Editorial archives

Journals provide long-term archiving for researchers’ published articles. However, these are not the only documents produced during the scientific publication process. Each publication is peer-reviewed, which involves exchanges between the reviewers and the authors. What happens to these documents after publication? How long should a magazine keep them on file to protect itself against any recourse? How to store them? Can they be deleted? What should be done with the personal data contained in these documents?

In the absence of a specific legal text, we will try here to provide practical answers to these questions by looking at both the RGPD and archive management issues.

Archive life cycle

Personal data

Exchanges between the publisher, the reviewers and the authors contain personal data: surnames, first names and e-mail addresses in most cases. As such, these documents are covered by the Règlement Général sur la Protection des Données (RGPD), a French law on data protection.

To find out more, see our article on personal data processing policy.

Life cycle

According to the CNIL and the Direction générale des Patrimoine, in their Guide pratique : les durées de conservation:

The life cycle of a dataset can be divided into three successive phases:

• Current use (‘active base’): this stage concerns the current use of personal data by the services responsible for implementing their processing. In practical terms, this corresponds to the files used daily. The data is accessible, in the immediate working environment, by all those in charge of day-to-day operations.
• Intermediate archiving: personal data is no longer used to achieve the set objective (‘closed files’) but is still of administrative interest to the organisation (e.g. management of any litigation, etc.) or must be kept to meet a legal obligation (e.g. invoicing data must be kept for ten years under the French Commercial Code, even if the person concerned is no longer a customer). The data can then be consulted on an ad hoc basis by specifically authorised persons.
• Final archiving: this refers to data that is archived indefinitely. This phase only concerns processing carried out for archival purposes in the public interest. This last phase essentially concerns the public sector subject to the requirements of Book II of the French Intellectual Property Code.

Thus, in our case, the current use of personal data contained in evaluation reports corresponds to the article evaluation phase, when the journal needs to exchange information with the reviewers.

Intermediate archiving corresponds to the period when the journal is likely to face litigation. In this case, the journal team will need access to the evaluation reports and the different versions of the article.

Final archiving is possible when there is no longer any risk of claims – or when this risk can be considered negligible.

What the law says

Guidelines for managing research archives

Theréférentiel de gestion des archives de la recherche(guidelines for managing research archives), drawn up by the Association des Archivistes Français and recommended by the CNRS for document conservation, are based on the following texts:

• Book II of the Code du patrimoine.
• Décret N° 79-1037 du 3 décembre 1979 modifié concerning the competence of public archive services and cooperation between administrations for the collection, preservation and communication of public archives.
• Instruction DPACI/RES/2005/003 of 22 February 2005 on the sorting and conservation of archives received and produced by departments and establishments involved in national education.
• Instruction DAF/DPACI/RES/2007/002 of 15 January 2007 on the processing and conservation of the archives of CNRS delegations and the archives of research and service units.
• Prime Minister’s circular of 2 November 2001 on the management of archives in the State’s public services and establishments (NOR : PRMX 0105139C)

It is intended as a guide and provides advice on how to handle and preserve ‘the archives of research laboratories, researchers and teacher-researchers in universities, research bodies and health agencies’.

For example, prooevaluation reports are included in the ‘Scientific production: dissemination of results > Communication of results and preparation of publications (books, articles, etc.)’ section:

• T: Sorting, i.e. destruction or deposit in archives.
• C: Final storage in the archives, with a receipt of deposit drawn up.

A period of 10 years has been set for documents that may be useful in the event of legal action, based on the French statute of limitations:

– Statute of limitations for ‘public prosecution of crimes’ set at 10 years, with the exception of 20 years for crimes committed against minors, which runs from the age of majority (article 7 of the Code of Criminal Procedure).

– Civil prescription period: ‘Liability claims arising from an event causing bodily injury, brought by the direct or indirect victim of the resulting damage, are prescribed by ten years from the date of consolidation of the initial or aggravated damage’ (article 2226 of the Civil Code).

RGPD

What’s more, evaluation reports and the various author documents contain personal data (first and last names of authors and reviewers, emails, affiliations, etc.) and must therefore comply with the General Data Protection Directive (RGPD). The journal must therefore justify the storage of this data and define a legal storage period.

Defining a storage period

For example, the research archive management guidelines recommend that documents used to prepare a publication should be kept for 10 years. This corresponds to the intermediate archiving period. This period is indicative and the journal is therefore able to decide on a different storage period.

Then there is the question of final archiving: what should be done after the 10 years of intermediate archiving?

Analysis grid

If the journal itself wishes to define the storage period for evaluation reports and correspondence between authors, reviewers and the publisher, it is necessary to examine the context, the law, the use of the document, its interest, etc. in order to determine the most appropriate treatment.

The document from the CNIL and the Direction générale des Patrimoine, the Guide pratique: les durées de conservation, contains an analysis grid for identifying the applicable storage periods. This summarises all the questions to ask when determining the period applicable to a processing operation.

This grid looks at the different stages of archiving and the context in which data processing takes place.

Questions to consider

The CNIL article Les durées de conservation des données (Data retention periods) provides a list of questions to ask when determining storage periods:

• ‘How long do I really need the data to achieve my objective?
• Do I have any legal obligations to keep data for a certain period of time?
• Do I need to keep certain data to protect myself in the case of a dispute? Which ones?
• How long can I take legal action?
• What information needs to be archived? For how long?
• What are the rules for deleting data?
• What are the rules for archiving data?

We can also add, in relation to the RGPD :

• Have I obtained non-anonymous consent from reviewers and authors to put review reports online?

In practice, what can be done?

Publication of reports

Some journals have decided to make their evaluation reports public. They are then published on the article page and stored under the same conditions.

Archiving and/or destruction

During intermediate archiving, documents must be accessible quickly. You also need access to the personal data they contain: names of reviewers, name of the author, etc.

At the end of the intermediate archiving period, what should be done with these documents?

• if it is considered that the limitation period has been exceeded, the documents can be deleted.
• if you wish to keep them for the history of the journal:

– deposit documents in a database and make them accessible after anonymisation (Data.gouv.fr, Zenodo, Nakala…)

– store documents on a secure server, without anonymising the data,