Task emails and essential role-based communications
The restrictions that apply to marketing communications such as newsletters do not apply to the type of emails that are essential for a Cochrane contributor to carry out their role.
- Workflow emails within Archie, Task Exchange or other Cochrane systems
- Personal emails to named individuals about a specific task
- Essential updates to all people with a certain role about a new Group policy
Archie workflows should be used fully at all stages of review production. When you store data in Archie, you do not need to worry about data protection compliance. Data in Archie are Cochrane’s responsibility.
When sending emails, try not to send any attachments which include personal data. If this is unavoidable, use a password protected file and send the password in a separate email.
If you are uncertain whether a planned email message requires consent or not, please contact email@example.com.
At specific points in the editorial process, editorial base staff need to handle personal data. Best practice guidelines on how to do this are detailed in the table below.
|Process||Specific Action||Why might this be a data protection issue||What can your group do to protect personal data?|
|Getting involved request||Adding new Group contacts and authors||Do not add people to mailing lists / databases without allowing them to confirm communication preferences||
Encourage people interested in your Group to create their own Cochrane Account. This avoids the need for collecting personal data on Group contact forms.
New authors and peer reviewers can add / edit their own affiliations and other details as necessary, once they have a role granting access to Archie.If you create new Group contacts, ensure you delete any Group Contact or Registration form once the personal data are stored in Archie.
|Title proposal||Circulating title proposals for comment||Sharing people’s contact details by email is not secure||
When circulating a title proposal to editors, do not include authors’ full addresses, emails, phone numbers, etc.
We suggest you either:
|Peer reviewers||Storing details of potential peer reviewers||Storing full contact details of potential peer reviewers without their knowledge could breach their data protection rights||Store all peer reviewers’ details in Archie. If you wish to make a note of a peer reviewer’s details before creating their contact record and Cochrane Account, please add a note in Archie to the review properties or workflow to include a link to a potential peer reviewer’s publicly-available online academic or professional profile.|
|Peer reviewers||Storing peer reviewer comments||Peer reviewers’ Declarations of Interest are personal data with all the associated rights attached||
Don't store forms locally, store them on Archie. If someone wants to know what data we hold about them or wants us to erase all data we hold on them we can only do this if it is centrally stored. Archie workflows store peer review forms and are securely backed up, so there is no need to store copies locally.
|Peer reviewers||Storing research interests of peer reviewers||Information about peer reviewers’ interests is personal data and should be processed in accordance with GDPR||Store this information in Archie, for example in a Note on the person record. OR encourage them to create a profile in Task Exchange where they can showcase their interests and skills.|
If you have further questions please contact firstname.lastname@example.org.