Myeloma methylation

• DS DUO:0000007 (version: 2019-01-07)disease specific researchThis data use permission indicates that use is allowed provided it is related to the specified disease.ModifiersMONDO:0009693
• NPUNCU DUO:0000018 (version: 2019-01-07)not for profit, non commercial use onlyThis data use modifier indicates that use of the data is limited to not-for-profit organizations and not-for-profit use, non-commercial use.
• PS DUO:0000027 (version: 2019-01-07)project specific restrictionThis data use modifier indicates that use is limited to use within an approved project.

Human genetic data access agreement for institutions (the “Agreement”)

Human genetic data access agreement for institutions (the “Agreement”) This AGREEMENT is entered into on the last date of signature below and made between: (1) THE INSTITUTE OF CANCER RESEARCH: ROYAL CANCER HOSPITAL, whose registered address is 123 Old Brompton Road, London SW7 3RP, UK, (the “ICR”) and (2) [Legal name of recipient institution] whose registered address is [insert address] (the “Recipient”). WHEREAS A. Further to the data access application dated [ ] attached to this Agreement as Appendix 1 (the “Application”), the Recipient has requested the Data in order to carry out the Research (as such terms are defined below). B. The work will be carried out under the supervision of the Recipient’s Principal Investigator, [ ] (the “Recipient Principal Investigator”) C. In response to the Recipient's request for access to the Data, ICR and the Recipient agree as follows: 1. Definitions “Data” shall mean all and any pseudonymised human genetic data obtained from the MPG-ICR including the Data Subjects’ age, sex and tumour pathology. Explicitly, Data does not include samples or biological materials; “Data Protection Legislation” means all applicable data protection and privacy legislation in force from time to time in the UK including the General Data Protection Regulation ((EU) 2016/679); the Data Protection Act 2018; the Privacy and Electronic Communications Directive 2002/58/EC (as updated by Directive 2009/136/EC) and the Privacy and Electronic Communications Regulations 2003 (SI 2003 No. 2426) as amended; any other European Union legislation relating to personal data and all other legislation and regulatory requirements in force from time to time which apply to a Party relating to the use of Personal Data (including, without limitation, the privacy of electronic communications). “Data Subjects” as such term is defined in Data Protection Legislation; “Intellectual Property” means (i) patents, designs, copyright and related rights, database rights, know-how and confidential information; (ii) all other intellectual property rights and similar or equivalent rights anywhere in the world which currently exist or are recognised in the future; and (iii) applications, extensions and renewals in relation to any such rights; “Molecular and Population Genetics research at ICR” (“MPG-ICR”) shall mean research undertaken in the Molecular and Population Genetics team at ICR; “Personal Data” as such term is defined in Data Protection Legislation. “Registered User” shall mean the Recipient Principal Investigator or a Researcher that is employed by the Recipient and is bound by confidentiality and non-use obligations in respect of Data. For the avoidance of doubt, “Registered User” may also include students, visiting academics, contractors, sub-contractors or independent consultants provided that any such individual is bound by confidentiality and non-use obligations no less onerous than those binding the Recipient. “Research” shall mean research that is more accurately described in the Application, seeking to advance the understanding and treatment of cancer and closely related diseases, and work on statistical methods that may be applied to such research; “Term” means [please insert] “Researcher(s)” shall mean an individual or individuals carrying out Research under the direct supervision of the Recipient Principal Investigator. 2 Purpose and Term The Recipient agrees to use Data only during the Term for the non-commercial Research purposes as described in the Application under the direct supervision of the Recipient Principal Investigator. 3 Confidentiality Recipient will not disclose the Data to any person except as authorised hereunder or required by law or a competent authority. The Recipient agrees to preserve, at all times, the confidentiality of Data. In particular, the Recipient undertakes not to use, or attempt to use the Data to deliberately compromise or otherwise infringe the confidentiality of information on Data Subjects and their right to privacy. 4 Data Protection Option 1 (For use when data access request originates from UK, EU or an ‘Adequate’ Country): 4.1 The Recipient warrants that it, and its Registered Users, shall perform its obligations under this Agreement in accordance with the Data Protection Legislation, or other standards and requirements of [insert adequate country e.g. Japan] privacy and personal information protection laws and regulations. The Recipient and its Registered Users understand their duties under such legislation in relation to the handling of Personal Data and the rights of Data Subjects. 4.2 The Parties acknowledge and agree that the Data may contain Personal Data and that each Party will be an independent ‘controller’ for the purposes of its compliance with the obligations set out in Chapter 4 of the Data Protection Act 2018. 4.3 The ICR and Recipient, where applicable, will rely on Articles 6(1)(e) and 9(2)(j) GDPR for the lawful sharing and processing of Personal Data. 4.4 The Parties each agree to provide each other with such assistance as is reasonably required with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators and to enable each Party to comply with requests from Data Subjects to exercise their rights under the Data Protection Legislation within the time limits imposed by the Data Protection Legislation. 4.5 The Recipient shall not retain or process Data shared under this Agreement for longer than is necessary to carry out the Purpose. OR Option 2 (For use when data access request originates from ‘non-adequate’/Third Countries under EU law): 4.1 The Parties agree that the transfer of Data to the Recipient and the Recipient’s subsequent use and storage of the Data shall be subject to the additional standard contractual clauses and additional conditions set forth in Schedule 1 and its annexes which are attached to this Agreement. 4.[2 or 6] The Recipient agrees that it, and its Registered Users, shall not analyse or make any use of the Data in such a way that has the potential to: (a) lead to the identification of any Data Subject; or (b) compromise the anonymity of any Data Subject in any way. 5 Access, Governance and Security 5.1 The Recipient agrees that it shall take all reasonable security precautions to keep the Data confidential; to guard against unauthorised or unlawful processing of the Data; and to prevent accidental loss or destruction of, or damage to, the Data. Such precautions to be no less onerous than those applied in respect of the Recipient’s own confidential information. 5.2 The Recipient agrees to only give access to Data, in whole or part, or any identifiable material derived from the Data, to a Registered User. The Recipient agrees that Registered Users are bound by obligations no less restrictive than those set forth herein. The Recipient further agrees that it accepts full liability for any breach of this Agreement by its Registered Users. 5.3 The Recipient agrees that it shall only give Registered Users that are not Researchers (including but not limited to students or new researchers to the field) access to the Data if they are supervised by a Recipient Principal Investigator. 5.4 If Recipient suspects or becomes aware of any actual or threatened breach in respect of any Data which it processes, it shall inform ICR and shall promptly provide (to the extent permitted by applicable law) sufficient information and assistance as the ICR (or its advisors) reasonably requires to meet any obligations to report a breach under applicable Data Protection Legislation (in a timescale which facilitates such compliance). Recipient shall send communications under this clause 5.4 to: dataprotectionofficer@icr.ac.uk 5.5 ICR reserves the right to request and inspect data security and management documentation to ensure the adequacy of data protection measures in countries that have no national laws comparable to that pertaining in the European Economic Area (EEA). 6 Errors The Recipient agrees to notify MPG-ICR team of any errors detected in the Data. 7 Data reissue The Recipient accepts that Data will be reissued from time to time, with suitable versioning. If Data is reissued at the request of sample donors and/or as the result of other ethical scrutiny, the Recipient agrees to destroy all earlier versions of the Data. 8 Intellectual Property 8.1 The Recipient recognises that nothing in this Agreement shall operate to transfer to the Recipient or its Registered Users any Intellectual Property rights in or relating to the Data. Recipient is obligated to refrain from filing applications or in other ways to seek proprietary rights and protection specifically related to the Data. 8.2 Recipient and its Registered Users shall have the right to develop Intellectual Property based on comparisons with their own data. The Recipient shall keep ICR informed of all results, inventions and developments (the “Results”) made through the Recipient’s use of the Data. Recipient shall retain title to any patent or other Intellectual Property rights in all Results made through the use of the Data, except to the extent the Results incorporate the Data. 8.3 Recipient agrees to grant to ICR a non-exclusive, fully paid up, worldwide, irrevocable, royalty-free license to use the Results and any Intellectual Property arising therefrom for academic research purposes. 8.4 Recipient shall promptly notify ICR of any Results (whether raw or summarized), documentation, reports, and other information recorded in any form that is generated in the performance of the Research by or on behalf of Recipient. 8.5 If any of the Results that incorporate, reference or relate to the Data are exploited commercially, the Recipient will grant the ICR a fair and reasonable equitable share of any revenues that accrue to the Recipient from such commercial exploitation, having regards to the significance (if any) of the contribution to the Results represented by ICR’s provision of the Data hereunder. 9 Publications 9.1 Should the use of the Data result in one or more scientific publication(s), the Recipient shall acknowledge in the publication(s) or presentation(s) that the Data was provided by ICR/MPG-ICR. If any publishable Results arise from the collaborative effort of the Recipient and ICR, then the publication of the study results shall be a joint publication between the Recipient and ICR. If so requested by ICR, Recipient will also declare in any such work that those who carried out the original analysis and collection of the Data bear no responsibility for the further analysis or interpretation of it by the Recipient. 9.2 Authorship will be determined in accordance with the International Medical Journal Editors (IMCJE) guidelines. Proper acknowledgement will be made to the individual team members of the MPG-ICR responsible for the generation of Data. The list of authors can be obtained by emailing Richard Houlston (Richard.Houlston@icr.ac.uk). This file contains details of authors, affiliations, potential conflicts of interest, open access requirements, acknowledgements and funding. 10 Termination of Agreement 10.1 This Agreement will terminate automatically upon any breach of the provisions of this Agreement by the Recipient which the Recipient has not remedied within thirty (30) days’ of a written notice from ICR specifying the alleged breach. 10.2 The Recipient accepts that the changing ethical framework of human genetic research may lead to: (i) alteration to the provisions of this Agreement, in which case the Recipient may accept such alterations or terminate this Agreement; or (ii) the withdrawal of this Agreement in extreme circumstances. 10.3 Either party shall have the right to terminate this Agreement with immediate effect upon giving written notice of termination to the other party. 10.4 In the event that this Agreement is terminated in accordance with this Clause 10, the Recipient shall return or permanently destroy all Data at the direction of MPG-ICR team. For the avoidance of doubt, upon termination by either party all rights acquired by the Recipient to the Data shall cease immediately. 11 Costs The Recipient acknowledges that ICR shall incur costs in providing the Data to the Recipient, including but not limited to administrative costs and the cost of obtaining appropriate data storage devices. 12 Legal statement 12.1 The Recipient acknowledges that ICR and all other parties involved in the creation, funding or protection of the Data: (a) make no warranty or representation, express or implied as to the accuracy, quality or comprehensiveness of the Data; and (b) makes no representations that the use of the Data will not infringe any patent or proprietary rights of third parties. 12.2 The Recipient assumes all liability for costs and damages, which may arise from the use, storage, or disposal of the Data by the Recipient. ICR will not be liable to Recipient for any loss, claim, or demand made by the Recipient, or made against Recipient by any third party, arising from the use or disclosure of the Data by the Recipient, except to the extent permitted by law when caused by the gross negligence or wilful misconduct of ICR. 12.3 Recipient shall indemnify the ICR for any liabilities, losses, demands, claims, damages, costs and expenses incurred which arise directly from or in connection with: (i) any accidental or unlawful destruction, loss, alteration of the Data by the Recipient; (ii) unauthorised or unlawful disclosure, access or use of the Data (iii) any use by or on behalf of Recipient of the Data for any purpose apart from the Purpose; (iv) any breach of this Agreement by Recipient, whether arising in negligence, contract or otherwise; and (v) to the extent permissible by law, any monetary penalty notice or other sanction imposed on ICR by the Supervisory Authority under the Data Protection Legislation as a result of the Recipient’s actions or omissions. 12.4 The Recipient understands that all the Data is protected by copyright and other intellectual property rights, such that duplication or sale of all of or part of the Data on any media is not permitted under any circumstances, except with the prior written consent of ICR. 13 Governing Law In the event of a dispute between the parties, the parties hereto agree that this Agreement shall be governed, construed and enforced by the laws of England, without regard to the conflicts of law rules and principles of such laws. 14 General 14.1. The Recipient shall not claim, infer, or imply ICR's endorsement of the Recipient's use of the Data, the Recipient as an institution or its personnel conducting research with the Data, or any resulting product(s). 14.2. Nothing in this Agreement shall be construed as creating a partnership, contract of employment or relationship of principal and agent between the parties hereto. 14.3. This Agreement contains the entire understanding between the parties hereto and supersedes all other negotiations, representations and undertakings in relation to the transfer of the Data. 14.4. Any change in the terms of this Agreement shall be valid only if the change is made in writing, agreed and signed by the parties hereto. 14.5. Except as permitted herein, no third party shall have any right to enforce any term of this Agreement. AGREED by the parties through their authorised signatories For and on behalf of ICR Authorised Signature: Name: Title: Date: For and on behalf of Recipient: Authorised Signature: Name: Title: Date: Read and Understood: Signature: ________________________________________ Recipient Principal Investigator: Dataset(s) requested: Email address: Date: Please send completed Agreements to: Brittany Rex The Institute of Cancer Research 15 Cotswold Road Belmont Sutton Surrey SM2 5NG Appendix 1: The Application [Optional] - Schedule 1 – SCCs for transfers to Third Countries.] SCHEDULE [X] Standard Contractual Clauses for the transfer of Personal Data from the Community to Third Countries (controller to controller transfers) Data transfer agreement Between The Institute of Cancer Research: Royal Cancer Hospital 123123 Old Brompton Road London SW7 3RP United Kingdom hereinafter “data exporter” and [insert other party’s name, address, country of establishment] hereinafter “data importer” each a “party”; together “the parties” Definitions For the purposes of the clauses: (a) ‘personal data’, ‘special categories of data/sensitive data’, ‘process/processing’, ‘controller’, ‘processor’, ‘data subject’ and ‘supervisory authority/authority’ shall have the same meaning as in Directive 95/46/EC of 24 October 1995 (whereby ‘the authority’ shall mean the competent data protection authority in the territory in which the data exporter is established); (b) ‘the data exporter’ shall mean the controller who transfers the personal data; (c) ‘the data importer’ shall mean the controller who agrees to receive from the data exporter personal data for further processing in accordance with the terms of these clauses and who is not subject to a third country’s system ensuring adequate protection; (d) ‘clauses’ shall mean these contractual clauses, which are a free-standing document that does not incorporate commercial business terms established by the parties under separate commercial arrangements. The details of the transfer (as well as the personal data covered) are specified in Annex B, which forms an integral part of the clauses. I. Obligations of the data exporter The data exporter warrants and undertakes that: (a) The personal data have been collected, processed and transferred in accordance with the laws applicable to the data exporter. (b) It has used reasonable efforts to determine that the data importer is able to satisfy its legal obligations under these clauses. (c) It will provide the data importer, when so requested, with copies of relevant data protection laws or references to them (where relevant, and not including legal advice) of the country in which the data exporter is established. (d) It will respond to enquiries from data subjects and the authority concerning processing of the personal data by the data importer, unless the parties have agreed that the data importer will so respond, in which case the data exporter will still respond to the extent reasonably possible and with the information reasonably available to it if the data importer is unwilling or unable to respond. Responses will be made within a reasonable time. (e) It will make available, upon request, a copy of the clauses to data subjects who are third party beneficiaries under clause III, unless the clauses contain confidential information, in which case it may remove such information. Where information is removed, the data exporter shall inform data subjects in writing of the reason for removal and of their right to draw the removal to the attention of the authority. However, the data exporter shall abide by a decision of the authority regarding access to the full text of the clauses by data subjects, as long as data subjects have agreed to respect the confidentiality of the confidential information removed. The data exporter shall also provide a copy of the clauses to the authority where required. II. Obligations of the data importer The data importer warrants and undertakes that: (a) It will have in place appropriate technical and organisational measures to protect the personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, and which provide a level of security appropriate to the risk represented by the processing and the nature of the data to be protected. (b) It will have in place procedures so that any third party it authorises to have access to the personal data, including processors, will respect and maintain the confidentiality and security of the personal data. Any person acting under the authority of the data importer, including a data processor, shall be obligated to process the personal data only on instructions from the data importer. This provision does not apply to persons authorised or required by law or regulation to have access to the personal data. (c) It has no reason to believe, at the time of entering into these clauses, in the existence of any local laws that would have a substantial adverse effect on the guarantees provided for under these clauses, and it will inform the data exporter (which will pass such notification on to the authority where required) if it becomes aware of any such laws. (d) It will process the personal data for purposes described in Annex B, and has the legal authority to give the warranties and fulfil the undertakings set out in, these clauses. (e) It will identify to the data exporter a contact point within its organisation authorised to respond to enquiries concerning processing of the personal data, and will co-operate in good faith with the data exporter, the data subject and the authority concerning all such enquiries within a reasonable time. In case of legal dissolution of the data exporter, or if the parties have so agreed, the data importer will assume responsibility for compliance with the provisions of clause I(e). (f) At the request of the data exporter, it will provide the data exporter with evidence of financial resources sufficient to fulfil its responsibilities under clause III (which may include insurance coverage). (g) Upon reasonable request of the data exporter, it will submit its data processing facilities, data files and documentation needed for processing to reviewing, auditing and/or certifying by the data exporter (or any independent or impartial inspection agents or auditors, selected by the data exporter and not reasonably objected to by the data importer) to ascertain compliance with the warranties and undertakings in these clauses, with reasonable notice and during regular business hours. The request will be subject to any necessary consent or approval from a regulatory or supervisory authority within the country of the data importer, which consent or approval the data importer will attempt to obtain in a timely fashion. (h) It will process the personal data, at its option, in accordance with: (i) the data protection laws of the country in which the data exporter is established, or (ii) the relevant provisions of any Commission decision pursuant to Article 25(6) of Directive 95/46/EC, where the data importer complies with the relevant provisions of such an authorisation or decision and is based in a country to which such an authorisation or decision pertains, but is not covered by such authorisation or decision for the purposes of the transfer(s) of the personal data, or (iii) the data processing principles set forth in Annex A. Data importer to indicate which option it selects: [Insert selection here, this will usually be Annex A] Initials of data importer: [Data importer’s signatory to initial here] (i) It will not disclose or transfer the personal data to a third party data controller located outside the European Economic Area (EEA) unless it notifies the data exporter about the transfer and: (j) the third party data controller processes the personal data in accordance with a Commission decision finding that a third country provides adequate protection, or (k) the third party data controller becomes a signatory to these clauses or another data transfer agreement approved by a competent authority in the EU, or (l) data subjects have been given the opportunity to object, after having been informed of the purposes of the transfer, the categories of recipients and the fact that the countries to which data is exported may have different data protection standards, or (m) with regard to onward transfers of sensitive data, data subjects have given their unambiguous consent to the onward transfer. III. Liability and third party rights (a) Each party shall be liable to the other parties for damages it causes by any breach of these clauses. Liability as between the parties is limited to actual damage suffered. Punitive damages (ie, damages intended to punish a party for its outrageous conduct) are specifically excluded. Each party shall be liable to data subjects for damages it causes by any breach of third-party rights under these clauses. This does not affect the liability of the data exporter under its data protection law. (b) The parties agree that a data subject shall have the right to enforce as a third party beneficiary this clause and clauses I(b), I(d), I(e), II(a), II(c), II(d), II(e), II(h), II(i), III(a), V, VI(d) and VII against the data importer or the data exporter, for their respective breach of their contractual obligations, with regard to his personal data, and accept jurisdiction for this purpose in the data exporter’s country of establishment. In cases involving allegations of breach by the data importer, the data subject must first request the data exporter to take appropriate action to enforce his rights against the data importer; if the data exporter does not take such action within a reasonable period (which under normal circumstances would be one month), the data subject may then enforce his rights against the data importer directly. A data subject is entitled to proceed directly against a data exporter that has failed to use reasonable efforts to determine that the data importer is able to satisfy its legal obligations under these clauses (the data exporter shall have the burden to prove that it took reasonable efforts). IV. Law applicable to the clauses These clauses shall be governed by the law of the country in which the data exporter is established, with the exception of the laws and regulations relating to processing of the personal data by the data importer under clause II(h), which shall apply only if so selected by the data importer under that clause. V. Resolution of disputes with data subjects or the authority (a) In the event of a dispute or claim brought by a data subject or the authority concerning the processing of the personal data against either or both of the parties, the parties will inform each other about any such disputes or claims, and will cooperate with a view to settling them amicably in a timely fashion. (b) The parties agree to respond to any generally available non-binding mediation procedure initiated by a data subject or by the authority. If they do participate in the proceedings, the parties may elect to do so remotely (such as by telephone or other electronic means). The parties also agree to consider participating in any other arbitration, mediation or other dispute resolution proceedings developed for data protection disputes. (c) Each party shall abide by a decision of a competent court of the data exporter’s country of establishment or of the authority which is final and against which no further appeal is possible. VI. Termination (a) In the event that the data importer is in breach of its obligations under these clauses, then the data exporter may temporarily suspend the transfer of personal data to the data importer until the breach is repaired or the contract is terminated. (b) In the event that: (i) the transfer of personal data to the data importer has been temporarily suspended by the data exporter for longer than one month pursuant to paragraph (a); (ii) compliance by the data importer with these clauses would put it in breach of its legal or regulatory obligations in the country of import; (iii) the data importer is in substantial or persistent breach of any warranties or undertakings given by it under these clauses; (iv) a final decision against which no further appeal is possible of a competent court of the data exporter’s country of establishment or of the authority rules that there has been a breach of the clauses by the data importer or the data exporter; or (v) a petition is presented for the administration or winding up of the data importer, whether in its personal or business capacity, which petition is not dismissed within the applicable period for such dismissal under applicable law; a winding up order is made; a receiver is appointed over any of its assets; a trustee in bankruptcy is appointed, if the data importer is an individual; a company voluntary arrangement is commenced by it; or any equivalent event in any jurisdiction occurs then the data exporter, without prejudice to any other rights which it may have against the data importer, shall be entitled to terminate these clauses, in which case the authority shall be informed where required. In cases covered by (i), (ii), or (iv) above the data importer may also terminate these clauses. (c) Either party may terminate these clauses if (i) any Commission positive adequacy decision under Article 25(6) of Directive 95/46/EC (or any superseding text) is issued in relation to the country (or a sector thereof) to which the data is transferred and processed by the data importer, or (ii) Directive 95/46/EC (or any superseding text) becomes directly applicable in such country. (d) The parties agree that the termination of these clauses at any time, in any circumstances and for whatever reason (except for termination under clause VI(c)) does not exempt them from the obligations and/or conditions under the clauses as regards the processing of the personal data transferred. VII. Variation of these clauses The parties may not modify these clauses except to update any information in Annex B, in which case they will inform the authority where required. This does not preclude the parties from adding additional commercial clauses where required. VIII. Description of the transfer The details of the transfer and of the personal data are specified in Annex B. The parties agree that Annex B may contain confidential business information which they will not disclose to third parties, except as required by law or in response to a competent regulatory or government agency, or as required under clause I(e). The parties may execute additional annexes to cover additional transfers, which will be submitted to the authority where required. Annex B may, in the alternative, be drafted to cover multiple transfers. FOR DATA IMPORTER Signature: Name: Title: FOR DATA EXPORTER Signature: Name: Title: SCHEDULE [X]: ANNEX A Data processing principles 1 Purpose limitation: Personal data may be processed and subsequently used or further communicated only for purposes described in Annex B or subsequently authorised by the data subject. 2 Data quality and proportionality: Personal data must be accurate and, where necessary, kept up to date. The personal data must be adequate, relevant and not excessive in relation to the purposes for which they are transferred and further processed. 3 Transparency: Data subjects must be provided with information necessary to ensure fair processing (such as information about the purposes of processing and about the transfer), unless such information has already been given by the data exporter. 4 Security and confidentiality: Technical and organisational security measures must be taken by the data controller that are appropriate to the risks, such as against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, presented by the processing. Any person acting under the authority of the data controller, including a processor, must not process the data except on instructions from the data controller. 5 Rights of access, rectification, deletion and objection: As provided in Article 12 of Directive 95/46/EC, data subjects must, whether directly or via a third party, be provided with the personal information about them that an organisation holds, except for requests which are manifestly abusive, based on unreasonable intervals or their number or repetitive or systematic nature, or for which access need not be granted under the law of the country of the data exporter. Provided that the authority has given its prior approval, access need also not be granted when doing so would be likely to seriously harm the interests of the data importer or other organisations dealing with the data importer and such interests are not overridden by the interests for fundamental rights and freedoms of the data subject. The sources of the personal data need not be identified when this is not possible by reasonable efforts, or where the rights of persons other than the individual would be violated. Data subjects must be able to have the personal information about them rectified, amended, or deleted where it is inaccurate or processed against these principles. If there are compelling grounds to doubt the legitimacy of the request, the organisation may require further justifications before proceeding to rectification, amendment or deletion. Notification of any rectification, amendment or deletion to third parties to whom the data have been disclosed need not be made when this involves a disproportionate effort. A data subject must also be able to object to the processing of the personal data relating to him if there are compelling legitimate grounds relating to his particular situation. The burden of proof for any refusal rests on the data importer, and the data subject may always challenge a refusal before the authority. 6 Sensitive data: The data importer shall take such additional measures (eg relating to security) as are necessary to protect such sensitive data in accordance with its obligations under clause II. 7 Data used for marketing purposes: Where data are processed for the purposes of direct marketing, effective procedures should exist allowing the data subject at any time to ‘opt-out’ from having his data used for such purposes. 8 Automated decisions: For purposes hereof ‘automated decision’ shall mean a decision by the data exporter or the data importer which produces legal effects concerning a data subject or significantly affects a data subject and which is based solely on automated processing of personal data intended to evaluate certain personal aspects relating to him, such as his performance at work, creditworthiness, reliability, conduct, etc. The data importer shall not make any automated decisions concerning data subjects, except when: (a) (i) such decisions are made by the data importer in entering into or performing a contract with the data subject, and (ii) the data subject is given an opportunity to discuss the results of a relevant automated decision with a representative of the parties making such decision or otherwise to make representations to that parties. or (b) where otherwise provided by the law of the data exporter. SCHEDULE [X]: ANNEX B Description of the transfer (To be completed by the parties) Data subjects The personal data transferred concern the following categories of data subjects: Purposes of the transfer(s) The transfer is made for the following purposes: Categories of data The personal data transferred concern the following categories of data: Recipients The personal data transferred may be disclosed only to the following recipients or categories of recipients: Sensitive data (if appropriate) The personal data transferred concern the following categories of sensitive data: Data protection registration information (where applicable): The Institute of Cancer Research is registered with the Information Commissioner's Office in the UK under number Z6775661. Additional Information (storage limits and other relevant information) Contact points for data protection enquiries Data importer Data exporter [ ] dataprotectionofficer@icr.ac.uk or The Data Protection Officer, Institute of Cancer Research, 123 Old Brompton Road, London SW7 3RP, United Kingdom SCHEDULE [X]:Annex C Additional Clauses 1. The Data importer agrees: 1.1. to only process the personal data for the purpose of [ ] OR [the purpose described in the Agreement] OR [the purpose described in Annex B of this Schedule [X]] 1.2. to only process the data for [the term of this Agreement which is expected to be xx months/years] OR [insert duration] (the “Retention Period”) and to securely destroy or return all data to the data exporter at the end of the Retention period, the Retention Period may only be extended on the prior written permission of the Data exporter; 1.3. to have in place appropriate technical and organizational measures that allow for the encryption of the personal data at rest and in transfer at all times; 1.4. to notify the data exporter within: (a) twelve (12) hours of becoming aware of a suspected security incident; or (b) within twenty-four (24) hours of becoming aware of an actual security incident that leads to a breach of security. The data importer will also notify the data exporter immediately if any such Data is corrupted or unusable, or if any pseudonymised data is or may be re-identified; 1.5. that it shall not analyse or make any use of pseudonymised data in such a way that has the potential to: (a) lead to the identification of any data subject; or compromise the anonymity of any data subject in any way; 1.6. that it shall not share the data with any other data controller or data processor for any purpose even if such purpose is detailed in Annex B of this Schedule [X]. 2. In the event that a US authority requests access to any of the personal data, the data importer agrees to take the following measures to prevent and/or limit US authorities accessing such data: 2.1. The data importer shall take the authority requesting the data to court and seek judgement about whether the data importer needs to comply with the request. The personal data shall only be provided to the authority by the data importer on the basis of such court judgement, including all possible appeals against any court decision to release the data; 2.2. The data importer shall inform the data exporter (a) of any such request, (b) whether or not they intend to comply with such request, and (c) of all details pertaining to the data access request; so that the data exporter can consider its obligations to inform the data subjects where necessary; 2.3. If the authority is requesting the data under a transparency exemption, then the data importer shall inform the data exporter in each instance. In the event applicable laws or regulations prevent the data importer from informing the data exporter in each instance, then the data importer shall at least provide reports to the data exporter detailing the type(s) of data requested, the names of the requesting authorities and the number of requests received; 2.4. The data importer acknowledges and agrees that data subjects shall have the right to seek compensation from the data importer for all damages suffered as a result of an authority’s access to the data in the US, regardless of the data importer’s culpability for such damages. 3. The parties will indemnify each other and hold each other harmless from any cost, charge, damages, expense or loss which they cause each other as a result of their breach of any of the provisions of this Schedule [X] and its annexes. Indemnification hereunder is contingent upon (a) the party(ies) to be indemnified (the “indemnified party(ies)”) promptly notifying the other party(ies) (the “indemnifying party(ies)”) of a claim, (b) the indemnifying party(ies) having sole control of the defence and settlement of any such claim, and (c) the indemnified party(ies) providing reasonable cooperation and assistance to the indemnifying party(ies) in defence of such claim.