Citizen Scientists Investigating Cookies and App GDPR compliance

Project Information

CSI-COP

Grant agreement ID: 873169

DOI

10.3030/873169

Project closed

EC signature date 26 November 2019

Start date 1 January 2020

End date 31 August 2023

Funded under

• Integrate society in science and innovation issues, policies and activities in order to integrate citizens' interests and values and to increase the quality, relevance, social acceptability and sustainability of research and innovation outcomes in various fields of activity from social innovation to areas such as biotechnology and nanotechnology

Total cost

€ 1 999 143,75

EU contribution

€ 1 999 143,75

Coordinated by

COVENTRY UNIVERSITY
United Kingdom

Periodic Reporting for period 3 - CSI-COP (Citizen Scientists Investigating Cookies and App GDPR compliance)

Reporting period: 2022-07-01 to 2023-08-31

Summary of the context and overall objectives of the project

EU-funded CSI-COP research and innovation project (Grant Agreement 873169: 2020-2023), entertained an original method to engage the general public as citizen scientists with exploring compliance of a new EU regulation: the General Data Protection Regulation (GDPR). The GDPR provides a strong mechanism to protect fundamental rights and freedoms of living people by requiring organisations to safeguard personal data and uphold the privacy of EU citizens. The CSI-COP project with partners in Europe and Israel from universities, SMEs and an NGO provided an ideal way to informally raise awareness of the GDPR’s principles of transparency, informed consent, and purpose limitation in websites and apps. CSI-COP’s approach empowered citizens with the knowledge on how to reduce the amount of personal data being harvested, and limit tracking of online behaviour used by the Advertising Technology industry to persuade purchasing and other habits.

CSI-COP was structured around six milestones reached through six specific objectives. Despite a pandemic, cyberattacks on two universities, and two partner terminations, CSI-COP achieved its objectives and reached its milestones evidenced from the results as deliverables available from CSI-COP website result page.

Work performed from the beginning of the project to the end of the period covered by the report and main results achieved so far

Period 1: January 2020 - December 2020
CSI-COP’s first period included nine months of research in work package 2 (WP2: January 2020-September 2020). Partners implemented change in working arrangements for online activity as a result of COVID-19. CSI-COP: a) conducted research on ethical practice for inclusive citizen science, b) innovated a privacy-by-design website, c) began creating a free informal education resource, and d) gained ethical approval to engage citizen scientists over the age of 18. Period 1 results include these deliverables:
• CS Research report on current methods in CS Engagement
• Guidelines for Diverse Citizen Science Recruitment
• Initial Data Management Plan 1 (DMP1)
• CSI-COP Framework for Engaging Citizen Scientists

Period 2: January 2021 - June 2022
The second Period in CSI-COP entailed acting on the research from WP2 in WP3 (October 2020-June 2022), implementing ethical personal data collection and processing, raising awareness of the GDPR and increasing the scientific literacy of citizens. The free informal education resource ‘Your Right to Privacy Online’ (MOOC) was created in English and launched from April 2021. The MOOC was translated in twelve languages, then delivered in online workshops, and when COVID-19 restrictions were lifted, in face-to-face and hybrid workshops across Europe and in Israel. The results from Period 2 include these deliverables:
• Societal Impact 1
• Data Management Plan 2 (DMP2)
• CSI-COP Policy Brief 1
• Report on CSI-COP’s Citizen science community
• Report on CSI-COP’s Trained Citizen Scientists


Period 3: July 2022 – August 2023
Innovation and project results’ dissemination drove the final period in CSI-COP. Fresh ethical approval allowed the involvement of Under-18s in the project. This approval gained engagement of school children aged 13+ with their teachers or care-givers in events as part of dissemination activities. The results on Period 3 include a report with anonymous details on who CSI-COP’s citizen scientists were (age-range, gender; socio-economic status and geographical location). The other outputs include datasets on citizen scientists’ website and app investigations. The innovated Taxonomy of cookies is an invaluable resource detailing the kinds of trackers the citizen scientists found in their investigations. The Repository is a precious tool easily searchable to provide a flavour of the extent of online tracking in websites and apps. The Repository shows that in the early years of the GDPR, this regulation is not being complied with fully with respect to being transparent about what third-party cookies are embedded in websites and apps, and not gaining full informed consent to extract consumers’ personal data. The partners’ combined dissemination activities increased awareness of the rights for the individual provided in the GDPR, and also the challenges businesses face in complying with this regulation with respect to purpose of collecting personal data. Policy Briefs realised from CSI-COP, and an extra output in the form of Guidelines, will contribute to better monitoring of GDPR compliance. The results from Period 3 as deliverables are:
• Searchable database of citizen scientists' website investigations with Report accompanying website database
• Searchable database of citizen scientists app investigations with Report accompanying app database
• Report on age, gender, socio-economic and geographical location of citizen scientists
• Taxonomy of Digital Cookies and Online Trackers
• Final Data Management Plan (DMP3)
• CSI-COP’s Web-based, open-access knowledge-resource of digital trackers. https://csi-cop.eu/repository/
• Repository computer code is uploaded to GitHub with a link in the ‘Help’ section: https://github.com/NanneboinaV/CSI-COP
• CSI-COP Policy Brief 2
• Three scientific papers submitted for peer-review
• Public report on the main dissemination and exploitation event in Brussels in May 2023
• Report on stakeholder cafés
• Report parent-teacher roundtables
• Societal Impact 2
• Synthesis Report of CSI-COP project and its results

All outputs from CSI-COP were made open-access as datasets, reports, resources and tools from CSI-COP website results page (https://csi-cop.eu/projectresults/) and Zenodo open access platform (https://zenodo.org/). Results will also be available from EU Cordis page and other online places.

Progress beyond the state of the art and expected potential impact (including the socio-economic impact and the wider societal implications of the project so far)

CSI-COP's work entailed delivering a public service in raising awareness of the rights accorded in the GDPR among the general public and examining GDPR’s compliance in websites and apps. The societal impact from this effort is evident in behavioural change in a) the project partners’ own organisational websites better complying with the GDPR, and b) the citizen scientists applying new knowledge gained and understanding of the scientific method as a result of engaging with CSI-COP, and c) citizen scientists, project researchers, and stakeholders’ improvement in personal data management online.

The main innovation and state-of-the-art arising from CSI-COP is its Repository: a web-based open-access knowledge resource of digital trackers found in the websites and apps investigated in the project. This includes investigations of over 100 EU funded project websites. The many resources realised from CSI-COP, including datasets, reports, resources, and tools are sustainable through their continued use in higher education by the university partners, in their teaching undergraduate and postgraduate courses, and wider by citizen science researchers and Internet Stakeholders to better understand the challenges of protecting personal data and preserving privacy online. CSI-COP’s research and innovation project has contributed significantly to exploring the GDPR as a new regulation through its inclusive approach of engaging a diverse cohort of citizen scientists in Europe and beyond. CSI-COP showed that citizen science is an effective way to engage the general public in research activities contributing to advancing science and recommending changes in public policy.

csi-cop-colour-no-text.jpg