united-kingdom gdpr european-union academia
Does the GDPR apply to reference managers?
<p><a href="https://en.wikipedia.org/wiki/Reference_management_software" rel="nofollow noreferrer">Reference managers</a> are software products that record the details of scientific papers that one interacts with.  All academics and many others use them as a crucial tool of their work.  Common examples are Zotero and EndNote.  Ones reference manager database is usually viewed as a possession of the individual rather than the employer.</p>
<p>They record the details of the papers you have read, including details of the authors, such as their names, employer and for the corresponding authors the contact details.  All this information is publically available, one is required to release this data to publish in peer reviewed journals and the reference managers collate it all at the click of a button when one is viewing the document.</p>
<p>I can think of no reason why the GDPR would not apply to reference managers, therefore I would assume it does.  While I would also assume that the legitimate interest basis for processing would allow one to use such software, one would have to consider the requirements that the GDPR places on the processing of data, perhaps the time or export constraints.</p>

<h2><a href="https://gdpr-info.eu/art-2-gdpr/" rel="nofollow noreferrer">Yes</a></h2>
<blockquote>
<ol>
<li><p>This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.</p>
</li>
<li><p>This Regulation does not apply to the processing of personal data:</p>
</li>
</ol>
<ul>
<li><p>in the course of an activity which falls outside the scope of Union law;</p>
</li>
<li><p>by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU;</p>
</li>
<li><p>by a natural person in the course of a purely personal or household activity;</p>
</li>
<li><p>by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.</p>
</li>
</ul>
</blockquote>
<p>Names are personal data and reference managers are a filing system.</p>
<p>This doesn’t mean that you can’t keep such information in such a database. It just means that you must comply with the GDPR when doing so.</p>
