COIN_CRC_GWAS

Data Access Policy (April 2021)

Human genetic data access agreement for institutions (the “Agreement”) This AGREEMENT is entered into on the last date of signature below and made between: (1) THE INSTITUTE OF CANCER RESEARCH: ROYAL CANCER HOSPITAL, whose registered address is 123 Old Brompton Road, London SW7 3RP, UK, (the “ICR”) and (2) [Legal name of recipient institution] whose registered address is [insert address] (the “Recipient”). WHEREAS A. Further to the data access application dated [ ] attached to this Agreement as Appendix 1 (the “Application”), the Recipient has requested the Data in order to carry out the Research (as such terms are defined below). B. The work will be carried out under the supervision of the Recipient’s Principal Investigator, [ ] (the “Recipient Principal Investigator”) C. In response to the Recipient's request for access to the Data, ICR and the Recipient agree as follows: 1. Definitions “Data” shall mean all and any pseudonymised human genetic data obtained from the MPG-ICR including the Data Subjects’ age, sex and tumour pathology. Explicitly, Data does not include samples or biological materials; “Data Protection Legislation” means all applicable data protection and privacy legislation in force from time to time in the UK including the General Data Protection Regulation ((EU) 2016/679); the Data Protection Act 2018; the Privacy and Electronic Communications Directive 2002/58/EC (as updated by Directive 2009/136/EC) and the Privacy and Electronic Communications Regulations 2003 (SI 2003 No. 2426) as amended; any other European Union legislation relating to personal data and all other legislation and regulatory requirements in force from time to time which apply to a Party relating to the use of Personal Data (including, without limitation, the privacy of electronic communications). “Data Subjects” as such term is defined in Data Protection Legislation; “Intellectual Property” means (i) patents, designs, copyright and related rights, database rights, know-how and confidential information; (ii) all other intellectual property rights and similar or equivalent rights anywhere in the world which currently exist or are recognised in the future; and (iii) applications, extensions and renewals in relation to any such rights; “Molecular and Population Genetics research at ICR” (“MPG-ICR”) shall mean research undertaken in the Molecular and Population Genetics team at ICR; “Personal Data” as such term is defined in Data Protection Legislation. “Registered User” shall mean the Recipient Principal Investigator or a Researcher that is employed by the Recipient and is bound by confidentiality and non-use obligations in respect of Data. For the avoidance of doubt, “Registered User” may also include students, visiting academics, contractors, sub-contractors or independent consultants provided that any such individual is bound by confidentiality and non-use obligations no less onerous than those binding the Recipient. “Research” shall mean research that is more accurately described in the Application, seeking to advance the understanding and treatment of cancer and closely related diseases, and work on statistical methods that may be applied to such research; “Term” means [please insert] “Researcher(s)” shall mean an individual or individuals carrying out Research under the direct supervision of the Recipient Principal Investigator. 2 Purpose and Term The Recipient agrees to use Data only during the Term for the non-commercial Research purposes as described in the Application under the direct supervision of the Recipient Principal Investigator. 3 Confidentiality Recipient will not disclose the Data to any person except as authorised hereunder or required by law or a competent authority. The Recipient agrees to preserve, at all times, the confidentiality of Data. In particular, the Recipient undertakes not to use, or attempt to use the Data to deliberately compromise or otherwise infringe the confidentiality of information on Data Subjects and their right to privacy. 4 Data Protection Option 1 (For use when data access request originates from UK, EU or an ‘Adequate’ Country): 4.1 The Recipient warrants that it, and its Registered Users, shall perform its obligations under this Agreement in accordance with the Data Protection Legislation, or other standards and requirements of [insert adequate country e.g. Japan] privacy and personal information protection laws and regulations. The Recipient and its Registered Users understand their duties under such legislation in relation to the handling of Personal Data and the rights of Data Subjects. 4.2 The Parties acknowledge and agree that the Data may contain Personal Data and that each Party will be an independent ‘controller’ for the purposes of its compliance with the obligations set out in Chapter 4 of the Data Protection Act 2018. 4.3 The ICR and Recipient, where applicable, will rely on Articles 6(1)(e) and 9(2)(j) GDPR for the lawful sharing and processing of Personal Data. 4.4 The Parties each agree to provide each other with such assistance as is reasonably required with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators and to enable each Party to comply with requests from Data Subjects to exercise their rights under the Data Protection Legislation within the time limits imposed by the Data Protection Legislation. 4.5 The Recipient shall not retain or process Data shared under this Agreement for longer than is necessary to carry out the Purpose. OR Option 2 (For use when data access request originates from ‘non-adequate’/Third Countries under EU law): 4.1 The Parties agree that the transfer of Data to the Recipient and the Recipient’s subsequent use and storage of the Data shall be subject to the additional standard contractual clauses and additional conditions set forth in Schedule 1 and its annexes which are attached to this Agreement. 4.[2 or 6] The Recipient agrees that it, and its Registered Users, shall not analyse or make any use of the Data in such a way that has the potential to: (a) lead to the identification of any Data Subject; or (b) compromise the anonymity of any Data Subject in any way. 5 Access, Governance and Security 5.1 The Recipient agrees that it shall take all reasonable security precautions to keep the Data confidential; to guard against unauthorised or unlawful processing of the Data; and to prevent accidental loss or destruction of, or damage to, the Data. Such precautions to be no less onerous than those applied in respect of the Recipient’s own confidential information. 5.2 The Recipient agrees to only give access to Data, in whole or part, or any identifiable material derived from the Data, to a Registered User. The Recipient agrees that Registered Users are bound by obligations no less restrictive than those set forth herein. The Recipient further agrees that it accepts full liability for any breach of this Agreement by its Registered Users. 5.3 The Recipient agrees that it shall only give Registered Users that are not Researchers (including but not limited to students or new researchers to the field) access to the Data if they are supervised by a Recipient Principal Investigator. 5.4 If Recipient suspects or becomes aware of any actual or threatened breach in respect of any Data which it processes, it shall inform ICR and shall promptly provide (to the extent permitted by applicable law) sufficient information and assistance as the ICR (or its advisors) reasonably requires to meet any obligations to report a breach under applicable Data Protection Legislation (in a timescale which facilitates such compliance). Recipient shall send communications under this clause 5.4 to: dataprotectionofficer@icr.ac.uk 5.5 ICR reserves the right to request and inspect data security and management documentation to ensure the adequacy of data protection measures in countries that have no national laws comparable to that pertaining in the European Economic Area (EEA). 6 Errors The Recipient agrees to notify MPG-ICR team of any errors detected in the Data. 7 Data reissue The Recipient accepts that Data will be reissued from time to time, with suitable versioning. If Data is reissued at the request of sample donors and/or as the result of other ethical scrutiny, the Recipient agrees to destroy all earlier versions of the Data. 8 Intellectual Property 8.1 The Recipient recognises that nothing in this Agreement shall operate to transfer to the Recipient or its Registered Users any Intellectual Property rights in or relating to the Data. Recipient is obligated to refrain from filing applications or in other ways to seek proprietary rights and protection specifically related to the Data. 8.2 Recipient and its Registered Users shall have the right to develop Intellectual Property based on comparisons with their own data. The Recipient shall keep ICR informed of all results, inventions and developments (the “Results”) made through the Recipient’s use of the Data. Recipient shall retain title to any patent or other Intellectual Property rights in all Results made through the use of the Data, except to the extent the Results incorporate the Data. 8.3 Recipient agrees to grant to ICR a non-exclusive, fully paid up, worldwide, irrevocable, royalty-free license to use the Results and any Intellectual Property arising therefrom for academic research purposes. 8.4 Recipient shall promptly notify ICR of any Results (whether raw or summarized), documentation, reports, and other information recorded in any form that is generated in the performance of the Research by or on behalf of Recipient. 8.5 If any of the Results that incorporate, reference or relate to the Data are exploited commercially, the Recipient will grant the ICR a fair and reasonable equitable share of any revenues that accrue to the Recipient from such commercial exploitation, having regards to the significance (if any) of the contribution to the Results represented by ICR’s provision of the Data hereunder. 9 Publications 9.1 Should the use of the Data result in one or more scientific publication(s), the Recipient shall acknowledge in the publication(s) or presentation(s) that the Data was provided by ICR/MPG-ICR. If any publishable Results arise from the collaborative effort of the Recipient and ICR, then the publication of the study results shall be a joint publication between the Recipient and ICR. If so requested by ICR, Recipient will also declare in any such work that those who carried out the original analysis and collection of the Data bear no responsibility for the further analysis or interpretation of it by the Recipient. 9.2 Authorship will be determined in accordance with the International Medical Journal Editors (IMCJE) guidelines. Proper acknowledgement will be made to the individual team members of the MPG-ICR responsible for the generation of Data. The list of authors can be obtained by emailing Richard Houlston (Richard.Houlston@icr.ac.uk). This file contains details of authors, affiliations, potential conflicts of interest, open access requirements, acknowledgements and funding. 10 Termination of Agreement 10.1 This Agreement will terminate automatically upon any breach of the provisions of this Agreement by the Recipient which the Recipient has not remedied within thirty (30) days’ of a written notice from ICR specifying the alleged breach. 10.2 The Recipient accepts that the changing ethical framework of human genetic research may lead to: (i) alteration to the provisions of this Agreement, in which case the Recipient may accept such alterations or terminate this Agreement; or (ii) the withdrawal of this Agreement in extreme circumstances. 10.3 Either party shall have the right to terminate this Agreement with immediate effect upon giving written notice of termination to the other party. 10.4 In the event that this Agreement is terminated in accordance with this Clause 10, the Recipient shall return or permanently destroy all Data at the direction of MPG-ICR team. For the avoidance of doubt, upon termination by either party all rights acquired by the Recipient to the Data shall cease immediately. 11 Costs The Recipient acknowledges that ICR shall incur costs in providing the Data to the Recipient, including but not limited to administrative costs and the cost of obtaining appropriate data storage devices. 12 Legal statement 12.1 The Recipient acknowledges that ICR and all other parties involved in the creation, funding or protection of the Data: (a) make no warranty or representation, express or implied as to the accuracy, quality or comprehensiveness of the Data; and (b) makes no representations that the use of the Data will not infringe any patent or proprietary rights of third parties. 12.2 The Recipient assumes all liability for costs and damages, which may arise from the use, storage, or disposal of the Data by the Recipient. ICR will not be liable to Recipient for any loss, claim, or demand made by the Recipient, or made against Recipient by any third party, arising from the use or disclosure of the Data by the Recipient, except to the extent permitted by law when caused by the gross negligence or wilful misconduct of ICR. 12.3 Recipient shall indemnify the ICR for any liabilities, losses, demands, claims, damages, costs and expenses incurred which arise directly from or in connection with: (i) any accidental or unlawful destruction, loss, alteration of the Data by the Recipient; (ii) unauthorised or unlawful disclosure, access or use of the Data (iii) any use by or on behalf of Recipient of the Data for any purpose apart from the Purpose; (iv) any breach of this Agreement by Recipient, whether arising in negligence, contract or otherwise; and (v) to the extent permissible by law, any monetary penalty notice or other sanction imposed on ICR by the Supervisory Authority under the Data Protection Legislation as a result of the Recipient’s actions or omissions. 12.4 The Recipient understands that all the Data is protected by copyright and other intellectual property rights, such that duplication or sale of all of or part of the Data on any media is not permitted under any circumstances, except with the prior written consent of ICR. 13 Governing Law In the event of a dispute between the parties, the parties hereto agree that this Agreement shall be governed, construed and enforced by the laws of England, without regard to the conflicts of law rules and principles of such laws. 14 General 14.1. The Recipient shall not claim, infer, or imply ICR's endorsement of the Recipient's use of the Data, the Recipient as an institution or its personnel conducting research with the Data, or any resulting product(s). 14.2. Nothing in this Agreement shall be construed as creating a partnership, contract of employment or relationship of principal and agent between the parties hereto. 14.3. This Agreement contains the entire understanding between the parties hereto and supersedes all other negotiations, representations and undertakings in relation to the transfer of the Data. 14.4. Any change in the terms of this Agreement shall be valid only if the change is made in writing, agreed and signed by the parties hereto. 14.5. Except as permitted herein, no third party shall have any right to enforce any term of this Agreement. AGREED by the parties through their authorised signatories For and on behalf of ICR Authorised Signature: Name: Title: Date: For and on behalf of Recipient: Authorised Signature: Name: Title: Date: Read and Understood: Signature: ________________________________________ Recipient Principal Investigator: Dataset(s) requested: Email address: Date: Please send completed Agreements to: Brittany Rex The Institute of Cancer Research 15 Cotswold Road Belmont Sutton Surrey SM2 5NG Appendix 1: The Application [Optional] - Schedule 1 – SCCs for transfers to Third Countries.]