154 Tijana Rupčić1 LIMITS OF CONFIDENTIALITY: ARGUMENTS FOR AND AGAINST DISCLOSING DOCUMENTS CONTAINING PERSONAL DATA IN ARCHIVAL HOLDINGS: PHYSICIANS FOR HUMAN RIGHTS CASE STUDY Abstract There are numerous dilemmas concerning the availability of personal and sensitive data, and I will try to offer some helpful answers for and against the use of such data. To evaluate the reasons why to (or not) disclose personal data I will use the guidelines offered by the EU in GDPR (General Data Protection Regulation, 2019) to create frame- work for evaluation of the sensitivity of the data contained in HU OSA 386. Besides this, I will use the guidelines provided by the OSA’s General Restriction Policy (Access Policy, s.d.). Furthermore, I will analyze the entire HU OSA 386 Collection (all series) and on the concrete examples give answers to why some data should be available and why some should not. Finally, I will examine this case study from several points – the holder of the Fonds (archivist) and user of the Fonds (researcher). Key words: Personal data, Sensitive data, OSA, war victims, Bosnia and Herzegovina LIMITI DI RISERVATEZZA: ARGOMENTI A FAVORE E CONTRARIO ALLA COMUNICAZIONE DI DOCUMENTI CONTENENTI DATI PERSONALI NEI PATRIMONI ARCHIVISTICI: CASO DI STUDIO DEI MEDICI PER I DIRITTI UMANI Sintesi Esistono numerosi dilemmi riguardanti la disponibilità di dati personali e sensibili, e cer- cherò di offrire alcune risposte utili a favore e contro l’utilizzo di tali dati. Per valutare i motivi per cui divulgare (o meno) i dati personali utilizzerò le linee guida offerte dall’UE nel GDPR (Regolamento generale sulla protezione dei dati) per creare un quadro per la valutazione della sensibilità dei dati contenuti in HU OSA 386. Oltre a questo, Userò le linee guida fornite dalla Politica di restrizione generale dell’OSA. Inoltre, analizzerò l’intera Collezione HU OSA 386 (tutte le serie) e sugli esempi concreti fornirò risposte sul perché alcuni dati dovrebbero essere disponibili e perché altri no. Infine, esaminerò questo caso di studio da diversi punti – quello del titolare dei fondi(archivista) e quello dell’utente dei fondi(ricercatore). Parole chiave: Dati personali, Dati sensibili, OSA, vittime di guerra, Bosnia ed Erzegovina 1 Tijana Rupčić, Central European University, e-mail: fereja.tina@gmail.com LIMITS OF CONFIDENTIALITY: ARGUMENTS FOR AND AGAINST DISCLOSING DOCUMENTS CONTAINING PERSONAL DATA IN ARCHIVAL HOLDINGS: PHYSICIANS FOR HUMAN RIGHTS CASE STUDY TIJANA RUPČIĆ 155 MEJE ZAUPNOSTI: ARGUMENTI ZA IN PROTI RAZKRITJU DOKUMENTOV, KI VSEBUJEJO OSEBNE PODATKE V ARHIVSKIH FONDIH: ŠTUDIJ PRIMERA ZDRAVNIKI ZA ČLOVEKOVE PRAVICE Povzetek Obstajajo številne dileme glede dostopnosti osebnih in občutljivih podatkov, zato bom poskušal ponuditi nekaj koristnih odgovorov za in proti uporabi teh podatkov. Za oce- no razlogov zakaj (ali ne) razkriti osebne podatke bom uporabil smernice, ki jih ponuja GDPR v EU (Splošna uredba o varstvu podatkov, 2019). S tem želim vzpostaviti okvir za ocenjevanje občutljivosti podatkov, ki jih vsebuje HU OSA 386. Dodatno bom vključil še smernice, ki jih zagotavlja Splošna politika omejevanja OSA (Politika dostopa – Access policy). Nadalje bom analiziral celotno zbirko HU OSA 386 (vse serije) in na konkretnih primerih podal odgovore, zakaj bi nekateri podatki morali biti na voljo in zakaj nekateri ne. Na koncu bom to študijo primera preučil z več vidikov – imetnika fonda (arhivista) in uporabnika fonda (raziskovalca). Ključne besede: Osebni podatki, občutljivi podatki, OSA, vojne žrtve, Bosna in Hercego- vina LIMITS OF CONFIDENTIALITY: ARGUMENTS FOR AND AGAINST DISCLOSING DOCUMENTS CONTAINING PERSONAL DATA IN ARCHIVAL HOLDINGS: PHYSICIANS FOR HUMAN RIGHTS CASE STUDY TIJANA RUPČIĆ 156 1 INTRODUCTION What is sensitive personal data, and why is it essential to protect it? In this case study, I will analyze holdings of the archival Fonds, HU OSA 386 Records of the Physicians for Hu- man Rights’ Bosnia Projects kept in the Vera and Donald Blinken Open Society Archives. By analyzing the documents of this particular collection, I will try to create a framework for discussing sensitive personal data disclosure. There are numerous dilemmas concerning the availability of personal and sensitive data, and I will try to offer some helpful answers for and against the use of such data. To evaluate the reasons why to (or not) disclose personal data, I will use the guidelines offered by the EU in GDPR (General Data Protection Regulation, 2019) to create a frame- work for evaluation of the sensitivity of the data contained in HU OSA 386. Besides this, I will use the guidelines provided by the OSA’s General Restriction Policy (Access Policy, s.d.). Furthermore, I will analyze the entire HU OSA 386 Collection (all series) and, on the concrete examples, give answers to why some data should be available and why some should not. Finally, I will examine this case study from several points – the Fonds (archi- vist) holder and user of the Fonds (researcher). 2 WHAT IS SENSITIVE PERSONAL DATA? In the simplest definition, sensitive data is data that must be kept safe against unsolicit- ed disclosure. Reasons for protecting sensitive data could be ethical, legal, or because of referring to personal privacy (Cammilleri-Subrenat & Levallois-Barth, 2007). The EU has well-defined regulations regarding confidential and sensitive data and non-personal sensitive data (General Data Protection Regulation, 2019, Art. 9). Sensitive and person- al data comes in many forms. My study’s focus is personal data, but I will mention and other types of data that are considered sensitive for the sake of a better understanding. Personal data that is considered sensitive regards to the identifiers such as names or ID numbers; physical or mental status; sexual orientation; criminal record; genetic and physiological information; religious or philosophical beliefs; political opinions or con- nections; biometric data such as fingerprints; ex-combatant status and refuge displace- ment status. Information that is economic, social, or cultural can be considered person- al. In modern times personal data can be regarded as information on location given by GPS or mobile phones (ibid.). Sensitive data can be data in confidential status such as business secrets, various inves- tigations, property protected by intellectual rights, security in the form of passwords, or military information. Biological data can be considered sensitive data, such as protecting the secrecy of en- dangered animal or plant species’ location (ibid.). Personal data (or any data) is protected by the primary custodian or the data controller. The data controller can be an organization (like PHR in this case) or an individual. Fur- thermore, the data controller is the one who determines the purpose and how personal data in his custody shall be processed. Data processing includes data collection, struc- turing, recording, storage, use, and disclosure by transmitting the data. In other words, data processing is making data available for the use or destruction of data (Guibault & Weibe, 2013). It is crucial to keep in mind that when handling personal sensitive data, processing and storing it should be dealt with utmost care and attention. This is notably important in cases when sensitive data contains any information that can be used to identify a living person. This concerns both textual (such as name or address) and visual data (such as a LIMITS OF CONFIDENTIALITY: ARGUMENTS FOR AND AGAINST DISCLOSING DOCUMENTS CONTAINING PERSONAL DATA IN ARCHIVAL HOLDINGS: PHYSICIANS FOR HUMAN RIGHTS CASE STUDY TIJANA RUPČIĆ 157 photograph or a recorded interview). Even if data is not directly implying someone’s identity, it still can be considered sensitive personal data. With a combination of differ- ent databases, one can ascertain someone’s identity—for example, the information of someone’s employer or affiliation with a specific organization (Guibault & Weibe, 2013). Depending on the type of data when storing it, one should keep in mind that processing should be done to assure the protection of sensitive data even in the future. Moreover, data should be accessible, findable, interoperable, and reusable. There are several ways to protect sensitive personal data, such as anonymization, pseudonymization, and encryption. The difference between anonymization and pseu- donymization is that in the case of anonymization is destroying any possible way of identifying the person or subject, and this process is irreversible, contrary to the pseu- donymization where tracing the data to its origin is possible because identity is only substituted. In a legal frame, pseudonymized data is still considered sensitive (unlike anonymization, where data is no longer considered personal) because it can be linked to someone’s identity. Finally, if data is in digital form, it can be encrypted. If the data which is to be shared is not anonymized, pseudonymized, or encrypted, there are still ways for it to be contained in a controlled and safe environment. For the protected shar- ing of the sensitive personal data, one can reach to organizing a committee that will have a task of revising the applications for the access and use of data or by storing data in institutional archives where data can be only accessed by the data creator or his/her representatives (Weibe & Dietrich, 2017). In the PHR collection case study, there was a limited restriction to its parts, which are no longer in effect. When it was given to the OSA, documentation of the PHR Bosnia project was processed and made available for the users according to the contract. The creator and institution both signed. The complexity of this case is that the original data control- ler is not the OSA but PHR representatives. By definition, all responsibility for the protec- tion of sensitive data is still their responsibility. Keeping that in mind, the responsibility for obtaining the informed consent that personal data will be available for research lies in the realm of the PHR’s responsibility as the original creator and data controller. Informed consent is an important aspect when dealing with personal and sensitive data. In the process of obtaining personal and sensitive data, one must inform partic- ipants about the nature of the project so they can make a voluntary decision whether to participate or not. Moreover, it is advisable to notify the participant of the plausible benefits of sharing the provided data for research purposes (Weibe & Dietrich, 2017). In most cases, personal data can be “innocent,” such as an address, but in the case of PHR, even this “innocent” information can be categorized as highly sensitive. In princi- ple, it is forbidden to disclose sensitive personal data. Still, there are several exceptions to this rule: when data subjects give their written consent or when it is necessary to use such data to establish or defend a right, or when it is fundamental for scientific research. 3 PHYSICIANS FOR HUMAN RIGHTS’ BOSNIA PROJECT In the summer of 1996, the organization Physicians for Human Rights underwent a con- tract with the International Criminal Tribunal for the Former Yugoslavia (ICTY). The pur- pose of this contract was to sponsor a team of international forensic scientists who had the task of unearthing the remains from the mass executions that were committed in Srebrenica during July 1995. Even though Srebrenica was in the area where Dutch UN peacekeepers were present, Serbian forces invaded the town on July 6th, 1995. In the next couple of days, the Serbian army rounded up all men and boys over 15, mostly ci- LIMITS OF CONFIDENTIALITY: ARGUMENTS FOR AND AGAINST DISCLOSING DOCUMENTS CONTAINING PERSONAL DATA IN ARCHIVAL HOLDINGS: PHYSICIANS FOR HUMAN RIGHTS CASE STUDY TIJANA RUPČIĆ 158 vilians, and deported them to the various sites where they were executed. At the begin- ning of August of 1995, an aerial image of the area surrounding Srebrenica had images of what appeared to be gravesites. In July of 1996 team of PHR identified four gravesites and started the process of exhumation (Brunbord, Lyngstad & Urdal, 2003). This team’s initial task is to examine the postmortem conditions, such as to cause and manner of death. Their finding was to be used in the prosecution of indicted war crim- inals in Hague. However, it became apparent very early that the information gathered during the postmortem analysis can help families of those who were killed in Srebren- ica. Survivors from Srebrenica had been tortured by the uncertainty of their relatives’ fates, and the PHR team could help give them the close of some sort. For the need to identify recovered bodies during the exhumation of the mass graves, PHR devised a method of identification. They started collecting data from the missing persons’ fami- lies, which they gathered from the exhumed bodies. In the first project, PHR faced early on with a problem of full disclosure. Given that survivors from Srebrenica were already severely traumatized and clinging on to the hope of their missing relatives were still alive, full disclosure of the purpose of the interviews was a sensitive subject (Keough, Kahn & Andrejevic, 2000). The PHR mandate is mostly defined by the rights of the Universal Declaration of Human Rights (1948) and the guidelines of the Geneva Conventions of 1949 and 1977 (Hannibal & Lawrence, 1995). In 2004 PHR handed over the documentation gathered during the identification of the war victims in Bosnia and Herzegovina who perished during the civil war in Yugoslavia (1991-1995). The collection HU OSA 386 contains the textual documents, photographs, and videotapes gathered by the PHR representatives in time between 1996 and 1999 (HU OSA 386, 1997-1999). One of the most prestigious and notable characteristics of the PHR is the transparent and effective fact-finding method in investigations of human rights violations. PHR rep- resentatives collect various medical documentation data during their missions, both physical and psychological, which are further supplemented by first-hand testimonies (Hannibal & Lawrence, 1995). Documentation collected by the PHR is successful only as much as the use that is made of it. In the case of the Bosnia Project, PHR handed over the documentation consisted of various reports, lists, memos, forms, correspondence, photographs, videos, and maps (HU OSA 386, 1997-1999). Holdings of the HU OSA 386 collection consist of the three projects: Ante Mortem Data Base Project, the Identification Project, and the Forensic Assistance Project. The com- plete documentation is divided into three series: the Identification Project, Forensic As- sistance Project, and Administrative Records (HU OSA 386, 1997-1999). Most of the docu- ments are textual, but there are also photographs and 21 videotapes that are digitized. In the contract signed between the representatives of the PHR and OSA in 2004, in the section regarding the use of materials, there are two distinct categories of content: (1) Basic categories: “all photos, videos… shall be open for research without restriction”; Finding Reports… open for research without restriction; Process Reports… under re- straint for a period of 5 years from their creation. Other materials shall be used accord- ing to the provisions of European Law; (2) Other categories (materials relating to graves, financial records, autopsy reports, DNA materials, postmortem database, materials cre- ated by other agencies) “shall be restricted until Donor (PHR) has reviewed and classi- fied them, but not exceeding two years from the date of signature of this Agreement; LIMITS OF CONFIDENTIALITY: ARGUMENTS FOR AND AGAINST DISCLOSING DOCUMENTS CONTAINING PERSONAL DATA IN ARCHIVAL HOLDINGS: PHYSICIANS FOR HUMAN RIGHTS CASE STUDY TIJANA RUPČIĆ 159 whereafter the Materials shall be subject to OSA’s General Restriction Policy2 and Hun- garian and European Union legal norms for handling personal data.”3 To question what data is considered personal and sensitive and which should be dis- closed for research in the case of the PHR Bosnia Project collection, I will analyze each series separately. 4 IDENTIFICATION PROJECT Inside this PHR collection series, there are records of two projects carried out by the PHR representatives: the Antemortem Database Project and the Identification Project. As previously mentioned, Antemortem Database contains the information with the de- scriptions of the missing person in great detail, which the relatives provide in a series of conducted interviews. The Identification Project is in the same sequence as matching the evidence gathered during the exhumation of the mass graves in Bosnia and Her- zegovina. These two projects are connected, and that is why they are part of the same series. From the beginning of the exhumation in Bosnia, two things were very trans- parent: exhumed bodies were male, most of them similar in age and statue, and only a few of those bodies had any identification documents. Because of this forensic team suggested that another project is needed (Keough, Kahn & Andrejevic, 2000). Thus, they launched the Antemortem Data Project. They obtained a detailed descrip- tion of the missing persons: their clothing, physical characteristics, medical history, and personal belongings when their disappearance. All this information was provided by relatives, friends, and acquaintances of the missing persons. Information gathered was then compared with the postmortem data collected from the autopsy reports. Finally, if everything aligned and matched, identification would be conducted thoroughly (ibid.). In the Identified Project series, there are five sub-series. In the identified cases, folders contain details on individuals that are successfully identified in this project. For exam- ple, in the folder HU OSA 386-1-1:2/2, there is information concerning the identified in- dividual – Salihović Sadet.4 In the legal framework, a deceased person’s data is not con- sidered personal data anymore, but, as in the case of Sadet Salihović, there is data that belongs to the surviving relatives. Inside the folder, there is information provided by his family members regarding the previously mentioned details such as clothing, personal objects, last interactions, and distinctive marks. In addition to this information, there is postmortem information obtained during the autopsy and forensic observation. There are several details concerning the sensitive personal data that are alarming in this fold- er. Information on the Salihović Sadet description is indeed sensitive personal data but is provided for a particular purpose. Given the fact that the data describing Salihović is gathered for the sake of identifying his remains, I see no reason for keeping this infor- mation restricted for the use of scientific research. Similar to the case of the information contained in the Yad Vashem databases (The Central Database of Shoah Victims’ Names, s.d.), personal data regarding the victims of the genocide should be disclosed for the sake of remembrance. 2 OSA General Restriction Policy is divided in two sorts: General restrictions and Specific restrictions. Gen- eral restrictions are regarding access applied to more than one group of materials and apply to certain kinds of material that can be found in various collections. The specific restriction is ones that are speci- fied by the donor or are applicable only on a certain collection or a part of it (Access Policy, s.d.). 3 Contract between PHR and OSA, 2004. 4 HU OSA 386-1-1:2/2, Records of the Physicians for Human Rights’ Bosnia Projects: Identification Project: Identified Cases; Open Society Archives at Central European University, Budapest. LIMITS OF CONFIDENTIALITY: ARGUMENTS FOR AND AGAINST DISCLOSING DOCUMENTS CONTAINING PERSONAL DATA IN ARCHIVAL HOLDINGS: PHYSICIANS FOR HUMAN RIGHTS CASE STUDY TIJANA RUPČIĆ 160 This identification project is essential not only for the closure offered to the missing fam- ilies but also for the collective memory. It gave back the name to Selihović Sadet (and many others), where before there was just an identification number. An identification number and the name are two different things because, in my opinion, ID numbers offer only sterile facts. In contrast, the term has a whole person attached to it, and this person had a family, job, hobbies, and many other different things that are worth remember- ing. Therefore, a person deserves to be recognized by their name, not just a number giv- en by the forensic specialist. On the other hand, these folders contain sensitive personal information about the families of the deceased. Names of the family members should not be disclosed; they consent to stand behind their name and surname while giving these interviews. The difficult part is that besides names, there are addresses and phone numbers attached to the people providing this information. Many of these phone numbers are still functional5 and should not be dis- closed for the researchers or any public use, as they are now. Besides, according to the OSA General Restriction Policy and GDPR guidelines (General Data Protection Regula- tion, 2019, Art. 9), such information should be restricted at all times unless they are to be used for legal purposes. In the sub-series List of Missing Persons, there is information on the missing persons (mostly lists containing the names of the missing and their relatives), there are as well the names of the people with whom the representatives of the PHR had contacts on the territory of the Bosnia and Herzegovina which provided the logistics and helped in com- piling these lists.6 Data contained in these folders is partially personal, but it can be dis- closed for public use because it harms no one. Information regarding the persons who provided the logistics is public even though they were doing public service at the time, and PHR had obtained permission from the Bosnian authorities on the highest level.7 Next, there are sub-series Tracing Requests containing the forms with the information about the requests’ applicators with their names, addresses, and phone numbers.8 Again, same as the parts of the Identified cases sub-series, such character’s personal data should be restricted from public use. Furthermore, data contained in sub-series Interviews and Questionnaires is of the gener- al character: names of the missing person and the interviewed relative, date of birth of the missing, and the place where the interview was conducted.9 There is no reason for this data to be restricted for use. There are various personal data concerning the DNA reports, forensic reports, and au- topsy forms filled by Tall Simons10 in the sub-series Medical Reports. There is a broad debate on the data connected to DNA and genetic material. In the strictest sense, DNA is one of the most sensitive personal data that individuals can provide. DNA contains the personal data of the genetic characteristic of the person (Parsons et al, 2019). In the 5 A quick search on the internet, and one can find people very easily; e.g. On-line Telephone Book of Bos- nia and Herzegovina (s.d.). 6 HU OSA 386-1-2:1, 386-1-2:2, 386-1-2:3, 386-1-2:4, 386-1-2:5; 7 HU OSA 386-1-2:1/6; 8 HU OSA 386-1-3:1; Identification Project: Tracing Requests. 9 HU OSA 386-1-4:1/4 Interviews and Questionnaires: Questionnaires from Sarajevo, 1998 – 1999. 10 Tal Simmons received her A.B. in Anthropology from Bryn Mawr College, her M.A. in Paleopathology and Funerary Archaeology from the University of Sheffield, and her Ph.D. in Anthropology from the Univer- sity of Tennessee. Simmons worked in the field for the non-government organization Physicians for Hu- man Rights (PHR) as director of the Forensic Monitoring Project in Tuzla, Bosnia. She is currently a forensic anthropology consultant, undertaking casework for the OCME in the Central and Tidewater districts of Virginia as well as for various international human rights NGO’s. LIMITS OF CONFIDENTIALITY: ARGUMENTS FOR AND AGAINST DISCLOSING DOCUMENTS CONTAINING PERSONAL DATA IN ARCHIVAL HOLDINGS: PHYSICIANS FOR HUMAN RIGHTS CASE STUDY TIJANA RUPČIĆ 161 legal framework of the GDPR, genetic data is recognized as sensitive personal data and falls under the fold of the personal data related to the healthcare context (Recital 34: Genetic Data, s.d.). In the case of the PHR Medical Reports, this is also a bit sensitive and complicated. If we take that DNA is one of the most sensitive personal data, then part of these reports should be restricted for the researchers. On the other hand, original DNA samples are not present, and the series contains only textual statements regarding the matching tests. If used for scientific research (both in humanities and natural sciences), reports can be disclosed for public use. Other documentation in this sub-series contains the per- sonal correspondence between the PHR representatives and the forensic experts in the US. The data controller organization did not put these documents under any restriction to be fully disclosed for public use. There is information on the local authorities’ representatives where the refugees from Srebrenica were located in the sub-series Collective Centers (HU OSA 386-1-6:1/1, 1996). A significant part of the personal data contained here is not of restricted character. It refers to the public servants and people who were official representatives of the NGOs (Red Crescent). The only data that could be considered for the particular restriction are documents containing the testimonies of informants providing the details on how Serbian army was involved in the exhumation of the mass graves in efforts to cover its crimes (HU OSA 386-1-6:1/4, 1996-1997). There are some photocopies of the families of the missing photographs where they hold the photos of their loved ones, but they are of terrible quality. They cannot be used for the identification of people photographed (HU OSA 386-1-6:1/1, 1996). 5 THE FORENSIC ASSISTANCE PROJECT The next series in the collection of the PHR is the Forensic Assistance Project. While the An- temortem Database Project and the Identification Project were concentrated on identify- ing the mass graves surrounding the Srebrenica massacre, the Forensic Assistance Project was involved in mass grave sites throughout Bosnia Herzegovina. In sub-series named Administrative files, we can find personal data related to the autop- sy reports of the conducted exhumations and the people present on the exhumation sites. The usage of these reports should be open to the public because all the parties involved gave their consent to be identified as present.11 However, there is information contained in various CVs of applicants for the offered jobs, and those should be, in my opinion, restricted usage. Persons who ended up getting the job should be recognized, but parts of the CVs containing more sensitive personal data (address, phone number, etc.) should be restricted. Furthermore, there are photographs of the exhumation sites and the recovered bodies in the sub-series of Findings, along with the full autopsy reports. Similar to the Medical Reports, data contained in this series can be considered as sensitive personal data.12 Be- cause this project was related to identifying the missing people and the reasons, I men- tioned already concerning the importance of the name of the person that perished in such circumstances, I think this data should remain disclosed for the research. Only one folder in series is marked by the creator as restricted because of its confidential status - Bučići Recovery Report 1998 (HU OSA 386-2-2:2/9, 1998). 11 HU OSA 386-2-1:1/8; 386-2-1:2/6; Forensic Assistance Project: Administrative Files. 12 HU OSA 386-2-2:1/1, 386-2-2:2/16, 386-2-2:3/14, 386-2-2:4/9; Forensic Assistance Project: Findings. LIMITS OF CONFIDENTIALITY: ARGUMENTS FOR AND AGAINST DISCLOSING DOCUMENTS CONTAINING PERSONAL DATA IN ARCHIVAL HOLDINGS: PHYSICIANS FOR HUMAN RIGHTS CASE STUDY TIJANA RUPČIĆ 162 Inside the sub-series, Consultation Reports and Recovery Documentation Reports contain information about the exhumation sites. These series are very similar and include pho- tographs from the exhumation sites. The pictures on their own can be considered per- sonal data are given that on many of those photos, people present at the site are visible. If provided only photographs, one cannot distinguish much more than just the person’s face, race, or ethnicity. However, knowing the situation’s delicacy, these photographs can be considered sensitive personal data and reconsidered to be put in restriction sta- tus. It is not clear, but in some of these photographs, maybe we can find some of the locals or informants who perhaps did not give their consent for their face (and therefore the identity) to be visible.13 The last part of this series, Maps Relating to the Forensic Assistance Project, contains pho- tocopies of the PHR representatives’ topographic maps to excavate the mass graves. Maps are, in general, considered sensitive data. Still, given that these maps were al- ready published by the original creator (Defense Mapping Agency of the United States of America), they are not to be considered for the disclosure (HU OSA 386-2-6:1/1, 1996). 6 ADMINISTRATIVE RECORDS Finally, as the last part of the collection of PHR, there is a series containing the Admin- istrative Records.14 Inside these series, there are various documents divided into several sub-series. Most of the data collected here are created for public purposes. The rest can be disclosed to the public (unless stated otherwise by the data creator) to research how the PHR organized, functioned, and conducted during these projects. For the purposes of this discussion, the sub-series Personnel and Employment can be considered to hold sensitive personal data. Inside these series, we can find the information on the various internships, applications for the position of interviewers, numerous CVs, and the book of contacts, which the representatives of the PHR used.15 Again, specific personal data contained here can be restricted because people mentioned in these documents did not know that their information can end up as a case study of the researchers. 7 CONCLUSION Sensitive personal data can be found anywhere, from the range of the biomedical re- search field to the social or linguistic sciences. Research data can contain any personal, sensitive, or confidential information. For scientific research purposes, data about peo- ple, even if it is susceptible, can be shared in a legal framework through anonymization, informed consent, or restricted access control. In the case of the PHR, the situation is more complicated. This data was collected in the first place and can be used as an argu- ment for and against the disclosure of sensitive personal data. According to the OSA General Access Policy, most documents (except for a few) contained in this collection are available for the user to both Hungarian and foreign citizens. I provided examples and arguments about why some data that is available could be restricted. Also, some data could be considered restricted at some point, and I explained why it should nev- er be restricted (Identification cases). In the case of personal data which should be restrict- ed (information on the families of the missing, CVs, and other resumes), people who are exposed by the open access perhaps did not consider the possibility that their data will be available to the open public so this aspect could be reconsidered for the restriction. 13 HU OSA 386-2-4; Forensic Assistance Project: Recovery Documentation Reports. 14 HU OSA 386-3, Administrative Records. 15 HU OSA 386-3-5, Administrative Records: Personnel and Employment. LIMITS OF CONFIDENTIALITY: ARGUMENTS FOR AND AGAINST DISCLOSING DOCUMENTS CONTAINING PERSONAL DATA IN ARCHIVAL HOLDINGS: PHYSICIANS FOR HUMAN RIGHTS CASE STUDY TIJANA RUPČIĆ 163 One solution to the problem of sharing sensitive personal data is to make open access to the metadata. In this way, it is possible to restrict access to the parts that contain sensi- tive data, which is not deemed appropriate for sharing with the open public. Another solution is, as previously mentioned, anonymization of both data and metada- ta or restricted access or committees granting the permissions for the usage of the data. Such users would be identified and would have to sign individual consent containing the conditions of use of the sensitive data. Protection of sensitive data is particularly needed when addressing wars or armed con- flicts, as is the case with the PHR case study. Such sensitive data should be handled with special care and consideration for protecting the interviewed people’s identity. Finally, an archivist can make an ethical judgment on whether some sensitive personal data should be disclosed or not. In my personal praxis as an archivist, I once practiced this and decided to put parts of the Funds of the Magistrate of Nagy Kikinda under re- striction even though they were not considered sensitive data in the legal framework.16 16 Case of the rape testimony of a 13 years old girl and mug shots of the gang of thieves from the end of 19th and beginning of 20th century because they had living relatives in Kikinda. LIMITS OF CONFIDENTIALITY: ARGUMENTS FOR AND AGAINST DISCLOSING DOCUMENTS CONTAINING PERSONAL DATA IN ARCHIVAL HOLDINGS: PHYSICIANS FOR HUMAN RIGHTS CASE STUDY TIJANA RUPČIĆ 164 REFERENCE LIST Access Policy. (s.d.). Vera and Donald Blinken Open Society Archives. http://www.osaar- chivum.org/about-us/policies/access-policy Brunborg, H., Lyngstad, T.H., and Urdal, H. (2003). Accounting for genocide: How many were killed in Srebrenica? European Journal of Population, 19, 229–248. Cammilleri-Subrenat, A. and Levallois-Barth, C. (2007). Sensitive Data Protection in the European Union. Buxelles: Bruylant. General Data Protection Regulation (GDPR). (2019, September 2). Intersoft News. https:// gdpr-info.eu/ Guibault, L. and Wiebe, A. (eds.). 2013. Study on the protection of research data and recom- mendations for access and usage. Göttingen: Universitätsverlag Göttingen. Hannibal, K. and Lawrence, R. S. (1995). The health professional as human rights pro- moter: ten years of physicians for human rights (USA). Health and Human Rights, 2(1), 112–127. Keough, M. E., Kahn, S. and Andrejevic, A. (2000). Disclosing the Truth: Informed Partici- pation in the Antemortem Database Project for Survivors of Srebrenica. Health and Human Rights, 5(1), 68–87. On-line Telephone Book of Bosnia and Herzegovina. (s.d.). BH Telecom. https://www. bhtelecom.ba/index.php?id=7226& Parsons, T. J., Huel, R. M. L., Bajunović, Z. and Rizvić, A. (2019). Largescale DNA identifi- cation: The ICMP experience. Forensic Science International: Genetics, 38, 236–244. Recital 34: Genetic Data. (s.d.). Intersoft Consulting. https://gdpr-info.eu/recitals/no-34/ The Central Database of Shoah Victims’ Names. (s.d.). Yad Vashem online database. https:// yvng.yadvashem.org Weibe, A. and Dietrich, N. (2017). Study on legal barriers to open data sharing. Göttingen: Universitätsverlag Göttingen. ARCHIVAL RECORDS: HU OSA 386 Records of the Physicians for Human Rights’ Bosnia Projects, 1997-1999, Open Society Archives at Central European University, Budapest. http://hdl.han- dle.net/10891/osa:b9e6110d-b739-451a-bc67-c13cb3b382af HU OSA 386-1-6:1/1 Identification Project: Collective Centers: Banovici Municipality, 1996, Open Society Archives at Central European University, Budapest. HU OSA 386-1-6:1/4 Identification Project: Collective Centers: Tuzla Municipality 1, 1996- 1997, Open Society Archives at Central European University, Budapest. HU OSA 386-1-6:1/1 Identification Project: Collective Centers; Banovici Municipality, 1996, Open Society Archives at Central European University, Budapest. HU OSA 386-2-2:2/9 Forensic Assistance Project: Findings; Bučići Recovery Report (Swedish Forensic Team), 1998, Open Society Archives at Central European University, Budapest. HU OSA 386-2-6:1/1; Forensic Assistance Project: MapsRelating to the Forensic Assis- tance Project: Topographic Maps: 2353 I - 2585 IV [Western Part of Bosnia and Her- zegovina], 1996, Open Society Archives at Central European University, Budapest. Typology: 1.01 Original scientific research LIMITS OF CONFIDENTIALITY: ARGUMENTS FOR AND AGAINST DISCLOSING DOCUMENTS CONTAINING PERSONAL DATA IN ARCHIVAL HOLDINGS: PHYSICIANS FOR HUMAN RIGHTS CASE STUDY TIJANA RUPČIĆ