ASLM Africa Laboratory Mapping Program

Basic Concepts in this draft:

1. ASLM wants to analyze, visualize, and draw conclusions  (create derivatives) from data owned by “Providers” (e.g. country MOHs, NGOs, Device manufacturers, WHO)

2. “Providers” who own data (or have copyright or some claim of ownership)  sign a data sharing agreement specifying the data custody terms and intellectual property terms under which the data is shared with ASLM

   1. Data custody terms include the rights and obligations on when, how, etc data will be stored, kept, disposed of by ASLM.

   2. Intellectual property terms define the rights and obligations of providers, ASLM, and third parties, on how the data and derivatives of it are owned and are shared. Because intellectual property is well-developed area of legal expertise, this data sharing agreement draft relies on proven licensing methods that are valid internationally for scientific, health and business purposes. InSTEDD strongly dis-recommends improvising licensing schemes or allowing non-experts to have significant say in these matters.

   3. The chosen license allows the creation of derivatives (and derivatives of derivatives) as long as the derivatives have correct attribution of the Providers, the use of derivatives is restricted to non-commercial use (unless Provider wants to). 

At a Glance

References

3. This draft agreement relies on global standard licenses (namely Creative Commons 4.0 and higher)  for licensing of data and derivatives.

   1. This has strong precedence as leading international practice for sharing of datasets, see Examples of use of Creative Commons internationally and scientifically by governments and institutions

   2. See Creative Commons for Databases FAQ

   3. Additional great background reading for data governance and sharing

   4. A relevant case study specific to diagnostics of African Sleeping Sickness and the benefits of sharing derivative conclusions openly with creative commons in PLoS.

   5. A conceptual blog post outlining the concept of using chain of custody licenses for privacy protection.

Pending Questions for ASLM

• Which country / governing law?

• Do we need to review this agreement with BMGF or other parties?
  
  

DRAFT Data Sharing Agreement for ASLM

Between:

ASLM: 

Provider:

I. Definitions

1. ASLM: (...)

2. Provider: Institution or party such as MOH, MOH department, NGO, WHO office etc that is agreeing to provide data to ASLM.

3. Primary datasets: the main data records being shared to allow ASLM to fulfill the Purpose. Primary datasets may be accompanied by accessory data, such as metadata and ancillary information for correct interpretation or display in Derivatives.

4. Derivatives: Original work developed by ASLM or 3rd parties that is materially based on the primary datasets shared by Provider.  Derivative works will be considered “Adapted Material” under the CC BY-NC-SA 4.0 terms.

5. CC BY-NC-SA 4.0: Creative Commons,  Attribution-NonCommercial-ShareAlike 4.0 International License.
   It is described in this human-readable text: https://creativecommons.org/licenses/by-nc-sa/4.0/ 
   And this complete legal code: https://creativecommons.org/licenses/by-nc-sa/4.0/legalcode

6. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 which can be found at: https://www.ietf.org/rfc/rfc2119.txt .

II. Purpose

The purpose of this agreement is to specify the terms and conditions under which Provider will share data with ASLM. It describes the rights and obligations of the Provider and ASLM with regards to data custody, and with regards to data intellectual property.

In the terms there are descriptions of specific pieces of information that ASLM and Provider must exchange and acknowledge. These are captured in Addendum A: Data Sharing Worksheet to simplify collecting the required information.

III. Data Custody

1. Provider must give primary datasets to ASLM. 

   1. With an agreed definition and completeness.

      1. Agreeing it contains certain ‘columns’ or data fields.

      2. Agreeing it contains certain events or rows.

   2. In an agreed timeframe.

      1. Automatically from the Provider shortly after the data gets generated or collected by Provider, or within a fixed period from ASLM’s request.

   3. In an agreed method.

      1. ASLM and Provider must collaborate in order to establish a secure and reliable method (e.g file exchange, API query, uploads to online workspace, etc.)

   4. Provider should collaborate with ASLM to assist with correct interpretation of the data by providing a data model, or commentary on the fields, to ASLM’s satisfaction.

   5. Provider should include supporting datasets (e.g. a list of district names) in addition to the primary datasets.

   6. If Provider can’t share data as specified due to a technical or non-technical issue Provider should notify ASLM proactively, and should work with ASLM to resolve the issue

2. ASLM must follow Data Storage practices:

   1. ASLM Should store data as appropriate for their goals of creating useful derivatives:

      1. In appropriate formats determined by ASLM, 

      2. Using appropriate storage means determined by ASLM,

      3. Under exclusive custody of ASLM or by 3rd parties that must be beholden to ASLM and terms of this agreement.

   2. ASLM may discard or delete parts of the data if not necessary for their goals.

   3. Provider should ensure the ASLM copy of data is not the only copy in existence. Under this agreement ASLM is a custody of a copy the data for the purpose of development of useful derivatives, not as a hosting service for the primary storage of Provider data.

   4. ASLM must implement professional-level data custody practices, including access control, access audit, and communications with Provider about custody risks.

3. Creation of Derivatives

   1. ASLM may create derivatives by querying, filtering, processing and crosslinking the data supplied by Provider:

      1. Derivatives may be static (eg a PDF report, a powerpoint presentation) or may be dynamic and interactive (e.g. a dashboard website).

      2. Derivatives may be created by itself or in combination with 3rd party data (e.g. a map from google maps, a population database from open sources). ASLM must fulfill the licensing terms for derivatives as specified below in IV Intellectual Property and Licensing. 

      3. ASLM may use 3rd parties to help with creation of derivatives. These 3rd parties or the derivatives produced by them must be contractually bound by the same terms of this agreement by enforcement of ASLM. ASLM must keep records of what data is shared with what 3rd parties for what purposes.

   2. ASLM must make derivatives that used the primary datasets available to the Provider through broad publication on the internet or upon request, following the section IV. Intellectual Property and Licensing.

4. Provider control of data

   1. If requested by Provider through the specified points of contact, ASLM must be able to delete/remove the data from it’s custody within 90 days. Data deletion should be done following professional practices including archival of backups and appropriate disposal of physical media.

   2. Provider acknowledges that a request for data deletion/removal may not retroactively affect derivatives. (e.g. a pie chart drawn the previous year).

IV. Intellectual Property and Licensing

1. Provider must have ownership rights to primary dataset, specifically rights to enact this agreement. Provider must guarantee that information is ethically sourced and that data collection methods have implemented appropriate informed consent, opt-out, and chain of custody practices.

2. Provider must assure the datasets being shared are respectful of individuals’ privacy and are de-identified, and anonymized, or otherwise transformed in ways that preserve privacy of individuals.

3. Provider acknowledges some accessory datasets, and are just exchanged for correct interpretation of the primary dataset, may be treated as being in the public domain (eg. a list of province names and IDs, or  a list of disease codes) and are immaterial to licensing terms of the primary dataset, so are excluded from this agreement for practical reasons.

4. Provider is responsible for authoring and providing ASLM appropriate attribution text (e.g. “This work is based on data provided by the Tuberculosis Control program of the Nigeria Ministry of Health”).

5. Provider must give data to ASLM under the CC BY-NC-SA 4.0 license.

   1. This is a legal international license appropriate for databases and other work, found in Definitions.

   2. It guarantees ASLM must add attribution to Provider’s contribution if derivative work is produced, as specified in license text.

   3. It guarantees that ASLM cannot perform commercial work using the dataset, as specified in license text.

   4. It guarantees that secondary derivatives also must follow these terms, as specified in license text. (eg someone creates a presentation using an ASLM -generated graph that’s based on data from a Provider in Nigeria)

   5. If Provider is sending documents or additional data beyond the primary dataset that Provider considers is under the terms of this sharing agreement,  it must annotate it with the following text to make sharing terms explicit and unambiguous:
      “© Provider Name, Year, Licensed as CC BY-NC-SA 4.0”
      (Example: “© Ministry of Health of Zambia, 2018, Licensed as CC BY-NC-SA 4.0”)

6. Provider may choose to share data with ASLM under additional data licenses, or under additional terms outside of the terms of this Data Sharing Agreement.  This puts Provider in control of how and when additional data uses by ASLM are possible.

   1. If ASLM were to encounter the opportunity to generate commercial work (eg with a diagnostics company), it must work with Provider to get the same dataset licensed under different terms (for example CC BY-SA 4.0, which requires attribution but does not restrict commercial use, but any license can be used including licences not based on Creative Commons). This gives the Provider an opportunity to negotiate with ALSM the terms under which it ASLM or 3rd parties achieve commercial use of derivatives.

7. ASLM must license derivatives under CC BY-NC-SA 4.0

   1. This is a legal international license appropriate for databases and other work.

   2. It legally guarantees the Provider shall have  access to derivatives.

   3. It guarantees further derivatives beyond those created by ASLM are also bound by the same transfer terms, as specified in license text.

   4. When creating derivatives, ASLM must follow CC BY-NC-SA 4.0  terms by:

      1. Adding attribution credit information to all subsequent derivatives, as specified in license text. The Creative Commons website provides simple text-based and image-based guidelines to achieve this. 

      2. Notifying the Provider of derivatives and giving Provider royalty-free access, or placing them in public domain, as specified in license text.

      3. Not sharing the raw data with 3rd parties for commercial purposes (as defined in license text), or using data directly for commercial purposes, without entering a additional licensing agreement with Provider.

V. Additional Provisions

1. Parties agree to keep each other’s point of contact information as specified in Addendum A: Data Sharing Worksheet updated and current.

2. Warranties  (...)

3. Termination (...)

4. Force Majeure  (...)

5. Governing law  (...)

VI. Signatures

1. ASLM (...)

2. Provider (...)

Addendum A: Data Sharing Worksheet