Data Access Policy for Datasets Deposited at the European Genome-phenome Archive (EGA)

1. Nature and conditions of the data

The datasets covered by this policy consist of pseudonymised human genomic, biological and/or health-related data derived from research participants, including patient samples. The data are:

2. Steps for the requestor

1. Submit a written proposal to the IDIBELL Data Management Unit

   Before the access request is granted, send a written proposal to:

   datamanagement@idibell.cat
   The Data Management Unit will instruct the requestor on preparing the Data Transfer Agreement (DTA) required to be signed by the requestor's institution.

   The proposal must include, at a minimum, the items listed in section 3. If the information provided is insufficient or incomplete, the DAC may request additional information before the evaluation is started or completed.

2. Evaluation by the IDIBELL Data Access Committee

   The Data Management Unit routes the proposal to the Data Protection Coordination, which performs an initial completeness check. The IDIBELL DAC — composed at minimum of the Data Protection Coordinator and the Principal Investigator responsible for the dataset — evaluates the proposal considering:

   • the scientific merit of the project and the compatibility of the proposed purpose with the conditions of use of the dataset;
   • coherence with the limitations derived from the informed consents, the ethical approvals and the access policies applicable to the dataset;
   • the scientific, ethical, legal and data-protection risks associated with the request.

   Decisions are taken by consensus: the DAC may approve, approve with conditions, or deny the request. The requestor is notified of the decision and, where applicable, of the additional information or conditions required.

3. Execution of the Data Transfer Agreement (DTA)

   If the proposal is approved:

   • IDIBELL provides the Data Transfer Agreement (DTA / Data Access Agreement) to the requestor;
   • the DTA is signed by a duly authorised representative of the requesting institution and by IDIBELL; the recipient Principal Investigator acknowledges the obligations in writing;
   • the DTA includes the description of the Data (Annex 1) and the description of the Project (Annex 2).
   Access to the data will not be granted until the DTA has been executed by both parties. The DTA grants a limited, non-exclusive, non-transferable and non-sublicensable right to access and use the data solely for the approved project, for a period not exceeding three (3) years, extendable by written agreement signed before expiry.

4. Request access at EGA

   Once the DTA is executed, submit (or complete) the data access request through the EGA platform. Access is then granted through the controlled-access mechanism of EGA to the authorised personnel listed in the application.

   The requestor must notify IDIBELL within 30 days of any changes or departures of authorised personnel, and prior to any significant change to the approved protocol of the project.

5. Use of the data, monitoring and end of access

   From the moment access is obtained, the requestor is responsible for the use, storage and, where applicable, disposal of the data, always in compliance with applicable law. Main obligations:

   • Permitted use. Use the data only for the approved project and for research purposes; no other use without the prior written authorisation of IDIBELL and, where applicable, of the DAC.
   • Confidentiality and no re-identification. Preserve at all times the confidentiality of the data and of the research participants; do not attempt to identify or re-identify any data subject, and do not link or combine the data with other information in a way that could re-identify participants, even with freely available data.
   • Storage and security. Store the data only at the institution indicated in the proposal, with appropriate technical and organisational measures (institutional systems behind a secure firewall with restricted access, password-protected and screen-locked laptops, encrypted portable media); do not change the custody of the data without prior written consent.
   • Third parties. Do not transfer or disclose the data, in whole or in part, or any material derived from the data, to any third party or outside the approved territory without prior written consent; external collaborators must complete a separate application for access.
   • Data breach. Notify IDIBELL without undue delay and no later than 24 hours after discovering a data breach; take all measures at own expense to correct and limit its consequences and cooperate in the investigation and in the reporting to the competent authorities.
   • Serendipitous findings. Report to IDIBELL any finding that may be of direct and substantial consequence for the health or well-being of a participant or their family members.
   • Consent withdrawals. Comply with the instructions of IDIBELL when a participant withdraws or modifies consent, or when legal or ethical requirements restrict the use of specific data.
   • Publications. Acknowledge IDIBELL and the data producers, and describe how the data can be accessed (name of the hosting repository and accession numbers). Respect the publication policy of the dataset, including the moratorium allowing the data producers to publish the first peer-reviewed report (by default, 12 months after the data were first made available on EGA, unless earlier written consent is granted). Follow the Fort Lauderdale Guidelines and the Toronto Statement.
   • Intellectual property. Do not make IP claims on the data or use IP protection to block access to, or use of, the data or conclusions drawn directly from them. Downstream discoveries may be licensed in line with the NIH Best Practices for the Licensing of Genomic Inventions (2005) and the OECD Guidelines (2006). Share with IDIBELL a summary of the research results generated.
   • End of access. When the project ends or the agreement is terminated, cease using the data and delete or destroy all copies, confirming this in writing to IDIBELL, unless retention is required for audit or legal purposes.
   • Monitoring. Provide reasonable updates on the progress of the project on request, and, if requested, allow inspection of data security and management documentation to verify compliance with the DTA.

3. Required information for the written proposal

• Applicant investigator information: name and surname, institution, postal address, telephone, e-mail.
• Reference dataset/study: EGA Study ID and dataset accession number(s) requested.
• Description of the project/study: title, principal investigator, abstract/summary, detailed objectives and expected results.
• Full team/staff list who will have access to the data and in what capacity (name, e-mail, job title, supervisor).
• Ethics committee approval of the project.
• Purpose of use of the data and how the data will contribute to the project/study.
• Where the data will be stored: full legal name and address of the institution where the data will be kept.
• Contact details of the Data Protection Officer (DPO) of the receiving institution.
• Conditions of data retention and storage: location, type of data storage, and the technical and organisational security measures that will be applied.
• Third-country transfers: where applicable, the intention to transfer personal data to a recipient in a third country or international organisation.
• Retention period for which the data will be retained after use or, where this is not possible, the criteria used to determine this period.
• End of project: what will be done with the data after the end of the project.
• Non-academic products: whether the study/project or any of the results derived from the use of the data will be used for the creation of products for non-academic purposes.
• Third parties: whether it is foreseen that the data or project results will be shared with any third parties.

4. Key terms of the Data Transfer Agreement

5. Data protection

• The requestor acts as a data controller with respect to its use of the data and is responsible for applying the technical and organisational measures necessary to guarantee the security of the personal data.
• The Data Protection Officer of IDIBELL is Fundació TIC Salut Social. Requests relating to personal data may be addressed to dataprotection@idibell.cat. More information is available at http://www.idibell.cat/ca/content/politica-de-privacitat.
• Data subjects may exercise their rights of access, rectification, objection, erasure, restriction of processing and portability by contacting the relevant data controller, and have the right to lodge a complaint with the competent supervisory authority.

6. Contacts

7. Data Transfer Agreement (DTA) template