11 Legal Aspects¶

Levels of Regulation¶

Depending on the nature of the data, legal and ethical frameworks, which operate at very different levels, must be considered closely in research data management (see Figure 6). For example, when it comes to personal data, the European General Data Protection Regulation (GDPR), the German federal data protection act called Bundesdatenschutzgesetz (BDSG), the Landesdatenschutzgesetze, which are the federal data protection acts of the 16 German states, and, if applicable, their respective state higher education acts apply, as well as, depending on the specific case, further data protection regulations, for example in the Social Code, Genetics Law, Pharmaceuticals Law, and School Law. However, there may also be guidelines, policies, or even specific ethical guidelines at institutional level. Basically, researchers are subject to the "Guidelines for Safeguarding Good Research Practice" of the German Research Foundation.

In some cases, it is useful to restrict access to the data if ethical or legal aspects are involved. Furthermore, the research itself may be subject to confidentiality agreements, e.g. contract research.

Data and Privacy Protection¶

Data protection can limit data handling, especially in fields like social sciences and medicine, when dealing with personal data. The Article 4 of the GDPR (DSGVO in German) defines personal data as any information that identifies or can identify a person, including names, ID numbers, location, or characteristics like physical, psychological, or social traits. Sensitive data, According to article 9 GDPR such as racial or ethnic origin, political opinions, or health details, require stricter protection. Personal details must either be removed from the data or used with the individual’s informed consent.

The EU GDPR, in effect since May 2018, harmonizes European data protection laws to safeguard individuals' rights, especially regarding personal data. It generally prohibits handling personal data unless permitted by law or with informed, explicit consent from the individual.

Informed consent means the person is made aware of their rights, how their data will be processed, its purpose, and its use, agreeing to participate under these conditions. Information can be given verbally, such as for children or illiterate individuals. If research data will be published, this must be disclosed. Consent should include all intended uses (e.g., archiving, publication, further analyses) since extending consent later is often impractical.

To protect personal data, various methods can be used to remove references to specific individuals. For example, numerical data can be anonymized or aggregated, where personal information is either removed or replaced with non-identifiable data (e.g., using a zip code instead of a street address). Video and audio recordings can also be edited, such as pixelating faces or distorting voices. Using pseudonyms, where personal details are replaced with non-personal equivalents, is another way to process qualitative data without requiring informed consent.

Further protective measures include access restrictions by means of password protection and the assignment of access rights. For example, access to the data can be granted only to certain IPs or only to defined groups of people.

The rapid evolution of digital media today leads more than ever to careless publication of personal data – for example in the form of photographs or videos. The right to one's own image, however, includes the right of every individual to decide what happens to images or other forms of representation of oneself in public. These may only be distributed or published with a consent. A consent can be both: financial compensation or answering questions in front of a camera. Exceptions to this rule:

• Contemporary historical images
• Pictures in which the person is only depicted incidentally and not as the main motif
• Pictures of meetings or similar

Act on Copyright and Related Rights¶

Copyright law protects the creative work of individuals and industries, giving authors exclusive rights to publish, modify, reproduce, perform, and distribute their creations. For a work to be protected, it must be original and the result of creative effort. According to art. 2 paragraph 1 of the German Copyright Act (UrhG), this includes works of literature, science, and art. However, ideas or information are not protected by copyright, as they are the foundation of a work, not the work itself. Copyright lasts for 70 years after the author's death, after which the work enters the public domain.

Ancillary copyrights, also known as "related rights" protect individuals like photographers, singers, performers, and content creators. These rights safeguard artistic or scholarly contributions, including the protection of database creators, photographers, and producers of audio recordings. Other related rights are outlined in the German Copyright Act, part 2, "Related Rights." The person who carries out the protected work holds these ancillary copyrights.

In addition to copyright, research data management may involve commercial property rights. For example, employment contracts may grant the institution, rather than the researchers, the legal rights to use the data. Rights of use may also be outlined in funding guidelines, institutional policies, or agreements between departments. Open content licenses (see Publishing Research Data) are another form of contract that grants usage rights, which can be implicit or oral, rather than written. While usage rights may be transferred authorship remains with the data creators.

If the research or its results are likely to be commercially viable, it is advisable to contact the office for knowledge transfer of your own institution. They can clarify how the licensing and reuse of the data is regulated. They also provide detailed information on patent law.

Contract law¶

Further rights and obligations for the handling of research data may arise from existing contractual agreements. These might be contracts with funding agencies as well as with scientific or economic cooperation partners.

Data usage agreements govern the sharing of data with colleagues for collaborative processing outside of collaboration agreements prior to publication. The terms under which third parties may process data are outlined in such a contract.

Two objectives are pursued by a data usage agreement:

1. Protecting the data provider from data misuse
2. Preventing misunderstandings by both contracting parties by ensuring that all data use questions are clarified.

A data use agreement is itself a licence that regulates usage rights and other conditions. In particular, it includes the following:

Use Cases¶

1. Researcher 1 and Researcher 2 work together using data from Researcher 1, but they don’t have a formal agreement about how the data should be used. When Researcher 2 gets a great result, he gets excited and publishes it quickly, forgetting to include Researcher 1. Fact: Authorship must be governed.

2. Researcher 1, from Institute 1, shares his data with Researcher 2, from Institute 2, for a collaborative project. They work well together. During the project, Researcher 1 changes his institute and third-party funded project. Despite this, they continue collaborating and are close to publishing their results. However, they suddenly realize they don’t know if Researcher 1 was permitted to take the data to his new institute or keep sharing it. They are unsure how to move forward. Fact: Data usage contracts run between researchers, but also between their respective institutes.

3. Researchers 1 and 2 collaborate on data for a long time and publish their work together. Later, they move on to separate projects. Years later, one of them discovers the old data while cleaning his hard drive. Realizing the data is relevant again, he publishes new work using it but doesn’t include his former colleague, as they’ve lost touch. Fact: Deletion periods must be governed.

4. Two researchers share a dataset for a joint project. The data is highly valuable and could bring significant recognition when published. One evening, Researcher 2 meets a colleague at a bar and casually emails the data to him, just to show it. Unfortunately, the colleague uses the data and publishes it. This leads to a major conflict between the original two researchers, including legal disputes. Fact: Transfer to third parties must be governed and followed.

5. A group of researchers shares a dataset for collaborative work, all focused on scientific goals. However, one researcher is approached by a large company interested in the data and offering a lucrative deal. The researcher partners with the company, and the data is used commercially. As a result, the scientific impact of the original planned publication is lost. Fact: The type of use should be governed along with transfer options.

Recommendations for a jump start¶