Data Storage and Management Policy

Version 2.01

This Pawsey Supercomputing Centre Data Storage and Management Policy applies to all Researchers at all times when any Data is being stored, archived, processed, analysed, transferred or visualised on any Pawsey Supercomputing Centre resource, known as Data Stores @ Pawsey Supercomputing Centre. For Researchers who are not employed or under the supervision of a Pawsey Supercomputing Centre Member, an additional End User Licence Agreement is required to be signed before accessing the Data Store @ Pawsey Supercomputing Centre.

This Policy is subject to change without notice.

1. Purpose of this Policy

The Pawsey Supercomputing Centre Data Storage and Management Policy (Pawsey Supercomputing Centre DSMP) aims to assist Researchers in Pawsey Supercomputing Centre Members and non-Pawsey Supercomputing Centre Members (e.g. other national and international researchers) to make full use of the presently available Data Stores @ Pawsey Supercomputing Centre options and simultaneously fulfil their responsibilities with respect to the storage and retention of data collected as part of their research activities which is sizable and scalable. The Pawsey Supercomputing Centre has created this policy from the topical legal requirements and best practice guidelines to ensure researchers can make better use of data.

2. Applications and Assumptions

It is expected that each institution using Pawsey Supercomputing Centre facilities will have their own guidance, process and procedure supporting effective data curation. It is also expected that researchers at those institutions will be aware of the authorisation procedures and processes for data management within their home institution. However all researchers who are using the Data Stores @ Pawsey Supercomputing Centre are required to comply with this policy in its entirety at all times. In the unlikely situation where an institution’s local policy conflicts with this policy, researchers are required to contact the Pawsey Supercomputing Centre Executive Director for further guidance before proceeding.

3. Pawsey Supercomputing Centre Data Storage Provision

The Pawsey Supercomputing Centre has data storage provision in several forms. The nature of the data storage available to researchers differs considerably, and as a consequence researchers are advised to familiarise themselves with all available options and consult with the Pawsey Supercomputing Centre on storage needs (especially related to space) before embarking on any projects with a data storage component. Allocation of the Data Stores @ Pawsey Supercomputing Centre are made through an allocation process. Instructions on how to access the Data Stores @ Pawsey Supercomputing Centre are available at this location: http://apply.pawsey.org.au

During the application process for data storage, the Pawsey Supercomputing

Centre requires written contact details of the main data custodian (data owner) as well as a deputy. Data owners will be required to formally (this may be digitally) confirm they are the data owner. This is the person who will be contacted when necessary by the Pawsey Supercomputing Centre. However, it should be recognised that all researchers accessing the Data Stores @ Pawsey Supercomputing Centre need to comply with this policy. In the Pawsey Supercomputing Centre application process, the data custodian will be required to identify the duration needed for storage.

Data will normally only be held by the Pawsey Supercomputing Centre for the duration of the research project, unless by prior agreement with the Pawsey Supercomputing Centre. Consequently data custodians are required to make other provisions for the long-term storage of their data. Data custodians will be asked to identify alternative long-term data storage options at the point of application.

Once access is approved, all researchers will formally access the Data Stores @ Pawsey Supercomputing Centre using an authentication process using a password. Researchers are not permitted to share passwords, and must not disclose individual passwords at any time. It is the responsibility of the researcher to ensure passwords are stored securely and to inform the Pawsey Supercomputing Centre immediately if they suspect their data security has been compromised.

4. Key principles of the Pawsey Supercomputing Centre Data Management Policy

At all times, when using the Data Stores @ Pawsey Supercomputing Centre, a researcher must as a condition of use agree to follow all of the following basic principles:

• A researcher must complete the relevant application forms for use of the Data Stores @ Pawsey Supercomputing Centre, outlining the project that it will be used for and the anticipated level of use.
• A researcher may only store and use data on the Data Stores @ Pawsey Supercomputing Centre in respect of projects that have been approved for such use by the Pawsey Supercomputing Centre.
• A researcher must consider copyright restrictions that may apply to data and

• must ensure that their storage and use of data on the Data Stores @ Pawsey Supercomputing Centre is not in breach of copyright laws.
• A researcher must consider relevant privacy legislation that may apply to data and must ensure that any data on the Data Stores @ Pawsey Supercomputing Centre including data collection, storage and use is permitted by law.
• A researcher must not store clinically identifiable patient data on the Data Stores @ Pawsey Supercomputing Centre; all such data must be subject to anonymisation before being store on the Data Stores @ Pawsey Supercomputing Centre.
• A researcher accessing the Data Stores @ Pawsey Supercomputing Centre must comply with all applicable Commonwealth, State and Territory legislation relating to biological, ethical or radiological safeguards; and all ethics, codes and guidelines adopted by the National Health and Medical Research Council, the Office of the Gene Technology Regulator and any other relevant regulatory agencies operating in Australia.
• A researcher must comply with relevant ethics approval processes within their institutions before storing data for projects on the Data Stores @ Pawsey Supercomputing Centre.
• A researcher must comply with any export (or import) regulations that apply to the data being stored or used on the Data Stores @ Pawsey Supercomputing Centre, including those under Australian law, and the laws of any foreign country to the extent they apply to data being stored on the Data Stores @ Pawsey Supercomputing Centre.
• A researcher must not store data on or use the Data Stores @ Pawsey Supercomputing Centre in connection with any of the Prohibited Uses set out in Appendix B.

In addition to the specific requirements identified above, researchers must not store or use data on the Data Stores @ Pawsey Supercomputing Centre if doing so is illegal, or would potentially expose CSIRO or another Pawsey Supercomputing Centre Member to civil legal action in Australia or elsewhere. Unless a separate End user Licence Agreement (EULA) has been signed by the relevant person, researchers are responsible for access to the Data Stores @ Pawsey Supercomputing Centre as part of a project by any person under their supervision or control who is not employed by a Pawsey Supercomputing Centre Member (non-employees will typically include research students or visitors to their institution). Researchers are responsible for ensuring that such

persons are fully informed about the institutional and Pawsey Supercomputing Centre policies regarding data management and are required to comply with them.

5. Definitions

6. Responsibilities

6.1 Responsibilities – Users of the Data Stores @ Pawsey Supercomputing Centre

Pawsey Supercomputing Centre Members and their employees are fully responsible for their own use of the Data Stores @ Pawsey Supercomputing Centre in accordance with this policy and their other obligations. Non-Pawsey Supercomputing Centre Members will similarly be required to release the Pawsey Supercomputing Centre Members from all liability as a condition to gaining access to the Data Stores @ Pawsey Supercomputing Centre. Without limiting their obligations, researchers accessing the Data Stores @ Pawsey Supercomputing Centre are also expected to manage their use of the Data Stores @ Pawsey Supercomputing Centre in accordance with the following processes:

• Ensure appropriate procedures for the collection, storage, use, re-use, access, and retention of data and records associated are available, before use of the Data Stores @ Pawsey Supercomputing Centre. This responsibility also applies to confidential research data and records. Researchers are responsible for ensuring data stored with the Pawsey Supercomputing Centre also complies with all requirements of their institution (for example, being located in an institutional repository, departmental register).
• Establish and document clear procedures for the collection, ownership and storage of research data and records when involved in a joint research project, collaborative research or research undertaken in accordance with a contractual
• agreement. If there are requirements to share this data from the Data Stores @ Pawsey Supercomputing Centre with collaborators, the Principal Investigator must make this requirement known to the Pawsey Supercomputing Centre at the earliest opportunity.
• Ensure that the integrity and security of their data is maintained (e.g. by not providing passwords etc. to external parties), and that this material is stored in a retrievable way. Researchers should make the Pawsey Supercomputing Centre aware of any breaches (or potential breaches) in the security or integrity of data on the Data Stores @ Pawsey Supercomputing Centre.
• Plan for the ongoing custodial responsibilities for the research data at the conclusion of the research project.
• Ensure that research students and third parties under their supervision are fully informed about their institutional and Pawsey Supercomputing Centre policies regarding data management and are bound to comply with such Pawsey Supercomputing Centre policies.
• Notify the Pawsey Supercomputing Centre of any changes of data ownership/custodianship in writing.

6.2 Responsibilities – Pawsey Supercomputing Centre

CSIRO is the Pawsey Supercomputing Centre Member that has been appointed as the Centre Agent for the purpose of managing the unincorporated joint venture and also has legal ownership of the physical facilities comprising the Data Stores @ Pawsey Supercomputing Centre. However, each researcher (on behalf of their relevant Pawsey Supercomputing Centre Member or non- Pawsey Supercomputing Centre Member) is fully responsible for their actions in using the Data Stores @ Pawsey Supercomputing Centre, including for any breach of this policy or any legal obligations. Day to day management of the Data Stores @ Pawsey Supercomputing Centre is carried out through the management arrangements that have been set up for the Pawsey Supercomputing Centre.

A Pawsey Supercomputing Centre Data Controller will be nominated by the

Pawsey Supercomputing Centre Executive Director to manage implementation of this policy and use of the Data Stores @ Pawsey Supercomputing Centre. CSIRO does not assert or claim any intellectual property rights, or other rights, over the data that researchers store on the Data Stores @ Pawsey Supercomputing Centre (subject to the terms agreed where CSIRO is also involved in the relevant project). CSIRO and the Pawsey Supercomputing Centre will have access to the data stored on the Data Stores @ Pawsey Supercomputing Centre as part of management of the Data Stores @ Pawsey Supercomputing Centre, and may as part of complying with its obligations to relevant Australian, State and Territory Governments bodies, Commonwealth Funding Agencies, to monitor use of the Data Stores @ Pawsey Supercomputing Centre and provide information to such bodies.

7. Sharing, retention (including special requirements) and deletion of Research Data

In order for the Pawsey Supercomputing Centre to properly manage the Data Stores @ Pawsey Supercomputing Centre it relies on researchers keeping it informed of their data use requirements and the future requirements for data access and retention. Failure to notify the Pawsey Supercomputing Centre of these requirements in advance may impact on the ability to accommodate requests from researchers.

7.1 Good research practice and data sharing

The Pawsey Supercomputing Centre believes that good research practice indicates that “Research data should be made available for use by other researchers unless this is prevented by ethical, privacy or confidentiality matters.” Consequently, the Pawsey Supercomputing Centre expects that all researchers will wherever possible and consistent with institutional policies and legal obligations make research data available to others. To ensure the Pawsey Supercomputing Centre can assist wherever possible to provide adequate network capacity and servers, researchers should advise how they plan to make data available to others when initiating research projects. Grant of access to some Data Stores @ Pawsey Supercomputing Centre facilities may also have open access requirements as a condition of the grant. In all circumstances researchers are (remain) responsible for ensuring that data is permitted to be made available as represented in the relevant application form or otherwise to the Pawsey Supercomputing Centre.

7.2 Retention and deletion of data

A researcher is obliged to ensure their data retention practice complies with the local REC, funding and Institution requirements. A researcher is required to advise the Pawsey Supercomputing Centre of data retention times for all data at the point of space allocation. The Pawsey Supercomputing Centre reserves the right to delete orphaned or data at any time.

7.3 Removal or Movement (special conditions) of Data

It is understood that some researchers will need to restrict access to some data (for example, to comply with ethical requirements) and in some cases this data may need to be moved. In these circumstances the Pawsey Supercomputing Centre will need to be informed in writing. This information should include:

i. Full details of the specific requirements (for example, feedback from a REC). ii. Full details of the data (all metadata).
iii. Full details of the size of the data set(s).
iv. Details of where the data is presently and where it needs to be moved to. v. A timeframe of when this requirement is needed.

vi. Contact details of who needs to be informed.

8. Storage of Research Data

All data curated with the Pawsey Supercomputing Centre will be digital and can include files, datasets, photos, video recordings. This data will be physically stored on the Data Stores @ Pawsey Supercomputing Centre.

Physical access to these facilities is controlled to ensure compliance with the Office of Health and Safety and security requirements. Researchers requiring physical access will be required to comply with relevant CSIRO security and access policies, including signing up to additional terms of use for these facilities.

9. Appropriate and Reasonable Use

Use of the Data Stores @ Pawsey Supercomputing Centre may be monitored including for compliance with this policy. Access may be terminated or limited without notice if use is considered in breach of this policy or otherwise inappropriate. Data storage resource usage will also be monitored. Any

excessive use of resources (10% beyond agreed quotas) may be investigated and where data processes are deemed excessive (beyond agreed quotas) and/or where ownership/contact details are withheld or removed during the allocation process, data may be removed without notice.

The Pawsey Supercomputing Centre has the right to remove access to the Data Store @ Pawsey Supercomputing Centre immediately until all issues have been rectified.

10. Limitation of Liability

Data Stores @ Pawsey Supercomputing Centre resources are provided to store and encourage the sharing of research data. However Pawsey Supercomputing Centre Data Storage resources should not be used as the sole location of important data/datasets and consequently researchers should hold a master data set at an alternative location.

CSIRO (AND THE OTHER PAWSEY SUPERCOMPUTING CENTRE MEMBERS) MAKE NO WARRANTY IN RELATION TO THE DATA STORES AND WILL NOT BE LIABLE FOR ANY LOSS OF ANY KIND ARISING FROM THE USE OF THE DATA STORES @ PAWSEY SUPERCOMPUTING CENTRE OR ASSOCIATED RESOURCES. EACH RESEARCHER AND THEIR EMPLOYING INSTITUTION AGREE TO BE SOLELY RESPONSIBLE FOR THEIR USE OF THE DATA STORES @ PAWSEY SUPERCOMPUTING CENTRE INCLUDING FOR ANY LOSS SUFFERED BY THEMSELVES OR A THIRD PARTY IN CONNECTION WITH SUCH USE, AND TO HOLD CSIRO AND THE OTHER PAWSEY SUPERCOMPUTING CENTRE MEMBERS HARMLESS IN RESPECT OF SUCH LOSSES.

CSIRO AND EACH OF THE OTHER PAWSEY SUPERCOMPUTING CENTRE MEMBERS EXPRESSLY EXCLUDE ANY WARRANTY, UNDERTAKING OR OTHER REPRESENTATION (INCLUDING TO THE EXTENT PERMITTED THOSE IMPLIED OR APPLICABLE UNDER COMMON LAW OR STATUTE) THAT THE DATA STORES @ PAWSEY SUPERCOMPUTING CENTRE:

i. WILL BE OF AN ACCEPTABLE QUALITY, BE AVAILABLE FOR OR DURING ANY PERIOD OF TIME, OR MEET ANY PERFORMANCE SPECIFICATION. EVEN WHERE AN APPLICATION OR REQUEST FOR ACCESS IS APPROVED BY THE PAWSEY SUPERCOMPUTING CENTRE, CSIRO RESERVES THE RIGHT TO CANCEL ACCESS

OR LIMIT PERFORMANCE OF THE DATA STORES @ PAWSEY SUPERCOMPUTING CENTRE WITHOUT NOTICE
ii. IS VIRUS - AND/OR HARMFUL CONTENT-FREE, THAT DEFECTS WILL BE CORRECTED, OR THE SERVICE PROVIDED WILL ALWAYS BE UNINTERRUPTED/ERROR FREE

iii. DOES NOT INFRINGE THE INTELLECTUAL PROPERTY RIGHTS OR OTHER RIGHTS OF ANY THIRD PARTIES, OR THAT USE OF THE DATA STORES @ PAWSEY SUPERCOMPUTING BY A RESEARCHER WILL NOT INFRINGE SUCH RIGHTS
iv. WILL BE SECURE OR THAT UNAUTHORISED THIRD PARTIES WILL BE UNABLE TO ACCESS DATA STORED ON THE FACILITIES (REGARDLESS OF ANY EXPRESS MEASURES THAT MAY BE IMPLEMENTED TO INCREASE SECURITY FOR PARTICULAR DATA). RESEARCHERS ARE RESPONSIBLE FOR ENSURING THAT THE SECURITY MEASURES IN PLACE ARE ACCEPTABLE FOR THE DATA THEY STORE ON THE FACILITIES.

Given the research nature of the facilities being provided, it is possible that there will be extended periods of downtime for the Data Stores @ Pawsey Supercomputing Centre during which it may not be possible to use the Data Stores @ Pawsey Supercomputing Centre, or access data that has already been ingested into the facilities. This is inclusive of scheduled and unscheduled outages. In such circumstances, the Pawsey Supercomputing Centre will endeavour to resolve these issues as soon as practicable, but does not warrant that an alternative service will be available. Scheduled outages will be made known via a facility available to all researchers.

11. Where to get advice at the Pawsey Supercomputing Centre

For further clarity on the content of the Pawsey Supercomputing Centre Data Policy, please contact: help@pawsey.org.au

12. Appendix

12.1 Appendix A – Related Data Storage Policies and Legislation

Researchers should in the first instance refer to individual institutional policies detailing copyright, data management and research ownership from their

institution’s perspective. The following resources are provided for general information purposes only and researchers need to determine their applicability to the specific project being conducted. This list is not exhaustive and other relevant procedures are also likely to apply to a project under contracts or funding arrangements; Australian, State, or Territory law; or as a matter of best industry practice.

The Australian Code for the Responsible Conduct of Research: - http://www.nhmrc.gov.au/guidelines/publications/r39/

Australian Office of the Information Commissioner for guidance with regard to Freedom of Information, Privacy and Information Policy:
- http://www.oaic.gov.au

Commonwealth and State Based guidance such as:
The Privacy Act (Queensland, 2009)
- http://www.legislation.qld.gov.au/legisltn/acts/2009/09ac014.pdf
The Privacy and Personal Information Protection Act (NSW, 1998) -http://www.legislation.nsw.gov.au/fullhtml/inforce/act+133+1998+FIRST+0+N The Information Privacy Act (Victoria, 2000)
- http://www.privacy.vic.gov.au/privacy/web2.nsf/pages/information---privacy--- act
The Personal Information Protection Act (Tasmania, 2004)
- http://www.egovernment.tas.gov.au/themes/information_security and management/personal_information_protection
The Privacy Act (Commonwealth, 1998)
- http://www.legislation.act.gov.au/a/db_6269/default.asp
The Northern Territory Information Act (2002)
- http://www.austlii.edu.au/au/legis/nt/consol_act/ia144
Australian Human Rights Commission Act 1986
- http://www.hreoc.gov.au/about/legislation/index.html#ahrc

Australian Commission on safety and quality healthcare – operating principles and technical standards for Australian Clinical Quality Registries, specifically regarding secure data housing, authentication and transfer:
- http://www.crepatientsafety.org.au/registries/operating_principals_technical_s tandards_nov08.pdf

The Office of the Gene Technology Regulator: - http://www.ogtr.gov.au

12.2 Appendix B – Prohibited Uses

The Data Stores @ Pawsey Supercomputing Centre must not be used as part of a research project involving any of the following:

- research on or development, design, manufacture, construction, testing or maintenance of any nuclear explosive device, or components or subsystems of such a device
- research on, or development, design manufacture, construction, operation, or maintenance of any nuclear reactor, critical facility, facility for the fabrication of nuclear fuel, facility for the conversion of nuclear material from one chemical form to another, or separate storage installation

- research on or development, design, manufacture, construction, operation or maintenance of any of the following facilities, or components for such facilities: a) Facilities for the chemical processing of irradiated special nuclear or source

material;
b) Facilities for the production of heavy water;
c) Facilities for the separation of isotopes of source and special nuclear

material; or items specifically designed or specifically modified for use in devising, carrying out, or evaluating nuclear weapons tests or nuclear explosions (except such items as are in normal commercial use for other purposes) are subject to the same requirements

d) Facilities for the fabrication of nuclear reactor fuel containing plutonium. - maritime nuclear propulsion plants, their land prototypes, and special facilities for their construction, support, or maintenance, including any machinery, devices, components, or equipment specifically developed or designed for use in such plants or facilities

- development, production, stockpiling, or use of chemical or biological weapons
- the design, development, production or use of rocket systems or unmanned air vehicles for the delivery of chemical, biological, or nuclear weapons.

12.3 Appendix C – Frequently Asked Questions

1. How can I use clinical or social data?
Clinical or social data must at all times be anonymised, encrypted and must

have clear signed and witnessed consent for use (including aggregation) and storage within the Data Stores @ Pawsey Supercomputing Centre.

2. What data storage am I allowed?

All researchers are eligible to use the Data Stores @ Pawsey Supercomputing Centre. The allocation of data is conducted via a process that is defined on the Pawsey Supercomputing Centre website.

3. Will my data be backed up?

The Pawsey Supercomputing Centre does not back up data. Data stored with the Pawsey Supercomputing Centre is located on duplicate media as a ‘failsafe’ from technology failure only. If researchers delete data from any of the Data Stores @ Pawsey Supercomputing Centre, or it is lost due to technical faults, the data is not recoverable. The Pawsey Supercomputing Centre encourages researchers to have a duplicate copy of all data held with the Pawsey Supercomputing Centre held elsewhere.

4. Can I share my data with colleagues?

Subject to compliance with applicable law, researchers using the Data Stores @ Pawsey Supercomputing Centre can share data with colleagues. Please visit the Pawsey Supercomputing Centre web page for further details about what resources are available to support research collaborations or use the contact details provided in Section 11.

5. Will you host my database for me?

The Pawsey Supercomputing Centre will, in some circumstances, host a database and is often able to offer custom solutions. Contact the Pawsey Supercomputing Centre for further details.

6. What is a quota?

A quota is a restriction or limit that is placed on the amount of data an account may use. A quota consists of a soft/hard quote and a grace period.

7. What is a grace period?

A grace period is the amount of time you are allowed to go over the soft limit before the system blocks your ability to write more data.