The Alma Mater Studiorum – University of Bologna (hereinafter "UNIBO") has launched the research project "PubSynth – UNIBO use-case" in line with the University's Strategic Plan 2022–2027, particularly with reference to objectives aimed at ensuring quality and transparency of all information inside and outside the university community, facilitate the development of open science, simplifying processes—including through digital transformation—and improving the quality of shared research facilities, equipment and infrastructure. The research is conducted by the Department of Economics and is funded by the project "GRINS - Growing Resilient, Inclusive and Sustainable" - for which UNIBO is the HUB-financed by the PNRR in the area of economic-political-social sciences and data sciences. The goal of the GRINS project is to provide evidence to guide public policies, as well as the decisions of citizens and businesses in complex decision-making contexts, contributing to more resilient, inclusive, and sustainable national growth.
The project aims to:
- use the technology provided by AINDO - patented and certified by Europrivacy™/® - to generate synthetic data referring to cross-sectional and longitudinal data of interest for monitoring, planning, managing, and improving the services offered to UNIBO students (pilot cases);
- develop, in collaboration with AINDO, an innovative technology that enables integration between synthetic datasets (pilot case);
- with reference to both use cases, evaluate outcomes in terms of: fidelity - i.e., the ability of synthetic data to replicate patterns observed in real data; utility - i.e., the ability to reproduce statistical analysis results on synthetic data comparable to those on real data; protection against risks of unintentional disclosure of personal data; computation time and scalability, i.e., the potential to extend this approach to other case studies. Concerning the risks of unintentional disclosure of personal data, similarity metrics will be used to ensure that no "leak" of information from the original data is present in the synthetic data.
The project as a whole may provide significant benefits: a) directly to those involved (e.g., by identifying dropout risk factors and guiding corrective and support measures); b) to the University and students, by providing feedback on the effectiveness of policies supporting access to university education; c) by offering families useful insights into the different characteristics of educational pathways in terms of disciplinary and transversal skills; e) to the national and international scientific community, by building an integrated database useful for research activities, with controlled access in compliance with national and European privacy regulations, using cutting-edge technologies for the protection of personal data (such as synthetic data).
Pursuant to Article 13 of Regulation (EU) 2016/679 (General Data Protection Regulation), it is noted that Alma Mater Studiorum - University of Bologna is the Data Controller and will process personal data in compliance with the requirements of Regulation (EU) 2016/679 (General Data Protection Regulation) and Legislative Decree No. 196 of June 30, 2003, as amended and supplemented (Personal Data Protection Code).
Entities involved in data processing
- Data Controller
Alma Mater Studiorum – University of Bologna. Registered office: Via Zamboni no. 33, 40126 - Bologna, Italy; E-mail: privacy@unibo.it; PEC: scriviunibo@pec.unibo.it - Data Protection Officer (DPO) of Alma Mater Studiorum – University of Bologna
Registered office: Via Zamboni no. 33, 40126 - Bologna, Italy; E-mail: dpo@unibo.it; PEC: scriviunibo@pec.unibo.it - Data Processor
Data Processor: AINDO S.p.A. for anonymization activities using synthesis techniques as part of the project "PubSynth" funded by UNIBO SPOKE 0 PE GRINS of the program – GRINS – GROWING RESILIENT, INCLUSIVE AND SUSTAINABLE (code PE0000018 CUP: J33C22002910001). Call 341/2022 "Extended partnerships between universities, research centers, and companies for the funding of basic research projects."National Recovery and Resilience Plan (NRRP), Mission 4 "Education and Research" – Component 2 "From Research to Business" – Investment 1.3, funded by the European Union – NextGenerationEU – Cascade Call SPOKE 0 AND 2 for the use case described above.
Purpose and methods of processing
For the implementation of the study, personal data - in particular administrative and survey data related to students enrolled at UNIBO from the academic year 2012/2013 to the most recent available year, as well as data concerning academic performance and surveys on graduates' profiles and employment status 1, 3, and 5 years after graduation - will be extracted from the University's digital archives.
These data will be processed by authorized University staff, who will replace all identifying information with a unique, consistent code for each individual, and subsequently communicate the data—only in pseudonymized form—to AINDO. The research team (the scientific lead and other specifically authorized researchers involved in the project) and AINDO will never have access to identifying data (e.g., name, surname, etc.) of the participants. Under no circumstances will the data be processed by authorized personnel for the sole purpose of identifying participants.
Personal data may be sent to third parties who, as Data Processors under Article 28 of Regulation (EU) 2016/679, support the Data Controller in the management of the University's IT systems and services.
Pseudonymized data extracted and stored for this research will be recorded, processed, and retained only for the time necessary to validate the synthetic data.
The synthetic data produced—anonymous and certified—will be stored indefinitely by the University for research purposes consistent with the above-mentioned objectives.
Data may only be disseminated in strictly anonymous and aggregated form, for example through scientific publications, statistics, and conference presentations.
Legal basis for processing and nature of data provision
The legal basis for such processing is found in Article 6(1)(e) (processing carried out in the public interest) of Regulation (EU) 2016/679 and Article 2-ter of Legislative Decree no. 196/2003 as amended.
Furthermore, the following resolution was adopted by the Board of Directors: no. 183430 dated 28/06/2022, which approved the University's Strategic Plan 2022–2027.
The data collected by the University is considered necessary for the achievement of the purposes, without prejudice to the data subject's right to object to data processing at any time by contacting the University using the details provided.
Data subject rights
Without prejudice to the limitations to the exercise of data subject rights under Articles 2-undecies and 2-duodecies of the Personal Data Protection Code (Legislative Decree 196/03), the data subject may exercise the rights recognized under Articles 15–21 of Regulation (EU) 2016/679, including the right to request access to their personal data, rectification or erasure of such data, restriction of processing, and objection to processing.
Requests to exercise these rights may be submitted to the Data Controller by contacting the Department using the information provided on the following page: https://dse.unibo.it/it/dipartimento/contatti.
Requests may also be sent to: grins.pubsynth@unibo.it.
These rights can be exercised only before the generation of synthetic data, since from that moment onward, the synthetic data will no longer be attributable to identifiable individuals.
If the data subject believes that their personal data is being processed in violation of Regulation (EU) 2016/679 or Legislative Decree 196/03 as amended, they have the right to file a complaint with the Italian Data Protection Authority, as provided by Article 77 of the Regulation, or to pursue appropriate legal remedies (Article 79 of the Regulation).
Right to object
The data subject may declare that they do not wish to take part in the research project, for which data processing will begin on 20 June 2025, by exercising their right to object at any time, as outlined above. All the aforementioned rights may only be exercised before the synthetic data are generated, as from that point onward the data will no longer be attributable to identifiable individuals.