Privacy notice

Current Research Information System - Discovery Privacy Notice

Updated on 9 December 2020

How the University process personal information in the University’s current research information system (CRIS)

On this page

How we use your information

Staff and student users’ personal data is used in the University’s current research information system (CRIS) for the recording, administration and management of research and research activities. At present, the University’s CRIS is provided by Elsevier using the system ‘Pure’ and is known as Discovery.

The CRIS is used to create a record of the research undertaken in the University. Information held in the CRIS is made available internally for reporting and management purposes and externally for reporting on research as required by funders and other external stakeholders.

The CRIS is fed personal data from other University systems. Data from the HR, Research Finance and Student Registry systems is combined within the CRIS with any personal data entered by University administrators, staff and student users.

This data is used to:

  • Create a record of the research activities undertaken by the University’s research community
  • Provide a record of student supervision in relation to research degrees
  • Report on research outputs, impact and other disclosable activity to the UK Research Excellence Framework (REF) and Scottish Funding Council
  • Report to funding bodies and other stakeholders (e.g. the provision of bibliographic data to ResearchFish further to funder requirements)
  • Support management and planning activities

Data from Discovery is used in the University’s internal Annual Research Review and is provided to senior colleagues in Academic Schools for that purpose.

The IP address and usage event datestamp of staff, student and external users, requesting to download an item e.g. article/dataset/thesis are transmitted to IRUS-UK (Institutional Repository Usage Statistics UK) a national aggregation service, to provide COUNTER-conformant usage statistics for all content downloaded from Discovery .

 

Personal data

The personal data processed within Discovery are:

Object Object Fields Retention period
General Information – Staff/student users First name Permanent storage
Last name Permanent storage  
University email address Contracted period of employment/studies plus one year
IP address Contracted period of employment/studies plus one year
Username Contracted period of employment/studies plus one year
Staff ID Permanent storage
Higher Education Statistics Agency ID Permanent storage
Student ID Permanent storage
External researcher ID e.g. Scopus or Web of Science ID where applicable Permanent storage
Unique identifier in Pure Permanent storage
Role within the organisation Permanent storage
Period of employment/study Permanent storage
Date of birth Permanent storage
Grant application and award data Permanent storage
Information added by University administrators, staff/student users Profile Photo Contracted period of
  • employment plus one year
  • studies plus one year
  Biographical Information Contracted period of
  • employment plus one year
  • studies one year
  ORCID (where appropriate) Permanent storage
  Research activities Permanent storage
Information about users' research outputs (staff only) Internal assessment score of any output (where appropriate/used) Permanent storage
  Narrative descriptions of outputs (where applicable) Permanent storage
General information – all users (staff, student and external) IP address of user requesting download of an item This information is not retained by Discovery beyond the duration of the user session. However, it is transmitted to IRUS-UK (Institutional Repository Usage Statistics UK) a national aggregation service, which provides COUNTER-conformant usage statistics for all content downloaded from the repository
  Usage event datestamp Information is retained by IRUS-UK for two years

Special categories of personal data

The University may require special categories of personal data to be processed in Discovery for inclusion in the University’s submission to the REF; otherwise the system will not normally contain such data. However, should you choose to enter special category data yourself, the University will process that information within Discovery.

Where individual staff circumstances influence the number of research outputs required for submission to the REF a note of such circumstances is held within the system. Circumstances for which the reduction in outputs required is defined (e.g. qualifying as an early career researcher or junior clinical academic, secondments, career breaks, family-related leave) are held in the system and can only be seen by authorised staff. Circumstances requiring a judgement to determine the reduction in outputs required (e.g. disability, ill health, caring responsibilities, gender reassignment) are held within the system and can only be seen by a restricted number of senior authorised University staff involved in the review and submission of individual staff circumstances for the REF. Individual staff circumstances data are not visible publicly.

Data controller

The University of Dundee is the data controller for this data. Elsevier, the provider of the system, is the University’s data processor. For information about Elsevier’s compliance with the General Data Protection Regulation (GDPR) please see https://www.elsevier.com/about/policies/privacy-principles/gdpr

IRUS-UK (Institutional Repository Usage Statistics UK), a national aggregation service, which provides usage statistics for all content downloaded from participating UK institutional repositories (IRs) also acts as a data processor. IP addresses are transmitted to IRUS-UK by the repository, Discovery, for the purposes of processing external users raw download usage data into COUNTER-conformant statistics.

For information about IRUS-UK’s compliance with the General Data Protection Regulation (GDPR) please see https://irus.jisc.ac.uk/privacy/

Lawful processing

The University asserts that it is lawful for it to process your personal data:

  • for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
  • for compliance with a legal obligation to which the controller is subject;
  • for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

Where processing falls outwith the normal course of business the University may, from time to time, seek your consent to process your data for one or more specific purposes.

The University asserts that it is lawful for it to process special categories of your personal data:

  • further to your consent (i.e. you have actively entered special category data into Discovery). Where the University requires to process special category data using another lawful basis, this privacy notice will be updated to reflect that.

Your rights

The University respects your rights and preferences in relation to your data. If you wish to update, access, erase, or limit the use of your information, please let us know by emailing Discovery@dundee.ac.uk. If you wish to complain about the use of your information please email dataprotection@dundee.ac.uk. You may also wish to contact the Information Commissioner’s Office.

Enquiries

Data Protection

dataprotection@dundee.ac.uk