Data Protection and Intellectual Property

Data Protection
 

Data protection is a field of law regulating the processing of personal data. In the Republic of Estonia, data protection is governed by the following legal acts:
·      the General Data Protection Regulation (GDPR) 2016/679 – a directly applicable regulation across the EU;
·      the Estonian Personal Data Protection Act (IKS)
 

Personal data refers to any information relating to a natural person. A natural person can be identified directly or indirectly on the basis of characteristics such as name, personal identification code, location data, online identifiers, or physical, genetic, mental, economic, cultural, or social attributes. Data that has been anonymised in a manner that makes identification impossible is no longer considered personal data; anonymisation must be irreversible.
NB! A legal person does not have personal data.

Under the GDPR, any individual is considered a data processor if they process data for purposes other than personal ones and not within the scope of their professional or commercial activity.  

Processing personal data means any operation performed on personal data or data sets, including collection, documentation, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, transmission, dissemination or making available in any way, alignment or combination, restriction, erasure, or destruction. The processing of personal data lasts from the moment the data is obtained until it is destroyed and includes all activities in between.
NB! You are already processing personal data if you merely view, possess, or store such data.

• Example: A person (X) has personal data about their friends (name, date of birth, gender, education level, email address, phone number, home address, hobbies, and preferences). If X uses this data solely for personal purposes (arranging meetings, communication, greetings, giving gifts, etc.), X is not considered a data processor under the GDPR, and GDPR/IKS does not apply. However, if X uses their friends’ personal data for a study required as part of their academic work, GDPR/IKS applies, and X is considered a data processor.

Thus, if students plan to conduct activities involving personal data within a LIFE project (e.g., studies, surveys, questionnaires) and the data is not processed anonymously, the activity constitutes personal data processing. In such cases, GDPR applies, and students carry the resulting obligations and responsibilities.
 

Students and supervisors should critically assess whether personal data processing is truly necessary within the LIFE project. If it is determined that processing personal data is essential, students must understand that this entails GDPR obligations (e.g., providing information to data subjects, collecting and storing consent forms, ensuring the secure storage of collected data, preventing unauthorised access) and responsibility, including potential penalties for non-compliance. In such situations, neither the supervisor nor Tallinn University is responsible for the personal data, responsibility lies solely with the students.

For example, if a student wishes to conduct a personalised study in which processing personal data is essential and the research objectives cannot be achieved using anonymised data, the student must obtain consent from the participants. It is important to note that in the context of personal data processing, mere awareness is not sufficient; explicit consent for data processing is required. Consent must be obtained in accordance with the requirements stated in GDPR Articles 7 and 8. Students must also understand the general principles of data protection (GDPR Article 5) and ensure that the processing complies with these principles.
In some cases, studies require approval from the Tallinn University Ethics Committee. This approval must be obtained before the study begins (including before collecting consent). You can find more information on when approval is needed here: https://www.tlu.ee/en/ethics-committee-tallinn-university
Only the supervisor may submit an application to the Ethics Committee based on materials prepared by the students and must guide students in following the committee’s decision.

Tallinn University employees may contact the data protection specialist (liana.iila@tlu.ee) with general questions. (the specialist does not advise on LIFE projects specifically but assists with explaining the university’s data protection rules and general principles.)

---

Intellectual Property

In the course of carrying out LIFE projects, intellectual property is created. This may include various texts, photographs, videos, audio recordings, computer programs, performances of works, website designs, design solutions, trademarks, know-how, and more.

Most of these outputs are protected by copyright. Copyright arises automatically at the moment a protectable work is created. Some outputs, such as trademarks or industrial designs, receive effective legal protection through registration with the Estonian Patent Office. Intellectual property rights are exclusive rights, meaning that the owner has the exclusive authority to use the created output and to permit or prohibit its use by others.

LIFE projects may result in different types of outputs protected by intellectual property rights, and the rules governing ownership may vary. Most commonly, outputs protected by copyright are created, in which case copyright belongs to the author, that is, the creator of the work. For certain types of outputs, however, ownership is regulated differently by law, for example in the case of audiovisual works, databases, or phonograms. Ownership of rights is determined by law, Tallinn University regulations, and contracts, and must be established on a case-by-case basis based on these documents.

The main legal acts regulating intellectual property in Estonia include the Copyright Act, the Industrial Designs Protection Act, the Patents Act, the Utility Models Act, and the Trademarks Act.

For outputs created within the ELU course, the provisions of Tallinn University’s Rules for the Protection of Intellectual Property concerning student works apply. Copyright to student works belongs to the student. The student is responsible for the quality of the work carried out in the LIFE project and for its compliance with relevant requirements.

Agreements concerning the ownership of intellectual property in project outputs, the transfer of economic rights, or licensing arrangements must be concluded between the relevant parties. Preparing and entering into such agreements is the responsibility of the student or the supervisor (e.g., when the supervisor has contributed creatively or otherwise in a way that gives rise to intellectual property rights), together with the project partner. The university becomes a contracting party and participates in the conclusion of such agreements only if the university intends to acquire rights related to the project for the fulfilment of its institutional objectives. Decisions regarding the acquisition of economic rights or the licensing of moral rights are made by the member of the Rectorate responsible for the structural unit seeking to acquire said rights. For digital content, it is possible to grant usage rights under open content licences, such as Creative Commons licences.

If you wish to transfer the economic rights of intellectual property, contact the LIFE coordinator (elu@tlu.ee) to obtain contract templates.

The student must ensure compliance with third-party intellectual property rights when carrying out a LIFE project. This means, among other things, that the student must verify whether the use of works created by others within the LIFE project has a legal basis or requires permission or a licence. Likewise, if a product or service created during the project is to be designated with a trademark, it is necessary to check beforehand that no identical or confusingly similar earlier trademark has been registered for the same or similar goods or services. If, in the course of a LIFE project, a student or supervisor infringes intellectual property rights belonging to others and/or a claim is filed due to such infringement, the responsible party will be the student and/or supervisor whose actions gave rise to the claim.