Gliomas, glioneuronal and neuronal tumors

• RS DUO:0000012 (version: 2021-02-23)research specific restrictionsThis data use modifier indicates that use is limited to studies of a certain research type.
• IRB DUO:0000021 (version: 2021-02-23)ethics approval requiredThis data use modifier indicates that the requestor must provide documentation of local IRB/ERB approval.
• GRU DUO:0000042 (version: 2021-02-23)general research useThis data use permission indicates that use is allowed for general research use for any research purpose.

BTB Personal Data Transfer Agreement

Personal Data Transfer Agreement (sep2023) __________ This Personal Data Transfer Agreement (this “DTA”) has been entered into by and between: PARTIES Karolinska University Hospital (corp. reg. no. 232100-0016), a public teaching hospital organized under the laws of Sweden, through [insert department at K], having its principal place of business at [Eugeniavägen 3, 171 64 Solna], Sweden (“K”) and [Insert name of Company/organisation/person that is to receive the data], ([corp. reg. no./pers. ID no. xxxxxx-xxxx]), a [insert legal entity such as “company”] organized under the laws of [Sweden/other country], having its principal place of business at [insert address], [Sweden/other country] (“Recipient”). The above parties are hereinafter jointly referred to as “Parties” and separately as “Party”. WHEREAS (A) K has collected personal data in the field of pediatric cancer research via Barntumörbanken (BTB)/The Swedish Childhood Tumour Biobank. BTB is a research project, national sample collection and infrastructure with the overall aim to enhance and be a resource for increased knowledge on childhood tumours, leading to positive impact on the future clinical care and outcome of children with cancer. BTB collects biobank samples from Swedish pediatric cancer patients and performs genomic and molecular genomic analysis on the collected tissue material. K is the research principal for the BTB project (ethical permits Dnr 2021-04058), while the main activities in the project are conducted at Karolinska Insititutet (KI), were BTB is a unit, in accordance with separate agreements between K and KI. BTB has procedures including scientific and regulatory evaluations for the secondary use of personal data collected and/or generated within the project. The personal data collections are under the supervision of Johanna Sandgren as Director for BTB at KI and Mathias Axelsson as the head of Molecular Diagnostics Karolinska/K. [K is the controller of the collected personal data, as that term is understood under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter “GDPR”). GDPR and all other applicable laws and regulations on data protection shall hereinafter jointly be referred to as “Data Protection Laws”. (B) Recipient would like to have access to certain personal data that K has collected. Recipient’s purpose of processing the personal data is academic research with ethical approval. The purpose of the personal data processing is for this project… [Insert a brief description of the Recipient’s purpose of processing the personal data that K has collected. A further description about the purpose of processing the personal data shall be described in Attachment 1 “Description of the Research”. The timeframe and methodology by which the data and/or data will be dispatched shall also be set out in Attachment 1.] (hereinafter the “Research”) as further described in Attachment 1 (the “Description of the Research”). (C) K is willing to transfer the personal data to Recipient, with the following legal basis according to GDPR: Article 6.1 (e) and 9.2 (j). NOW THEREFORE, the Parties have agreed as follows: 1. ACESS TO DATA 1.1 The transfer, as well as the personal data covered (the “Dataset”), are specified in Attachment 2 (the “Description of the Transfer”). 1.2 Recipient alone has determined the purposes and the means of processing the Dataset in regard to the Research described in Attachment 1 and the Parties therefore agree that they are both independent controllers. 1.3 The Dataset shall at all times be transferred to Recipient by appropriate technical and organizational measures to ensure a level of security appropriate to the risk of the transfer according to the instructions in Attachment 2. 1.4 Any personal data in the Dataset shall be pseudonymised, as that term is defined under GDPR, by K, so that the personal data cannot be attributed to a specific data subject without the use of a link or code key which is retained separately by K, i.e. in a coded and encrypted format which protects data subject identities. [Ta bort klausulen om beslut (från verksamhetschef eller samrådsgruppen för datautlämning) för utlämnande av icke pseudonymiserade personuppgifter finns.] 1.5 The Parties acknowledge that K’s responsibilities regarding the processing of personal data under this DTA is limited to the transfer of the Dataset to Recipient. 1.6 Recipient is the independent controller of all processing activities that Recipient performs after having received the Dataset and Recipient understands and agrees that Recipient is solely responsible for ensuring compliance with Data Protection Laws. 1.7 The Parties agree that in relation to the processing of personal data, this DTA shall take priority over any other agreement between the Parties. 2. PERMITTED USE 2.1 Recipient agrees to only use the Dataset for the purposes set out in this DTA and to otherwise not use or disclose the Dataset unless required by applicable law. 2.2 K shall be free, in its sole discretion, to distribute the Dataset, in whole or in part, to others and to use it for its own purposes. 3. PROCESSORS 3.1 Where Recipient’s processing of the personal data will be carried out by a processor on behalf of Recipient, Recipient shall ensure that the processor will implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of Data Protection Laws. 4. DATA PROTECTION 4.1 Any information included in the Dataset shall be securely safeguarded, encrypted and appropriately protected from unauthorized access, use and theft. Recipient shall, as a minimum, observe the requirements on technical and organizational measures set forth by Data Protection Laws. Recipient shall notify K of any errors detected in the personal data without undue delay. 4.2 Recipient shall refrain from analysing and/or using personal data in a way that has the potential to (i) lead to the re-identification of any data subject, (ii) compromise the anonymity of a data subject in any way, or where applicable (iii) result in use of personal data outside the strict scope of any data subject’s consent. For the avoidance of doubt, Recipient shall under no circumstance use the information included in the Dataset to identify or contact data subjects unless specific permits are established for such handling. 4.3 The Parties agree to provide reasonable assistance as is necessary to each other to meet obligations placed upon them as controllers under this agreement and Data Protection Laws in an expeditious and compliant manner, including but not limited to obligations relating to the handling of personal data breaches and data subjects exercising their rights. 5. INTELLECTUAL PROPERTY 5.1 The transfer of the Dataset for use in the Research does not constitute a transfer of rights or titles to the Dataset and K retains title to any information included in the Dataset. 5.2 Unless otherwise agreed by the Parties in a separate agreement, rights and title to any intellectual property rights made under the Research shall vest in Recipient. Unless explicitly stated otherwise, nothing herein shall be deemed to constitute the grant of any license under any intellectual property rights, or know-how of Recipient, its researchers or of third-party collaborators. 6. PUBLICATIONS 6.1 The Dataset is made available to Recipient as a service to the research community. Therefore, the Parties agree that results of the Research will be made publicly available. [Recipient] will publish results of the Research in scientific journals in accordance with academic standards. 6.2 In accordance with scientific custom, the contribution of K, KI/BTB and its researchers shall be expressly noted in all written or oral public disclosures, by co-authorship or acknowledgement as appropriate. 6.3 For obtained methylation data used in scientific publication the SNQ&SEQ Platform should be mentioned accordingly: ¨Methylation profiling was performed by the SNP&SEQ Technology Platform in Uppsala (www.genotyping.se). The facility is part of the National Genomics Infrastructure (NGI) Sweden and Science for Life Laboratory. The SNP&SEQ Platform is also supported by the Swedish Research Council and the Knut and Alice Wallenberg Foundation¨. For obtained whole genome sequencing, whole transcriptomic sequencing and exome sequeincing data NGI should be mentioned: “The authors acknowledge support from Science for Life Laboratory, the Knut and Alice Wallenberg Foundation, the National Genomics Infrastructure funded by the Swedish Research Council, and Uppsala Multidisciplinary Center for Advanced Computational Science for assistance with massively parallel sequencing (alternatively genotyping) and access to the UPPMAX computational infrastructure”. Barntumörbanken and the Swedish childhood cancer fund should furthermore be mentioned: “The authors acknowledge The Swedish Childhood Tumor Biobank, supported by The Swedish Childhood Cancer Fund, for access to sequencing/methylation data”. 6.4 [Recipient] shall submit proposed publications referencing the Dataset, to K for review at least fourteen (14) days before the intended submission for publication. The Parties agree to abide by the policies of journals in which publications will appear as to such matters as the public release or availability of data or biological materials relating to the publication, to the extent it is in accordance with applicable law and ethical permit. 7. TRANSFER OF PERSONAL DATA TO A THIRD COUNTRY 7.1 Recipient shall ensure that any transfer of the Dataset, in whole or in part, including to any recipient located in a country outside the EU/EEA (“Third Country”), is performed in accordance with Data Protection Laws. 8. DATA TRANSFER COSTS [Alternativa klausuler: Välj det alternativ som är tillämpligt i ert fall. Ta sedan bort det alternativ som inte gäller. OBS! Denna textruta ska inte finnas med i det slutliga avtalet utan tas bort.] 8.1 [Alt. 1] K shall provide the Dataset to Recipient at no cost. 8.2 [Alt. 2] Recipient shall compensate K for providing the Dataset with the sum of [insert sum to be paid and VAT, if applicable]. Payment will be made within 30 days from the invoice date. 8.3 The invoice shall be addressed to: [Insert information on where to the invoice is to be sent] 9. CONFIDENTIALITY 9.1 Recipient shall ensure that confidentiality, to the full extent permitted by applicable law, applies to personal data contained in the Dataset and that access to the Dataset is strictly limited to the personnel (“Authorized Users”) listed in Attachment 2. 9.2 Recipient shall ensure that all Authorized Users (i) are informed of the confidential nature of the Dataset, (ii) have received appropriate training of their responsibilities, and (iii) have executed written confidentiality agreements or are under an appropriate statutory obligation of confidentiality. Recipient shall ensure that such confidentiality obligations survive the termination of their personnel arrangement. 10. COMPLIANCE WITH RULES AND REGULATIONS 10.1 The Recipient will use the personal data in the Dataset within the limits set by the study protocol as well as any biobank agreement and informed consent from study subjects, applicable to the Research described in Attachment 1. 10.2 Recipient shall also use the Dataset in compliance with all applicable legislation, rules, regulations, guidelines and ethical requirements, as well as any constraints set forth by Ethical Review Authorities or other regulatory permits, applicable to the Research described in Attachment 1 and the handling and protection of the information in the Dataset. 11. NO WARRANTIES 11.1 The Dataset is provided without warranties, expressed or implied. K makes no representations that the use thereof will not infringe any proprietary rights of third parties. 12. INDEMNITY 12.1 Recipient will indemnify and hold K harmless against any loss, claim, damage or liability which may arise from or in connection with this DTA or the use, handling or storage of the Dataset. 13. TERM AND TERMINATION 13.1 This DTA shall enter into force on the date of the last signature by the Parties. In the event that Recipient is in breach of its obligations under this DTA, K may suspend the transfer of personal data to Recipient until the breach is repaired or this DTA is terminated. In the event that Recipient (i) does not repair its breach within thirty (30) days of K giving notice thereof, or (ii) is in substantial or persistent breach of its obligations under this DTA, K may terminate this DTA with immediate effect. 13.2 The Parties agree that the termination of this DTA at any time, in any circumstances for whatever reason, does not exempt them from the obligations and conditions under this DTA in regard to the processing of any personal data transferred. 13.3 Notwithstanding anything to the contrary contained herein, Recipient shall, to the extent permitted by applicable laws including, but not limited to Data Protection Laws, delete any transferred personal data in the Dataset when it is no longer necessary to store for the purposes set out in this DTA, (as further described in Attachment 1). 14. NOTICES 14.1 Formal notices to be given under this DTA shall be in writing and be delivered to the person on the address stated below, unless the receiving Party has specifically notified the sending Party of another address for this purpose. The notice may be delivered personally or by mail but always with receipt acknowledgement. 14.2 These persons shall be the Parties’ contacts for questions regarding this DTA. K Recipient Name: Name: Address: Address: Telephone: Telephone: E-mail: E-mail: 15. ASSIGNMENT 15.1 Recipient may not assign or sublicense its rights or obligations under this DTA to any third party without the prior written consent of K. 16. AMENDMENTS 16.1 No provision of this DTA may be amended, modified or otherwise changed, other than by an instrument in writing duly executed on behalf of the Parties. 16.2 The Parties acknowledge that to the extent required, this DTA shall be amended to achieve compliance with future changes to Data Protection Laws. 17. APPLICABLE LAW AND DISPUTES 17.1 This DTA shall be governed by the laws of Sweden and any dispute arising out of or in connection with this DTA, which cannot be solved amicably, shall be settled by a Swedish court of law, with Stockholm District Court as the first instance. 18. SIGNATURES 18.1 This DTA has been drawn up in two (2) originals of which the parties have taken one (1) each. Karolinska University Hospital [Insert name of Recipient] Printed name: Title: Date: Printed name: Title: Date: Printed name: Title: Date: Printed name: Title: Date:   ATTACHMENT 1 DESCRIPTION OF THE RESEARCH Description of the research The personal data shall be used in the following research: Mention EPM Dnr.. Investigators: Background Objective: Questions that may be explored in the [Insert the name of the study] study: Methods: Samples requested: References   ATTACHMENT 2 DESCRIPTION OF THE TRANSFER Data subjects The personal data transferred concern the following categories of data subjects: Categories of data The personal data transferred concern the following categories of data: The frequency of the transfer The data is transferred on a one-off or continuous basis: Purpose(s) of the transfer(s) The transfer is made for the following purposes: Authorized Users The personal data transferred may be disclosed to the following personnel or categories of personnel: Sensitive data Describe sensitive data and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures. The personal data transferred concern the following categories of sensitive data: Appropriate technical and organisational measures Description of the technical and organisational measures implemented by the [Recipient] (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons. The technical and organisational measures must be described in specific (and not generic) terms Following technical and organizational measures will be taken: Additional useful information (storage limits and other relevant information) Contact points for data protection enquiries [Insert name of Recipient] Karolinska University Hospital [Contact] [Email-address to contact] Karolinska University Hospital Data Protection Officer dataskyddsombud.karolinska@regiontsockholm.se