	Italy
15	SERVICIUL DE PROTECTIE SI PAZA	SPP	Romania
18	BAYERISCHES STAATSMINISTERIUM DES INNERN	MPD	Germany
20	KENTRO MELETON ASFALEIAS - CENTRE FOR SECURITY STUDIES	KEMEA	Greece
21	SOFTWARE IMAGINATION & VISION SRL	SIMAVI	Romania

 
Who will be responsible for all of the data when this study is over?

All CONNEXIONS partners acting as Joint Controllers of the collected personal data (see above).

Will it be stored? How long for?

The information will be kept for the lifetime of the CONNEXIONS project which is expected to end in February 2022.

Will the collected personal data be used for other purposes?

No. Social media users’ information gathered in CONNEXIONS will not be used for any other purposes outside of those specified in this document.

Will the collected data be processed by automated tools supporting decision-making?

Your data will be used for developing a proof-of-concept platform which involves automated tools processing the content gathered with the goal to support the platform operators in decision-making. Data collected from you will only be used to test the capabilities of the CONNEXIONS platform and you will not suffer any consequences of such automated processing supporting decision-making. After hashing of your account information the researchers will not be able to trace back your data back to you.

4. Your Rights

You have the right to:

• Request information about whether we hold personal information about you, and, if so, what that information is and why we are holding it. This information shall be provided within a reasonable period after obtaining the personal data, but at the latest within one month.
• Request access to your personal information. This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request rectification of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you.
• Request transfer of your personal information in an electronic and structured form to you or to another party (right to “data portability”). This enables you to take your data from us in an electronically useable format and to be able to transfer your data to another party in an electronically useable format.
• Lodge a complaint with the Hellenic Data Protection Authority (https://www.dpa.gr).
• For the exercise of your rights and for any other data-related information you may contact the CONNEXIONs Coordinator Dr. Stefanos Vrochidis ( ).

[1] All usernames collected from Twitter are pseudonymised before stored in the CONNEXIONS platform. See section “What is the purpose of the processing?” for more details.
[2] All usernames collected from YouTube are pseudonymised before stored in the CONNEXIONS platform. See section “What is the purpose of the processing?” for more details.