ISA Nutrition 2015

Harmonised Data Access Agreement (hDAA) for Controlled Genetic Access Data

Table of Content Section I: Contact and Project Information 2 Section II: harmonised Data Access Agreement (hDAA) 5 Terms and Conditions 6 Agreement 9 Appendix I 10 Section I: Contact and Project Information Data Recipient (including contact details) Please ensure that a full postal address and a valid Institutional email address are included Name: Institution’s Legal Name: Institutional Postal Address: Institutional E-mail Address: Website of the Institution: Authorised Representative of the Data Recipient Name: Position: Affiliation: Institutional Postal Address: Institutional E-mail Address: Data Controller(s) (including contact details) Please ensure that a full postal address and a valid Institutional email address are included Name: Regina Mara Fisberg Institution’s Legal Name: Universidade de São Paulo (USP) Institutional Postal Address: Avenida Doutor Arnaldo, 715 – São Paulo – SP – Brasil – CEP 01246904 Institutional E-mail Address: rfisberg@usp.br Website of the Institution: https://www.fsp.usp.br/site/ Authorised Representative of the Data Controller(s) Name: Marcelo Macedo Rogero Position: University professor Affiliation: University of São Paulo Institutional Postal Address: Avenida Doutor Arnaldo, 715 – São Paulo – SP – Brasil – CEP 01246904 Institutional E-mail Address: mmrogero@usp.br Title of the Proposed Research Project Research Project (Scientific Abstract): Please provide a clear description of the Project, its stakeholders, its main question and its relevance to the research domain addressed, its specific aims, and duration. Note that any use of the Data, if approved, must fall under the framework of the described Project (300 words max): Research Credentials Please provide a list of three Publications, relevant to the Project description, of which the Data Recipient is author or co-author, and, also, attach their (Data Recipient’s) short CV. If the Data Recipient has not authored or co-authored three relevant Publications, please describe their relevant expertise or experience in no more than 150 words; also, notify how the research project will be carried out (e.g. available funding, infrastructure and so on). Section II: harmonised Data Access Agreement (hDAA) Definitions GDPR: This hDAA makes both parties compliant with the Regulation (EU) 2016/679 of the European Parliament and of the Council, that is, the General Data Protection Regulation (herein referred to as the ‘GDPR’) , as well as in accordance with the Brazilian Data Protection Law (Law No. 13.853/2019), the procedures must also adhere to Good Clinical Practices (Resolution No. 466, dated December 12th, 2012). Data: Refers to controlled access data (the Data). Under this Agreement, the Data is pseudonymised. Data Access/Transfer: Refers to an Institution’s right to request access to the Data and retrieve them from the Data Controller’s Institution upon approval of this hDAA by the corresponding DAC within the Data Controller’s Institution. Data Handling: Refers to an Institution’s ability to analyse and manipulate the Data within its own computer network. Data Controller(s): Refers to an Institution, responsible for the generation of the Data and its pseudonymisation. A key-code permitting relinkage to Data Subjects is kept by the Data Controller(s). Data Subject: Refers to any individual who is the source of any Data covered by this Agreement. Data Recipient (‘You’): Refers to the Institution who requests Access to the Data through this Agreement. Authorised Personnel: The individual(s) at the Institution requesting Access to the Data. Research Project: The Project for which You have requested Access to the Data. Publications: Refers, without limitation, to any and all articles published in print journals, electronic journals, reviews, books, posters, and other written and verbal presentations of Research that have been accepted by peer review. EU-STANDS4PM: This hDAA was based on the EU-STANDS4PM, http://www/eu-stands4pm.eu/ Terms and Conditions In signing this Agreement: You, the Data Recipient, agree to only use the Data for the Purpose of the Project. You agree to preserve, at all times, the confidentiality of information and Data pertaining to Data Subjects. You undertake not to use or attempt to use the Data to compromise or otherwise infringe the confidentiality of information on Data Subjects and their right to privacy. You agree not to attempt to identify Data Subjects. You and your Authorised Personnel agree to take into consideration any usage restrictions (if any), stemming from consent, i.e. the appropriate lawful basis for processing the Data, as well as any usage restrictions stemming from any applicable internal policies of your Institution. You agree that in handling this Data You will follow an up-to-date information technology (IT) policy that must include, at a minimum, the following items: a. Logging and auditing of Access to the Data and to the computer network; b. Password protection to computer network and/or strong data encryption; c. Virus and malware protection to computers on the computer network; d. Secure backup procedure; You acknowledge that Access to the Data is granted for the duration of the Project described in Section I, as well as any new Project under the same research field or area. Any use of the Data for a Project of another research field or area will need to be approved under a new Agreement. You recognize that nothing in this Agreement shall operate to transfer to You any intellectual property rights to the Data. You agree not to make intellectual property claims on the Data and not to use intellectual property protection in ways that would prevent or block Access to, or use of, any element of the Data. You can elect to perform further Research that would add intellectual and resource capital to the Data, and decide to obtain intellectual property rights on these downstream discoveries. In this case, You agree to implement licensing policies that will not obstruct further Research, following the Organisation for Economic Co-operation and Development Guidelines. You agree that the Research Project 1) bears no legal responsibility for the accuracy or comprehensiveness of the Data; 2) accepts no liability for indirect, consequential, or incidental damages or losses arising from use of the Data; and 3) bears no responsibility for the further analysis or interpretation of these Data over and above that published by the Controller(s). You agree to hold the Data Subject(s) and Data Controller(s) harmless and to defend and indemnify all these parties against all liabilities, demands, damages, expenses, and losses arising out of Your use for any Purpose of the Data. You agree to a moratorium on publishing global analyses of the dataset until the Data Controller(s) have published their own global analysis or twelve (12) months, the maximum, have passed from the time the Data were deposited, whichever occurs first. You acknowledge that prompt publication or public disclosure of the results of the Research Project is encouraged. You also agree that by publishing Your global analyses of the Data, you will not disclose any results generated from the Data. You agree to acknowledge the contribution of the Data Controller(s) in all oral and written presentations, disclosures, and Publications resulting from all analyses of the Data. You agree to use the Data in Your laboratory. Any Authorised Personnel shall work under Your direct supervision. You agree to distribute a copy of these terms to the Authorised Personnel. You may not transfer any information included in the Data to anyone unless specifically designated in the Research Project, or by prior specific or general written authorisation of the Data Controller(s) responsible for the generation of the original Data in each case. You may not transfer the Data itself to anyone outside the Institution, unless the Controller(s) has (have) approved such transfer and its terms in writing. Should You wish to share the Data with an external collaborator, the external collaborator must complete a separate Data Access Agreement. You shall ensure that ‘all’ who have Access to the Data, namely You and Your Authorised Personnel, will be listed out, and are made aware and be bound by the terms of this Agreement. You remain solely and fully responsible for Your Authorised Personnel’s non-compliance with the provision of the Agreement and/or applicable laws. In case of a breach of security resulting from ‘accidental’ use of Data by You and Your Authorised Personnel, which leads to disclosure of Data, then You must report this to the Data Controller(s) within 72 hours maximum, and follow any relevant rule as provided by the GDPR. In case of a ‘non-accidental or minor’ breach of hDAA by You You will further be required to destroy any Data held. You accept that this Agreement will terminate immediately upon ‘any’ breach by You, or its termination (see Section I). You endeavour to settle any dispute with the Data Controller(s) amicably. If you are unable to reach an Agreement, you will meet and negotiate in good faith in an effort to resolve the issue. If the issue has not been resolved within a reasonable period (e.g. 30 calendar days), you are both entitled to submit it for resolution by an arbitrator. Further, the language of the proceedings will be ‘English’ if not otherwise agreed. The award of the arbitration will be final and binding upon the parties concerned. This Agreement (and any dispute, controversy, proceedings, or claim of whatever nature arising out of it or its formation) shall be interpreted, governed by and construed in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council, that is, the General Data Protection Regulation (herein referred to as the ‘GDPR’) , as well as in accordance with the Brazilian Data Protection Law (Law No. 13.853/2019). Agreement I have read, understood and agree to abide by the terms and conditions stipulated in this Data Access Agreement. Data Recipient or Authorised Representative of the Data Recipient: Name: Title and position (if applicable): Affiliation (if applicable): Signature: _____________________________________Date: _____________________ Data Controller(s) or Authorised Representative of the Data Controller(s): Name: Title and position (if applicable): Affiliation (if applicable): Signature: _____________________________________Date: ______________________ Appendix I