Good day, everyone. My name is Nobu Belele, Angel Shousi, and I'm a researcher and software
developer at a, okay. So, yeah, I'm a researcher, software developer at an organization called
the Data Intensive Research Initiative of South Africa. We're based in Pretoria. So,
in this presentation, I'll just be talking about how, as a national data repository,
we're just trying to sort of comply with the privacy law in South Africa. So, for this
presentation, I will just go through describing the landscape that we currently have in South
Africa in terms of the cyber infrastructure, and also what my organization does, and then
talk about the law and some other things in the presentation. So, then, to start off with,
we are seeing a lot of countries that are coming to realize how important personal information is,
and that is why we're getting this rise in the development of privacy laws, and it's not just
something that applies now to developing countries, but also you see it in the so-called
developed countries as well, because, yeah, the concept of data is being realized, and what,
though, we haven't seen or what I haven't been able to find in research is now how are these
laws having an effect on national data repositories, such as the one that we are trying to create. So,
this presentation is just about that. So, then, looking at a worldview in terms of privacy laws
that have been created around the world, I found this image. I think there's a source at the bottom.
So, looking more maybe in the African space, you can see that there is some growth towards the
creation of privacy laws, but there is, of course, still a couple of countries that are not there yet
in terms of creating these. So, then, the National Integrated Cyber Infrastructure System, or in
short, NIKIS, was created by the South African government to cater to cyber infrastructure,
focusing on research. So, there are three components that make up NIKIS. The first one is the Computing
Services. It's called CHPC, or the High Performance Computing Center, and there it focuses on
providing HPC, High Performance Computing Services. And then, the second one is the
Networking Services, which is called SANDRAN, that is the South African ANDRAN, focused on
networks connecting different institutions around the country. And then, the one that I come from,
which is DERISA, that is focused then on data services. So, then, looking then in depth at DERISA
a little bit, our primary core objective is to build a national research data infrastructure. So,
that is building and maintaining tier one nodes and services, and also supporting tier two domain
nodes, which I will explain in the next slide. And our other objective as well is to provide
research data management services. So, they're the first one being the ability to provide
researchers a platform where they can be able to store their data. We also have a data management
planning tool that we have created and is available to our researchers, and it currently
hosts the official template for our national research funder, which is the NRF. We also have
a personal identification service, so that's where researchers can be able to mount DOIs. And we're
also responsible then for creating policies, practices that support research data management.
Another objective is advocacy and coordination, where we are responsible for R&D initiatives,
and also developing human capital skills through the provision of postgraduate programs. We have
annual conference as well, training workshops, etc. So, these are all aligned towards promoting
research data management. So then, in terms of our data repository, that is sort of the architecture
that we have, where currently we have a four petabyte research, or four petabyte storage, sorry,
for active data. And we are in the process of procuring eight petabytes more, so that will form
part of now the active data, which is for real-time access. And then, we're also in the process of
procuring a 40 petabyte storage, and that one will be for archiving purposes. So, all of this is being
managed by iRODS, and the interface that we are using for now depositing the data is called Metal
NX. So then, our repository then, we have functionality where you are able to subscribe
to it using federated identity, which is Sapphire, that's the South African federation. And then,
you can be able to deposit, store data, discover and download. So then, looking at the infrastructure
of what we're trying to build is that, as Dereesa, we are on a national level, and we're
identifying that as tier one. So we're building, maintaining the national one, and the plan is
then to link up to tier zero organizations, such as SKA CERN, but also have tier two, tier three,
the regional institutional ones linking up to Dereesa. So then, this tiered approach,
we see it as providing a platform for these silo repositories to actually connect and
to provide more integration of data. So then, what Poppy Act is, stands for protection of
personal information, and its purpose is to ensure that all South African institutions conduct
themselves in a responsible manner when collecting, processing, storing and sharing personal
information. And it is based on those eight principles, accountability, processing limitation,
purpose specification, which just means that the data must be collected for a specific purpose,
and it should be processed for the purpose. If there's been any other further processing
limitation, which is a guideline, if further processing is done on this data, it should then
not maybe infringe on the privacy of the information that is there. It also advocates for information
quality, that whatever information is collected, stored, et cetera, is of high quality, complete,
et cetera, openness, security safeguards, and ensuring that whatever data is collected,
that data subject is aware. So that is what the data subject participation principle is about.
So then, I just added this slide just to sort of talk about some of the differences between the
Poppy Act and what GDP are, where if you're looking at the Poppy Act, what's the column,
the Poppy Act is limited to personal information that is processed within the borders of South
Africa, and it applies to natural and juristic persons. In terms of fines, if maybe you found
to be contravening it, the fines are said to be up to 10 million, and if a breach does occur,
our Poppy Act does not specify how soon the organization should say or talk about the breach,
they just say as soon as possible. So that could be African time, anytime. Possibility of criminal
offence there is, and then in terms of privacy, they do not speak about the use of privacy by
design or carrying out privacy impact assessments, whereby in comparison, the GDPR is specific in
terms of using privacy by design and conducting privacy impact assessments, and there are fines
as well which are quite hefty when compared to our Poppy Act and they're very strict in terms of
breach notification. So then, how can a national repository like ours or maybe like any other,
can meet the conditions of a privacy law or in our case Poppy? So then, for this, we identified
three components that we feel need to be addressed or need to be thought about when you are trying
then now to meet the privacy, a privacy law. So the first one is the policies, so they're expanding
into the standards, procedures, processes, and also understanding what is the purpose of this
data that you're collecting and then security aspects. So there is, of course, more information
that you should be looking at, but for this presentation, these are the three that I'm just
going to briefly discuss. So then, in terms of policies, etc., we have a detailed policy framework
which I actually didn't put in this presentation, but we've looked at, we started by first looking at
what is our data flow. So we're looking at our research data lifecycle and then from there,
identifying now how from this data flow our applications fit in and we then identify policies
that relate to that. So then, some of the policies that we have, like the usage standards and
procedures, a privacy policy, a policy for how we will be ingesting data into our storage,
a data management policy that talks about curations, stewardship, etc., and also ownership
policy for citations, licensing rights, and also auditing. So, for example, when you register onto
our platform, we specify that a user has to accept our policy standards, etc., before being able to use
our storage infrastructure. And then, in terms of the purpose of the data, this we view in two ways,
in terms of the data that is collected by the researcher, but also then when it is being
stored by our repository. And then, also there, we feel that policies are something also that is
important for the purpose of the data. And then, when we're looking now at the data that we are
collecting to try and meet the guideline of collecting data only for a specific purpose,
that is just a screenshot of the data that Sapphire, which is our federated identity,
collects. And you can see our required attributes and also our optional attributes there. So,
that's just some of the information that we create, sorry, that we collect. And yeah,
so when you're creating an account as well, you just need a password to secure your account.
And then, security-wise, so we have passwords. And those are just stored in our database in an
encrypted format. And our database is accessed through being queried. And yeah, all the user
information data, etc., is stored in a secured database. So then, considerations to meet
privacy law, just then aligning our national repository to the components of the principles
of the Poppy Act in terms of data. Our preference is towards open, shareable data and not really
personal information. But if there is personal information, then we specify that it should be
de-identified. In terms of accountability, accountability lies on both the data owner
and the repository. And processing, reprocessing limitation, we also plan to comply with Poppy in
terms of when we reprocess, we want the data to be de-identifiable so that if it is reprocessed,
that sort of keeps the data secure. Information quality, just ensuring that whatever data we
collect and store is of high quality. Security safeguards, we've put in place backups in case
of loss or damage. And then, encryption of information. And we also conduct security
risk assessments on our systems and infrastructure, firewalls in place, etc.
And data subjects, participation. They're just being able to remove data when required.
And also, we're still looking at how then what impacts that will have on our archive solution,
when let's say data has already been archived and we have to remove it. What are the implications
of that? So then, just to conclude then, as I say, that there is a rise in privacy laws,
and this has an impact on our repositories. So the considerations of what this presentation
just looked at is around policies, data, and security. Thank you.