1.2 How will the data be collected, observed or generated?
What standards, methodologies or quality assurance processes will you use?
Content to be filled in by: NL, KD, JK
In addition to the official SNSF guidance, consider also for each dataset type in your project (including data you might re-use):
- the use of core facility services and mention their certification(s) if any
- the following of double blind procedures
- the use of standards and internal procedures and describe them briefly
Examples:
- Experiments will include appropriate controls to ensure validity and repeated measures to assess data consistency.
- Quality of analytical data will be controlled through calibration of devices, repetition of experiments, comparison with literature/internal standards/previous data, by a peer review.
How will you organize your files and handle versioning?
Content to be filled in by: NL, JK, KD
Indicate and describe the tools you will use in the project. You may rely on the following tools depending on your needs:
- a naming convention, i.e. the structure of folders and file names you will use to organize your data. For example: Project-Experiment-Scientist-YYYYMMDD-HHmm-Version.format or concretely Atlantis-LakeMeasurments-Smith-20180113-0130-v3.csv .
- a code revision management system, such as Git. Several Git servers are available for ETH domain: c4science.ch , gitlab.epfl.ch , gitlab.ethz.ch .
- a data management system such as an Electronic Laboratory Notebooks / Laboratory Information System (ELN/LIMS). Within ETH domain the following ELN/LIMS are supported institutionally: OpenBIS, SLims .
1.3 What documentation and metadata will you provide with the data?
Content to be filled in by: JK, NL, KD, AS, ME
Indicate all the information that is required in order to be able to read and interprete the data (context of data) in future. General documentation of the data is often compiled into a plain text or
markdown README file. These formats may be opened by any editor and are future proofed.
In addition, for each data type :
- Give the metadata standard use to describe the data. For examples see: Research Data Alliance Metadata Standards Directory. If no appropriated existing standard is available, you may describe the ad hoc format of metadata you will use in this section.
- Metadata may also be embedded in the data, e.g embedded comments for code. Or, when for example using Hierarchical Data Format HDF5, arbitrary machine readable metadata can be included directly at any level.
- Describe which software including its version is used to produce/read to create the data, the format and corresponding filename extension and its version.
- If possible, the software that was used should be archived too.
- If any, which metadata are generated automatically?
- If possible, a data analysis or result should be supplied together with the raw data.
Additional information that are helpful in a README file:
- description of the software that was used
- description of the system environment that was used
- description of relevant parameters such as:
- geographic locations involved (if applicable)
- all relevant information regarding elicitation of data
2.Ethics, legal and security issues
2.1 How will ethical issues be addressed and handled?
Content to be filled in by: ReO (+VPSI), AS, ME
OK pour ReO, en cours.
Done for VPSI (see last sentence)
- Are there any ethical and privacy issues concerning your data in general and sharing it in particular?
- If so, have you sought guidance from your institution's contact person(s) for research ethics and/or data protection issues?
- Does your data contain confidential or sensitive information? If so, have you discussed data sharing with the respondents from whom you collected the data and gained their written consent if needed?
- Does the data need to be anonymized prior to sharing?
- How will the sensitive data be handled to ensure it is stored and transferred securely?
Methods to ensure the protection of personal and/or sensitive data are described in the following paragraph (2.2).
2.2 How will data access and security be managed?
Content to be filled in by: VPSI + ReO
OK pour ReO, en cours.
Done for VPSI (see below)
- The main concerns regarding data security are data availability, integrity and confidentiality.
- The level of the data availability risk is low/medium/high. The level of data integrity risk is low/medium/high. The level of data confidentiality is low/medium/high.
- Measures taken :
- All personal data will be anonymized in such a way that it will be impossible to attribute data to specific persons.
- All personal data will be pseudonymized. The correspondence table will be encrypted and access restricted to the project leader.
- All sensitive data will be encrypted and encryption keys will be managed only by authorized employees.
- Sensitive data transfers will be end-to-end encrypted.
- Sensitive data will be accessible only by authorized participants to the project. The list of authorized participants will managed by…
- Data access rules will be detailed in before starting the project.
- Access to laboratory and offices will be restricted to authorized persons. The list of authorized persons will managed by…
- All data will be backuped on a regular basis and access to backup media will be managed accordingly to data access rules. Backups will be stored in another location.
- All damaged media containing sensitive data will be physically destroyed.
- All servers will be located in a datacentre… with restricted access.
- No data will be stored on a public cloud / cloud hosted outside Switzerland.
- No sensitive/personal data will be stored on a public cloud / cloud hosted outside Switzerland.
- All computers storing or computing sensitive data will not be connected to the Internet.
- All computers storing or computing sensitive data will have a hardened configuration (disk encryption, restricted access to privileged accounts to a small, controlled group of users, restricted or disabled remote access using privileged accounts, disabled guest or default accounts, local firewall, automatic screen lock with password protection, disabled remote out-of-band management (IPMI, Active Management Technology (AMT), etc.), disabled USB ports, removable privacy filter on screens, automatic updates via “Windows Update”, Apple’s “Software Update” or Linux “yum auto-update”, anti-virus software, Adobe’s “Flashplayer” and “Java” runtime disabled,…).