Bigpicture Policy for Data Users

Relevant information for Data Users in the Bigpicture Data Sharing Agreement (DSA)

Policy for data users-0525.pdf

PDF 1 mb

Summary of relevant clauses for Data Users

This document serves as an overview of the relevant clauses and sections of clauses for Data Users, and is for reference purposes only. In case of doubt about the contents of the clauses, the original text of the DSA always takes precedence over this summary. The full text of the relevant clauses is also included in this document.

Clause 2. [Definitions]

‘Data User’ means any Beneficiary whose Employees are exercising the Access Rights to certain Data in accordance with the terms set out in this Agreement and defined by the Data Contributor in the ToU. For the avoidance of doubt, Data Users may include employees of Affiliated Entities and Linked Third Parties, Sub-Contractors, to the extent that those entities enjoy the rights and obligations under this Agreement. In next phases of the Project, Data Users will also include Slide Contributing Third Parties and finally Third Parties.

Clause 3. [Contribution of the Data]

Data Contributors and Data Users shall sign the Hosting and Processing Agreement with Hosting Beneficiaries as set forth in EXHIBIT 4.

Clause 5. [Data Access]

Clause 5 outlines the terms and conditions for Data Access. Beneficiaries (as potential Data Users) can request access to specific datasets by following the Terms of Use set by the Data Contributor, in line with the Consortium Agreement and data protection laws. To apply, they must submit a request through the REMS portal, providing necessary details such as the dataset, data users, employees, and the research purpose.

If the requesting party is in a non-European Economic Area country without an EU adequacy decision, a data transfer agreement must be signed to meet cross-border data transfer obligations, such as the Standard Contractual Clauses issued by the European Commission or comply with another compliant cross-border data transfer mechanism. A Transfer Impact Assessment may also be required.

Clause 6. [Obligations of the Data Users]

Clause 6 outlines the obligations of the Data Users. They must ensure that its Employees use the Data only for the agreed purpose, as specified in the Data Access request, and in compliance with the relevant agreements and legislation. The Data must not be processed in ways incompatible with its original purpose. The Data Contributor retains the right to use their Data for their own purposes if they are the Data Controller or have a legal right to do so.

Each Data User processing Data must:

Comply with applicable Data Protection Legislation.
Act proportionately to the research aim when acting as a Controller.
Follow recognized ethical standards for scientific research.
Adhere to the conditions and restrictions set by the Data Contributor in the Terms of Use.

Specific obligations for Data Users include:

Implement guidelines and procedures to ensure Employee compliance with the DSA, ToU, and Data Protection Legislation.
Ensure Employees treat all Data as confidential unless otherwise indicated and comply with data transfer rules for countries outside the EU/EEA.
Ensure authorised third parties process Data only according to instructions.
Access and process Data only as necessary for the Project or approved Research Use.
Notify the Data Contributor of any errors in the Data or security breaches without undue delay.
Accept that Data access may be interrupted or suspended for maintenance or security reasons.
Accept updates to Data and remove earlier versions if reissued due to Data Subject requests.
Implement security measures to protect Data downloaded from the Bigpicture Platform.
Delete Data upon a justified request from the Data Contributor.

When accessing Personal Data:

For Research Use, the Data User will be considered a Controller unless stated otherwise in EXHIBIT 2 or agreed in writing between the concerned Data Contributor and Data User in a separate agreement.
For Implementation of Action, roles are outlined in EXHIBIT 2.

Clause 10. [Data Protection Impact Assessment (DPIA)]

Clause 10 outlines the obligations for Beneficiaries regarding the execution of a DPIA. Data Users must ensure they access Personal Data only if a DPIA is not required or if a DPIA has been completed and its conclusions permit the planned use. The Data Contributor or its Data Access Committee (DAC) can request the DPIA from the Data User before granting access to the data.

Clause 11. [Non-transferability]

Data Users (except where Data User is the Beneficiary which contributed the relevant Data) must ensure that neither they nor their Employees transfer or disclose the Data or any material to any third party, including other Employees, unless:

a) Permitted under the DSA,

b) A separate Data Access request has been filed and approved by the relevant Data Contributor, or

c) Permitted under the provisions on the rights of the Affiliated Entities, Linked Third Parties and Sub-Contractors in the Consortium Agreement and the DSA.

Clause 15. [Term and termination]

Clause 15 outlines, insofar as relevant to the Data Users, the consequences of termination or expiration of the DSA.

a) Upon termination or expiration of the DSA, all Beneficiaries must stop processing the relevant Data. However, if a Beneficiary started processing Data for research before termination, they can continue until completion, unless the termination is due to specific listed reasons or the withdrawal of necessary authorizations.

b) Access Rights to the Data will be immediately revoked for Data Users and their Employees whose participation is terminated.

c) All Data Users and their Employees must securely delete the Data they received via the Bigpicture Platform and remove any existing copies, unless permitted otherwise by the Data Contributor or applicable law.

d) Data Users must confirm the Data erasure or provide reasons for retention if requested by the Data Contributor.

EXHIBIT 4: Hosting and Processing Agreement

Agreement to be signed between Data Contributors/Data Users and Hosting Beneficiaries, whereby the Data Contributors and Data Users act as (or on behalf of) Controllers and Hosting Beneficiaries (CSC and UU) act as Processors.

Full text of relevant clauses for Data users

Clause 2. [Definitions]

Clause 3. [Contribution of the Data]

3.7. Data Contributors and Data Users shall sign the Hosting and Processing Agreement with Hosting Beneficiaries as set forth in EXHIBIT 4. For Personal Data this Hosting and Processing Agreement in EXHIBIT 4 will contain Personal Data Processing terms and conditions in compliance with Art. 28 GDPR. For Anonymized Data, it will contain, without limitation, terms of storing and hosting and conditions for providing Access to the Anonymized Data.

Clause 5. [Data Access]

Beneficiaries (as potential data users) can request access to specific datasets by following the Terms of Use set by the Data Contributor, in line with the Consortium Agreement and data protection laws. To apply, they must submit a request through the REMS portal, providing necessary details such as the dataset, data users, employees, and the research purpose.

If the requesting party is in a non-European Economic Area country without EU data adequacy, a data transfer agreement must be signed to meet cross-border data transfer rules, such as using the EU's Standard Contractual Clauses. A Transfer Impact Assessment may also be required.

5.2. Each Beneficiary (as potential Data User) shall be able to request and obtain Access to a selected Dataset in accordance with the Terms of Use for such Dataset as specified by the Data Contributor. Those Terms of Use will respect the Access Rights as already granted by the Consortium Agreement (to the extent that those do not infringe Data Protection Legislation).

5.3. To apply for Access, Beneficiary shall submit an Access request through the REMS portal on Bigpicture Platform. When applying for Access, the Beneficiary shall supply all the information that is required by the DAC pursuant to the relevant ToU, in particular, identify the Dataset to which Access is requested, the requesting Data User and its Employees, and, strictly limited to the extent needed to assess whether the Access request complies with applicable laws, the purpose of use for the Data (the Research Question).

5.7. If the Beneficiary or other party requesting Access to the Personal Data is located in a third country (i.e. a country outside the European Economic Area) without adequacy decision from the European Commission, prior to granting Access to such Data, the Data Contributor and the Beneficiary requesting Access to the Data (Data User) shall enter into a data transfer agreement as needed to satisfy cross-border transfer obligations relating to Personal Data, such as the Standard Contractual Clauses issued by the European Commission or comply with another cross-border data transfer mechanism deemed compliant under applicable Data Protection Legislation to allow Personal Data to be transferred to the Data User, as stated in requirements of Clause 8.2.d). For the avoidance of doubt, if applicable, a Transfer Impact Assessment shall be performed by the respective Data Contributor with respect to the requesting Beneficiary or other party.

Clause 6. [Obligations of the Data Users]

6.1. Data User is liable for ensuring that the Data are used by its Employees solely for the agreed purpose and as indicated in the Data Access request (as per Clause 5.3) and in accordance with the Consortium Agreement, this Agreement, the Terms of Use defined for that Dataset and with applicable Data Protection Legislation. For the avoidance of doubt, Data User has the duty to ensure that the Data are not further Processed in a manner that is incompatible with the purposes for which the Data were originally collected or shared by the Data Contributor and as reflected in the ToU and/or as approved by the Data Contributor pursuant to Clauses 5.3 and 5.4. This does not limit the Data Contributor’s right to use their Data for their own purposes, outside of this Agreement, to the extent that the Data Contributor is a Controller of these Data and/or has a legal right or basis for such use.

6.2. Each Data User that Processes Data shall (i) act in compliance with the appliable Data Protection Legislation, (ii) when acting as a Controller, apply for and Process Data in a manner that is proportionate to the research aim pursued, (iii) observe recognized ethical standards for scientific research, such as Convention for the protection of Human Rights and Dignity of the Human Being with regard to the Application of Biology and Medicine, (iv) follow the conditions and any usage restrictions set out by the Data Contributor in the ToU.

6.3. Data User undertakes:

a) To implement and distribute any such guidelines, policies, procedures, contractual obligations and instructions as necessary to ensure their Employees’ compliance with the obligations contained in this Agreement, ToU and applicable Data Protection Legislation,

b) To ensure that it will, additionally to its other obligations and liabilities as either Controller or Processor in the performance of the Project and/or Research Use, procure that its Employees will:

Comply with the principles and obligations under this Agreement and any restrictions which have been indicated by the Data Contributor in the ToU for the relevant Dataset,
Process the Data exclusively in accordance with the specifications in the Terms of Use and the terms and conditions of this Agreement and Consortium Agreement,
Treat all Data as strictly confidential, unless otherwise indicated in the ToU for that Dataset,
In relation to transfers of Data to a country outside of the EU/EEA, without adequacy decision from the European Commission comply with Clauses 5.7 and 8.2.d) as applicable.

c) To have in place procedures to ensure that any third party it authorizes to have Access to the Data, including (sub)Processors, shall be obligated to Process the Data only according to its instructions,

d) When acting as a Controller, only to Access and Process the Data as strictly necessary for the implementation of the Project or for the defined and approved Research Use in accordance with the GDPR data minimization principle, and the provisions of this Agreement, the Terms of Use for the Data and the Consortium Agreement,

e) To notify Data Contributor of any errors detected in the Data and when the identity of the Data Contributor is not disclosed, the notification should be provided to contact point defined in Clause 16.2,

f) To agree that their Access to Data may be interrupted and may be blocked or suspended at any time in accordance with the conditions set forth in this Agreement (including the conditions set out in the ToU) or otherwise as required for maintenance or security reasons,

g) To notify the relevant Data Contributor’s contact person identified in EXHIBIT 6 of this Agreement of any Security Breach without undue delay after becoming aware thereof and to act in accordance with the provision of Clause 12 of this Agreement, and when the identity of the Data Contributor is not disclosed, the notification should be provided to contact point defined in Clause 16.2,

h) To accept that Data be updated from time to time, with suitable versioning and, if Data is reissued at the request of Data Subjects and/or as the result of ethical scrutiny, remove earlier versions of the Data from subsequent analysis and publication and destroy/discard all earlier versions of the Data, to the extent reasonably possible, in line with the Consortium Agreement and Data Protection Legislation,

i) To accept that ToU for each Dataset in the Bigpicture Platform may be subject to update or change; the change will not affect the rights to use the Data as previously granted to the Data User by the Data Contributor,

j) To undertake, where Data Contributor has informed the Data User in the ToU of the Dataset that there is a requirement to return Incidental Findings to Data Subjects, to notify any such Incidental Findings to the Data Contributor that shared the Data,

k) Where Data User downloads Data from the Bigpicture Platform, to implement appropriate security measures to protect the Data, in particular to prevent unauthorized access to the Data, as set forth in the ToU of the Dataset,

l) To ensure that Data is completely and irrevocably deleted (backup copies included) on the side of the Data User at any time upon written and duly motivated and justified request from the Data Contributor to the extent such request is necessary to comply with applicable Data Protection Legislation, a Supervisory Authority’s or any other binding regulator’s or authority’s order or injunction, in a secure manner so as to avoid any potential restoration or reconstruction of Data, and to agree to issue to the Data Contributor without undue delay after such destruction a written confirmation of secure destruction of Data, including a commitment to have destroyed all copies (including backups) of Data,

m) To follow any other condition as set forth in the relevant ToU of the Dataset.

6.4. Where Access to Data is granted for Personal Data:

a) For Research Use, the concerned Data User acknowledges and agrees that i) it will be considered a Controller with regard to the Data Accessed and Processed under this Agreement, unless stated otherwise in EXHIBIT 2 and/or agreed in writing between the concerned Data Contributor and Data User in a separate agreement, and ii) it will be performing Processing activities in line with such capacity.

b) For Implementation of Action, the role of the concerned Data User and of the other Beneficiaries involved in the Processing of the Data, is indicated as per the table in EXHIBIT 2. Should Joint Controllership arise, this will be regulated by the Joint Controllers, including under the terms of this Agreement and EXHIBIT 2.

Clause 8. [General obligations of Beneficiaries]

8.1. [Compliance with Data Protection Legislation] Each Beneficiary is solely responsible for complying with applicable Data Protection Legislation for its own Processing activities, including evaluating its current or potential future role as Controller, Joint Controller or Processor in relation to a Work Package and/or a Work Package task under the Project in which such Beneficiary participates in or when conducting Research Use of the Personal Data. Roles of the Beneficiaries in relation to Data are indicated by them in EXHIBIT 2 of the Agreement. For the avoidance of doubt, the provisions of this Clause 8 shall be considered as additional and complementary to the specific rules on Data contribution, Data storage in Bigpicture Platform and Access to Data by the Data Users, which are defined in above in Clauses 3–6. In the event of any conflict between general obligations under Clause 8 and the provisions of Clauses 3-6 in the scope of Data contribution, Data storage in Bigpicture Platform and Access to Data by the Data Users, the latter shall prevail.

Clause 10. [Data Protection Impact Assessment (DPIA)]

10.3. The Data Users should ensure that they Access Personal Data only if no DPIA is required for its use as indicated in the Access request, or if a DPIA has been conducted and its conclusions (including Supervisory Authority’s consultation as potentially required) allow the planned use of the Personal Data by the requesting Beneficiary. The Data Contributor (or its DAC) may request the DPIA from the Data User prior to granting Access to the Data.

Clause 11. [Non-transferability]

11.2. Data User (except where Data User is the Beneficiary which contributed the relevant Data) will not, and procures that Employees will not, transfer or disclose Data, in whole or part, or any material derived therefrom to any third party (including other Employees of Data User) except:

a) As permitted under this Agreement, or

b) If a separate Data Access request has been filed with the relevant Data Contributor and approved beforehand by this Data Contributor, or

c) As permitted under the provisions on the rights of the Affiliated Entities, Linked Third Parties and Sub-Contractors in the Consortium Agreement and this Agreement.

Clause 15. [Term and termination]

15.3. [Consequences] Consequences of termination or expiration per Clauses 15.1 and 15.2 and subject to the provisions of the Consortium Agreement shall be as follows:

a) All the Beneficiaries (if the Agreement is terminated or expires in accordance with Clause 15.1) or the Beneficiary whose participation to the Agreement is terminated in accordance with Clause 15.2 will discontinue the relevant Processing. Notwithstanding the foregoing, a Beneficiary which has commenced Processing Data for Research Use prior to such termination or expiration may proceed with such Processing activity until completion thereof, and the provisions of this Agreement shall remain applicable in accordance with Clause 15.1(b) hereof. This shall not apply (i) in the event the Agreement is terminated for the reasons listed in Clause 15.1(c), 15.2(b) i., ii. (with respect to defaulting Beneficiary), and iv, or (ii) in the event of discontinuation or withdrawal of authorisation or Ethics Approval concerning the Research Use.

b) The Access Rights granted under this Agreement to the Data User and their Employees whose participation is terminated for the reasons listed in Clause 15.1(c), 15.2(b) i., ii., and iv. or due to discontinuation or withdrawal of authorisation or Ethics Approval concerning the Research Use will be revoked immediately.

c) All Data Users and their Employees will securely delete the Data received via the Bigpicture Platform on behalf of the Data Contributor and remove existing copies, as required under Data Protection Legislation, unless otherwise permitted by the relevant Data Contributor or as otherwise stipulated in applicable law, without prejudice to the right of the Data User to proceed with the Processing as set out in Clause 15.3a).

d) All Data Users will confirm to the Data Contributor on its written request that the erasure by the relevant Employees took place or otherwise state the reasons for the retention.