OCR
122 | Digital Media and Storytelling in Higher Education However, if there is a professional element - in the case of educational or research activities - the data protection rules apply. Processing is defined as any operation involving personal data such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use and disclosure, or making it available to the public (Article 4.2 of Regulation 2016/679 EU). In the case of research, the data controller is the researcher himself, and in the case of research carried out by a research organization, it is the organization. In the case of education, however, the situation is more complex. Suppose that a student made a digital story about his neighbors disease for a biology lesson and used the photos, findings, and videos of the person concerned. At first glance, it may seem that the student (or the parent, as we are talking about a minor) is the data controller. We may also assume that since the biology teacher reguested the task, he or she is the data controller. However, the guestion is not that simple. Since the recording is presented in the context of a classroom exercise, its storage, projection and other data processing is carried out by the educational institution. The teacher, as a public employee, is not acting on his or her own behalf, and thus is not the data controller; as it is actually the institution which is carrying out the educational activities. Complications can be avoided if the researcher-facilitator and/or the educational institution is careful to put an appropriate data protection framework in place before using DST. Data management should comply with data protection principles and rules such as accuracy, purpose limitation, and data minimization. Prior to the process, the participants - and in the case of minors, their parents — should be informed of the data management strategy and their (or their parents’) consent to the processing of their data should be sought. At the end of the DST process, participants should be informed of their data protection rights: the rights to information, access, rectification, erasure (right to be forgotten’), restriction of processing, portability, and objection, and automated decision-making. It is also worth paying particular attention to the fact that, where relevant, DST may also contain personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, health data or personal data concerning the sex life or sexual orientation of natural persons. The processing of such data may be lawful only under very strict conditions. Copyright and related rights Copyright issues are a clear issue in the use of DST, as creators use both their own and others content to create their digital stories. According to Section 9(1) of Act LXXVI of 1999 on Copyright, the author is entitled to all copyrights, both moral and property rights, from the creation of the work. All photographic and video recordings made by a natural person are