Research data are usually not only meant to be archived, but also to be made available to other research institutions or individuals. When sharing data with third parties certain legal regulations in copyright and data protection law have to be considered. Ambiguous situations and complications can usually be avoided, if research data are given an appropriate license and if the management of personal data is carefully planned in advance.
Copyright Law (UrhG)
An important desideratum in academia is long-term preservation of research data. Research data can only be archived long-term with the permission of the rights holder (e.g. the creator or principal) and if third-party rights are not violated which means that either the data must be licensed or a simple or exclusive right to use must apply . An overview of German usage rights is provided in UrhG §15.
It is recommended to treat research data as a protected resource according to German copyright law, since in some cases the necessary threshold of originality may be reached or the data fall under copyright protection as part of a data bank (§ 87a UrhG). The protection as a data collection/data bank only applies, if a "substantial investment" has been made. In that case, the person or institution, that bore the financial and organisational risk associated with the investment, would be determined as the rightsholder to the data bank.
Whether or not data fall under any protection laws, can only be ascertained through legal assessment of each individual case. That is why research insitutions should contractually determine conditions for re-use of the data with the author/creator.
Another area that might cause legal issues with long-term preservation of data are third-party funded projects. When research institutions become proprietors of research data via such projects, this can lead to legal obligations to store the data (§ 16 UrhG) and make them accessible online (§ 19a, 87b UrhG). Especially if several institutions are involved in a cooperation project, contracts about data ownership should be negotiated in advance .
Data Protection Law
Personal and/or sensible data can present a special challenge when archiving or publishing them, since they fall under several data protection clauses:
- Federal Data Protection Act (Bundesdatenschutzgesetz)
- State Data Protection Acts
- Social Code § 67b Abs. 1 SGB X
Data that fall under either of these laws can still be archived and even published, provided that discipline-specific ethical standards and regulations are complied with. The following list compiled by the UK Data Archive provides an overview of a few relevant aspects:
- In order to be able to use personal/sensitive data for research and to archive it, informed consent is needed.
- Before sharing such data, make sure the principles of purpose (why you need the data) and data economy (use as little data as possible) apply.
- Where necessary, identities have to be protected by anonymizing or pseudonymizing personal data.
- Arrangements about access to the data have to be considered/made.
- In some cases an evalutation by an ethics committee might be necessary.
Data in the workplace
When an employee creates a work in the work place, the rights to these works regularly belong to the employer. The concession of these rights usually happens upon signing the contract of employment/service or, at the latest, when handing over the work (§43 UrhG). If the author of the work/data bank is in an un-tenured work relationship with the employing institution/university, this means tha he or she is legally obligated to transfer the usage rights to their employer.
However, this basic legal principle does not apply to tenured staff such as professors (including guest and honorary professors) due do their constitutionally guaranteed right to academic freedom (Art. 5 Abs. 3 GG). So, if a tenured professor creates a work or database, the usage rights are not automatically transferred to the university .
Issues to consider for academic work contracts:
- contracts should contain a clause that give the research institution as your employer basic usage rights for all results of your research (unless in a tenured relationship)
- the conceded rights should be named, specifically and precisely
Data archiving and informed consent
Before archiving personal and/or sensitive data, written consent of the person in question needs to be obtained (see § 126 Abs, 1 BGB), either in paper or electronic form (see § 126 Abs, 3 BGB). A copy or a fax are not sufficient.
What to consider before archiving or publishing personal/sensitive data:
- Do you have written consent for archiving/publishing the data?
- If there are personal data in your data set, are they really necessary to understand the data? (principle of data economy)
- Have appropriate technological and organisational measures been taken to secure archived, personal data in accordance with § 9 S. 1 and § 9 S. 1 BDSG as well as § 7 Abs. 2 NDSG and the applicable regulations in your state of residence?
More information (German only) is provided by the Baden-Württemberg Data Protection Office (ZENDAS).
- ↑ Spindler, Gerald & Hillegeist, Tobias (2011): „Rechtliche Probleme der elektronischen Langzeitarchivierung von Forschungsdaten“. In Büttner, Stephan; Hobohm, Hans-Christoph; Müller, Lars (Hrsg.): Handbuch Forschungsdatenmanagement. Bad Honnef, Bock u. Herchen.