Access to and Retention of Research Data

The purpose of the policy on Access to and Retention of Research Data is to outline the rights and responsibilities of investigators and the institution in the use, retention and maintenance of data produced as a result of the research enterprise of the university. Specific requirements related to data collection and retention are often dictated not only by University policy, but also by the terms and conditions of contracts, or by statutes, regulations, and expectations set forth by funding agencies, agencies responsible for oversight of human or animal protections, and agencies responsible for the protection of intellectual property. Regulations regarding Research Data and Material vary according to multiple factors and should be understood within the context of the study within which they are generated. Issues such as the retention of original versus electronic copies of data, special considerations pertaining to the collection, use, and storage of personal health information (“PHI”), restrictions related to export control, and guidelines for providing public access to data are addressed in detail elsewhere, and it is not the intent of this policy to supersede these existing regulations and guidelines. At the outset of any research study, the regulations of the funding agency (if externally funded), other applicable legal guidelines (e.g., HIPAA), and the specific terms of any contracts, subcontracts, or cooperative agreements regarding data ownership or handling should be examined and inform the development of data management plans and practices. It is important to note that this policy does not supersede, or directly expand, the University’s policies specific to intellectual property (see the UNCG Patent policy and the UNCG Copyright policy for more information).

Rather, the intent of this policy is to provide for the creation of an environment that maximizes the ability of investigators and the institution to ensure that research data are stored, retained, made accessible for use and reuse, and/or disposed of, according to legal, statutory, ethical and funding bodies’ requirements. Both the University and the individuals who collect and access Research Data and Materials have rights and responsibilities with regard to the stewardship of Research Data and Materials. The University’s commitment to the responsible and ethical conduct of research dictates that the stewardship of research data be handled in a thoughtful and thorough manner. Given that multiple individuals, offices, and groups are integral to ensuring thoughtful and thorough stewardship, this policy was created to facilitate clarity and consistency among all stakeholders who collect, analyze, maintain or otherwise access research data.

The Policy on Access to and Retention of Research Data applies to all University faculty, staff, postdoctoral fellows, students and any other persons, including consultants, involved in the design, conduct or reporting of research performed at or under the auspices of the University regardless of the funding source for the project. For purposes of this policy, “research,” as defined by federal regulations, is “a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge.” By definition, this policy does not apply to data gathered during the course of normal instructional practices nor does it apply to the enterprise-level administrative data governed by UNCG’s Data Classification Policy.

“Research Data and Materials” are defined as information recorded in any form, regardless of form or the media on which it may be recorded, and includes without limitation [as stated by the Federal Office of Management and Budget (OMB)] “the recorded factual material commonly accepted in the scientific community as necessary to validate research findings.” As such, Research Data and Materials include unmodified biological specimens, environmental samples, equipment, laboratory notebooks, notes of any type, photographs, films, digital images, protocols, numbers, graphs, charts, numerical raw experimental results, instrumental outputs from which Research Data can be derived, and other deliverables under sponsored agreements. This policy does not pertain to records maintained and retained by the Office of Sponsored Programs or the Office of Contracts and Grant (e.g., proposals, grant award documents, and financial records), which are governed by existing policies, but instead to substantive data generated during the research process.

The Principal Investigator (PI) of a research study is the primary custodian/steward of Research Data and Materials generated in the context of that study. The PI provides scholarly leadership and bears primary responsibility for technical, programmatic, fiscal, and administrative requirements of the project, working in partnership with the department, division, and university administration to manage and protect the Research Data and Materials produced at the University.

The University works in partnership with the PI to facilitate the PI’s ability to fulfill their role as primary custodian/steward. In addition, the University is the entity accountable for ensuring that the maintenance of and access to Research Data and Materials are in accordance with ethical, legal, institutional and professional rules, regulations, and obligations, placing the ultimate responsibility for the stewardship of Research Data and Materials with the institution. The University therefore owns all Research Data generated by research projects conducted at or under the auspices of UNCG regardless of funding source, unless specific terms of sponsorship, contractual arrangements (including subcontracts), other agreements or University policy clearly state otherwise. The University’s ownership rights and stewardship responsibilities governing records and inventions generated in the course of research projects involving university faculty, staff or students are informed by policies set forth in multiple documents, including 1) the University Copyright Ownership and Use Policy at https://policy.uncg.edu/university-policies/copyright/, 2) the University Patent and Invention Policy at http://www.uncg.edu/ott/documents/uncgFPP.pdf), 3) the UNC Records Retention and Disposition Schedule at http://its.uncg.edu/Records_Management/General_Schedule/Administrative (see GU4, GU26, and GU32 specifically), and 4) federal regulations, including without limitation OMB Circular A-110, Sec. 53 at http://www.whitehouse.gov/omb/circulars_a110.

University responsibilities include, but are not limited to:

1. Complying with the terms of sponsored projects agreements;
2. Ensuring that all legal and ethicalrequirements have been met in terms of use of animals, human subjects, recombinant DNA, biological agents, radioactive materials, and the like;
3. Protecting the rights of faculty, students, postdoctoral scholars, and staff, as set forth in this policy and any other applicable policy;
4. Securing the intellectual property rights of the university; and
5. Facilitating the investigation and resolution of charges, such as scientific misconduct, conflicts of interest, or complaints/concerns from internal and external sources.

The University’s claim to ownership is directly related to these responsibilities and its general responsibility to promote research, scholarship, and creative activity. It is not intended to interfere with the role of the PI as primary custodian/steward of Research Data and Materials or the ability of the PI and other members of the research team to pursue their scholarly work, including decisions about fair and ethical access to data. This policy does not attempt to determine relative rights of researchers or issues surrounding collaborative efforts such as authorship. This policy is designed to complement, not supersede, other policies related (but not limited) the protection of human subjects, HIPAA, FERPA, the NC Public Records Act, classification of administrative data, acceptable use, intellectual property, financial management, etc., and to put in place a structure that ensures that the interests of all stakeholders of Research Data and Materials – the University, members of the research team, research participants, and funding sources – are protected.

As custodian/steward of research data, the Principal Investigator (PI) bears primary responsibility for the collection, retention, and (when appropriate) archiving of Research Data and Materials. This includes the selection of an appropriate method of storing Research Data and Materials, and identification of records related to the research process that should be retained to enable complete responses to questions about accuracy, authenticity, primacy, and compliance with laws and regulations governing the conduct of research. The PI is responsible for educating all participants in the research project of their obligations regarding Research Data and Materials (OMB Circular A-110, Sec. 53 at http://www.whitehouse.gov/omb/circulars_a110) related to the Research Data. The PI should also consult with University resources regarding the development of any contingency plans for data storage in the event of unforeseen events. Particularly for long-term or longitudinal research projects, the PI should establish procedures for the protection of essential records in all forms (electronic and hardcopy) in the event of a natural disaster or other emergency.

Research Data and Materials must be maintained for the periods required by law, University policy, and sponsored agreement terms. Research data should be retained as long as is necessary to:

1. Meet any statutory or regulatory obligations (records legislation, funding agency guidelines, and contractual arrangements with research partners);
2. Meet the current needs of researchers;
3. Meet the future needs of researchers where these can reasonably be anticipated;
4. Resolve any charges of misconduct or litigation; and
5. Satisfy expectations of the University in documenting research activity.
6. Meet needs related to disclosures, patents, and other intellectual property matters.

Research Data and Materials shall be retained for a minimum of five years after the final project is closed out, unless a longer retention period is indicated by the funding source or other relevant agreements. It is important to note that retention periods differ by agency and by type and scope of project (e.g., clinical trials have specific regulations regarding retention periods). It is the PI’s responsibility to determine and plan for the appropriate retention period at the outset of the study. Primary data should be retained whenever possible. It is important to note that, unless otherwise specified by a funding agency or by contractual terms, there are no limits on the maximum amount of time that data can be retained, as long as appropriate standards for data management and security can be maintained.

There are situations where long-term archival of Research Data and Materials may be needed. Some funding agencies require that a copy of research data is made publically accessible in de-identified form; these requirements are specified in the sponsor agreement and should be planned for accordingly. In the absence of such a requirement, there are circumstances when research data may have lasting research value for the research community and broader audiences, and should be archived to allow for continued use. The decision to archive data when it is not mandated by University policy (e.g., Final Reports must be archived within three years), the funding agency or sponsor rests with the PI, and should be made in accordance with specifications about data access and use stipulated in participant consent forms, data management plans, and other appropriate agreements. Circumstances under which consideration of longer-term or permanent retention of research data are recommended include where the outcomes of the research: 1) are or may become of high public interest or contention or 2) have substantially shifted the paradigm for the field of inquiry. If Research Data and Materials have resulted in the identification, registration, or use of intellectual property (e.g., supports a patent application), the Office of Innovation Commercialization should be consulted about best practices for data retention.

Best practice dictates that plans for storing, maintaining, and protecting Research Data and Materials should be made prior to beginning data collection and should be reviewed on a continual basis. Decisions made early in the research process can narrow or expand later flexibility of access and use of research data. For instance, if you think your data may be a candidate for long-term or permanent retention, decisions made regarding human subjects compliance and the nature of participant consent can limit your later ability to retain data in a usable form. Also, there may be financial costs associated with proper data storage. Developing data management plans prior to seeking external support may allow PIs to request funds to cover costs incurred for data management.

Multiple resources at the University can provide expertise and assistance with developing thoughtful data management plans, including where to store data, how to store data, how to best protect confidentiality, how federal rules may impact data management (e.g., HIPAA requirements), how data management choices may impact compliance with human or animal subjects approvals, and what costs may be associated with different methods of data retention. These resources include the University Libraries (see http://library.uncg.edu/research/facultyresearch_support.aspx), unit and division-based Information Technology Services staff, the Office of Research and Economic Development, and the Office of Research Compliance.

As with ownership, policies regarding data collection, retention, and archiving are designed to complement, not supersede, other relevant policies including (but not limited to) protection of human subjects, HIPAA, FERPA, the NC Public Records Act, classification of administrative data, acceptable use, intellectual property, financial management, Genetic Information Nondiscrimination Act, etc.

As noted, Research Data and Materials must be maintained for the periods required by law, University policy, and sponsored agreement terms. Beyond the period of retention, the destruction of records is at the discretion of the PI according to his or her College/School or department policy. However, Research Data should not be destroyed until the PI has confirmed that there are no circumstances that dictate otherwise, including ongoing inquiries or investigations, ongoing use of the data by students, or current patents or other claims to intellectual property. Records will normally be retained in the unit where they are produced. Research records must be retained in UNCG facilities unless permission is granted by the Vice Chancellor for Research and Economic Development to do otherwise.

With respect to the removal of Research Data and Materials, the University recognizes the custodial and scholarly role of the PI, the importance of research data to the future research and career of its faculty, staff, and students, and the mobility of faculty, staff, and students as they pursue their careers. When members of a research team involved in research projects at UNCG leave the university, they may take copies of research data for projects on which they have worked, as long as the following conditions are met: 1) Doing so does not conflict with the University Patent and Invention Policy, the University Copyright Ownership and Use Policy, and any exceptions herein; 2) doing so does not conflict with agreements set forth in human or animal subjects approvals or the conditions consented to by research participants; 3) doing so does not conflict with agreements between the University and any third party, including without limitation sponsored research or confidentiality agreements; 4) the use of such data (for example, to conduct additional research, or for presentation or publications) is approved beforehand by the PI and other co-investigators; and 5) in all cases, the primary research data must be retained in custody of the PI at the University.

If a PI leaves the University, the default protocol is for the PI to take copies of Research Data and Materials, but for all primary Research Data and Materials to remain in the custody of the University. A PI may, though, request transfer of the primary research data to their new institution as part of either a request to transfer a project in its entirety or a request to transfer the data only. The request process is initiated through a formal data transfer or materials transfer agreement to be drafted and approved by the Dean of the College/School employing the PI (or Unit Head) in partnership with the Vice Chancellor for Research and Economic Development, and reviewed by University Counsel. This agreement should entail at least the following:

• Guaranteed, unrestricted access by UNCG to the primary data generated under the auspices of UNCG;
• Formal recognition of UNCG’s continued ownership of the data by the new institution, unless otherwise agreed upon by UNCG after all appropriate individuals and offices have been consulted; and
• Adoption by the new institution of all custodial responsibilities for the data, including acceptance of federal security requirements for restricted data and any other obligations UNCG may hold relative to the data being transferred.

Should transfer of Research Data be approved, the following requirements apply:

• The University may retain copies and ownership of data.
• Research Data generated during the Researcher’s employment at the University will be maintained in accordance with University policy.
• Research Data that are integral to the ongoing research of UNCG employee or student will continue to be made available for that purpose.
• The PI bears full responsibility for making original Research Data available to UNCG or federal and legal entities, and for ensuring that there is a written agreement signed by authorized representatives of the University and the researcher’s new institution, prior to transfer of such Research Data.

In the event that a PI leaves the University and the University keeps either the original data or a copy of the data, the PI must identify another member of the research team at UNCG to assume a custodial role. If there are no individuals at the University who can fulfill these requirements, the Office of Research and Economic Development will assume custody for the sole purpose of addressing any legal, ethical, or financial issues that arise.

As previously stated, the PI is the primary custodian/steward of Research Data and Material. Any other faculty, staff, student or person involved in the creation of Research Data may have the right to review that portion of the Research Data that he or she created. It is recommended best practice that PIs oversee the creation of detailed governance plans for research teams, especially when they involve multiple PIs and/or multiple institutions. These plans will preferably address procedures for resolving conflicts and policies for communication, data sharing, publication, and intellectual property.

The University must have access to Research Data and Materials to fulfill its stewardship responsibilities as discussed above. In the context of meeting these responsibilities, the University also has the option to take custody of the Research Data if cause is determined by the Vice Chancellor for Research and Economic Development or other designee of the Provost. This option only will be exercised in the course of the University fulfilling its legal, ethical, and financial stewardship responsibilities as discussed above. For instance, data may be taken into temporary custody to facilitate response to an allegation of research misconduct. Removing the PI from their role as primary custodian/steward of Research Data and Materials during the course of an investigation protects the interests of all stakeholders of the data, including the PI. Such option will not be invoked without notification of the Principal Investigator.

In some instances, a research sponsor has a legal right of access or access may be requested through the sponsoring agency under the federal Freedom of Information Act (FOIA). When a PI receives a request under FOIA for their research data gathered under a federally funded project, the PI should direct the request to the Office of University Counsel and the Vice Chancellor for Research and Economic Development, and work under their guidance to determine the appropriate response.

Research associates, postdoctoral associates, fellows, and students or other research trainees may be granted access to research data by the PI for academic or research purposes in connection with a course of study or degree program or in their capacity as employees. Individuals given access to research data from any source are subject to all university rules, state laws, and contractual obligations relevant to the data, including training requirements related to the responsible conduct of research and human or animal subjects protections as mandated by funding agencies and University policy. PIs who give other individuals access to data shall inform them, in writing where appropriate, of any limitations or restrictions on the use or dissemination of the data. In general, individuals should retain access to data resulting from research projects they themselves have initiated, and to data acquired by processes for which they were primarily responsible. However, researchers previously given access to research data in connection with a course of study, degree program, or contract may be denied such access at the discretion of the PI or other responsible university official for reasonable cause. Concerns or disputes concerning access to data will be handled according to the procedures set forth in the University Copyright Use and Ownership policy.

Research data can include personally identifiable or sensitive components such as social security numbers, trade secrets and other proprietary information. To safeguard this information, PIs should apply specific federal laws, state specific laws such as the NC Identity Theft Protection Act, and the following four basic principles:

1. Avoid treating all data as if it were equal
   1. Rank order sensitive data according to its worth to the project.
   2. Establish appropriate levels of protection/security and access.
   3. Ensure that the research team is aware of potential risks and their obligation to assist in ensuring data security.
2. Always know who is using what data and where it is
   1. Ensure knowledge of data routing processes amongst the research team.
   2. Conduct an inventory of all sensitive data (i.e. identify and note all sensitive data) at the beginning of all projects and draft a diagram of data utilization that is shared with an easily accessible to the research team.
3. Comply with applicable statutes, regulations and University policies
   1. Ensure that use of personal health information (PHI) adheres to the HIPAA Security Rule. Additionally, you can contact the UNCG Information Security Officer, the UNCG HIPAA Security Officer or refer to the federal guidelines http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/securityrulepdf.pdf.
   2. Prioritize data security by implementing security-centered practices into the daily routine of the research team. This should include, but not be limited to, encryption, role based access, password protection, and frequent auditing efforts. For data maintained on UNCG ITS storage facilities, detailed information about file access history (information on file read, write, delete, and other operations) is maintained and available to PIs.
4. Avoid maintaining unnecessary data
   1. Use frequent audits and purge sensitive electronic and paper data (per applicable guidelines) when no longer necessary to maintain.
   2. Periodically check funding agency and institution retention policies to verify if timelines for storage have been modified

The PI is responsible for ensuring compliance with any applicable legal restrictions and agreed-upon restrictions from sponsors (including publication and sharing with non-U.S. citizen collaborators and/or students) when using data that is controlled under federal International Traffic in Arms Regulations or Export Administration Regulations (see http://research.uncg.edu/wp-content/uploads/2012/06/UNCG_Export_Control_Guidelines_final.pdf).

The Vice Chancellor for Research and Economic Development will initiate review of this policy on an annual basis. Comments or questions should be addressed to the Vice Chancellor for Research and Economic Development.

• Original Data Transfer Request (PDF: requires a reader such as Adobe Reader)
• UNC General Records Retention and Disposition Schedule: Administrative Records
• University Copyright Ownership and Use Policy
• University Patent and Invention Policy (PDF: requires a reader such as Adobe Reader)
• University Acceptable Use of Computing and Electronic Resources
• Council on Government Relations paper on Access to and Retention of Research Data: Rights and Responsibilities (PDF: requires a reader such as Adobe Reader)
• Federal Office of Management and Budget Circular A-110
• Policy on Enhancing Public Access to Archived Publications Resulting from NIH-Funded Research
• NIH Grants Policy statement (PDF: requires a reader such as Adobe Reader)