Current through Register Vol. 51, No. 19, September 20, 2024
A. An
approved applicant shall enter into and sign a data use agreement prior to
receipt of the requested data. If an approved applicant does not sign a data
use agreement within 30 days of the date of written notification of application
approval, the application shall be deemed withdrawn and will receive no further
consideration.
B. Prior to entry
into a data use agreement and receipt of requested data, an approved applicant
shall disclose any data sharing plan or agreement required by a funding source
as a condition of an applicant's receipt of funding.
C. A data use agreement entered into with a
data recipient under §A of this regulation shall, at a minimum:
(1) Define the scope of use of the requested
data and the research methodology;
(2) Provide a plan for safeguarding the
privacy and security of the data and complying with all applicable laws
governing the privacy and security of data;
(3) Require a data recipient to adhere to
security processes and procedures aimed at preventing unauthorized access, use,
or disclosure of the data;
(4)
Require that a data recipient notify Commission staff of any potential or
actual data breach, including any instance of unauthorized access, use, or
disclosure of data, no later than 7 days from the date of knowledge of the
breach;
(5) Require a data
recipient to notify Commission staff in writing within 24 hours of receipt of
any request from a third party requesting a data recipient to disclose all or
part of the data received from the Commission, including but not limited to
compulsory process, such as a subpoena, discovery request, warrant, or judicial
or administrative order, or a public information act request, to provide the
Commission adequate time to intervene and respond before the date that a data
recipient has been requested or ordered to provide the data;
(6) Specify the beginning and end dates of a
data use agreement;
(7) Provide for
the return or destruction of data by a certain date upon termination of a data
use agreement, or upon a determination that a data recipient has failed to
comply with a data use agreement;
(8) Require that a data recipient comply and
assist, if requested, in any audit of compliance with a data use
agreement;
(9) Provide that a
breach of any term or condition of a data use agreement is a breach of
contract;
(10) Permit that
appropriate administrative and judicial remedies under applicable law may be
pursued against a data recipient for failing to comply with the terms and
conditions of a data use agreement; and
(11) Be signed by:
(a) A person authorized to contractually bind
a data recipient's organization; or
(b) A data recipient, if a data recipient is
not part of an organization.
D. The Executive Director may consider a
request from a data recipient for an extension of time or a modification of a
term or condition of an executed data use agreement if:
(1) A data use agreement includes an express
provision allowing a request for an extension of time or a modification of a
term or condition;
(2) A data
recipient submits a written request in the form and manner specified by the
Commission, which shall include the reasons for the request, or specify good
cause for the extension or modification request;
(3) A request for an extension of time states
the requested new end date for the data use agreement; and
(4) A request for modification does not seek
approval of a new or different use of the released data that was not approved
under Regulation .10 of this chapter.
E. Commission staff shall refer a written
request for an extension of time or a modification of a term or condition of a
data use agreement to the Executive Director for a decision. The Executive
Director shall:
(1) Consider a data
recipient's written request submitted under §D of this regulation before
making a decision; and
(2) Make a
decision to approve, approve with conditions, or disapprove the request, and
notify the data recipient in writing of the decision.
F. If the Executive Director approves an
extension or modification request, or approves with conditions, the Executive
Director shall issue a signed, dated written amendment to the data use
agreement approving the extension or modification request, stating the new end
date of the data use agreement, if applicable, and specifying any additional
conditions on the extension or modification.
G. Re-Use of Data.
(1) A data recipient who wishes to re-use
data previously released, pursuant to an approved application and executed data
use agreement prior to the termination of the data use agreement and
destruction of the data, for a different use or purpose or to link with other
data sources not described in the approved application shall submit a written
application in the form and manner specified by the Commission and pay a
nonrefundable application fee in the amount published on the Commission's
website at the time of submission of an application for re-use of previously
released data.
(2) Commission staff
shall refer a data recipient's completed application for re-use of previously
released data prior to termination of a data use agreement for a different use
for DRAC and Executive Director review, in accordance with Regulations .09-11
of this chapter.
(3) If a re-use
application is approved, a data recipient shall pay the applicable
nonrefundable data re-use fees in full in the amount published on the
Commission's website before a data recipient can use the previously released
data for a different use or purpose.
H. A data recipient who wishes to request
additional data not requested in a data recipient's approved application and
described in a data use agreement shall:
(1)
Submit a new application in the form and manner specified by the Commission and
pay a new nonrefundable application fee in accordance with Regulation .12 of
this chapter, regardless of whether a data recipient intends to use the
additional data for the same use described in a data recipient's previously
approved application; and
(2) Pay
required fees for receipt of additional data in accordance with Regulation .12
of this chapter if a data recipient's request for additional data is
approved.