Responsible Data Use: Data restrictions Robert R. Downs, PhD Center for International Earth Science Information Network (CIESIN), Columbia University Version 1.0 Review Date

Module Template: Subtitle; Version 1.0, Reviewed 9/15/11 Overview Some data contain restrictions on who may access them and how they may be used. Restrictions may be placed on data for various reasons and may be permanent or temporary. Restrictions that apply to a data product or service must be recognized, managed, and complied with so that the restrictions are not violated. Data managers must ensure that restricted data are adequately protected so that they are not disseminated to unauthorized persons. Data users must ensure that their use does not violate any restrictions that have been placed on the data they are using.

Module Template: Subtitle; Version 1.0, Reviewed 9/15/11 Relevance to Data Management Restrictions may be placed on data to protect individuals or interests. Intellectual property rights or licensing restrictions may apply. Laws, regulations, or policies may restrict access to some data. Security – Information about locations or property may be restricted. Confidentiality – Information about individuals may be restricted. Environmental Protection – Information about locations or inhabitants may be restricted. Violating restrictions that have been placed on data is unethical and could result in civil or criminal penalties, such as fines, loss of privileges, or incarceration.

Module Template: Subtitle; Version 1.0, Reviewed 9/15/11 What kinds of restrictions are placed on data? Access and use Restrictions may limit who may have access to the data or how they are used. Access may be authorized only for specific purposes, such as educational use. Restrictions may limit whether data may be used to create new products or services. Modifications or derivations of the data may be prohibited. Dissemination and copies Restrictions may limit who is authorized to distribute the data, how the data may be distributed, and whether copies of the data may be created. Distribution may be limited to a specific location or service. Distribution may be limited to a specific time period, which may be in the future. Restrictions on dissemination may apply to the data and to all derivations or products created from the data.

Module Template: Subtitle; Version 1.0, Reviewed 9/15/11 Methods for restricting data Identify data that must be restricted. Label data as restricted. Store data in secure facilities. Transport data using secure means. Include with the data, a description of the conditions under which the data are restricted along with acceptable uses. Establish infrastructure and procedures for storing, managing, disseminating, accessing, copying, transmitting, and using restricted data. Train staff on how to protect data from unauthorized use.

Module Template: Subtitle; Version 1.0, Reviewed 9/15/11 Methods of providing access to restricted data Limit access to authorized individuals or roles Enable access within a facility only accessible by authorized persons. Limit access to authorized individuals with password-protection. Establish a data enclave without capabilities to copy or transmit data. Provide options for accessing restricted data Require evidence of approval or expertise. Require users to sign a confidentiality, non-disclosure, or data use agreement. Require approval of data protection plan from potential users. Request an exception or waiver of restrictions under certain conditions. Request clearance for specific individuals to access restricted data. Request declassification of restricted data from relevant authority. Modify the data to protect restricted portions Change aspects of data that are restricted (recode, generalize) Remove or obscure the portions of data that are restricted (redact)

Module Template: Subtitle; Version 1.0, Reviewed 9/15/11 Providing access to restricted data Review or establish organizational policies on restricted data Identify conditions under which restricted data may be disseminated. Select a dissemination method that does not violate restrictions. Create a data dissemination plan that complies with restrictions. Request approval from authorities for data dissemination plan. Disseminate data in accordance with data dissemination plan. Monitor data dissemination to ensure compliance with all restrictions on data. Cease dissemination if restrictions on data are violated and immediately report any violations to authorities.

Module Template: Subtitle; Version 1.0, Reviewed 9/15/11 References and Resources Where to go for more information Best Practices for Sharing Sensitive Environmental Geospatial Data Data_Guide_EN_v1.pdf Computer Security Act of Confidentiality Issues in Geospatial Data Applications Dealing With Sensitive Data sensitive-datahttp:// sensitive-data ICPSR – Restricted Data Guidelines for Providing Appropriate Access to Geospatial Data in Response to Security Concerns

Module Template: Subtitle; Version 1.0, Reviewed 9/15/11 Other Relevant Modules Data Management Plans: Data access, sharing, and re-use policies Providing access to your data: Handling Sensitive Data Providing access to your data: Rights Submission agreements: Constraints