DNA_methylation_pancreas

Policy adapted from: A European standardization framework for data integration and data-driven in silico models for personalized medicine – EU-STANDS4PM Harmonised Data Access Agreement (hDAA) for Controlled Access Data Stamatina Liosi (UCL), Stephan Beck (UCL)

Table of Content Section I: Contact and Project Information Section II: harmonised Data Access Agreement (hDAA) Terms and Conditions Agreement   Section I: Contact and Project Information A. Data Recipient (including contact details) Please ensure that a full postal address and a valid Institutional email address are included Name: Institution’s Legal Name: Institutional Postal Address: Institutional E-mail Address: Website of the Institution: B. Authorised Representative of the Data Recipient Name: Position: Affiliation: Institutional Postal Address: Institutional E-mail Address: C. Data Controller(s) (including contact details) Please ensure that a full postal address and a valid Institutional email address are included Name: Institution’s Legal Name: University Hospital Duesseldorf Institutional Postal Address: Institute of Pathology Heinrich-Heine-University of Duesseldorf Moorenstr. 5 40225 Duesseldorf Institutional E-mail Address: Irene.Esposito@med.uni-duesseldorf.de Website of the Institution: www.uniklinik-duesseldorf.de/pathologie D. Authorised Representative of the Data Controller(s) Name: Position: Head/Deputy Head Legal Department Institutional Postal Address: Stabsstelle Recht und Compliance, Moorenstr. 5, 40225 Duesseldorf, Germany Institutional E-mail Address: recht-forschung@med.uni-duesseldorf.de E. Title of the Proposed Research Project F. Research Project (Scientific Abstract): Please provide a clear description of the Project, its stakeholders, its main question and its relevance to the research domain addressed, its specific aims, and duration. Note that any use of the Data, if approved, must fall under the framework of the described Project (300 words max): G. Research Credentials Please provide a list of three Publications, relevant to the Project description, of which the Data Recipient is author or co-author, and, also, attach their (Data Recipient’s) short CV. If the Data Recipient has not authored or co-authored three relevant Publications, please describe their relevant expertise or experience in no more than 150 words; also, notify how the research project will be carried out (e.g. available funding, infrastructure and so on). Section II: harmonised Data Access Agreement (hDAA) Definitions GDPR: This hDAA makes both parties compliant with the Regulation (EU) 2016/679 of the European Parliament and of the Council, that is, the General Data Protection Regulation (herein referred to as the ‘GDPR’). Data: Refers to controlled access data (the Data). Under this Agreement, the Data is pseudonymised. Data Access/Transfer: Refers to an Institution’s right to request access to the Data and retrieve them from the Data Controller’s Institution upon approval of this hDAA by the corresponding DAC within the Data Controller’s Institution. Data Handling: Refers to an Institution’s ability to analyse and manipulate the Data within its own computer network. Data Controller(s): Refers to an Institution, responsible for the generation of the Data and its pseudonymisation. A key-code permitting relinkage to Data Subjects is kept by the Data Controller(s). Data Subject: Refers to any individual who is the source of any Data covered by this Agreement. Data Recipient (‘You’): Refers to the Institution who requests Access to the Data through this Agreement. Authorised Personnel: The individual(s) at the Institution requesting Access to the Data. Research Project: The Project for which You have requested Access to the Data. Publications: Refers, without limitation, to any and all articles published in print journals, electronic journals, reviews, books, posters, and other written and verbal presentations of Research that have been accepted by peer review. EU-STANDS4PM: This hDAA was developed by the EU-STANDS4PM, http://www/eu-stands4pm.eu/ Terms and Conditions In signing this Agreement: 1. You, the Data Recipient, agree to only use the Data for the Purpose of the Project. 2. You agree to preserve, at all times, the confidentiality of information and Data pertaining to Data Subjects. You undertake not to use or attempt to use the Data to compromise or otherwise infringe the confidentiality of information on Data Subjects and their right to privacy. You agree to protect the confidentiality of Data Subjects in any research papers or publications that You prepare by taking all reasonable care to limit the possibility of identification. 3. You agree not to attempt to identify Data Subjects. You agree not to link or combine these Data to other information or archived data available in a way that could re-identify the Data Subjects, even if access to that data has been formally granted to the User Institution or is freely available without restriction. 4. You and your Authorised Personnel agree to take into consideration any usage restrictions (if any), stemming from consent, i.e. the appropriate lawful basis for processing the Data, as well as any usage restrictions stemming from any applicable internal policies of your Institution. 5. You agree that in handling this Data You will follow an up-to-date information technology (IT) policy that must include, at a minimum, the following items: a. Logging and auditing of Access to the Data and to the computer network; b. Password protection to computer network and/or strong data encryption; c. Virus and malware protection to computers on the computer network; d. Secure backup procedure; 6. You acknowledge that Access to the Data is granted for the duration of the Project described in Section I, as well as any new Project under the same research field or area. Any use of the Data for a Project of another research field or area will need to be approved under a new Agreement. 7. You recognize that nothing in this Agreement shall operate to transfer to You any intellectual property rights to the Data. 8. You agree not to make intellectual property claims on the Data and not to use intellectual property protection in ways that would prevent or block Access to, or use of, any element of the Data. 9. You can elect to perform further Research that would add intellectual and resource capital to the Data, and decide to obtain intellectual property rights on these downstream discoveries. In this case, You agree to implement licensing policies that will not obstruct further Research, following the Organisation for Economic Co-operation and Development Guidelines. 10. You agree that the Data Controller a) makes no warranty or representation, express or implied as to the accuracy, quality or comprehensiveness of these Data; b) excludes to the fullest extent permitted by law all liability for actions, claims, proceedings, demands, losses (including but not limited to loss of profit), costs, awards damages and payments made by Third Parties that may arise (whether directly or indirectly) in any way whatsoever from Your use of these Data or from the unavailability of, or break in access to, these Data for whatever reason and; c) bears no responsibility for the further analysis or interpretation of these Data. 11. You agree to hold the Data Subject(s) and Data Controller(s) harmless and to defend and indemnify all these parties against all liabilities, demands, damages, expenses, and losses arising out of Your use for any Purpose of the Data. 12. You agree to a moratorium on publishing global analyses of the dataset until the Data Controller(s) have published their own global analysis or twelve (12) months, the maximum, have passed from the time the Data were deposited, whichever occurs first. You acknowledge that prompt publication or public disclosure of the results of the Research Project is encouraged. You also agree that by publishing Your global analyses of the Data, you will not disclose any results generated from the Data. 13. You agree to acknowledge the contribution of the Data Controller(s) in all oral and written presentations, disclosures, and Publications resulting from all analyses of the Data. 14. You agree to use the Data only in Your laboratory. Any Authorised Personnel shall work under Your direct supervision. You agree to distribute a copy of these terms to the Authorised Personnel and ensure that they have acknowledged its terms in writing and are subject to respective confidentiality obligations. 15. You may not transfer any information included in the Data to anyone unless specifically designated in the Research Project, or by prior specific or general written authorisation of the Data Controller(s) responsible for the generation of the original Data in each case. 16. You may not transfer the Data itself to anyone outside the Institution, unless the Controller(s) has (have) approved such transfer and its terms in writing. 17. Should You wish to share the Data with an external collaborator, the external collaborator must complete a separate Data Access Agreement. 18. You shall ensure that ‘all’ who have Access to the Data, namely You and Your Authorised Personnel, will be listed out, and are made aware and be bound by the terms of this Agreement. You remain solely and fully responsible for Your Authorised Personnel’s non-compliance with the provision of the Agreement and/or applicable laws. 19. In case of a breach of security resulting from ‘accidental’ use of Data by You and Your Authorised Personnel, which leads to disclosure of Data, then You must report this to Data Controller(s) within 24 hours maximum, and follow any relevant rule as provided by the GDPR. 20. In case of a ‘non-accidental or minor’ breach of hDAA by You You will further be required to destroy any Data held. 21. You accept that this Agreement will terminate immediately upon ‘any’ breach by You, or its termination (see Section I). 22. You endeavour to settle any dispute with the Data Controller(s) amicably. If you are unable to reach an Agreement, you will meet and negotiate in good faith in an effort to resolve the issue. If the issue has not been resolved within a reasonable period (e.g. 30 calendar days), you are both entitled to submit it your claim to the competent courts pursuant to sec. 23. 23. This Agreement (and any dispute, controversy, proceedings, or claim of whatever nature arising out of it or its formation) shall be interpreted, governed by and construed in accordance with the Laws of the Federal Republic of Germany excluding its provisions on conflict of laws, and shall be subject to the exclusive jurisdiction of the competent courts in Duesseldorf, Germany.   Agreement I have read, understood and agree to abide by the terms and conditions stipulated in this Data Access Agreement. Data Recipient or Authorised Representative of the Data Recipient: Name: Title and position (if applicable): Affiliation (if applicable): Signature: _____________________________________Date: _____________________ Data Controller(s) or Authorised Representative of the Data Controller(s): Name: Title and position (if applicable): Head/Deputy Head Legal Department Signature: _____________________________________Date: ______________________