Data user agreement template - suggestions

[DorienHuijser]

Hi all! I received @jsheunis 's request for input and I have a few possible additions to the Data User Agreement. At the same time that the OBC working group was working on this agreement, I was too (for our own research group initially). For our agreement, I have been in contact with the privacy and law departments of Leiden University (NL).

The current OBC's template already contains the most important articles, but a few additions you could include (copy-pasted from our current template, some may be a bit too wordy though):

• 1. I acknowledge that the data are provided “as is”, without any warranty of satisfactory quality or fitness for a particular purpose or use, or any other warranty
• 2. I will keep hard copies of the data in a (digitally) locked area/location and I will protect electronic copies of data using passwords or on a secure disk, preventing data leakages at all times.
• 3. I will immediately alert the providers (the "owners" of the data) in case of use, reuse or disuse that is not authorized by this agreement, including cases of data leakage, breach of personally identifiable information, loss of data and disclosure of data to unauthorized parties.
• 4. This one is a bit extreme: The provider(s) retain(s) the right to inspect the security, storage or other arrangements for the data and request additional information about the user’s research project and/or its progress.
• 5. Method of data sharing: After the user(s) has/have requested access and agreed to the current agreement, the provider(s) will grant access to the data via:
• 6. After termination, the user(s) is/are required to remove (all elements of) the data from their own storage and to make certain that no third parties have access to the data. A notification to the provider(s) is also required.
• 7. Added per suggestion of our law department: Dutch law applies to this agreement. Disputes will only be submitted to the district court in The Hague, but not before the parties have made an extreme attempt to settle their dispute in another way. of course this may not be feasible for an international template
• 8. You could consider adding a line for the name, contact info and date (and [digital] signature?) so that it is possible to keep a good overview of who has access to which data

I didn't want to do a pull request as these are a lot of points to include and you are completely free to leave them out :) Curious to know what you think!