SNP genotyping in B cell receptor gene regions

1. Data Access Committee A Data Access Committee (DAC) is a body of one or more named individuals who are responsible for data release to external requesters based on consent and/or National Research Ethics terms. Each dataset submitted by Oslo University Hospital (OUS )for archival and controlled access sharing in Federated EGA Norway, has a DAC appointed by OUS to govern controlled access to the dataset according to this Data Access Policy. Multiple datasets may be affiliated to a single DAC. OUS as an institution has the overall data controller responsibility, and will appoint a DAC based on proper internal procedures that ensures involvement of institutional functions such as Data Protection Officer, legal control, etc. 2. Data use conditions To advise any would-be requester on how the data can be used, Data Use Ontology codes (DUO) is associated to each dataset, providing the requester more insights into which terms for sharing and use of the data that applies, and that needs to be addressed as part of the communication with the DAC in a data access request. Data use is restricted to studies seeking to advance the understanding of autoimmune disease mechanisms. No access to an OUS dataset deposited in FEGA Norway can be granted to a requester before all applicable conditions and requirements for the use and management of the data have been agreed upon in a signed Data Access Agreement. 3. Data Access Agreement The Data Access Agreement (DAA) will include requirements specific for both the dataset and the management of the data in the hands of the requester applying for access, and will thus be an individual DAA for each case of granted access to a dataset. As a rule, a DAA for an OUS dataset will take the form of a Data Transfer Agreement, where the requester will commit to take on responsibilities and duties as a data controller. Generic templates for GDPR compliant DAAs between OUS and a data requester within the area of applicability of GDPR (European Economic Area) can be found at https://ega.elixir.no. Please note that the DAA will include requirements for secure data processing on a platform similar to the Services for sensitive data (TSD) hosted by the University of Oslo (see https://www.uio.no/tjenester/it/forskning/sensitiv/mer-om/tsd_system_desc.pdf for a system description). For sharing of an OUS dataset from FEGA Norway to a location outside the area of applicability of GDPR, such as the United States, Canada, etc, a standard DAA template is not yet available. Disclosure of information to countries outside the area of applicability of GDPR requires that the conditions in GDPR are met according to the EU Standard Contractual Clauses. 4. Processing of requests for access The overall data access approval process at OUS can be summarised as follows: - DAC for an OUS dataset is contacted by a potential data requester - DAC continues communication with requester to understand the purpose of use, i.e. research setting the dataset is envisioned for by requester, to identify if data sharing is possible directly under current conditions for the dataset, or actions such as re-consenting is needed and desirable to accommodate the proposed research setting/data use. - A Data Access Agreement is jointly formulated and agreed upon, with the DAC following internal OUS procedure to include the Data Protection Officer and Division for research support. - When a completed DAA has been signed between the parties, and archived at OUS, the DAC will instruct the FEGA Norway node to release the data to the requester.