Example of a DUA for a dataset

[mih]

Like a data usage agreement (DUA) covering a dataset can be expressed within a ODRL policy document. Hence this is related to #153, and the example could/should focus on that approach.

Related properties are:

• https://www.w3.org/TR/vocab-dcat-3/#Property:resource_access_rights
• https://www.w3.org/TR/vocab-dcat-3/#Property:resource_license
• https://www.w3.org/TR/vocab-dcat-3/#Property:resource_rights
• https://www.w3.org/TR/vocab-dcat-3/#Property:resource_has_policy

[loj]

I've put together a few broad categories that represent common limitations/constraints/requirements from DUAs that would possibly want to be recorded as part of a dataset. Most categories would require further reading of the DUA for specifics, but it could at least be recorded whether or not a type of requirement (e.g. publication requirement) exists.

• Data Access: usually authorized for institute, project, or individual
  Examples:

  • Institute level access: anyone from the institute listed in the DUA can have access
  • Project level access: only those working directly on the project specified in the DUA are allowed to have access
  • Individual level access: only authorized individuals can have access

• Research Use Limitations: often use is limited to a specific project or scope
  Examples:

  • Research must be within scope of the defined project/research use statement
  • Research use statement, but broad use/exploration encouraged
  • Broad use is encouraged

• Reporting Requirements:
  Examples:

  • Submit an annual report of research progress

• Publication Requirements: specific actions required with any public disclosure of results
  Examples:

  • Cite specific paper
  • List specific people as authors
  • Include appropriate acknowledgements
  • Notification of publication
  • Approval of publication
  • Make any publications that arise from use of data open-access
  • Return results data to upstream

• Infrastructure Requirements: requirements imposed on the infrastructure where data is stored/used
  Examples:

  • Security best practices
  • Access controls, logging
  • Report security incidents
  • Data must remain on institution's server
  • Data must be encrypted
  • No storage on portable media
  • Delete data when research is completed or DUA is expired
  • Participant withdrawals

• Term: date the DUA expires

[mih]

I spend a moment to think about easing into this topic in a FLAT annotation scenario (input focused). I do not really see people composing ODRL policies by hand. Either their are precrafted and simply assigned, or something else is needed.

https://www.ebi.ac.uk/ols4/ontologies/duo has "data use modifiers" and "data use restrictions" that are pretty much instances of ODRL Rules.

I think if there is a DUA document for a dataset, it should be linked directly. In addition an attempt could be made to codify it in ODRL.

Even in the absence of a formal agreement, it could help in a concrete metadata app to provide simple rights-related tags. Those could sail under the label of "Data usage rules". A dataset could be tagged based on a predetermined collection of such rules, and a "policy-generator" could even crank out real ODRL statements based on them.