Average_5mC_Roadmap_chromatinStates

EGA DATA ACCESS AGREEMENT [TEMPLATE] 2021.3.25

Following template policy will be updated to conform to current legislation upon data access request EGA DATA ACCESS AGREEMENT [TEMPLATE] (“Agreement”) This Agreement is made effective on its last date of signature by and between the following parties: University of Helsinki (“UH”), [FACULTY / UNIT] Business ID: FI0313471-7 Address: Yliopistonkatu 3 (P.O. Box 4) 00014 University of Helsinki, Finland and; [NAME OF RECIPIENT] (“User Institution”) Business ID / similar: [ADD NUMBER] Address: [ADD ADDRESS] The terms and conditions of this Agreement govern access to the managed access datasets (the details of which are set out in Appendix 1) to which User Institution has requested access. User Institution agrees to be bound by the terms and conditions of this Agreement. Definitions “Authorized Personnel” The individuals at User Institution to whom UH grants access to Data, including the User, the individuals listed in Appendix 2 and any other individuals for whom the User Institution subsequently requests access to Data. Details of the initial Authorized Personnel are set out in Appendix 2. “Controller” As defined in Article 4(7) GDPR. “Data” The managed access datasets to which the User Institution has requested access as specified in Appendices 1 and 2. “Data Producers” UH and the collaborators listed in Appendix 1 responsible for the development, organization, and oversight of these Data. “External Collaborator” A collaborator of the User, working for an institution other than the User Institution. “GDPR” EU General Data Protection Regulation (2016/679). “Personal Data” Personal Data as defined in GDPR Article 4(1) that is included in Data. “Personal Data Breach” A breach of User Institution’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed by User Institution. “Project” The project for which User Institution has requested access to Data, the description of which is provided in Appendix 2. “Publications” Includes, without limitation, articles published in print journals, electronic journals, reviews, books, posters and other written and verbal presentations of research. “Research Participant” An individual whose data form part of these Data, including that individual’s Personal Data. “Research Purposes” Non-commercial research conducted in the public interest that seeks to advance the understanding of genetics and genomics, including the diagnosis, treatment and monitoring of disorders, as well as work on statistical methods that may be applied to such research. Non-commercial research as meant above does not include research: that is conducted or commissioned by, or on behalf or for the sole benefit of, a commercial entity; that is conducted with the primary motivation of generating: i) profit or ii) data or intellectual property rights to be used to generate such profit; or in which the results are not at any stage intended to be presented in Publications due to commercial considerations. Notwithstanding the above, non-commercial research includes research in which the primary motivation is to further public interest as detailed above, but in which commercial considerations arise (e.g. intellectual property rights are generated and commercialized) as a byproduct of the research. “User” The principal investigator for the Project at the User Institution. Use of Data by User Institution User Institution agrees to only use Data: for the sole purpose of conducting the Project (described in Appendix 2); solely within that Project; for Research Purposes; and subject to the limitations (if any) set out in Appendix 1. User Institution agrees only to transfer or disclose Data, in whole or part, or any material derived from Data, to Authorized Personnel. User Institution shall not share Data with an External Collaborator. For clarity, an External Collaborator’s may only access Data subject to that External Collaborator completing a separate application and entering into a separate data access agreement with UH. User Institution agrees to permanently destroy the Data held, once it is no longer used for the Project, unless obliged to retain the Data for archival purposes in conformity with audit or legal requirements. Confidentiality & Prohibition of Re-identification User Institution shall preserve, at all times, the confidentiality of these Data in the manner specified in this Article 3. In particular, it undertakes not to use, or attempt to use Data to disclose or compromise information pertaining to Research Participants, unless otherwise provided in this Agreement. User Institution shall ensure the confidentiality of Data by using measures that are at least equivalent to those by which User Institution protects its own confidential information. Without prejudice to the generality of the foregoing, User Institution agrees to use at least the measures set out in Appendix 1 to protect these Data. User Institution shall protect the confidentiality of any information relating to Research Participants in any research papers or Publications by undertaking best reasonable measures to limit the possibility of both direct and indirect identification of Research Participants. User Institution shall not link or combine these Data with other information or archived data available in a way that could result in the re-identification of Research Participants, even if access to such additional data has been formally granted to the User Institution or is freely available without restriction. GDPR Compliance User Institution acknowledges that upon receipt of Data that includes or constitutes Personal Data, User Institution constitutes a party that has determined the means and purposes of the processing of such Personal Data. IF THE USER INSTITUTION IS LOCATED WITHIN AN EEA COUNTRY: User Institution shall constitute a Controller of the Personal data and shall comply with all Controller obligations provided in the GDPR, including but not limited to complying with the data protection principles, information obligations, rights of Research Participants as data subjects and other general obligations of a Controller pursuant to GDPR Articles 24-27 and 30-31 (as applicable). IF THE USER INSTITUTION IS NOT LOCATED WITHIN AN EEA COUNTRY BUT IN A COUNTRY WITH A VALID ADEQUACY DECISION: User Institution shall comply with all obligations provided in their national legislation that are applicable to the equivalent to a Controller under the GDPR and in the manner specified in the EU Commission’s applicable adequacy decision, including but not limited to complying with the data protection principles, information obligations, rights of Research Participants as data subjects and other general obligations equivalent to those of a Controller under the GDPR. IF THE USER INSTITUTION IS NOT LOCATED WITHIN THE EEA NOR A COUNTRY WITH AN ADEQUACY DECISION: As a Controller, User Institution shall comply with the terms and conditions set out in the Controller-Controller Standard Contractual Clauses appended to this Agreement as Appendix 4. In case of discrepancy between the provisions of Appendix 4 and any other document included in this Agreement and/or its appendices, the provision included in Appendix 4 shall prevail. The Parties acknowledge that User Institution’s use Personal Data in the Project is for Research Purposes alone. Further, such use is compatible with the purposes for which the Data was originally collected by Data Producers in a manner which: has a strong link between the original purpose and the use of such Data in the Project, as both are conducted for Research Purposes; is compatible with the context in which the Personal Data was collected, as the Research Participants have been informed of the possibility of their Personal Data being used for further Research Purposes; Is in line with the reasonable expectations of Research Participants; Takes into account the nature of the Personal Data; Does not cause marked risks or harm to Research Participants in terms of the consequences of processing of Personal Data by User Institution; and Is subject to pseudonymization and other applicable safeguards in both the original purposes for which the Personal Data were collected and the Project. Consequently, if the User Institution is subject to the provisions of the GDPR, the Parties acknowledge that the User Institution’s processing of Personal Data in the Project constitutes compatible use (as provided in GDPR Article 6(4)) and therefore User Institution does not require a separate basis for processing Personal Data (as meant in GDPR Articles 6(1) and 9(2)) in the Project. Upon UH’s request, User Institution shall without undue delay provide UH with additional information pertaining to the processing of Personal Data in the Project in order to allow UH to comply with its obligations as the original Controller of Personal Data. In such an eventuality, the information to be provided by User Institution to UH consists of, at a minimum, the information specified in GDPR Articles 13, 14 and 30(1) (as applicable). UH or its representative may at any moment inform User Institution of a Research Participant withdrawing their participatory consent or exercising their rights as a data subject under the GDPR. User Institution shall perform all reasonable actions specified by UH in order to fulfil the rights of the Research Participant. In the event of a Personal Data Breach, User Institution shall, after having become aware of such Personal Data Breach, notify UH of the Personal Data Breach without delay from becoming aware of it. Such notification shall be made in writing and additionally by any other reasonable and prompt manner (e.g. by phone). Publications The User Institution agrees to follow the Publication Policy provided in Appendix 3.1. This includes respecting the moratorium period for the Data Producers to publish the first peer-reviewed report describing and analyzing these Data. User Institution agrees to follow the Toronto Statement (as attached in Appendix 3.2) and the Fort Lauderdale Guidelines (as attached in Appendix 3.3). This includes but is not limited to recognizing the contribution of the Data Producers and including a proper acknowledgement in all reports or publications resulting from the use of these Data. Intellectual Property Rights User Institution agrees that it shall not make or attempt to make any intellectual property claims on these Data and not to use intellectual property protection in ways that would prevent or block access to, or use of, any element of these Data. Within the context of the Project’s Research Purposes, User Institution may perform research that would add intellectual and resource capital to these Data and decide to obtain intellectual property rights on these downstream discoveries and inventions. User Institution shall own such intellectual property rights. However, User Institution agrees to implement licensing policies that will not obstruct further non-commercial research activities, with such policies conforming with the Organisation for Economic Co-operation and Development Guidelines for the Licensing of the Genetic Inventions (2006) (as appended as Appendix 3.4.). Liability, Representations & Warranties User Institution assumes all liability for damages, actions, claims, proceedings, losses (including but not limited to loss of profit), costs, awards damages and payments made by User Institution that may arise (whether directly or indirectly) in any way whatsoever from User Institution’s use, storage or disposal of these Data, or from the unavailability of or break in access to these Data for whatever reason. For clarity, UH is not liable to User Institution for any loss, claim or demand made by User Institution, or made against the User Institution by any third party, arising from the use, storage or disposal of Data. User Institution acknowledges that Data Producers, and all other parties involved in the creation, funding or protection of Data: make no warranty or representation, express or implied, as to the accuracy, quality or comprehensiveness of these Data; bear no responsibility for the further analysis or interpretation of these Data. Notwithstanding the above, User Institution is not responsible for claims arising from or related to the gross negligence or willful misconduct of UH or its officers, agents or employees. Notification Obligations User Institution shall notify UH within 30 days of any changes or departures of Authorized Personnel. User Institution shall notify UH prior to any significant changes to the protocol for the Project. User Institution shall promptly notify UH should it become aware of a breach of the terms or conditions of this Agreement. User Institution shall distribute a copy of these terms to the Authorized Personnel. User Institution is responsible for ensuring that the Authorized Personnel comply with the terms of this Agreement. Termination Either Party may terminate this Agreement for any reason by providing thirty (30) days prior written notice to the other Party. If this Agreement terminates for any reason, User Institution shall destroy any Data held, including copies and backup copies. User Institution accepts that it may be necessary for the Data Producers to alter the terms of this Agreement from time to time. In the event that changes are required, Data Producers or their appointed agent will contact User Institution to inform it of the changes and User Institution may elect to accept the changes or terminate the Agreement. Any such changes are be implemented upon execution of a signed amendment to this Agreement. Inspections If requested, upon advance written notice, and to the extent necessary, during mutually agreeable normal administrative business hours User Institution will allow UH to inspect User Institution’s data security and management documentation (either physically or electronically, as decided by UH) to verify that User Institution is complying with the terms of this Agreement. UH shall schedule such inspections in coordination with User Institution. Inspections are subject to compliance with User Institution’s reasonable measures for confidentiality, safety and security, and are also be subject to compliance with generally applicable premises rules at User Institution (if applicable). Applicable Law & Dispute Settlement This Agreement (and any dispute, controversy, proceedings or claim of whatever nature arising out of this Agreement or its formation; hereinafter “Dispute”) is construed, interpreted and governed by the laws of Finland. All Disputes between the Parties in connection to this Agreement shall be first discussed in good faith between the Parties in order to try to find an amicable solution. Any Dispute which cannot be solved amicably within 90 days of commencement of negotiations shall be subject to the exclusive jurisdiction of the Finnish courts. Signatures This Agreement may be executed in counterparts, each and every one of which are deemed an original and all of which together constitute one and the same instrument. Each Party may execute this Agreement in Adobe Portable Document Format (PDF) sent by electronic mail, reliable electronic signature service providers (e.g., DocuSign) or as otherwise agreed between the Parties. PDF and/or electronic signatures of authorized signatories of the Parties are deemed to be original signatures, are valid and binding upon the Parties, and, upon delivery, constitute due execution of this Agreement. UNIVERSITY OF HELSINKI Signature:   Name:   Title:   Date:   UH PRINCIPAL INVESTIGATOR I confirm that I have read and understood this Agreement. Signature:   Name:   Title:   Date:   [THE REMAINDER OF THIS PAGE REMAINS BLANK USER INSTITUTION SIGNATURES ON FOLLOWING PAGE] USER INSTITUTION: [ADD NAME OF USER INSTITUTION] Signature:   Name:   Title:   Date:   USER I confirm that I have read and understood this Agreement. Signature:   Name:   Title:   Date:   APPENDICES: APPENDIX 1. Dataset Details APPENDIX 2. Project Description APPENDIX 3. Additional Requirements 3.1. Publication Policy 3.2. Toronto Statement 3.3. Fort Lauderdale Guidelines 3.4. OECD Guidelines for the Licensing of Genetic Inventions IF APPLICABLE: APPENDIX 4. STANDARD CONTRACTUAL CLAUSES, CONTROLLER - CONTROLLER