Md. Code Regs. 10.25.05.13

Current through Register Vol. 51, No. 22, November 1, 2024

Section 10.25.05.13 - Data Use Agreement

A. An approved applicant shall enter into and sign a data use agreement prior to receipt of the requested data. If an approved applicant does not sign a data use agreement within 30 days of the date of written notification of application approval, the application shall be deemed withdrawn and will receive no further consideration.

B. Prior to entry into a data use agreement and receipt of requested data, an approved applicant shall disclose any data sharing plan or agreement required by a funding source as a condition of an applicant's receipt of funding.

C. A data use agreement entered into with a data recipient under §A of this regulation shall, at a minimum:

(1) Define the scope of use of the requested data and the research methodology;

(2) Provide a plan for safeguarding the privacy and security of the data and complying with all applicable laws governing the privacy and security of data;

(3) Require a data recipient to adhere to security processes and procedures aimed at preventing unauthorized access, use, or disclosure of the data;

(4) Require that a data recipient notify Commission staff of any potential or actual data breach, including any instance of unauthorized access, use, or disclosure of data, no later than 7 days from the date of knowledge of the breach;

(5) Require a data recipient to notify Commission staff in writing within 24 hours of receipt of any request from a third party requesting a data recipient to disclose all or part of the data received from the Commission, including but not limited to compulsory process, such as a subpoena, discovery request, warrant, or judicial or administrative order, or a public information act request, to provide the Commission adequate time to intervene and respond before the date that a data recipient has been requested or ordered to provide the data;

(6) Specify the beginning and end dates of a data use agreement;

(7) Provide for the return or destruction of data by a certain date upon termination of a data use agreement, or upon a determination that a data recipient has failed to comply with a data use agreement;

(8) Require that a data recipient comply and assist, if requested, in any audit of compliance with a data use agreement;

(9) Provide that a breach of any term or condition of a data use agreement is a breach of contract;

(10) Permit that appropriate administrative and judicial remedies under applicable law may be pursued against a data recipient for failing to comply with the terms and conditions of a data use agreement; and

(11) Be signed by:

(a) A person authorized to contractually bind a data recipient's organization; or

(b) A data recipient, if a data recipient is not part of an organization.

D. The Executive Director may consider a request from a data recipient for an extension of time or a modification of a term or condition of an executed data use agreement if:

(1) A data use agreement includes an express provision allowing a request for an extension of time or a modification of a term or condition;

(2) A data recipient submits a written request in the form and manner specified by the Commission, which shall include the reasons for the request, or specify good cause for the extension or modification request;

(3) A request for an extension of time states the requested new end date for the data use agreement; and

(4) A request for modification does not seek approval of a new or different use of the released data that was not approved under Regulation .10 of this chapter.

E. Commission staff shall refer a written request for an extension of time or a modification of a term or condition of a data use agreement to the Executive Director for a decision. The Executive Director shall:

(1) Consider a data recipient's written request submitted under §D of this regulation before making a decision; and

(2) Make a decision to approve, approve with conditions, or disapprove the request, and notify the data recipient in writing of the decision.

F. If the Executive Director approves an extension or modification request, or approves with conditions, the Executive Director shall issue a signed, dated written amendment to the data use agreement approving the extension or modification request, stating the new end date of the data use agreement, if applicable, and specifying any additional conditions on the extension or modification.

G. Re-Use of Data.

(1) A data recipient who wishes to re-use data previously released, pursuant to an approved application and executed data use agreement prior to the termination of the data use agreement and destruction of the data, for a different use or purpose or to link with other data sources not described in the approved application shall submit a written application in the form and manner specified by the Commission and pay a nonrefundable application fee in the amount published on the Commission's website at the time of submission of an application for re-use of previously released data.

(2) Commission staff shall refer a data recipient's completed application for re-use of previously released data prior to termination of a data use agreement for a different use for DRAC and Executive Director review, in accordance with Regulations .09-11 of this chapter.

(3) If a re-use application is approved, a data recipient shall pay the applicable nonrefundable data re-use fees in full in the amount published on the Commission's website before a data recipient can use the previously released data for a different use or purpose.

H. A data recipient who wishes to request additional data not requested in a data recipient's approved application and described in a data use agreement shall:

(1) Submit a new application in the form and manner specified by the Commission and pay a new nonrefundable application fee in accordance with Regulation .12 of this chapter, regardless of whether a data recipient intends to use the additional data for the same use described in a data recipient's previously approved application; and

(2) Pay required fees for receipt of additional data in accordance with Regulation .12 of this chapter if a data recipient's request for additional data is approved.

Md. Code Regs. 10.25.05.13

Regulation .13 adopted effective 48:25 Md. R.1071-1098, eff. 12/13/2021