Data Privacy Policy

The A4 consortium, that is referred to in these Terms of Use as “we”, “us”, or “our” is committed to protect and respect the right to data privacy and carries out the project research in full compliance with the data protection principles as outlined in the General Data Protection Regulation (GDPR) 2016/679 and the Data Protection Directive 2016/680, also known as the Law Enforcement Directive.

Transparency is fundamental to trust and this Data Privacy Policy aims at providing the concerned by the project research individuals with all the necessary information regarding the data processing activities in accordance with the transparency requirement under Article 12 GDPR.

Where data is obtained directly from the data subjects, the project consortium provides them at the time when data is obtained, with the necessary information under Article 13 GDPR and obtains their consent via appropriate means (informed consent form & information sheet). In cases where data is not directly obtained from the data subjects, the project consortium makes the necessary information on the data processing publicly available in accordance with Article 14 (5) (b) GDPR via this Data Privacy Policy. However, the provision of such information can be limited where the provision proves impossible or would involve a disproportionate effort.

Further, as A4 research is dedicated to the development of a bespoke set of tools for LEAs, the information provided is limited in order to avoid impairment of the project’s pursued purposes, that are outlined in the relevant section below. Within these limitations we have tried to provide you with clear and concise information on the processing.

Please keep in mind that this Data Privacy Policy might be regularly updated to reflect changes in the data processing activities within the A4 research that have not yet been defined and/or carried out.

Who we are

A4 is an EU-funded project. The A4 consortium consists of five partners from three different European countries. During the A4 research, each of these partners will act as the data controller and therefore will be responsible for the implementation of data protection rules in relation with the processing operations it will perform.

Purposes of processing

Personal data is processed within the research goal of the A4 project, which is to counter the impunity for all actors involved in the trafficking of human beings (THB), particularly of women and girls for sexual exploitation, through enhancing LEAs’ investigation capacities, from one of the major THB gateways to EU territory, as well as through the exchange of knowledge and improvement of cooperation among 3 European countries with a key common characteristic: low conviction rates for human trafficking and other related offences.

A4 does this by establishing a critical mass of police key pro-actors that will receive dedicated training. They in turn will serve as the basis of a peer-to-peer learning network strengthening sensitization and cooperation on the issue at hand. To do so, A4 needs to process data that might be of personal nature.

Sources and categories of data

A4 data collection activities involve a number of different data-sources. It uses publicly accessible documents, such as court-decisions from the European Court of Human Rights and other case files on the matter of trafficking of human beings. Additionally, it will also gather data collected during discussions and questioning of key stakeholders. This includes data from key informants participating in focus groups and workshops, as well as survey data gathered during the implementation of it action plan. Furthermore, observational data on the practices of key professionals will be collected, this includes data on Standard Operating Procedures, as well as monitoring data during the pilot implementation.

Please note that only data relevant in the context of the chosen use cases will be collected and analysed. The aim of the research is absolutely not to monitor an identified individual or key stakeholder, but to gather data on the state of the art, as well as monitoring project progress and success. During the research phase, A4 partners do not intend to use any of the data mentioned above, in order to identify a natural person. Data will be anonymized.

Privacy and ethical impact assessment

The A4 consortium is aware of the risks to fundamental rights and freedoms of the affected individuals and will perform a privacy and ethical impact assessment of the project’s outcomes in order to balance such risks. Several safeguards will be implemented, such as the limited scale of the processing, precautions to ensure that no personal data is used in order to identify an individual or to take a decision against an individual, mainly through strong security measures and awareness of researchers.

The assessment will also take into account the protection of other fundamental rights, such as the right to non-discrimination, the freedom to communicate, to dignity, and even to physical freedom.

As a step in the privacy and ethical impact assessment the partners will consult with the appropriate national data protection authorities and the European Network of Research Ethics Committees (EUREC) and/or other competent bodies.

Legal basis for processing

A4 is a research project and its purpose is lawful and has been clearly articulated. The appropriate legal basis for the processing of personal data by the A4 project is the legitimate interest pursued by the joint controllers and therefore is based on Article 6 (1) (f) GDPR.

The processing operations are necessary to fulfil the research purposes. Further, the research presents a real public interest, as the final deliverable will enhance the fight against THB and therefore overweighs the potential harm -which is in any case limited in scope- on the rights and freedoms of individuals that might be affected due to the A4 research.

Personal data storage, retention and minimisation

For the purposes of A4 different sets of data are being processed and are being handled accordingly. A4 collects and stores data that has a medium or low degree of sensitivity. This data is stored in a private secure cloud-environment managed by the project consortium. The appropriate use of that data is monitored. Data that has a low or no degree of sensitivity can be collected and kept in the private environment of the partner who collects the data, however the partner allows consortium members controlled access to that data whenever they need it for the purposes of the project.

Personal data will not be stored longer than necessary for the research purposes of the project. Following the purpose limitation principle, data that might be of a personal nature will be deleted or anonymised as soon as they are no longer necessary or, in any event, as soon as the project is completed in May 2021. Further, according to the data minimisation principle, the collection and use of data that might be of a personal nature will be reduced to the minimum necessary to perform the research.

Personal data transfers

The A4 research does not transfer data to third parties. The personal data may be shared between the A4 partners strictly for the research purposes of the Project. All partners will treat information received from other partners as confidential and will not disclose it to third parties, unless it is obvious that the information is already publicly available or there is a legal obligation to do so. The partners will impose the same obligations on their employees and suppliers.

Your rights under data protection legislation

Subject access request

You have the right to obtain confirmation as to whether or not personal data concerning you is processed, and, where that is the case, access to it. We will provide you free of charge with a copy of the personal data undergoing processing in a commonly used electronic form.

Right to rectification

You also have the right to obtain the rectification of any inaccurate personal data concerning you. If you have challenged the accuracy of your data and asked for rectification you have the right to request the restriction of processing while we are considering your rectification request.

Right to be forgotten

A4 is relying on legitimate interest as basis for its processing activates (please see the Legal basis for processing section above), so in case you object to the processing of your data and there is no overriding legitimate interest, we will comply with your request and erase your data. Please note that your right to be forgotten might be limited, in case erasure is likely to seriously impair the achievement of the research purposes of the project.

Right to object

You can object to the processing of your data; in order to do that, you must provide us with specific reasons based upon your particular situation. Please note that the right to object is not an absolute right, and we can continue with the processing if we can demonstrate compelling legitimate grounds for the processing, which override your interests, rights and freedoms. If that is the case, we will explain our decision to you, otherwise your data will be excluded from processing.

Contact details

If you would like to exercise any of the above-mentioned rights or you want to find out more about how we process your data, you can contact the A4 project coordinator Giorgos Triantafyllou at: g.triantafyllou.kemea@gmail.com

All requests will be carefully considered on a case-by-case basis. However, given the particularities of the research purposes of the A4 project, some requests might not be fulfilled, especially if they are likely to impair the achievement of the project’s purposes.

Right to lodge a complaint

In case you feel that we have not addressed your request appropriately or you consider that the processing undertaken by A4 infringes your rights, you are entitled to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. You are also able to seek to enforce your rights through a judicial remedy.