Data Agreements

Micah Altman, Harvard University

Agrements for Data Collections 1

Agreements for Data Collections

Micah Altman

Senior Research Scientist, Institute for Quantitative Social Science

(Associate Director, Harvard-MIT Data Center; Archival Director, Henry A. Murray Research Archive )

Harvard University



The plan for today? Principles and Drivers

Principles of Agreement Data Lifecycle Stakeholders Areas of Law

Implications for Agreements Motivating Questions Example Checklist

Additional Resources



Principles for Agreements Why Formalize Agreements?

Clarify and articulate rights and responsibilities Distribute risk across parties Establish record for later individual/institutional

memory Establish institutional commitment Signal commitment to third parties

Preconditions for success Meeting of minds

intent to agree, mutual understanding of agreement Compatible incentives Compatible capabilities

Agr

eem

ents

for

Dat

a C

olle

ctio

ns:

Prin

cipl

es



Common Agreements Involving Data Data Collection Data Deposit/Submission Data Dissemination/Release Institutional Collaboration, Transfer,

Exchange



Data Lifecycle* Collection Data Entry & Verification Processing

Identifier assignment Internal metadata Coding Merging Cleaning

Research and Publication Support Documentation, Dissemination Archiving Recoding, Secondary Analysis, Merging(… and back to the beginning)

*(Rinse, Lather, Repeat)



What’s Wrong with the Previous Slide* Data is changed all the time. What metadata? Publications emerge before processing

(“the conference is next week”) Dissemination happens early

(sometimes…maybe… if I know you) Much data is never archived

* (So, I lied)



Stakeholders Sponsors

Home institution(s) Government sponsors Non-profit sponsors Corporate sponsors

Publishers Print publishers Data archives

Consumers Readers Policymakers Researchers conducting

Secondary Research

Sources Research Subjects Owners of object of study Owners of

supplementary/integrated data

Producers Primary investigators Research group

Secondary investigators Staff Collaborators



Legal Issues - Types Intellectual Property

Copyright DMCA Trademark Patent Database Protection Trade Secret

Open Access FOIA State FOI Laws Sponsor Deposit

Requirements Federal Records

Regulations

Contract & License Explicit Contracts &

Licenses Shrinkwrap/Clickwrap

Personal Information IRB’s and 45 CFR 26 HIPAA FERPA Invasion of Privacy Defamation



Legal Issues - Observations Intellectual Property

Frequently there is a big gap between ownership and control of data Quantitative data is much more often protected by license (and possibly

by DMCA if embedded) than by patent, database protection, trademark, trade secret

Even data that combines existing sources is not necessarily “derivative work”. Merged research databases often exhibit sufficient creativity in selection & organization to constitute an original work

Open Access Research produced under contract to federal agency constitute federal

record, and are subject to FOIA Grant-funded research does not, unless specifically used to support

regulation. More difficult or impossible to FOIA Most sponsor & journal deposit requirements are not enforced or

monitored Exception: A few journals enforce data deposit for publication effectively.

Primarily in bio-sciences.



Legal Issues – Observations (Continued) Contract & License

Contract involved exchange of benefits, license is a grant of permissions Shrinkwrap/clickwrap licenses should not be ignored Most data restriction through license

Personal Information Generally, difficult for individuals to sue institutions and be awarded much However, risks of government fines, penalties, curtailing of research grants

significant for institutions conducting federally funded research Releasing data is generally a problem ok if the data is not personally identifiable

(social security numbers, credit card numbers, home address, names, etc.), data is public record and/or historical, or data subjects gave informed consent to release

For most data, removing the 19 enumerated direct and indirect HIPAA identifiers is sufficient to show good faith

However, be aware that some data is very difficult or impossible to deidentify: A/V (unless image and voices are disguised) Qualitative data (care must be used to remove identifying context like schools attended, as

well as explicit identifiers) High-dimensional sparse data, such as Netflix movie rankings, can be linked using external

sources



Stakeholders and Legal Requirements

Personal Information

Open accessIntellectual Property

Contract

SponsorInterests

HIPAA FERPA45 CFR 26

Invasionof

Privacy

Defamation

FOIAState FOI

PublisherInterests

DMCACopyright

Trademark

Patent Trade Secret

Contracts Licenses

Click-wrapagreements

Contributor Interests

ConsumerInterest



Stakeholders Implicated as Information Flows

Research sources:- Research Subjects.- Owners of subject material- Owners of supplementary data

Research sponsors:- Home institution- Funding sources

Project Personnel:- Investigators- Research Staff

Research Publishers- Print publishers- Research archives

Research Consumers- Readers- Secondary researcher

LicensingCopyrightDMCAInformed ConsentPrivacyTrade secrets

LicensingFreedom of InformationCopyright

Copyright

CopyrightLicensing

Fair Use

InformationTransfer

PrivacyConfidentialityIntellectual Property

Replicable ResearchPolicy RelevanceAccessibility of ResearchProtect IPAvoid third party IP/Privacy Issues

Replicable ResearchPublishPromote use of PublicationsTrack use

Replicable researchPromote use of their publicationsProtect publisher IPAvoid third party IP/Privacy Issues

Replicate and extendSecondary analysisLink research

Stakeholder Concerns Legal Issues



Agreement General Questions What actions are to be undertaken by each

stakeholder? What risks and responsibilities does each

stakeholder bear? What benefits are exchanged? How will the agreement be monitored? What is the expected timeline for the

agreement as a whole, actions, risks, exchanges, monitoring?



Motivating Questions for Data Agreements Motivating Questions Who are the stakeholders? What do the stakeholders require and want? How does the agreement engage with the

data lifecycle to ensure these things? What are the motivating questions, use

cases, scenarios? What incentives do the stakeholders have to

cooperate?



Data Agreement: Materials Nature of collections

Legal restrictions: Copyrighted? Public domain? Factual? Other types? (etc.) Accompanying metadata? Formats being delivered? Software required to read/use those formats? Completeness. Other material required to use or understand collections?

Frequency When, and if applicable, at what intervals, will the materials be delivered? Is there

any ongoing duty to update or upgrade the materials? Review/Monitoring

What level of review/acceptance, if any, and by whom Time period in which for review? What happens if the reviewer determines that the materials are in some way

deficient? Responsibilities related to Materials

Will the depositing institution have any other obligations with respect to the Materials once they are delivered?

Maintain updates? Maintain particular feeds or pipelines? Create and maintain a related website? Install/use software? (Related licensing requirements?) Technical Standards compliance?



Data Agreement: Rights Use rights

Reproduce, distribute, publicly display, or publicly perform some or all of work. Prepare derivative works of or otherwise modify? Own derivative works? Create databases incorporating, re-arrange or compile the collections Cache, store , archive, reformat.

Ownership Is copyright transferred? (Generally not necessary, not always possible.) Ownership of right title and interest?

Are sublicense rights needed? To whom? Can sub-licensees grant rights? Scope

Can depositor withdraw materials or rights? Under what conditions? Term/Duration of licenses? Limited to term of agreement? Exclusivity? Limited to certain purposes – preservation, personal, instructional, research, non-

commercial? Privacy restrictions – re-identification, linking, merging Territorial restrictions Transferability of license? Revocability?



Data Agreement: Obligations Describe the scope of any obligations to review, manage, test, catalog, index,

organize, host, make available, store, preserve, archive, retrieve, maintain, and update, etc. What is the duration of this obligation? The term of the agreement? in perpetuity?

Term of obligation? Terminates with agreement? Where will materials be stored, hosted, (etc.)? Are there other conditions under which materials may be deaccessioned?

Obligations to distribute materials? To whom? Under what conditions? Are there limitations on the fees distributors may charge users? Is there an obligation to allow redistribution by third party? Is there a specified end-user license or other required conditions? Does it include obligation to

inform end users of restrictions on materials? Must distributor obtain users assent to license? For what term?

Are there obligations to update materials? Under what conditions? Notifications, obligations to notify of changes of copyright/privacy status? Attribution, cite in publications or derivative works? Mention in advertising? Obligations to comply with FOIA (and related state government statutes) requests

and/or subpoenas for original materials? Direct response required, or simply permit the Government access to catalog and repository for requestor to search for such materials?

Does either party have any obligation to train or provide other assistance to the other party regarding the use or manipulation of the Materials? metadata creation, etc.?



Data Agreement: Term Term of agreement?

Time period; based on conclusion of work; perpetual? If ongoing, is agreement in accordance with specific provision? Are there renewal terms? Is renewal automatic? Is there a limit

on renewals? Termination rights

Do both parties have the right to terminate for material brach? Is there a period allowed to cure the breach?

Enumerated causes for termination? Or termination allowed without cause?

Right to terminate based on bankruptcy/dissolution/sale/transfer of ownership of parties?

Termination effects Continuing licenses to collections (either transferred or

promised) post termination? Continuing obligations to preserve, update, or perform other

actions with respect to collections?



Data Agreement: Fees What fees will be charged, by whom, and for

what? Are fees adjustable, and on what basis? When are fees due/payable? Are other costs incurred explicitly waived?



Data Agreement: Warrantees Representations and warranties concerning the intellectual property

rights in the Materials? the Materials do not infringe any third party’s intellectual property rights

(copyright, patent, trademark, trade secret); the depositing institution has the right to grant the rights granted in the

Deposit Agreement; the depositing institution has confirmed that any copyright restrictions

imposed on the Materials are current and accurate; the Materials do not violate any third party’s right of privacy or publicity, and

are not defamatory or libelous. Warranties regarding the accuracy, reliability, currency or

completeness of the Materials? Other general warranties

that the depositing institution has the right to enter into the agreement that the Deposit Agreement does not conflict with any other agreement that the person executing the agreement has the authority to do so on

behalf of the depositing institution that the Materials and the depositing institution’s performance under the

Deposit Agreement complies with



Data Deposit Agreement: Disclaimers General Disclaimers. Each Deposit Agreement should include a general disclaimer of consequential, indirect, punitive

and incidental damages. Specific Disclaimers. Disclaiming liability for any loss or damage to the Materials. Are there other specific disclaimers

that are appropriate for the Materials? Limitation of Liability. Include a dollar limitation on the direct damages that may be recovered under the Deposit

Agreement? If included, will the limitation of liability protect both parties? In general, the limit on direct damages should have some relationship to the risks involved, the potential damages that may be

incurred, and each party’s need/desire to limit the risk undertaken pursuant to the agreement. Note that if no fees are charged under the Deposit Agreement, limiting direct damages to the fees charged may not be

enforceable in certain states because such a provision does not provide an effective remedy. Indemnity based on breach of contract or of the representations and warrantie? Will the the depositing institution indemnify, defend and/or hold harmless the receiver from third party claims?

alleging that the Materials infringe a third party’s intellectual property rights; alleging that the Materials infringe a third party’s rights of privacy and/or publicity; alleging that the Materials are defamatory or libelous; or alleging property damage or injury; alleging tortious interference; based on the depositing institution’s violation of law; based on the depositing institution’s negligence or willful misconduct.

Mutual indemnity? Under what circumstances, and with what exceptions?

Notes: Often request for indemnity will trigger a request for mutual indemnity. Indemnity and warranties are overlapping However, biggest risk is from third parties – indemnity, not warranty. Consider explicitly excluding liability based on specific disclaimers. If fees, or dollar limits are mentioned, consider excepting indemnity from these limits? Be aware that depositors may have a limited ability to enter into an indemnifying agreement (e.g. government entities sometimes

cannot enter such agreements), or may not have the resources to provide effective indemnification should a third party allegation arise.



Data Deposit Agreement: Miscellaneous Is the agreement, or the information exchanged by parties

confidential? Who are points of contact? Governing law; jurisdiction; venue? Dispute resolution procedure? Force majeure? Waiver and severability? Entire agreement provision? Copyright or licensing of agreement itself (e.g. Creative

Commons)? Notices Amendment and modifications Assignment Relation of the parties/independent contractors Advertising clauses; use of institutional logos and trademarks



Variation: Data Dissemination Generally includes limited use rights

Analysis, research Often no redistribution/derivative works rights

Point in time license, no termination for specific release

Generally includes obligations Attribution Notification by user to source of problems Privacy obligations

Often no warranties, indemnification



Variation: Data Collection Agreement Look ahead to rights desired under deposit

and dissemination agreements Data collection agreements should grant

rights/obtain informed consent for these uses



Resources Library Collection Development?

Library of Congress Digital Preservation Website:<http://www.digitalpreservation.gov>

Data Preservation Alliance for the Social Sciences:

<http://www.icpsr.org/datapass/>

Agr

eem

ents

for

Dat

a C

olle

ctio

ns:

Res

ourc

es



Questions?

Questions about this talk, etc.:[email protected]

Education

Data Agreements