Data and privacy responsibilities
The Global Centre for Risk and Innovation (GCRI) handles several kinds of data: research data from sources and partners, records about people who take part in the programme, information from website users and enquirers, and operational records. Each carries its own rights and responsibilities. This page explains, in plain terms, who is responsible for what and how rights are respected. The formal notice for this website is the privacy notice, and GCRI Canada is its controller. This page is part of trust and accountability.
- 01InstitutionThe Global Centre for Risk and Innovation (GCRI)
- 02Service levelR0: information and enquiries
- 03In briefThe short answer
- 04Four kinds of dataDifferent data, different responsibilities
- 05PrinciplesHow rights are respected
- 06Key termsTerms used on this page
- 07Your rightsAccess, correction and concerns
GCRI · Institution · service level R0
The short answer.
Data and privacy responsibilities at GCRI cover four kinds of data: research data from sources and partners, records about programme participants, information from website users and enquirers, and operational records. Responsibility follows the purpose for which data is held, and the page explains who answers for what and how to exercise rights.
Report to outcome.
Fig.How a reported error is reviewed and corrected. Design, not a record.
Digital demand and connectivity in the Gulf.
Urban demand centres and the hubs that anchor digital and data infrastructure, shown for the Gulf as an example geography for this subject.
Different data, different responsibilities.
Responsibility follows the purpose for which data is held, and that purpose limits how it is used.
| Data | Examples | Key responsibility |
|---|---|---|
| Research data | Observations, statistics, model inputs from sources and partners | Source rights and limitations persist; original source authority is retained |
| Participation records | Records about institutions, leaders and experts in programmes | Used for the programme they relate to, under its terms |
| User and enquiry data | Messages sent to GCRI and website use | Used to answer the enquiry and keep a record of it; never used for marketing |
| Operational records | Security logs, agreements, accounts | Kept as required for operation, security and legal obligations |
How rights are respected.
Used for what it was given for
Data is not repurposed beyond the purpose stated when it was collected or agreed.
No cross-institution sharing
GCRI, GRF and GRA each have their own notice and controller. Enquiries are not shared across institutions.
Protected knowledge stays protected
Protected community and Indigenous knowledge never enters public examples or model training.
Terms used on this page.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Personal data | Any information relating to an identified or identifiable natural person, directly or indirectly, such as a name, an identification number, location data or an online identifier, as the EU General Data Protection Regulation defines it. |
| Data controller | The person or body that decides the purposes and means of processing personal data and answers for that processing under data protection law, in the GDPR's definition. |
| Purpose limitation | The principle that data collected for one purpose should not be used for incompatible purposes. |
| Data minimisation | Collecting and keeping only the personal data needed for a stated purpose. |
Access, correction and concerns.
You can ask what personal information GCRI Canada holds about you, ask for it to be corrected and raise a concern about how it is handled. Requests go to the Interim Privacy Officer of GCRI Canada at privacy@therisk.global. The acknowledgement gives a reference and names the next step.
National programmes keep their own agenda, data and decision rights. The Global Risks Forum and The Global Risks Alliance have their own notices, for example GRF privacy.
Questions and answers.
Who is responsible for my personal data on therisk.global?
Is my enquiry shared with GRF or GRA?
How is research data about places or communities protected?
Where are the formal terms?
Around GCRI.
Start with an enquiry.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.