Gut microbiota biomarkers associated with Multiple Myeloma: The REMNANT Study

1. Data Access Committee A Data Access Committee (DAC) is a body of one or more named individuals who are responsible for data release to external requesters based on consent and/or National Research Ethics terms. Each dataset submitted by Oslo University Hospital for archival and controlled access sharing in Federated EGA Norway, has a DAC appointed by Oslo University Hospital to govern controlled access to the dataset according to this Data Access Policy. Multiple datasets may be affiliated to a single DAC. Oslo University Hospital as an institution has the overall data controller responsibility, and will appoint a DAC based on proper internal procedures that ensures involvement of institutional functions such as Data Protection Officer, legal control, etc. 2. Data use conditions To advise any would-be requester on how the data can be used, Data Use Ontology codes (DUO) is associated to each dataset, providing the requester more insights into which terms for sharing and use of the data that applies, and that needs to be addressed as part of the communication with the DAC in a data access request. No access to an Oslo University Hospital dataset deposited in FEGA Norway can be granted to a requester before all applicable conditions and requirements for the use and management of the data have been agreed upon in a signed Data Access Agreement. 3. Data Access Agreement The Data Access Agreement (DAA) will include requirements specific for both the dataset and the management of the data in the hands of the requester applying for access, and will thus be an individual DAA for each case of granted access to a dataset. As a rule, a DAA for an Oslo University Hospital dataset will take the form of a Data Transfer Agreement, where the requester will commit to take on responsibilities and duties as a data controller. A template for a GDPR compliant DAA between Oslo University Hospital and a data requester within the area of applicability of GDPR (European Economic Area) can be found on the https://ega.elixir.no website. For sharing of an Oslo University Hospital dataset from FEGA Norway to a location outside the area of applicability of GDPR, such as the United States, Canada, etc, a standard DAA template is not yet available. 4. Processing of requests for access The overall data access approval process at Oslo University Hospital can be summarised as follows: ● DAC for an Oslo University Hospital dataset is contacted by a potential data requester ● DAC continues communication with requester to understand the purpose of use, i.e. research setting the dataset is envisioned for by requester, to identify if data sharing is possible directly under current conditions for the dataset, or actions such as re-consenting is needed and desirable to accommodate the proposed research setting/data use. ● A Data Access Agreement is jointly formulated and agreed upon, with the DAC following internal Oslo University Hospital procedure to include the Data Protection Officer and Division for research support. ● When a completed DAA has been signed between the parties, and archived by Oslo University Hospital, the DAC will instruct the FEGA Norway node to release the data to the requester.