Questionnaire on Training and operational needs analysis
Information Sheet
In support of the GANNDALF Project
Project number: 101167951 HORIZON-CL3-2023-FCT-01
Introduction
This survey aims to determine the availability of LEA training courses in cybercrime detection and investigation and the determination of shortfalls in existing offerings and identify additional topics that may complement the training curriculum; and ascertain the current operating procedures and the tools used by investigators.
In that framework, the answers help develop innovative training curricula for increasing LEA capacity to fully understand the current landscape of contemporary cybercriminal activities, increase awareness and support the uptake of the GANNDALF Crime Investigation Framework through the development of training materials.
You have been invited to be a participant in a research activity carried out in the scope of the EU-funded HORIZON project, GANNDALF. This document provides detailed information about the research to help you make an informed decision on whether to participate. Before deciding, it is important that you clearly understand the purpose of the research and what it would imply for you, including all the proceedings of the research and any potential risks and benefits it may entail. Please feel free to ask all questions you may have. This information document may include terms or concepts that you do not fully understand. If this is the case, please ask the contact person or any other member of the team coordinating the activity to fully explain it or clarify pieces of information. At all times during the foreseen activities and afterwards, the GANNDALF consortium assures compliance with the relevant national and European legislation.
Project and research ambitions
The GANNDALF project is an innovative initiative aimed at tackling advanced cyber threats and cyber-dependent crimes through cutting-edge technologies and collaborative frameworks. It focuses on enhancing law enforcement agencies' (LEAs) ability to share data securely, conduct joint investigations, and leverage state-of-the-art tools for real-time collaboration. By developing a modular decision-support toolbox, a customizable crime investigation sandbox, and facilitating policy development, training, and public awareness, GANNDALF empowers LEAs to respond effectively to the evolving landscape of cybercrime and strengthen cyber resilience across borders. This information sheet informs you about the details and implications of participating in the survey on the above-mentioned topic.
Your participation
Your participation in the survey as described below, is highly valuable in achieving the objectives of the GANNDALF project. Your participation is only possible in case you freely consent to participating, which is the legal basis for taking part in the activity and for collecting and processing the data you and other research participants will be kindly asked to provide.
Taking part in this research project is voluntary
You are free to withdraw your participation from this activity at any time without providing justification. No consequences will follow your withdrawal. Any personal data of yours that might still be attributable to you will be immediately deleted by removing such data from the pool of to-be-analysed information. Any relevant files and hard copies will be destroyed.
The activity
Participants will be provided with this information sheet and asked to sign a consent form expressing their consent to participate and to share some personal data by taking part in this survey.
Data collection and processing
As mentioned above, this activity is carried out under the HORIZON project GANNDALF which processes personal data for the purposes of the survey. Again, data processing takes place amidst the above-mentioned activity. The only personal data that will be collected are those shared through the informed consent forms. This effort will be concluded well within the lifetime of GANNDALF, which is running from 01 October 2024 until 30 September 2027. The data collected by asking participants to provide comments and feedback is to be stored in a highly aggregated and pseudonymised form.
Again, we will not process any of your information if you do not give your consent; as explained in greater detail below, if you change your mind, you can withdraw your consent at any time during or after the activity by reaching out to the responsible research coordinator(s) and/or the Data Protection Officer (contact details are given at the end of this document). We will only collect and process the minimum amount of information that is required to achieve the purpose of this research activity. We will apply appropriate security measures during all processing and storage of your data (see below). All data collection and processing take place in strict accordance with the EU General Data Protection Regulation 2016/679. You’ll be able to exercise all your rights as a research participant in accordance with the EU General Data Protection Regulation 2016/679, which we fully respect and comply with; these are also described in this sheet. No automated decision-making or profiling in accordance with Articles 22(1) and (4) of the General Data Protection Regulation 2016/679 is going to take place.
Will personal data be used for future research or shared with others?
We do not plan to share any personal data with anybody other than the research partners with a need to know.
Will personal data be stored?
Access to the systems is limited to the research coordinator(s) (and their co-workers) in accordance with current security standards. The data may be stored for the purpose of conducting a possible audit for five more years after the final payment. It will be deleted from all storage media as soon as possible, either in the immediate aftermath of an audit (when it would no longer be needed) or immediately after the end of the above-mentioned five-year period. No further processing will be conducted.
Who can access my information?
We will disclose your information if the EC, who is funding this research, requests information for auditing purposes or to evaluate our procedures. Within the consortium partners, your information will only be accessible on a need-to-know basis.
Your key data protection rights
In accordance with principles of research ethics and the EU data protection framework, you have rights regarding how your personal data is processed. Here are your rights and how we can fulfil them:
• Right to access personal data processed about you, and the right for these data to be in a portable form – If you request access to personal data that we hold about you, we will provide you with these data in an easily accessible format.
• Right to rectify personal data held about you – If you think the personal data that we hold about you is inaccurate or incomplete, you can request us to correct or complete your personal data.
• Right to restrict the processing of your personal data – If you want to restrict the way we process your personal data, you can request that we do so.
• Right to request that your personal data is erased – If you want us to delete your personal data from our systems, you can request that we do so.
• Right to leave the research activity – If you wish to withdraw from participating in this survey, you can do so at any time without negative consequences and your personal data will not be processed.
• Right to be informed about the purpose of data collection, the use of the data and storage of the provided data.
• Right to request that we transfer your personal data to another organisation.
• Right to complain to a supervisory authority – If you feel we have not adequately dealt with your requests, you can complain to the national data protection authority.
• Right to lodge a complaint to the project coordinator and/or the DPO (contact below).
Requests to exercise these rights will be handled without undue delay. If requests to exercise these rights are excessive, malicious, impossible to fulfil, or require a disproportionate effort, we may reject some requests in accordance with data protection legislation.
What risks will I face by taking part in this study? What will be done to protect me against such risks?
In principle, risk of breach of confidentiality in the handling of your personal data may lead to personal data breaches. Because this study collects information about you, one of the risks of this research is a loss of confidentiality.
Measures to protect against such risks:
• Voluntary participation
• Acknowledgement of the legal and ethical framework by partners
• Accountability and documentation
• Security of retention (appropriate security measures implemented in storing the data)
• Proper explanations of the policy context
• The presence (online or offline) of technical experts that can be consulted
What are the benefits of participation?
None of the participants will be paid for their participation.
Confidentiality of the research
All data that will be collected and processed will be treated highly confidentially. As explained above, no sharing will take place other than with consortium members that have a need-to-know. Moreover, the data will be stored safely on servers to which only employees of the research partners have access. Appropriate security measures will be implemented to further ensure the confidentiality of data.
Contact details
GANNDALF Project Coordination: info@lists.ganndalf-project.eu
Data Protection Officer (DPO) for this activity: …..
Research coordinator for this activity:….
Consent Form
I understand the following:
• I have read the information sheet explaining the project and understand how this research activity will collect and process my responses, and my personal data if I choose to provide it.
• I will be asked to provide professional or personal views and that the record of my involvement in the research will be kept confidential.
• I have the right to ask questions about my project participation and receive clear answers before making any decision.
• I am free to end my participation at any time.
• My responses will be incorporated into an aggregated analysis and not kept on file or stored in the form of physical copies.
• If the information I provide is used for the writing of a piece of work to be delivered to the EC, or scientific research paper, my name and other attributable data will be removed from that information so that my identity and experiences remain confidential (unless attribution is required, and I have consented to it).
• I have been made aware of my rights regarding my personal data and how to exercise them.
• Personal data received will be stored in separate files in a secure manner.
• My personal data will not be transferred to third parties.
• I have been given the contact details of the research team and I have been informed that I am free to contact them.
• My participation is voluntary. I have not been pressured or coerced in any way to take part in this research activity.
• I hereby consent to participate in the GANNDALF project and to the processing of my personal data associated with this participation for the purposes and procedures as described herein.