Guidance

University and business collaboration agreements: model agreement guidance

Updated 25 May 2018

1. Introduction

1.1 Purpose

The purpose of the Lambert Toolkit is to provide assistance to academic or research institutions and industrial ‘partners’ which wish to carry out research projects together.

The aims of the Lambert Toolkit are to:

• facilitate negotiations between potential collaborators
• reduce the time and effort required to reach agreement
• provide examples of best practice
• improve the level and frequency of collaboration between academia and industry.

The model agreements are merely starting points and their use is not compulsory, but by using them you may be able to reduce the amount of time and money spent negotiating.

1.2 Maximising innovation and finding a workable compromise

The aim of the model agreements is to maximise innovation. The cornerstone of the model agreements is that, at the very least, the commercial ‘partner’ (called the Collaborator, in Collaboration Agreement 6, the Company) will have the right to use the results of the Project on a non-exclusive basis so as to promote the use of the Results and therefore innovation.

The model agreements have not been developed with the aim of maximising the commercial return to Institutions; the aim is to encourage collaboration with industry and the sharing of knowledge. They do not represent an ideal position for any Party; depending on the circumstances they are designed to represent a workable and reasonable compromise for both or all Parties.

1.3 The balance between the collaborator’s contribution and the rights in the results

The assumption underpinning the model agreements is that the Collaborator will have greater rights to exploit the results of the research project where it has made a greater contribution (financial or other) to the Project.

Where the Collaborator wants to own the IPR in the Results, the Parties may agree to that, but the return or potential return to the Institution will be greater than where the IPR is retained by the Institution.

For example, where the project is more speculative in nature, or has implications for future research at the Institution, the financial contribution of the Collaborator will be less and the rights to use and exploit the IPR granted to the Collaborator will be more limited.

The underlying principle of the Collaboration (two party) Agreements is that, unless there are exceptional circumstances, the Collaborator will, as a minimum, pay the Institution on a full economic cost basis and in return will receive a royalty free non-exclusive licence to use the Results (Collaboration Agreement 1).

The more the Collaborator contributes (in money, background, human and other resources), the more rights it receives so that, where the Collaborator owns the IPR in the Results and the Institution retains no rights (as in Collaboration Agreement 5), the Collaborator’s contribution will be at full market rates (taking into account its non-financial contribution).

This principle is not cast in tablets of stone, but was what the Lambert Inner working group had in mind when negotiating the terms of the model agreements.

That approach is too simplistic for use in the Consortium Agreements where there are more than two parties, but when determining the payment plan and the return to each of the Parties from the exploitation of the Results, the contribution made by each Party (financially and other wise) to the Project should be taken into account.

1.4 Sector specific agreements

Although there has been some call for model agreements which are specific to certain sectors, the Lambert Working Group decided that to do that was not practical.

Although wording is suggested in brackets which may be specific to a sector in order to illustrate the sort of wording which might be inserted in those places, the model agreements are not designed to be specific to any sector.

1.5 Jurisdiction

The guidance and the model agreements are designed to be used only when the agreements are governed by English law. If you want to enter into a contract under a different legal system, you can adapt the model agreements, but you will need to take legal advice from a lawyer qualified to advise on that country’s law and who can help you adapt the model agreements where necessary to comply with local laws.

2. Guidance on the model agreements

2.1 Introduction

The Lambert Toolkit contains 7 one to one model agreements (Collaboration Agreements) and 4 multiparty agreements (Consortium Agreements). The Collaboration Agreements have numbers and the Consortium Agreements have letters.

Where possible, the terms of all the model agreements are the same or similar except for the provisions dealing with the ownership and exploitation of IPR and rights to use for Academic and Research Purposes. Of necessity, there are differences between the Collaboration Agreements and Consortium Agreements in areas such as project management, termination and the consequences of termination.

In 2016 two Collaboration Agreements, 4A and 6, were added to the Lambert Toolkit as a result of requests for these types of agreements.

The model agreements which appeared in the earlier versions of the Lambert Toolkit have been updated to cover areas which have become more important since the earlier versions of the Lambert Toolkit were published, for instance, anti-bribery and corruption and data protection.

Each model agreement envisages a different set of circumstances.

Obviously it is not possible to have a set of model agreements which captures everyone’s circumstances in every project, but the Lambert Toolkit aims to have model agreements for some of the most commonly encountered circumstances and to illustrate terms which might apply in different scenarios.

The model agreements can, and should, be adapted to meet the particular circumstances of the Project.

The Lambert Toolkit includes guidance on:

2.2 Heads of terms

The Lambert Toolkit also contains two examples of Heads of Terms, one for two party Collaboration Agreements and the other for multi-party Consortium Agreements.

You may find it useful to use these as a starting point for negotiations to agree the basic principles. Much time, frustration and expense can be saved if the principles are agreed before anyone attempts to draft a full agreement.

Heads of Terms will allow you to discuss the principles of the collaboration without getting caught up in arguments about the wording of the proposed agreement. Once the principles have been agreed the drafting of the agreement should be easier.

Agreeing the principles first should also help you to decide which of the model agreements most closely meets the circumstances of your project.

The Heads of Terms are not exhaustive. It can be tempting to try and include everything in Heads of Terms, but that often results in detailed negotiations taking place before basic principles have been agreed.

In general the Heads of Terms are not binding, but some clauses – those relating to confidentiality, the payment of the costs of negotiations, the governing law and dispute resolution and third party rights - are binding so that, for instance, the parties are obliged to keep the provisions of the Heads of Terms and the negotiations confidential.

2.3 The Lambert collaboration agreements scenarios

Research collaboration agreement	Terms
Collaboration Agreement 1	The Institution owns the Results and grants the Collaborator a non-exclusive licence to use the Results
Collaboration Agreement 2	The Institution owns the Results and grants the Collaborator a non-exclusive licence to use the Results The Collaborator has the right to call on the Institution to negotiate an exclusive licence
Collaboration Agreement 3	The Institution owns the Results and grants the Collaborator a non-exclusive licence to use the Results The Collaborator has the right to call on the Institution to negotiate an assignment
Collaboration Agreement 4	The Collaborator owns the Results and Institution has the right to use the Results for Academic and Research Purposes. Academic Publication is permitted
Collaboration Agreement 4A	Each Party has the right to exploit certain Results created in the course of the Project and takes an assignment of those Results The Institution has the right to use the Results owned by the Collaborator for Academic and Research Purposes and its students and staff have Academic Publication Rights The Collaborator has the right to use the Results owned by the Institution for Research Purposes
Collaboration Agreement 5	The Collaborator owns the Results and Institution does NOT have the right to use the Results for Academic and Research Purposes. Academic Publication is NOT permitted. This form of Agreement is more suited to Contract Research
Collaboration Agreement 6	This Agreement contains the terms for a Knowledge Transfer Partnership (KTP) where a graduate or postgraduate student carries out the Project The Company owns the Results. The Institution has the right to use the Results owned by the Company for Academic and Research Purposes and its students and staff have Academic Publication Rights Its terms are very similar to those of Collaboration Agreement 4 with additional terms in the light of the KTP programme

2.4 The Lambert consortium agreements scenarios

Consortium agreement	Terms
Consortium Agreement A	Each Party owns the Results which it creates and grants each of the other parties a non-exclusive licence to use those Results for the purposes of the Project and for any other purpose, so that any Party may exploit any of the Results. This Agreement may be suitable for use in collaborations funded by an organisation which wishes to create a level playing field, but is not likely to be used for research where the funder requires the parties to have an agreed exploitation strategy
Consortium Agreement B	One Party (called the Lead Exploitation Party) is best suited to carry out the exploitation of the Results. The other Parties assign their IPR or grant an exclusive licence of their IPR in the Results to the Lead Exploitation Party which undertakes to exploit the Results and to pay the other Parties a share of revenues generated from that exploitation or a success payment. The Academic Parties have the right to use the Results for Academic and Research Purposes and students and staff have Academic Publication Rights. The Commercial Parties have the right to use the Results for Research Purposes.
Consortium Agreement C	Two of the four Parties are best placed to exploit different Results - they may have different core businesses or interests and be interested in different results. Each of those two Parties takes an assignment of certain Results, and undertakes to exploit those Results and to pay the other Parties a share of the revenues generated from that exploitation or a success payment. The Academic Parties have the right to use the Results for Academic and Research Purposes and students and staff have Academic Publication Rights. The Commercial Parties have the right to use the Results for Research Purposes
Consortium Agreement D	Each Party owns the Results which it creates and grants each of the other Parties a non-exclusive licence to use those Results for the purposes of the Project only. The Parties do not have an agreed strategy for the exploitation of the Results. If a Party wishes to exploit another Party’s Results or Background, it must negotiate a licence or an assignment. The Academic Parties have the right to use the Results for Academic and Research Purposes and students and staff have Academic Publication Rights

The Commercial Parties have the right to use the Results for Research Purposes.

3. Guidance common to all the model agreements

3.1 Alternative wordings

In many places the model agreements contain alternative wording in square brackets. You will have to choose which of those alternatives best suits your circumstances. In some cases, none of the suggested wording may fit your circumstances and you should use different wording. There is no right or wrong; which wording you use depends on what the parties want and what they are able to agree and what the law allows them to do.

Throughout the model agreements, time periods and amounts are in square brackets. Again there is no right or wrong and the figure will depend on what the parties want and what they are able to agree.

The model agreements contain provisions relating to external funding. Those provisions are in square brackets and should be omitted if there is no external funding for the project.

3.2 The parties

The model Collaboration (one to one) Agreements, except the KPT Agreement (Collaboration Agreement 6), use the expression the Institution to mean a university or public research institution and the expression the Collaborator to mean a private sector undertaking or other entity (such as an NHS Trust) with which or for whom the Institution is working. In Collaboration Agreement 6, the private sector undertaking is called the Company.

In the model Consortium (multiparty) Agreements) the parties are AAA, BBB, XXX and ZZZ. These agreements have been drafted as though AAA and BBB are universities or research institutions (Academic Parties) and XXX and ZZZ are private sector undertakings (Commercial Parties), but they could be other entities (such as an NHS Trust) with which the Institutions are working. Other permutations may be adopted, but the definitions of the Academic Parties and the Commercial Parties will need to be adapted accordingly.

The full names and addresses of the parties should appear at the beginning of the Agreement.

Although a company may change its name and the address of its registered office, a company incorporated in the UK never changes its registered number. Therefore it is advisable to identify the company by its registered number.

You can check the registered number of corporate bodies registered with the Registrar of Companies in England, Wales, Scotland and N. Ireland by searching.

You may also find the European Business Registry useful.

3.3 Definitions and interpretation (Clause 1)

3.4 Academic publication

A charitable Institution’s objectives will include the dissemination of learning or knowledge for the public benefit.

Therefore a key element of most Agreements will be the right for the Institution’s researchers and students to publish academic papers and participate at conferences.

Publication is not only the life blood of the academic researcher’s career, but also important to the development of the research profile of the Institution.

All of the model agreements (except Collaboration Agreement 5 - Contract Research) allow for this in clause 5.

However, publication may damage the competitive position of the Institution or the Collaborator and/or the possibility of protecting and exploiting the IPR. For example, early disclosure will prevent a patent application from being successful because the invention will not be novel.

Therefore the Agreements (except Collaboration Agreement 5 - Contract Research) allow for a delay or, in exceptional circumstances, a prohibition on publication.

3.5 Academic and research purposes

So that a charitable Institution may use the Results in furtherance of its charitable educational objectives, where the other or another party owns some or all of the Results, the model agreements (except Collaboration Agreement 5 - Contract Research) allow the Institution to use the Results for research, teaching and education and, optionally, clinical patient care.

Collaboration Agreement 5 is designed to be used for Contract Research where the Institution is providing research services on a commercial basis.

Collaborators may wish to exclude certain types of research, such as collaborative research with a competitor of the Collaborator, from being used for Academic and Research Purposes.

3.6 This agreement

It is important that changes to the Agreement are properly recorded in writing and signed on behalf of each Party in order to avoid any misunderstandings. A copy of the document recording the change should be kept with the original signed copy of the Agreement.

The Lambert Toolkit contains example of a form of Variation Agreement for the Collaboration Agreements and the Consortium Agreements respectively which you might find useful if you need to change an agreement which has already been signed, for instance if a new party joins the project.

3.7 Background

It is likely that each party will make information, data, techniques, Know-how, inventions, discoveries, software or and materials available for use in the project.

Each party allows its Background to be used for the purposes of the project (clause 4.2).

Consortium Agreements A, B and C contain alternative wording for the licence of Background necessary for the exploitation of the Results.

Although it may not be necessary or possible to identify all of the Background necessary for the Project at the start of the Project, if the success of the Project depends on one or more of the Parties making certain Background available, that should be identified and described in the Project Plan (Schedule 2).

By listing the Background to be contributed you are distinguishing that Background from the Results of the Project.

Unless Schedule 2 obliges a Party to contribute specific Background, there will be no obligation to provide that Background. That will not prevent a party contributing that Background if it wishes to do so.

Depending on the nature of the Background, it may be advisable or necessary to enter into a Materials Transfer Agreement (clause 2.11).

The definition of Confidential Information should be considered in the context of Background – should all Background be the Confidential Information of the Party which contributes it, or should Background be treated as confidential only if it is identified as confidential at or before the time of disclosure?

While researchers may want to publish Background, it may be important that the Collaborator’s Background remains confidential. It is important that this issue is resolved at the outset.

3.8 Business day

If either Party is not in England, consider whether to change England in this definition. Note that public holidays in different parts of the UK are different.

3.9 Clinical patient care

This is an optional definition in the model agreements under which the Institution does not own all the Results. Delete this definition if Clinical Patient Care is not an activity for which the Institution may need to use the Results.

3.10 The collaborator’s supervisor

The project is to be carried out under the direction and supervision of the Collaborator’s Supervisor or Principal Investigator (clause 2.1).

3.11 Confidential information

Some Parties may take the view that all of their Background is commercially sensitive and must be kept confidential. If that is the case, the words in square brackets following the reference to Background should be deleted.

Alternatively, if the intention is that only Background and other information which is identified as being confidential is to be treated as such, the words in square brackets should be included.

Some Parties may take the view that all information disclosed must be kept confidential. Alternatively it may be treated as confidential only if it is identified as confidential or if, because of its nature or the circumstances of its disclosure, it should be treated as confidential.

Whether or not the words in square brackets are included, any information or material which is to be kept confidential should be marked ‘Confidential’ when it is disclosed to the other or other Parties.

3.12 Control

This expression is used to define a Group Company. It is a wide definition.

3.13 The data protection legislation

Please refer to the guidance on Data Protection and Schedule 6.

3.14 The external funding, the funding body and the funding conditions

These definitions, and provisions which refer to them, should be deleted if there is no External Funding for the Project.

It is important that the terms of the Agreement do not conflict with any terms imposed by the provider of any External Funding.

Before entering into any Collaboration or Consortium Agreement you should check the terms of any External Funding and any conflicts should be resolved by amending the terms of the Collaboration or Consortium Agreement or, perhaps, by deciding not to use one of the model agreements.

Note that some (but not all) funding bodies will insist that the party receiving the funding ensures that its collaborators comply with those terms and some funders (including UK Research Councils) will insist that there is a collaboration agreement in place before any funding is provided.

3.15 The field

This is an optional definition for use in Collaboration Agreements 1, 2 and 3, where the licence granted to the Collaborator may be restricted to a specific business or technological area or field of use.

By granting a non-exclusive licence in a field, the Institution is precluded from granting exclusive rights to any third party in the same field and in the same territory, but it may grant non- exclusive licences, and may itself exploit the technology, in that field and territory.

If the Collaborator’s key business area is pharmaceuticals, or its activities are limited to Europe, the Collaborator may have no need for a licence in other fields or territories, so leaving the way clear for the Institution, or other licensees of the Institution, to exploit the IP in other fields/territories.

3.16 The financial contribution

This is the money to be contributed by the Collaborator or Commercial Parties to the Project.

The ways in which this may be structured are almost endless and may include lump sum payments in advance or in instalments, payments depending on the costs incurred (e.g. staff costs), licence fees, royalties, revenue shares, success fees, etc., etc. or a combination of any of the above.

The payments to be made, and when they are to be made, should be set out in detail in Schedule 1.

3.17 Good data management practices

Schedule 4 sets put some basic data management practices. It is anticipated that some parties will need to add to these provisions. It is important that people can rely on the integrity of the research data and that adequate records are kept, not only for the purposes of filing patents but also to be able to demonstrate who created the results for the purposes of establishing the ownership of other IPR.

You may also wish to consult the RCUK’s Guidance on Best Practice on the Management of Research Data.

3.18 A group company

Collaborators may carry out research across a number of companies in their group. Therefore the model agreements allow Collaborators’ and Commercial Parties’ Group Companies to have access to the Background for the purposes of the Project and, in some cases, to exploit the Results and use the Results for Research Purposes.

3.19 Intellectual property rights (IPR)

The ownership and exploitation of IPR is one of the most difficult issues and the Parties should try to resolve it early when negotiating the terms governing the Project.

Certain sectors may wish to expand on the definition of IPR to include specifically, for instance, plant breeders’ rights.

3.20 Key personnel

The Project plan in Schedule 2 should contain the names of any people whose involvement is important to the success of the Project. Where most of the work is being done by one Party, for example, the Institution, the Key Personnel may all be the Institution’s researchers, but where the Collaborator is making a substantial ‘human’ contribution to the research activities, some Key Personnel may be provided by the Collaborator. The significance of the Key Personnel is that, if one of them leaves and is not replaced, the Agreement may be terminated under clause 9.2 (clause 8.2 in Collaboration Agreement 5).

3.21 Know-how

In some Projects the Know-how may be as important as the Results which are protected by patent or other IPRs. It includes technical information which is not patented, either because is not patentable or because the owner has decided not to patent it.

3.22 The principal investigator

The project is to be carried out under the direction and supervision of the Collaborator’s Supervisor or Principal Investigator (clause 2.1).

3.23 The project plan

One of the most important parts of the Agreement is the description of the project in Schedule 2. That Schedule and clause 2.2 determine what work is to be done and the resources which are to be provided; the nature of the IPR created will flow from the description of the Project and the anticipated Results.

Schedule 2 is the cornerstone of the Agreements and it is important that the researchers give serious thought to its contents and that it is complete and accurate and distinguishes each Party’s contribution from the contribution of other Parties.

It is also important that Schedule 2 contains a timetable for the Project (even if that timetable has to be refined as the Project progresses).

3.24 Research purposes

Research Purposes may be defined very widely – anything short of commercialisation (which the Agreements define as licensing or selling for value) - or for experimental purposes. If a narrow definition is used, depending on the sector, the Collaborator may want to expand on the definition to cover, for instance, to obtain regulatory approval or carry out clinical trials.

3.25 The results

These can take many forms, but they are whatever is identified or first reduced to practice or writing or developed in the course of the Project, and the IPR in them.

The Model Agreements do not identify the Results and it may not be possible for the Parties to identify them before the Project is actually carried out but, if the purpose of the Project to create specific outputs, these should be identified in the Project Plan (Schedule 2).

Identifying different sorts of Result is important where the ownership of the Results is to be split between the parties (as in Collaboration Agreement 4A and Consortium Agreement C).

3.26 The territory

This is an optional definition for use in Collaboration Agreements 1, 2 and 3, where the licence granted to the Collaborator may restricted to a specific territory. If the licence is not restricted to a specific territory, use ‘worldwide’ and delete the alternative wording.

By granting a non-exclusive licence in a field, the Institution is precluded from granting exclusive rights to any third party in the same field and in the same territory, but it may grant non-exclusive licences, and may itself exploit the technology, in that field and territory.

If a Collaborator’s key business area is pharmaceuticals, or its activities are limited to Europe, the Collaborator may have no need for a licence in other fields or territories, so leaving the way clear for the Institution, or other licensees of the Institution, to exploit the IPR in other fields/territories.

3.27 Variation agreement

Please refer to the model Variation Agreements(#ref5). These are designed to take you through each clause of the Research Collaboration Agreement or Consortium Agreement so that you check which terms may need to be varied if, for instance, a new party joins the Project.

In many cases you will need to vary only some of the terms of the Collaboration Agreement or Consortium Agreement.

3.28 Clauses 1.2 - 1.10

These clauses help interpret the Agreement.

Clause 1.5 allows communications by email. That may be convenient but it means that care must be taken to save emails in such a way in which they can be found and retrieved if necessary.

Clause 1.8 is included because of the way in which English interprets the wording of agreements.

Clauses 1.10 and 1.11 should be deleted if there is no External Funding for the Project.

3.29 The project (Clause 2)

3.30 Clause 2.1: The duration of the project

Ideally work should not start until the Agreement has been signed and it may be important that the terms are agreed before the Project starts if it is necessary to show that the Project is ‘Collaborative Research’ for State Aid purposes. Please refer to the Guidance on State Aid.

But, if work on the Project has begun before the Agreement is signed and dated, it is important to make the Agreement apply retrospectively to work already done.

The Agreement should not be back-dated, i.e. do not give it a date which is earlier than the date on which the last party to sign actually signs the Agreement; instead make the Commencement Date the date on which the Project actually started.

3.31 Clause 2.2: The contributions to the project

How this clause and clauses 2.3, 2.6, 2.7, 2.8, 2.9 are completed depends on whether or not the research is carried out only by the Institution or by both/all the Parties.

In some cases the Collaborator’s contribution may be the Financial Contribution and no more. In that case Collaboration Agreement 5 (Contract Research) may be the most suitable agreement to use.

The Institution may take the view that it should not be obliged to provide more resources than the Collaborator’s Financial Contribution and any External Funding allows. If that is the case, it may wish to add:

and in the case of the Institution, this will be limited to the extent covered by the Financial Contribution paid by the Collaborator and any External Funding the Institution receives for the Project

at the end of the first sentence.

3.32 Clauses 2.3 and 2.4: Regulatory and ethical licences and good practices

The purpose of this clause is to ensure that each Party either has or will, at the appropriate time, obtain any consents and approvals (for instance regulatory and ethical) that may be necessary for it to carry out its responsibilities under the Project. This is unrelated to the warranty in relation to the infringement of third party IPR in clause 7.1.

Each party must ensure that its staff and students comply with those licences and consents, keep proper records and comply with Schedule 4.

3.33 Clause 2.5: Access to premises and IT systems

The purpose of this clause is to ensure that when another Party has access to premises or IT systems, health and safety and security policies are observed.

3.34 Clause 2.6: Compliance with policies

This optional clause obliges the parties to comply with Schedule 7 which contains some basic rules where the research involves humans or animals.

Larger Collaborators are likely to have their own policies which they will want to be followed, and Part 3 of Schedule 7 refers to these. The Collaborator is able to change its own policies.

Some Funders may also have their own policies which will need to be adopted.

3.35 Clause 2.7: No guarantee of success

This clause makes it clear that the success of the Project is not guaranteed; that is in the nature of a research project.

3.36 Clause 2.8: Reporting

The Parties should agree how frequently reports are to be submitted. The frequency of reports will depend on the nature of the Project and the requirements of any Funding Body.

3.37 Clause 2.9: Reporting the Results

Potentially patentable inventions are to be notified promptly. That is so that steps towards filing a patent can be taken as soon as possible.

The notification of other results is left until the next report under clause 2.8. This is to reduce the administrative burden but, depending on the nature of the Project, the Parties may wish to amend clause 2.9 so that all Results are to be notified promptly.

3.38 Clause 2.10: Power to enter into the agreement

The Parties confirm that they have the right to enter into and perform the Agreement.

3.39 Clause 2.11: Materials transfer

Depending on the nature of any materials transferred between the Parties, there may need to be a separate Materials Transfer Agreement.

3.40 Clauses 2.12 and 2.13: Funding Conditions

If the Funding Conditions have not already been accepted, the Agreement is conditional on the Funding Conditions being accepted, i.e. the Agreement is not binding until the Funding Conditions have been accepted.

To avoid this uncertainty persisting for too long, a time limit of 30 days is imposed.

Some funders will have a short period during which an offer of funding is open for acceptance. It is important that the Parties comply with the Funding Conditions and keep each other informed.

Delete these clauses if there is no External Funding.

3.41 The financial contribution and external funding (Clause 3)

3.42 Clause 3.1: Financial contributions

The Financial Contribution(s) of the Parties should be set out in detail in Schedule 1.

When invoices are to be raised and when they are to be paid should be stated in this clause.

It may or may not be necessary for accounts of expenditure to be kept. It will be necessary where payments from the Collaborator depend on or any External Funding is provided on the basis of costs incurred or in order to satisfy any questions raised in connection with State Aid.

When completing Schedule 1, the Parties should take the rules relating to State Aid into account, to make sure that no state aid is being received by the Collaborator/Commercial Parties.
Schedule 2 should set out how the External Funding is to be allocated.

3.43 Clause 3.3: Interest on late payments

This clause allows interest to be calculated by reference to LIBOR or the Late Payment of Debts (Interest) Act. The Late Payment of Commercial Debts Act allows interest to be charged at a rate that is about 8% over Bank of England base rate. You should choose which you wish to use. Another possibility is calculating interest by reference to the base rate of any high street bank.

3.44 Clause 3.4: Ownership of equipment

This clause makes it clear that equipment bought using the Collaborator’s Financial Contribution or any External Funding will belong to the Institution unless Schedule 2 states otherwise.

3.45 Hardship provision

In Projects where any financial contribution is not based on the costs incurred, the Parties may agree to include a hardship provision in Schedule 1, providing for the Collaborator meeting (or at least considering meeting) any unanticipated increases in the Institution’s overheads, such as National Insurance contributions.

3.46 Use and exploitation of Intellectual Property Rights (clause 4)

As the provisions on the ownership, use and exploitation of the Results vary from model agreement to model agreement, please consult the Guidance Specific to each of the model agreements

This section sets out some general issues and principles common to most of the model agreements.

For information on the different types of IPR and its protection please see Intellectual Property office website.

3.47 Factors influencing ownership and exploitation of the results

It is important that the Parties decide which IPR provisions apply when they are discussing their respective contributions to the Project and the contents of the Project Plan in Schedule 2.

The decision as to which Party will own the IPR in the Results and/or has the right to exploit them will depend on a number of factors including: the Parties’ respective contributions in terms of intellectual effort, background, money, materials, facilities and human resources; their ability to exploit the Results, any conditions imposed in relation to any External Funding; and the Collaborator’s need to own assets against which it may be able to raise funds or attract investment.

To help you decide which of the Collaboration Agreements most closely reflects the circumstances of your Project, there is a Decision Guide to lead you through some of the principles and criteria that you may wish to take into account when deciding on the ownership and rights to exploit the IPR in the Results. You may find it helpful to consult this before using any of the model Collaboration Agreements.

3.48 Joint or co-ownership of IPR

The Parties may favour joint ownership of the IPR in the Results an ‘easy’ solution to the question of which Party should own the IPR.

Under English law, what each co-owner may do with the IPR in the Results is generally very limited. For instance, although each co-owner may use an invention, any dealing in the patent which protects that invention, including granting any licence, requires the permission of the other co-owner(s). That may result in the Collaborator not being able to commercialise the IPR and, depending on the importance of the IPR to the Collaborator’s business, it may affect the value of the business, making it more difficult to attract investment or to find a buyer.

If the Agreement is to provide for co-ownership, it should set out the rights of each owner clearly so that there is no misunderstanding. For instance, it might provide for the Collaborator having the exclusive right to commercialise (with the right to license others) in certain territories and fields (as if the Collaborator were an exclusive licensee) without having to obtain the Institution’s permission.

Thought also needs to be given to:

a) co-operation in filing for any patent or registering any other IPR which is co-owned;

b) both of the co-owners joining in any action against infringers;

c) how the proceeds of exploitation are to be shared between the co-owners;

d) what is to happen to the Collaborator’s share in the IPR if the Collaborator is wound up; and

e) what is to happen if the Collaborator wants to sell its business,

and appropriate provision should be included in the Agreement.

Many of the model agreements do not cover the joint ownership of IPR because this occurs more rarely than people think and it is more difficult for both the Collaborator and Institution to manage.

The model agreements usually adopt the simpler approach that one or other of the Parties will own the IPR, but the result of negotiations may be that the Institution owns the IPR in some Results and the Collaborator owns the IPR in other Results.

Collaboration Agreement 4A and Consortium Agreements A and D contain examples of a co-ownership provision.

The members of the Lambert Working Group recommend that you avoid joint or co-ownership where possible. If it is important that more than one party owns some IPR, a better way forward may be to consider whether some of the IPR should be owned by one Party, other IPR by another Party and so on, rather than having several or all of the organisations participating in the Project having a joint interest in the ownership of the IPR.

3.49 The status quo

The Agreements are concerned with the ownership and right to exploit the IPR in the Results. Clause 4.1 clarifies that the ownership of the IPR in the Background (or in any other technology, design, work, invention, software, data, technique, Know-how, or materials which are not Results) remain the property of the Party contributing them.

No rights are granted except those expressly set out in the Agreement.

Most of the model agreements do not grant licences to use Background except for the purposes of the Project, but Consortium Agreements A, B and C do allow Background to be used in so far as s necessary to exploit the Results.

3.50 Exclusive/non-exclusive (and sole) licences

If the Institution grants a non-exclusive licence of the IPR in the Results in a specified field and territory, both the Institution and the Collaborator will be able to use and commercialise the Results in that filed and territory, and the Institution will be able to license other parties (on a non-exclusive basis) to use and commercialise the Results in that field and territory.

But the Institution will not be able to grant anyone any exclusive rights to use and commercialise the IPR in the Results in that field and territory.

If the Institution grants an exclusive licence of the IPR in the Results to the Collaborator, only the Collaborator will be able to use and commercialise the Results in the field and the territory specified in that licence; the Institute will not be able to use and commercialise the IPR in the Results itself in that field in that territory. Nor will the Institute be able to license others to do so.

It is also possible to grant what is called a sole licence. That means that the Collaborator will be the only licensee, but the Institution does not exclude itself from using and commercialising the IPR in the Results.

3.51 Background

Each Party grants the other(s) a licence to use its Background for the purpose of carrying out the Project, but for no other purpose.

This right to use the Background may not be sub-licensed.

3.52 Patenting strategy/protecting IPR

The Agreements (except Collaboration Agreement 1 under which no more than non-exclusive licence to use the Results is granted) contain alternative wording under which the owner of IPR has an obligation to protect the IPR or discretion whether or not to protect the IPR.

If the Collaborator or another Party is interested in acquiring exclusive rights or in taking an assignment of the IPR in any Results, it may wish the Institution to apply for a patent or other protection to protect those Results. In practice the Institution and the Collaborator will need to discuss a patenting strategy before the Agreement is signed.

The model agreements provide for the Collaborator or Party wishing to take an exclusive licence or assignment paying the patenting and other costs which the Institution/other owner would not otherwise have incurred but that, if the rights are then licensed or assigned to another person, the Institution reimburses the Collaborator/other Party.

3.53 Assistance from other parties

Each Party is obliged to ensure that its employees and those of Group Companies (and where relevant students) involved in the creation of the Results give the owner of the Results assistance (except financial assistance) in connection with the registration and protection of the IPR in the Results, including filing and prosecuting patent applications and taking action against infringers.

3.54 Group companies

Where a licence is granted to a Collaborator or Commercial Party, the Agreements allow Group Companies take the benefit of that licence, although they are not entitled to the benefit of the Agreement as a whole.

3.55 Contractors and students

Where any student or contractor works on the Project, the Institution or the Party engaging the contractor should ensure that it has acquired any rights in the IPR which that student or contractor acquires by virtue of his or her involvement in the Project.

When a Party engages a contractor, the IPR created by the contractor will belong to the contractor unless the Party engaging the contractor takes an assignment of IPR from the contractor.

3.56 Prospective assignments of IPR

Some forms of IPR, such as copyright, may be assigned in advance or prospectively assigned, i.e. before the IPR is created, but that is not always the case.

Where the Agreements contain an assignment of IPR, the IPR is assigned in advance where the law allows that and, where IPR cannot be assigned in advance, there is an agreement to assign it later, once it has come into existence.

3.57 Warranty of full title guarantee

Where IPR is assigned the assignee may want the assignor to assign ‘with full title guarantee’. The person giving that warranty is promising that:

• it has the right to dispose of the IPR and that it will, at its own cost, do all that it reasonably can to give the title (ownership) that it purports to give
• the IPR is free from all charges and encumbrances (such as a mortgage) and rights of third parties (except those it does not know about/could not be expected to know about)

You will need to discuss whether the assignor is willing to assign with full title guarantee or whether the fuller alternative wording in clause 7.11 of Research Collaboration Agreements 4, 4A, 5 and 6 should be amended to suit the circumstances.

3.58 Licence back of the results

Where the IPR in the Results has been assigned to any party, the other(s) will need a licence to use the IPR to carry out the Project. Therefore Collaboration Agreements 4, 4A, 5 and 6 contain a licence back of the Results for these purposes.

3.59 Research purposes

A Collaborator may own some of the Results, but may want to be able to use other Results for Research Purposes.

Collaboration Agreement 4A and Consortium Agreements B, C and D contain rights for the Collaborator or Commercial Parties to use the Results for Research Purposes Definition of research purposes above

Where an agreement licenses or assigns the IPR in only some of the Results to the Collaborator/Commercial Party, the Collaborator/Commercial Party may wish to negotiate a licence of the IPR in other Results for Research Purposes.

3.60 Royalties

Where any royalties are to be paid in return for a licence, the words ‘fully paid-up, royalty free’ should be deleted from the grant of that licence in the model agreements.

3.61 Re-assignment of IPR/time limited licences/assignments

Understandably there will be concerns about assigning IPR to an undertaking which may later be insolvent or which may not be successful in exploiting the Results.

Therefore Institutions may wish to include provision for the re-assignment of IPR if certain targets for on-going payments are not met, or if the Collaborator is not exploiting the IPR. That sort of clause may not be effective if the Collaborator is insolvent.

Copyright (but not patent) may be assigned for a limited time so, where the main IPR is protected by copyright, one approach to consider is an assignment which is limited in time.

If there is concern about the solvency of the Collaborator to whom IPR is to be assigned, the assignor may prefer to grant a licence which can be terminated on breach or insolvency.

Another approach to consider is to time-limit the rights of the Collaborator, allowing it exclusivity for a number of years, and at the end of that period, the Collaborator and the Institution both having non-exclusive rights to exploit the IPR.

3.62 Academic publication (Clause 5: except collaboration agreement 5)

For reasons explained above in the context of the definition of Academic Publication, there is an obvious tension between industry’s wish to protect the IPR and academia’s wish to publish, and it may be necessary for the Parties to discuss how a proposed publication may be amended in order to accommodate the academics’ desire to publish while retaining protection for commercially valuable or sensitive information and materials. This issue should be addressed as early as possible in the negotiations.

Clause 5.2 of the Agreements obliges the Institution to give notice of any proposed publication and gives the Collaborator an opportunity to require a delay to allow the IPR to be protected.

The period during which publication may be delayed will vary according to the circumstances and the nature of the information to be published; it may be as little as one month or as much as 12 months (or possibly more). Some forms of IPR (e.g. copyright in computer programs) do not need to be protected and therefore no delay is justified.

Know-how and trade secrets are protected only by being kept confidential and, for that kind of Result or Background, it may be justifiable for publication to be prevented indefinitely.

There is also the more grey area of inventions which may be protected by patent but which the owner chooses not to patent but to protect by keeping the invention confidential. In that case the Parties will need to discuss and agree whether it is justifiable for publication to be delayed indefinitely or only for a limited time.

Clause 5.2 contains optional wording to prevent Background being Published even though the Collaborator has not responded to a notice of proposed Publication. That will be justifiable where the Background is the Collaborator’s Confidential Information.

Collaboration Agreement 5 (Contract Research) does not allow for Academic Publication. This is because the Institution is being commissioned to undertake research on a commercial basis, and will be paid accordingly.

3.63 Theses

Where students are involved in the project, the Collaborator and the Institution may agree to add a clause allowing for the submission of a thesis and its deposit in the Institution’s library. An example of this sort of clause is given below.

The Institution will need to have a process for examining theses confidentially and restricting access to them in the library.

Possible thesis clauses:

Where, with the agreement of the Collaborator, any registered student of the Institution has been involved in the Project, nothing in this Agreement will prevent that student submitting a thesis based on any of the [Results and the] Collaborator’s Background for a degree of the Institution, or the examination of that thesis by examiners appointed by the Institution, or the deposit of that thesis in a library of the Institution in accordance with the relevant procedures of the Institution. However, if the examination or deposit of the thesis will disclose any [Result or any] of the Collaborator’s Background, the Institution will notify the Collaborator at least [30][60] OR [90] days before the thesis is due to be submitted, and the Collaborator may, by giving notice to the Institution (a Thesis Notice) within [15] OR [30] days after the Collaborator receives the notice from the Institution , require any external examiners or readers of the deposited thesis to sign confidentiality undertakings as a condition of receipt of the thesis. If the Institution does not receive a thesis notice within that period, it may proceed with examination and deposit of the thesis.]

or

Where, with the agreement of the Collaborator, any registered student of the Institution has been involved in the Project he will follow the Institution’s regulations for the submission of any thesis or theses for examination. In any event the Institution will procure that the student will submit a draft thesis to the Principal Investigator and the Collaborator’s supervisor at least [30] days before the date for submission for examination. The student may not, without the Collaborator’s express written consent, include in any thesis any of the Collaborator’s Background or any Results in which the Collaborator owns the Intellectual Property Rights.]

3.64 Confidentiality (Clause 6 or clause 5 in research collaboration agreement 5)

3.65 Confidential Information

The Agreements treat the Results as the Confidential Information of the Party which owns the IPR in them.

The Background contributed by a Party may also be its Confidential Information, either automatically or if that Party has identified it as being confidential (depending on how the definition of Confidential Information is completed).

A Party’s Confidential Information also includes other information disclosed by that Party and identified as being confidential or which by its nature or the circumstances of its disclosure should be presumed to be confidential.

3.66 Time limits

It is common to limit the time during which information is to be kept confidential, and clause 6.1 (5.1 in Collaboration Agreement 5) allows for that. The danger of doing this is that the information may still be commercially sensitive, or should be kept confidential for some other reason, after the end of the period of confidentiality.

The Parties should consider whether any information should be kept confidential indefinitely. That will be especially important in the case of valuable Know-how.

If information is to be kept confidential indefinitely, the words in square brackets in clause 6.1 (clause 5 in Collaboration Agreement 5) should be omitted.

Even if the clause is unlimited in duration, the law will not uphold it so as to protect information which is in the public domain – see clause 6.2.2 (clause 5.2.2 I Collaboration Agreement 5).

3.67 Exceptions

Clause 6.2 (clause 5.2 in Collaboration Agreement 5) sets out the exceptions to the obligation of confidentiality and restriction on use in clause 6.1 (5.1).

3.68 Freedom of Information

Simply stating in the Agreement that certain information is confidential and/or marking it as confidential will not guarantee that will be kept confidential. Members of the public have the ‘right to know’ or right of access under the Freedom of Information Act 2000 (FOIA) and the Environmental Information Regulations 2004 (EIR) to recorded information held by public authorities. Universities are public authorities for this purpose.

This means that universities are obliged to disclose information on request unless the information comes within one of the exemptions to the FOIA.

For the purposes of research collaborations, the most likely exemptions are:

a) the information was provided by another person to the Institution in confidence and its disclosure would mean that the Institution would be in breach of confidence and could be sued by the person whose information is disclosed (that is that the disclosure would be an actionable breach of confidence on the part of the Institution);

b) the information is a trade secret; or

c) the disclosure of the information would prejudice someone’s commercial interests and the public interest in withholding the information outweighs the public interest in disclosing it.

If an Institution is requested to provide information under the FOIA, it is likely to need to consult with the other Party or Parties to determine whether one of the above exemptions applies. For example, even if information has been supplied by the Collaborator in confidence initially, if the information has since come into the public domain, it will no longer come within the first exemption. The Institution may not, however, be aware of that unless it consults with the Collaborator.

Clause 6.2.5 (clause 5.2.5 in Consortium Agreement 5) allows the Institution to make any disclosure required by law. That means that the exemption mentioned in a) above will not apply; the Collaborator will not be able to prevent the Institution from making a disclosure made under the FOIA.

Although that helps the Institution to comply with the FOIA, and to avoid the risk that the Collaborator may bring a claim for breach of confidence, the Collaborator may find that approach unacceptable so far as its commercially valuable or sensitive information is concerned, and it will make the Collaborator less willing to provide information to the Institution. Therefore an exception for disclosures under the FOIA has been added in clause 6.6 (Clause 5.6 in Collaboration Agreement 5).

Some Collaborators may prefer to restrict disclosures under the FOIA and EIR in return for giving an indemnity to the Institution.

More information on the FOIA can be found on the Information Commissioner’s Website.

Note that the legislation in Scotland is different. Information about the Freedom of Information (Scotland) Act 2002 and the Environmental Information (Scotland) Regulations 2004 may be found at: Scotland Information Commissioner’s Website.

Where necessary, the Agreement will need to be amended to reflect the law in Scotland.

3.69 Theses

If the Parties have agreed to include a clause allowing for the examination and submission of theses, they will need to add the following as clause 6.3.1 (clause 5.3.1 in Collaboration Agreement 5):

; or by the examination or deposit of a student thesis if the [Institution] [Academic Party] has followed the procedure in clause [6.3.2] OR [5.3.3] and has not received a Thesis Notice within the period stated in that clause.’

3.70 Restrictions on the use of another party’s name

Clause 6.7 (clause 5.7 in Collaboration Agreement 5) contains a standard restriction on the use of another’ Party’s name or logo without consent.

Each party may want to qualify that along the lines suggested in clause 6.8 (clause 5.8 in Collaboration Agreement 5).

3.71 Limitation of Liability (clause 7 or clause 6 in Research Collaboration Agreement 5)

The Parties should consider their insurance arrangements when considering their liability and giving any indemnities.

3.72 IPR warranty

The alternative wordings for clause 7.1 (clause 6.1 in Collaboration Agreement 5) take very different approaches.

In the first version of the clause there is a limited warranty in respect of the non-infringement of third party rights. The second set of wording makes it clear that no warranty is given in this respect. This is something that the Parties will have to negotiate.

Even where a warranty is given, the warranty is qualified and, where possible, appropriate searches should be made by the Party wishing to exploit the Results.

It is impossible to search for certain types of IPR such as copyright, and where that is the major kind of IPR in the Results, it will be more appropriate to have a warranty in respect of the non-infringement of third party rights.

3.73 Indemnity from the collaborator/commercial parties

In clause 7.3 (clause 6.3 in Collaboration Agreement 5), the Collaborator/ Commercial Parties indemnify ((agrees bear the losses and expenses of) the Institution/Academic Parties and their employees and students, against any claim brought against them as a result of the Collaborator’s/Commercial Parties’ use of the Results or the Institution’s/ Academic Parties Background. The rationale for this is that the Collaborator/ Commercial Parties take the commercial risks associated with its use of the IPR, but reference to the Institution giving the indemnity has been added should the Parties agree that the Institution should also give that sort of indemnity.

The indemnity is conditional on the person claiming the benefit of the indemnity letting the Collaborator/Commercial Party know about the claim quickly, not making any admission, mitigating its losses and expenses (i.e. doing what it can to keep them to a reasonable level) allowing the Collaborator/Commercial Party to deal with the claim, and helping the Collaborator/Commercial Party in dealing with it (at the Collaborator’s/Commercial Party’s expense). These conditions are imposed to make sure that the Institution and its employees and students do not make matters worse and potentially increase the amount of the claim.

The Collaborator will not, however, indemnify anyone if their negligence or deliberate breach of the Agreement, or breach of clause 6 (clause 5 in Collaboration Agreement 5), or knowing infringement of third party IPR or knowing breach of third party rights of confidence has given rise to the claim.

Liability under this indemnity is capped in clause 7.7.1 (clause 6.7.1 in Collaboration Agreement 5).

The Parties should consider whether the Collaborator/Commercial Parties should be required to have insurance to back up the indemnity. Larger organisations may self-insure, but where a Party has limited financial resources, the indemnity may be worthless unless the Party giving it has appropriate insurance.

3.74 Indemnities in respect of breaches of data protection

In clause 7.4 (clause 6.4 in Collaboration Agreement 5) each Party (the Indemnifying Party) indemnifies (agrees bear the losses and expenses of) the others arising from the Indemnifying Party’s breach of the Data Protection provisions in Schedule 6.

The provisions of these Schedules have been singled out because their breach can lead to innocent parties incurring large fines and/or substantial liability to third parties.

Liability under this indemnity is capped in clause 7.8.2 (clause 6.8.2 in Collaboration Agreement 5), but the Parties may take the view that the level of those caps should be higher than the general cap on liability in clause 7.7 (clause 6.7 in Collaboration Agreement 5).

The indemnity in clause 7.4 (clause 6.4 in Collaboration Agreement 5) is not subject to the same conditions as appear in the indemnity in clause 7.3 (clause 6.3 in Collaboration Agreement 5) because, whereas it is appropriate for a party which infringes IPR by its contribution to the Project to defend third party claims and it will be in the direct firing line, the Indemnifying Party will not have the same involvement in any investigation carried out by the Information Commissioner into the data processing practices of the Indemnified Party. The most likely result of a data protection breach is the imposition of a fine which the Indemnifying Party will not be able to mitigate.

3.75 Exclusions of liability and disclaimers

Clause 7.2 (clause 6.2 in Collaboration Agreement 5) excludes liability for any use or reliance by another Party of the Results or any advice or information given in connection with the Results.

That is qualified by the indemnities given in clauses 7.3 and 7.4 under which the Parties do accept liability in certain respects.

The words in square brackets in clause 7.2 (clause 6.2 in Collaboration Agreement 5) should be omitted if the second version of clause 7.1 (clause 6.1 in Collaboration Agreement 5) is used.

The object of clause 7.5 (clause 6.5 in Collaboration Agreement 5) is to exclude liability for:

a) indirect loss, that is loss that the Parties would not necessarily foresee as being the natural and direct result of a breach of contract or negligence; a loss that is suffered only because some special circumstance; and

b) loss of profits, revenue, contracts and opportunity, whether direct or indirect.

The complete exclusion of loss of profits and revenue may leave the Collaborator with no worthwhile claim. The Parties should consider whether this results a fair allocation of risk and reward, especially if the Collaborator is commissioning the research in an area which is important to its business.

Clause 7.5 (clause 6.5 in Collaboration Agreement 5) is qualified by the indemnities given in clauses 7.3 and 7.4 (clauses 6.3 and 6.4 in Collaboration Agreement 5) under which the Parties do accept liability in limited circumstances.

The law, such as the Supply of Goods and Services Act, and sometimes the course of dealing between the Parties, can mean that conditions are implied into an agreement, even though they are not actually set out in the agreement. Clause 7.9 (clause 6.9 in Collaboration Agreement 5) excludes that sort of condition. A typical example of an implied condition is that reasonable skill and care will be used or that goods will be fit for purpose. Only the express terms of the Agreement apply to the Project.

3.76 General cap/limitation on liability

Clause 7.6 (clause 6.6 in Collaboration Agreement 5) caps each Party’s liability. Alternative wording is provided and the Parties will have to negotiate the level of that cap.

The cap in this clause does not apply to liability under any of the indemnities or for any breach of the Funding Conditions. If the Parties agree that that general cap should apply to liability under the indemnities and for breach of the Funding Conditions, this clause should not be subject to clause 7.7, and clause 7.7 (clause 6.7 in Collaboration Agreement 5) should be deleted.

3.77 Unlimited liability

Clause 7.8 (clause 6.8 in Collaboration Agreement 5) lists the types of liability which are not excluded or limited. This principle overrides the limitations and exclusions in other clauses.

The types are liability which are not excluded or limited are: liability for death or personal injury caused by negligence (which the Unfair Contract terms Act does not allow to be limited or excluded), liability for fraud and other liability which the law does not allow to be limited or excluded.

The model agreements take the line that it would be unfair to cap or exclude liability for deliberate the breach of the Agreement.

3.78 Force majeure (clause 8 or clause 7 in research collaboration agreement 5)

Each Party is excused if its delay in performance or failure to perform is caused by circumstances outside its control, but to avoid the Project being in limbo indefinitely the other Party or Parties may terminate or treat a party as having withdrawn from the Project if the delay lasts for more than a specified amount of time.

For the purposes of this clause, the acts and omissions of Group Companies are deemed to be within the Collaborator’s/Commercial Parties’ control, the acts and omissions of students are deemed to be within the Institution’s/Academic Parties’ control and the acts and omissions of any contractor are deemed to be within the control of the Party engaging that contractor.

3.79 Termination (clause 9 or clause 8 in research collaboration agreement 5)

3.80 Breach or insolvency

Under clause 9.1 of the Collaboration Agreements (clause 8.1 in Collaboration Agreement 5) any Party may terminate the Agreement if the other Party is in breach of contract or is insolvent.

If the breach is capable of remedy, there is an opportunity to remedy the breach before notice of termination is given, except no opportunity to remedy is given for a breach of Schedule 5 (Anti-bribery) or Schedule 7 (which includes Anti-slavery).

Under the Consortium Agreements the position is more complicated. Because these are multi-party Agreements, instead of the Agreement terminating and the whole Project coming to an end, the Consortium Agreements work on the premise that a Party is treated as having withdrawn from the project if it breaches the anti-bribery provisions or is otherwise in breach and does not remedy that breach or if it is insolvent. In those cases the other Parties give notice treated that Party as having withdrawn.

3.81 Loss of key personnel

In some Projects it may make sense to have a right to terminate if key personnel are unavailable and a suitable replacement is not appointed within a specified period (clause 9.2 or clause 8.2 in Collaboration Agreement 5).

The use of this clause on the Consortium Agreements should be considered carefully; the withdrawal of a Party could jeopardise the Project as a whole and it may be preferable not to allow any Party to withdraw without the agreement of all the other Parties.

In practice, if a key researcher moves to another Institution, it may be possible to novate the agreement with the new Institution.

3.82 Termination for convenience

Collaborators/Commercial Parties may take the view that provided they honour their obligations to pay the Institution/Academic Parties, they should be able to terminate or withdraw from the Project. Therefore clause 9.3 (clause 8.3 of Collaboration Agreement 5) allows them to terminate or withdraw on notice, subject to them honouring their obligations to pay certain expenses and costs.

The use of this sort of clause in the Consortium Agreements should be considered carefully; the withdrawal of a Party could jeopardise the Project as a whole and it may be preferable not to allow any Party to withdraw without the agreement of all the other Parties.

3.83 Payment obligations post termination

The Collaborator/Commercial Parties are obliged to pay for work done before termination.

In addition, on termination or if a Commercial Party withdraws or is treated as having withdrawn because it is not possible to replace a member of the Key Personnel or for convenience, the Collaborator/Commercial Party is obliged to re-imburse the Institution/Academic Parties for all costs and expenses which they have incurred or agreed to incur and which they are unable to cancel.

On termination or if a Commercial Party is treated as having withdrawn where the Collaborator/Commercial Party is at fault or where the Collaborator/Commercial Party withdraws for convenience , the Collaborator/Commercial Party must also continue to pay employment costs for the Institution’s/Academic Parties’ staff (if its Financial Contribution was intended to cover the costs).

If at the end of the Agreement any part of the Financial Contribution has not been used, that part is to be returned.

3.84 Other provisions surviving termination

Some provisions, especially confidentiality, IPR and liability should survive the end of the end of the Project or termination of the Agreement.

If on-going payments are to be made as part of the Financial Contribution, the obligation to continue making those payments may need to survive the end of the Project or termination.

3.85 Licences post termination

The following licences/rights will survive the termination of the Agreement:

• the Institution’s/Academic Parties’ rights to use Results or Background for Academic and Research Purposes and for Academic Publication (except for Collaboration Agreement 5 where there are no such rights)
• the Collaborator’s/Commercial Parties’ rights to use Results or Background for Research Purposes
• if the Collaborator terminates because of the Institution’s breach or insolvency, the basic non-exclusive licence granted to the Collaborator under Collaboration Agreements 1, 2 and 3 to use the Results in the Field in the Territory
• rights to use the Background and Results of a Party to a Consortium Agreement which withdraws or is treated as withdrawing from the Project

3.86 General (clause 10 or clause 9 in research collaboration agreement 5)

3.87 Notices

If any Party has cause to give a notice under the Agreement, the procedure in clause 10.1 (clause 9.1 in Collaboration Agreement 5) must be followed.

3.88 Assignment of the agreement

Assignment of the Agreement is subject to the consent of the other Party or Parties, but optional wording has been included to allow the Collaborator to assign to a Group Company.

If a Party bows out of the Project by assigning or transferring the Agreement to a new party, the original Parties and the new Party should consider whether to execute a novation agreement. Typically this will release the Party bowing out of the Project from its undertakings (but preserve its obligations of confidentiality) and give the Parties an opportunity to sort out any rights they need to use or exploit the IPR of the Party leaving the Project.

3.89 Entire agreement

The Agreement is the entire agreement between the Parties. The Parties should think carefully about whether that statement is correct. The effect of this clause is to remove the possibility that undertakings or understandings given or implied in any other documents or orally have any effect. That may not be appropriate if, for instance, there is a supplementary Materials Transfer Agreement or the Parties are relying on what was said in any proposal submitted for External Funding.

The Funding Terms may be part of ‘the deal’ if they impose conditions which apply to the relationship between the Parties.

3.90 Governing law

Although English law governs the Agreement and disputes are to be referred to the English courts, the Parties are free to bring legal proceedings in any other jurisdiction to protect their IPR or Confidential Information.

3.91 Escalation

The model agreements allow for the escalation within each organisation to help resolve disputes. That should not preclude any Party taking action through the courts, where the matter is serious.

If the Parties wish to maintain friendly relations, they might like to consider alternative dispute resolution (ADR) as an alternative to resolving disputes through the courts, but should bear in mind that they will have to pay any mediator and the mediation will not be binding unless both/all parties agree to the outcome.

3.92 Anti-Bribery

Please refer to the guidance on anti-bribery and corruption.

3.93 Data protection

Please refer to the guidance on data protection

3.94 Counterparts

Although it is not strictly necessary to have this sort of clause, it allows for the possibility that both Parties will not sign the same single copy of the Agreement and is useful where there may be a need for more than one original copy, e.g. to produce as evidence.

You should not include this wording if there is a risk that work on the Project will begin before the Agreement is signed by both Parties or that the Agreement will never be signed by both Parties, but you nevertheless proceed with the Project on the basis of agreed but unsigned terms.

3.95 Export control

There may be no export control considerations, but in some sectors export control will be important. A sample clause is given in the Agreements, but where export control is important, the Parties may need more sophisticated provisions.

3.96 Signatures

The Collaboration Agreements should be prepared in duplicate and, unless you are using counterparts, both Parties should sign both copies.

The number of Consortium Agreements will depend on the number of Parties. Unless you are using counterparts, all Parties should sign all copies.

The signed copies should be kept safely. If there is a dispute they may need to be produced in court.

The Principal Investigator and the Collaborator’s Supervisor or the individual who is responsible for the direction and supervision of the Project are asked to acknowledge the terms of the Agreement as a check that the researchers are aware of its terms and that those terms reflect what they think they are doing. The researchers are not Parties to the Agreement and are not liable to the other party or Parties if there is a breach of the Agreement.

In Collaboration Agreement 6 (KTP), the Company may wish the Associate (the graduate or postgraduate student who will carry out the work) to acknowledge that he or she has read and understood the Agreement.

3.97 The schedules

3.98 Schedule 1 (The financial contribution(s))

The ways in which the Project may be funded by the Parties are very varied and will need to be negotiated.

This Schedule should set out complete details of the Financial Contribution to be paid by each Party, e.g. whether the Financial Contribution is a fixed price or, where it is on a costs basis, the types of expenditure which will be reimbursed, the maximum amount (if any) which will be paid, any milestones to be met and any conditions attaching to payment.

The Parties may agree that the Collaborator will cover increases in salary (or at least those in line with national pay awards), superannuation and NI contributions. In that case, Schedule 1 should reflect this.

The starting point is that the Collaborator will meet the full economic cost of the project or, where the Collaborator is to own IPR, the full economic cost plus a profit element.

For information on full economic cost is available.

As charities, Institutions are obliged to take reasonable steps to protect their property (including IPR generated by a research project) and to maximise their return from that property.

That return may take various forms - a one-off payment, a series of lump sum payments, royalties, a share of revenues, a success payment or a combination of the above.

The initial return is the Financial Contribution paid by the Collaborator(s).

Where a Collaborator later negotiates and is granted a further licence or takes an assignment of IPR, the Institution will seek a further return. What that return is will be determined in the negotiations between the Institution and the Collaborator for the licence or assignment.

When completing Schedule 1, the Parties should take the rules relating to State Aid into account, to make sure that no state aid is being received by the Collaborator/Commercial Parties. The Contributions in kind listed in Schedule 2 will also have a bearing on whether there is any State Aid.

It is instructive to look at the case of Dutch Technische Universiteit Delft (TUD) and the company Delftship BV where the European Commission considered a 5% royalty which had been negotiated by TUD.

3.99 Schedule 2 (The project plan)

This Schedule should contain a full description of the Project, clearly setting out what each Party is to do (with a timetable if appropriate), and the human resources, facilities and equipment each Party is to provide. The Schedule sets out some headings for the sort of details to be provided.

3.100 Schedule 3

If there is External Funding for the Project, the Funding Conditions should be set out in this Schedule.

3.101 Schedule 4

Schedule 4 sets put some basic data management practices. It is anticipated that some Parties will need to add to these provisions. It is important that people can rely on the integrity of the research data and that adequate records are kept, not only for the purposes of filing patents but also to be able to demonstrate who created the results for the purposes of establishing the ownership of other IPR.

3.102 Schedule 5

Please see the guidance on Anti-bribery and corruption.

3.103 Schedule 6

Please see the guidance on Data Protection

3.104 Schedule 7

Part 1 of this Schedule contains some basic rules where the research involves humans. Depending on the nature of the research the Parties may also wish to include rules about the use of animals.

Part 2 of this Schedule contains provisions relating to anti-slavery designed to help compliance with the Modern Slavery Act 2015 (the MSA).

Section 54 of the MSA obliges organisations with a turnover of £36M or and who sell goods or services in the UK to produce an annual statement setting out the steps the taken to ensure that slavery and human trafficking is not taking place in their business or their supply chains. Including the sort of provisions which appear in part 2 of Schedule 7 in contracts is one way of helping combat slavery and human trafficking and can be referred to in the annual statement.

The obligation to comply with all applicable laws and regulations in clause 2.3 will include an obligation to comply with the MSA (where it applies) but the provisions in Part 2 of Schedule 7 go further in obliging the Parties to have anti-slavery policies and impose similar conditions through their supply chains.

Larger Collaborators/Commercial Parties are likely to have their own policies which they will want to be followed, and Part 3 of Schedule 7 refers to these. The Collaborator/Commercial Party is able to change its own policies.

4. Guidance specific to each of the model agreements

4.1 Guidance specific to collaboration agreement 1

In this Agreement the Institution owns the IPR in the Results and grants the Collaborator and Group Companies a non-exclusive licence to use the IPR in the Results for any purpose (possibly in a specific field and/or territory), but the Collaborator has no right to sublicense the use of the Results.

If the Collaborator wishes to sublicense the use of the Results, or to have exclusive rights, it will need to negotiate to obtain a further licence, and/or to take an assignment of some or all of the IPR in the Results.

(Please see Collaboration Agreements 2 and 3).

Collaboration Agreement 1 does not envisage any further licence or an assignment, but there is nothing to stop the Institution and the Collaborator negotiating that later if this is what they both wish to do.

There is some comfort for Collaborators in that they already have non-exclusive rights granted under Consortium Agreement 1, and that means that the Institution will not be able to grant an exclusive licence to a third party in the same field and territory; in practice the most likely person the Institution will want to deal with is the Collaborator because of its involvement in the Project and understanding of the technology and the market for the technology; the Institution will have an incentive to do business with the Collaborator, so as to increase the Institution’s return.

4.2 Guidance specific to collaboration agreement 2

In this Agreement the Institution owns the IPR in the Results and grants the Collaborator and Group Companies a non-exclusive licence to use the IPR in the Results for any purpose (possibly in a specific field and/or territory), but the Collaborator has no right to sublicense the use of the Results. This is exactly as in Collaboration Agreement 1.

The difference between Collaboration Agreements 1 and 2 is that Collaboration Agreement 2 envisages that the Collaborator will want the opportunity to negotiate an exclusive licence of the IPR in some or all of the Results.

Clause 4.7 allows the Collaborator, during the Project Period and for a specified number of months after the end of the Project, to give notice calling on the Institution to negotiate an exclusive licence of the Institution’s IPR.

Although this is called an option notice, this is not an option as such; the Institution cannot be obliged to grant the licence and its grant will depend on the Parties being able to reach agreement on what is to be licensed and on the terms of that licence.

To give the Collaborator a chance to negotiate that licence and the Institution an incentive to come to the negotiating table, the Institution agrees not to grant a licence:

• to use the Institution’s Results nor to assign the IPR in those Results to a third party for a specified period of time
• of any of its Results nor to assign the IPR in those Results to a third party on any terms more favourable than those offered to the Collaborator for a period of time following the end of the period during which the Parties are to negotiate

If the Collaborator is interested in taking a licence of the Institution’s results, the Collaborator may be concerned that those results are protected by patent or other applications. Therefore clause 4.7.4 provides for consultation and the Collaborator paying the costs if it requests the Institution to protect any Results.

The clause also provides for the re-imbursement of the costs paid by the Collaborator if the Institution later licenses or assigns to a third party any of the Institution’s Results for which the Collaborator has paid any those costs.

In order to bring more certainty to the negotiations, the Parties may prefer to include an outline of the terms they envisage will apply to any further licence in a Schedule to the Agreement.

The sort of issue which will need to be addressed include:

• which Results are licensed?
• is the licence an exclusive (or possibly a sole) licence?
• is the licence restricted to one or more specified territories, or is it worldwide?
• is the licence restricted to one or more specified fields?
• what is the duration of the licence – is it indefinite, for a minimum or fixed term of years, or terminable on a certain amount of notice by either Party?
• will the Collaborator make a one-off payment, pay a series of lump sum payments, pay royalties, pay a success fee, or a combination of the above in return for the licence?
• how are payments to be calculated?
• when are payments to be made?
• are there any targets?
• do the rights revert to the Institution if those targets not met?
• is the Institution obliged to make payments to the Collaborator if the Institution then commercialises the rights which have reverted to it?
• are any of the confidentiality obligations in the Collaboration Agreement to be relaxed to give effect to the new arrangements?

In reality, Collaboration Agreements 2 and 3 may be combined so that the Collaborator has the right to negotiate an exclusive licence and/or an assignment. The outcome of negotiations could be, for instance, that the Collaborator takes an exclusive licence in one field and an assignment of IPR in a different field.

4.3 Guidance specific to collaboration agreement 3

In this Agreement the Institution owns the IPR in the Results and grants the Collaborator and Group Companies a non-exclusive licence to use the IPR in the Results for any purpose (possibly in a specific field and/or territory), but the Collaborator has no right to sublicense the use of the Results. This is exactly as in Collaboration Agreement 1.

The difference between Collaboration Agreements 2 and 3 is that Collaboration Agreement 3 envisages that the Collaborator will want the opportunity to negotiate an assignment (rather than an exclusive licence) of the IPR in some or all of the Results. Clause 4.7 allows the Collaborator, during the Project Period and for a specified number of months after the end of the Project, to give notice calling on the Institution to negotiate an assignment of the Institution’s IPR.

Although this is called an option notice, this is not an option as such; the Institution cannot be obliged to make the assignment and it will depend on the Parties being able to reach agreement on what is to be assigned and on the terms of that assignment.

To give the Collaborator a chance to negotiate that assignment and the Institution an incentive to come to the negotiating table, the Institution agrees not to grant a licence:

• to use the Institution’s Results nor to assign the IPR in those Results to a third party for a specified period of time
• of any of its Results nor to assign the IPR in those Results to a third party on any terms more favourable than those offered to the Collaborator for a period of time following the end of the period during which the Parties are to negotiate

In order to bring more certainty to the negotiations, the Parties may prefer to include an outline of the terms they envisage will apply to any assignment in a Schedule to the Agreement.

The sort of issue which will need to be addressed include:

• which Results are to be assigned?
• is the assignment restricted to one or more specified territories, or is it worldwide?
• is the assignment restricted to one or more specified fields?
• will the Collaborator make a one-off payment, pay a series of lump sum payments, pay a revenue share, pay a success fee, or a combination of the above in return for the assignment?
• how are payments to be calculated?
• when are payments to be made?
• are there any targets?
• do the rights revert to the Institution if those targets not met?
• is the Institution obliged to make payments to the Collaborator if the Institution then commercialises the rights which have reverted to it?
• are any of the confidentiality obligations in the Collaboration Agreement to be relaxed to give effect to the new arrangements?

In reality, Collaboration Agreements 2 and 3 may be combined so that the Collaborator has the right to negotiate an exclusive licence and/or an assignment. The outcome of negotiations could be, for instance, that the Collaborator takes an exclusive licence in one field and an assignment of IPR in a different field.

In reality, model research collaboration agreements 2 and 3 may be combined so that the Collaborator has the right to negotiate an exclusive licence and/or an assignment. The outcome of negotiations could be, for instance, that the Collaborator takes an exclusive licence in one territory and an assignment of IP in a different territory.

4.4 Guidance specific to collaboration agreement 4

In this Agreement the Collaborator owns the IPR in the Results.

The Institution assigns the IPR in the Results to the Collaborator, and the Collaborator grants a licence back of the Results so that the Institution can participate in the Project.

The Institution has the right to use the Results for Academic and Research Purposes, and Academic Publication is permitted.

The Parties will have to agree whether or not any warranty will be given in respect of the assignment in clause 7.10.

Clause 4.7 provides the possibility of the re-assignment of the IPR in the Results to the Institution, at the Institution’s request, if the Collaborator is not exploiting or taking reasonable steps to exploit the Results. This is designed to prevent the Collaborator ‘sitting on’ the Results. The Collaborator may wish to consider any re-assignment being dependent on the reimbursement of costs incurred in registering any patents and on the Institution paying the Collaborator a revenue share in the event of the Institution successfully exploiting the IPR re-assigned to the Institution.

The Collaborator is unlikely to agree to this clause if the Results relate to its Background, Materials or Confidential Information.

4.5 Guidance specific to collaboration agreement 4A

This is one of the two model agreements added in 2016. It has been added to the Lambert Toolkit to cover the ownership of the Results being split between the Institution and the Collaborator.

Each Party has the right to exploit certain of the Results and takes an assignment of those Results.

There are various reasons why the Parties might agree to split the ownership of the Results. The definition of the Collaborator’s Results contains optional wording for use where:

• the Collaborator will own the Results which relate to the Background, Materials or Confidential Information which it has provided to the Project or which are the subject or one of the subjects of the Project (and which may already exist or be under development). (Exactly how the reference to the Collaborator’s Background, Materials or Confidential Information is worded will depend on the Collaborator’s sector. For instance, if the Collaborator is in the pharmaceuticals sector, it may be concerned to protect its compounds, whereas in the IT sector, the Collaborator will be concerned to protect its source codes.);
• the ownership is split by reference to fields of use or application; or
• it is possible to identify the sort of Result which will be owned by the Collaborator by some other criteria.

The Parties will need to agree which Results are to belong to the Collaborator and which are to belong to the Institution.

(If the Collaborator’s or Institution’s Results are not defined by reference to that Party’s Materials, the definitions of the Collaborator’s Materials and the Institution’s Materials should be deleted.)

Optional wording provides for the Results owned by the Institution to be all the Results except those owned by the Collaborator. This avoids any Results falling between the cracks and not being owned by either Party. If you define the Institution’s Results in some other way, there is a danger that Results will be created which are not assigned to either Party.

The Parties will also need to agree whether each Party is obliged to protect its Results or has discretion to protect its Results.

Clause 4.3 contains alternative wording:

• obliging each Party to protect; or
• acknowledging that each Party may protect (but not obliging it to protect)

the IPR in its Results by filing and prosecuting patent and other applications and taking action in respect of any alleged or actual infringement.

If a Party does not think it necessary to register or maintain any protection for any of the IPR in its Results, it must notify the other and the Party which created that IPR may take steps as it sees fit to register and maintain any protection for that IPR.

The Institution has the right to use the Results owned by the Collaborator for Academic and Research Purposes and Academic Publication is permitted.

The Collaborator has the right to use the Results owned by the Institution for Research Purposes.

The Parties will have to agree whether or not any warranty will be given in respect of the assignment in clause 7.10.

Clause 4.7 provides the possibility of the re-assignment of the IPR in the Results to the Institution, at the Institution’s request, if the Collaborator is not exploiting or taking reasonable steps to exploit the Results. This is designed to prevent the Collaborator ‘sitting on’ the Results which it owns. The Collaborator may wish to consider any re-assignment being dependent on the reimbursement of costs incurred in registering any patents and on the Institution paying the Collaborator a revenue share in the event of the Institution successfully exploiting the IPR re-assigned to the Institution.

The Collaborator is unlikely to agree to this clause if the Results relate to its Background, Materials or Confidential Information.

Clause 4.11 allows the Collaborator, during the Project Period and for a specified number of months after the end of the Project, to give notice calling on the Institution to negotiate an exclusive or non-exclusive licence of the Institution’s IPR.

Although this is called an option notice, this is not an option as such; the Institution cannot be obliged to grant the licence and its grant will depend on the parties being able to reach agreement on what is to be licensed and on the terms of that licence.

To give the Collaborator a chance to negotiate that licence and the Institution an incentive to come to the negotiating table, the Institution agrees not to grant a licence:

• to use the Institution’s Results nor to assign the IPR in those Results to a third party for a specified period of time; and
• of any of its Results nor to assign the IPR in those Results to a third party on any terms more favourable than those offered to the Collaborator for a period of time following the end of the period during which the Parties are to negotiate.

If the Collaborator is interested in taking a licence of the Institution’s Results, the Collaborator may be concerned that those results are protected by patent or other applications. Therefore clause 4.11.4 provides for consultation and the Collaborator paying the costs if it requests the Institution to protect any Results.

The clause also provides for the re-imbursement of the costs paid by the Collaborator if the Institution later licenses or assigns to a third party any of the Institution’s Results for which the Collaborator has paid any those costs. In order to bring more certainty to the negotiations, the Parties may prefer to include an outline of the terms they envisage will apply to any further licence in a Schedule to the Agreement.

The sort of issue which will need to be addressed include:

• which Results are licensed?
• is the licence an exclusive (or possibly a sole) licence?
• is the licence restricted to one or more specified territories, or is it worldwide?
• is the licence restricted to one or more specified fields?
• what is the duration of the licence – is it indefinite, for a minimum or fixed term of years, or terminable on a certain amount of notice by either Party?
• will the Collaborator make a one-off payment, pay a series of lump sum payments, pay royalties, pay a success fee, or a combination of the above in return for the licence?
• how are payments to be calculated?
• when are payments to be made?
• are there any targets?
• do the rights revert to the Institution if those targets not met?
• is the Institution obliged to make payments to the Collaborator if the Institution then commercialises the rights which have reverted to it?
• are any of the confidentiality obligations in the Collaboration Agreement to be relaxed to give effect to the new arrangements?

Clause 4.12 provides for an assignment back to the Institute if the Collaborator is insolvent. There may be problems enforcing that if it is a preference on the insolvency of the Collaborator. Therefore alternative wording is provided for the assignment of IPR to the Collaborator being limited in time, but that may not work for some forms of IPR, e.g. patents, rather than copyrights.

In practice this should only be an issue where the Institution assigns IPR to a smaller Collaborator. Due diligence on the part of the Institution may help mitigate the risk, but the Institution may prefer to grant an exclusive licence rather than to assign IPR to the Collaborator.

4.6 Guidance specific to collaboration agreement 5

In this Agreement the Collaborator owns the IPR in the Results.

The Institution assigns the IPR in the Results to the Collaborator, and the Collaborator grants a licence back of the Results so that the Institution can participate in the Project.

The Institution does NOT have the right to use the Results for Academic and Research Purposes, and Academic Publication is NOT permitted.

The difference between Collaboration Agreements 4 and 5 is that, under the latter, the Institution has no right to use the Results for Academic and Research Purposes and there is no Academic Publication clause. This means that in carrying out a Project under Collaboration Agreement 5 the Institution is not pursuing its main charitable aim.

This sort of agreement is best suited to Contract Research, where an institution is not carrying out the research to further its main charitable aim or primary purpose, but instead is providing research services on a commercial basis in order to generate a financial return which is then used to further its charitable aims.

If the research represents a threat to a charity’s assets the research should be channelled through a subsidiary company.

Please refer to the guidance on the Charitable Status of Universities.

The Parties will have to agree whether or not any warranty will be given in respect of the assignment in clause 7.11. Please refer to the guidance on Full Title Guarantee

Clause 4.7 provides for a re-assignment of the IPR in the Results to the Institution of the Collaborator is not exploiting them.

4.7 Guidance Specific to Collaboration Agreement 6 (KTP)

This is one of the two model agreements added in 2016. It has been added to the Lambert Toolkit to cover a Knowledge Transfer Partnership (KTP) where a graduate or postgraduate student (Associate) carries out the Project and the Collaborator owns and take an assignment of the Results.

The Institution may use the Results for Academic and Research Purposes and Academic Publication is permitted.

In this Agreement, the industry partner is called the Company rather than the Collaborator.

The terms of this Agreement are very similar to those of Collaboration Agreement 4 with additional terms in the light of the KTP programme.

KTPs are funded by the government to help businesses innovate by accesses the knowledge and skills available in UK universities, colleges and research institutions.

More information about FTPs is available.

4.8 Guidance Specific to Consortium Agreement A

Each Party owns the Results which it creates and grants each of the other Parties a non-exclusive licence to use those results for the purposes of the Project and for any other purpose, so that any Party may exploit any of the Results.

Those rights may be in return for payments set out in the Payment Plan.

This Agreement may be suitable for use in collaborations funded by an organisation which wishes to create a level playing field, but is not likely to be used for research where the finder requires the Parties to have an agreed exploitation strategy.

The Agreement contains optional wording for a licence to use the other Parties’ Background just for the Project or also in order to exploit the Results.

The Academic Parties have the right to use the Results for Academic and Research Purposes and Academic Publication is permitted.

This Agreement contains provisions relating to the co-ownership of IPR.

The members of the Lambert Working Group recommend that you avoid co- or joint ownership where possible. If it is important that more than one party owns some IPR, a better way forward may be to consider whether some of the IPR should be owned by one party, other IPR by another party and so on, rather than having several or all of the organisations participating in the project having a joint interest in the ownership of the IPR.

Clause 4.4 provides for co-ownership, but only where it is not possible to distinguish between the parties’ contribution to any Result. The co-owners may take steps to protect the jointly owned IPR. If one of them does not want to take those steps, the other co-owner(s) may take them and the owner not wishing to protect the IPR must provide reasonable assistance.

If you do decide to have co- or joint ownership it is important that the Agreement sets out the rights which joint owner has to exploit the IPR.

Clause 4.7 allows all the co-owners to deal with and exploit the jointly owned IPR without accounting to the other co-owner(s) for any money made, or in return for payments on accordance with the Payment Plan.

4.9 Guidance Specific to Consortium Agreement B

One Party (called the Lead Exploitation Party) is best suited to carry out the exploitation of the Results.

The other Parties assign their IPR or grant an exclusive licence of their IPR in the Results to the Lead Exploitation Party which undertakes to use all reasonable endeavours commercialise the Results and to pay the other Parties a share of revenues generated from that commercialisation or a success payment.

The financial arrangements should be set out in the Payment Plan.

The exclusive licence may be for a limited period, after which all the Parties will have non-exclusive rights to exploit the results.

This Agreement contains alternative wording in clause 4.2 under which a licence to use Background is granted in order to allow the exploitation of the Results.

The Parties will also need to agree whether the Lead Exploitation Party is obliged to protect the Results or has discretion to protect its Results.

Clause 4.3 contains alternative wording:

• obliging the Lead Exploitation Party to protect
• acknowledging that the Lead Exploitation Party may protect (but not obliging it to protect)

the IPR in the Results by filing and prosecuting patent and other applications and taking action in respect of any alleged or actual infringement.

If the Lead Exploitation Party does not think it necessary to register or maintain any protection for any of the IPR in the Results, it must notify the Project Manager and the Party which created that IPR may take steps as it sees fit to register and maintain any protection for that IPR.

The Academic Parties have the right to use the Results for Academic and Research Purposes and Academic Publication is permitted.

The Commercial Parties have the right to use the Results for Research Purposes.

This Agreement envisages that, in addition to the Lead Exploitation Party, there is a Lead Party (which may or may not be the same person) which undertakes the duties of the Lead Company set out in the offer letter or other offer of external funding. The Lead Party’s duties include claiming and administering the external funding and submitting reports to the funding body. The Lead Party appoints the Project Manager.

4.10 Guidance specific to consortium agreement C

Two of the four Parties are best placed to exploit different Results - they may have different core businesses or interests and be interested in different results.

Each of those two Parties (AAA and XXX) takes an assignment of certain Results, and undertakes to use all reasonable endeavours to commercialise those Results and to pay the other Parties a share of the revenues generated from that exploitation or a success payment.

The financial arrangements should be set out in the Payment Plan.

The model agreement may be amended to produce variants on which Parties will own which IPR and which Parties will not have rights to commercialise.

This Agreement contains alternative wording in clause 4.2 under which a licence to use Background is granted in order to allow the commercialisation of the Results.

The Parties will also need to agree whether AAA and XXX are obliged to protect the Results or have discretion to protect the Results.

Clause 4.3 contains alternative wording:

• obliging AAA/XXX to protect
• acknowledging that AAA/XXX may protect (but not obliging it to protect)

the IPR in the Results by filing and prosecuting patent and other applications and taking action in respect of any alleged or actual infringement.

If AAA or XXX does not think it necessary to register or maintain any protection for any of the IPR in the Results, it must notify the Project Manager and the Party which created that IPR may take steps as it sees fit to register and maintain any protection for that IPR.

The Academic Parties have the right to use the Results for Academic and Research Purposes and Academic Publication is permitted.

The Commercial Parties have the right to use the Results for Research Purposes.

Clause 4.12 provides for an assignment back of the IPR if AAA or XXX is insolvent. There may be problems enforcing that if it is a preference on the insolvency. Therefore alternative wording is provided for the assignment of IPR being limited in time, but that may not work for some forms of IPR, e.g. patents, rather than copyrights.

This Agreement envisages that there is a Lead Party which undertakes the duties of the Lead Company set out in the offer letter or other offer of external funding. The Lead Party’s duties include claiming and administering the external funding and submitting reports to the funding body. The Lead Party appoints the Project Manager.

4.11 Guidance Specific to Consortium Agreement D

Each Party owns the Results which it creates and grants each of the other Parties a non-exclusive licence to use those Results for the purposes of the Project.

The Parties do not have an agreed strategy for the exploitation of the Results. If a Party wishes to exploit another Party’s Results or Background, it must negotiate a licence or an assignment of IPR.

This Agreement is not likely to be used for research where the funder requires the Parties to have an agreed exploitation strategy.

The Academic Parties have the right to use the Results for Academic and Research Purposes and Academic Publication is permitted.

The Commercial Parties have the right to use the Results for Research Purposes.

This Agreement contains provisions relating to the co-ownership of IPR.

The members of the Lambert Working Group recommend that you avoid co- or joint ownership where possible. If it is important that more than one party owns some IPR, a better way forward may be to consider whether some of the IPR should be owned by one party, other IPR by another party and so on, rather than having several or all of the organisations participating in the project having a joint interest in the ownership of the IPR.

Clause 4.4 provides for co-ownership, but only where it is not possible to distinguish between the parties’ contribution to any Result. The co-owners may take steps to protect the jointly owned IPR. If one of them does not want to take those steps, the other co-owner(s) may take them and the owner not wishing to protect the IPR must provide reasonable assistance.

If you do decide to have co- or joint ownership it is important that the Agreement sets out the rights which joint owner has to exploit the IPR.

Clause 4.5 allows all the co-owners to deal with and exploit the jointly owned IPR without accounting to the other co-owner(s) for any money made, or in return for payments on accordance with the Payment Plan.

Clause 4.9 allows a Party, during the Project Period and for a specified number of months after the end of the Project, to give notice calling on another Party to negotiate an exclusive or non-exclusive licence to commercialise that other Party’s IPR.

Although this is called an option notice, this is not an option as such; the other Party cannot be obliged to grant the licence and its grant will depend on the Parties being able to reach agreement on what is to be licensed and on the terms of that licence.

To give the potential licensee a chance to negotiate that licence and the potential licensor an incentive to come to the negotiating table, the potential licensee agrees not to grant a licence:

• to use its Results nor to assign the IPR in those Results to a third party for a specified period of time
• of any of its Results nor to assign the IPR in those Results to a third party on any terms more favourable for a period of time following the end of the period during which the Parties are to negotiate

If a Party is interested in taking a licence of the other Party’s IPR, that Party may be concerned that that IPT is protected by patent or other applications. Therefore clause the Agreement provides for consultation and the Party wishing to take a licence paying the costs if it requests the other Party to protect any IPR.

The clause also provides for the re-imbursement of the costs paid by the Party wishing to take a licence if the other Party later licenses or assigns to a third party any IPR for which the Party wishes to take a licence.

5. The model variation agreements

A fundamental principle in all the model agreements is that no variation to the Agreement will be valid unless all the existing Parties agree to the variation in writing.

The Lambert Toolkit contains an example of a form of Variation Agreement for the Collaboration Agreements and the Consortium Agreements respectively.

These are designed to be used when a new party joins the Project but, with amendment, they could be used when a party leaves and the work is re-allocated or when the parties agree to make any other variation to the Agreement.

The Variation Agreements list each clause in the Collaboration Agreement or the Consortium Agreement as a prompt to the Parties to consider whether there are consequential changes to be made to each clause. In practice it may not be necessary to change every clause.

The Variation Agreement will not be binding (with the result that not all the Existing Parties will be able to enforce the Agreement against the New Party) unless there is consideration, i.e. that each Party who receives the benefit of a promise or undertaking gives something in return. In many cases the Existing Parties will give promises or undertakings to the New Party in return for the New Party’s promises/undertakings but, to avoid the possibility of there not being consideration, the Variation Agreements adopt the simple expedient of having each of the Existing Parties paying the New Party £1.

The fact that the £1 is little compared to the value of the New Party’s promise to participate in the Project does not matter; it is the fact that there is consideration (and not its adequacy) which matters.

The alternative to paying £1 is that the Variation Agreement is executed as a Deed. These forms of Variation Agreement do not take the form of a deed in order to avoid the delay which that might involve.

In some cases, in order to avoid administrative hassle, one of the Existing Parties may sign a Variation Agreement on behalf of the other Existing Parties. If that is to happen, it is important to check that proper authority has been given to the party signing on behalf of the other Existing Parties and that the other Existing Parties have the right to give that authority.

The Variation Agreements may be adapted for use where one Party ceases to be involved in the Project (the Retiring Party) and another party (the New Party) comes in to take its place. In that case the Retiring Party will be concerned that there is a clause releasing it from future obligations. The other Parties (whether an original Party or the New Party) will be concerned to ensure that certain provisions of the Research Collaboration Agreement (such as the Confidentiality clause) continue to be binding on the Retiring Party and that the Retiring Party’s IP may continue to be used by the continuing Parties. Please see clause 10 of the Consortium Agreements, for an example.

Clause 1.5 and references to the Funding Conditions should be deleted if there is no External Funding for the Project.

6. The charitable status of universities

Universities in England and Wales are charities. As charities they have a duty to:

a) further the charitable aims set out in their constitution for the public benefit;

b) act solely in furtherance of their charitable aims or objectives; and

c) take reasonable steps to protect their property (including intellectual property generated by a research project) and to maximise their return from that property. That is neither an absolute obligation nor an obligation not to take any risk at all.

The aims of an institution undertaking research will be different from those of a commercial organisation which sponsors or participates in the research project.

When an institution carries out research it may do so either:

i) in furtherance of its main charitable aim or primary purpose (charitable research); or

ii) to generate a financial return which is then used to further its charitable aims (non-charitable research).

Research in collaboration with a commercial organisation, or a public sector organisation or another charity may be charitable or non-charitable research, depending on the circumstances - whether or not any useful knowledge acquired is disseminated and the research is undertaken for the public benefit.

The distinction between charitable and non-charitable research is important:

a) for tax reasons; and

b) because a charity may trade on a substantial and continuing basis only if the trade is part of carrying out its main charitable aims (what is called primary purpose trading for tax purposes), and a charity may not carry on a substantial ongoing non-charitable trade.

Research will be charitable only if:

i) the research is a useful subject of study or is directed towards establishing an outcome which is of value, and it is calculated to promote the institution’s charitable aims;

ii) there is an intention to disseminate to the public, and others able to use or benefit from it, useful knowledge (i.e. which increases knowledge and understanding or produces other outcomes for the public benefit) acquired as a result of the research; and

iii) the research is undertaken for the benefit of the public or a section of the public, and not only, or mainly, for self-interest or for private or commercial purposes - although there may be an incidental benefit to a commercial collaborator.

The dissemination of useful knowledge (which may take place through teaching, academic and other publication, the filing of a patent or the exploitation or application of IPR) may constitute adequate public benefit.

This explains why universities normally want to have the right to use the results of the research project for academic purposes, such as teaching and carrying out further research, and for its staff and research students to be able to publish the results in academic journals, and why universities are usually reluctant to agree to any condition which prevents publication for longer than a few months.

A commercial collaborator will often, but by no means always, want to restrict the dissemination of the results or to own or have exclusive rights to the IPR in the results of the research. For that reason, where a commercial collaborator pays for a specific piece of research to be carried out for its own benefit and there is no public benefit, unless the research is small in scale and poses no significant risk to the institution’s assets, the research should be categorised as contract research and carried out, not by the institution, but by a subsidiary company which is not restricted from carrying on a substantial ongoing non-charitable trade and which donates its profits to the institution by way of gift aid.

In order to allow the subsidiary to participate in the research project, the institution’s resources should be made available to its subsidiary company at market value and on an arms-length basis.

If a commercial collaborator enjoys benefits such as access to the results of the research before they are published or exclusive rights or ownership of any IPR, and the research is carried out by the institution (and not by its subsidiary company), the institution must be able to justify those benefits on the grounds that they are legitimately incidental, that is that they are:

a) necessary to further the institution’s charitable aims or as a consequence of furthering those aims; and

b) reasonable, looking at the circumstances known to the institution at the time the decision to carry out the research was made, and looking relatively at the benefit to the commercial organisation and the benefit to the institution’s charitable aims.

If providing a benefit to a commercial collaborator is the reason, or a substantial reason, for carrying out the research, the research will be non-charitable.

Whether or not a benefit to a commercial collaborator is incidental is a matter of judgement and various factors will influence that judgement. The main factor should be the institution’s aims and powers, but a relevant factor may be to have a good relationship with commercial collaborator which may help the institution to achieve its charitable aims in future.

The institution is not obliged to have a crystal ball, and there is always the risk that it may underestimate the rewards which the commercial collaborator may make for the results in future. That that turns out to be the case is not in itself an indication that the benefit to the commercial organisation was, at the time the institution agreed to participate in the research project, more than incidental.

There is no rule to the effect that an institution can never participate in research which is for the benefit of a commercial collaborator. In some cases the institution’s charitable aims may be furthered by the project because the institution is involved in complementary research or because the project may result in knowledge which contributes to the institution’s other research.

Likewise there is no rule that the institution must own the IPR in the results of the research or that those results should be co-owned by the institution and the commercial collaborator. But where the commercial collaborator benefits from the charitable research, it is important that the institution receives or (given that there is no guarantee that a result can or will be exploited successfully) has the opportunity to receive, adequate financial reward in return for its participation in the project.

If the institution does own the IPR in the results, where possible they should be exploited for the benefit of the institution. This may be by means of selling the rights or licensing them to a commercial collaborator or to a third party at the market price or rate.

The commercial collaborator’s contribution to the project should be taken into account when setting the price or rate for a sale or licence to it, and the institution may chose not to charge the full market price or rate if the IPR is used to further the institution’s charitable purposes and the benefit to the commercial collaborator is incidental.

For further guidance on this subject please refer to:

• schools, colleges and universities: Charity Commission
• charities and trading

It may also be useful to look at the websites of HEFCE and the British Universities Finance Directors Group

7. Data protection

7.1 Introduction

Data protection law applies to the use of personal data for research purposes.

This guidance is designed to help you understand the provisions of the European and UK legislation which are relevant to processing personal data for research purposes. At the end of this guidance on data protection you will find guidance on the specific provisions which relate to the use of personal data for the purposes of research and for academic expression.

Before you skip to the end of this guidance on data protection, we recommend that you familiarise yourself with the data protection law. Unless you are familiar with that, it is difficult to understand the safeguards which must be adopted and the derogations which apply when using of personal data for the purposes of research and academic expression.

Each of the Research Collaboration Agreements and the Consortium Agreements has a Schedule 6 which provides terms covering;

• where one of the Parties is the data controller and another Party processes personal data for the controller; or

• where there are two or more controllers and they share personal data for the purposes of the Project

If that makes no or little sense to you, please read this guidance on data protection.

7.2 The General Data Protection Regulation

As from 25 May 2018 the General Data Protection Regulation 2016/679 (the GDPR) applies to the processing of personal data.

You will find a searchable copy of the GDPR.

The GDPR applies where personal data are processed in the context of the activities of a controller or a processor which is established in the European Union (EU), whether or not the processing of the data actually takes place in the EU.

A controller or processor will be established in the EU if it is involved in any real and effective activity, even a minimal activity, through stable arrangements in the EU. Having just one representative or agent in the EU, or having a postal address or bank account in the EU could be sufficient to give a controller or a processor an establishment in the EU.

If the controller or processor does not have an establishment in the EU, the GDPR will still apply when:

• the personal data of data subjects in the EU is processed in connection with offering goods or services to those data subjects (even if there is no charge for the goods or services); or

• the behaviour of individuals in the EU is monitored

7.3 Personal data and identifying individuals

Personal data are information which relates to an identified or identifiable living human being (an individual), called the data subject.

An identifiable individual is someone who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (such as an IP address) or by reference to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.

The GDPR does not apply where the individual is not identified or identifiable. Anonymous data are not personal data and the GDPR does not apply to the processing of anonymous data.

Identifying an individual includes the controller or someone else singling out the individual to identify that individual directly or indirectly.

To decide whether an individual is identifiable, you should consider all the means reasonably likely to be used to identify the data subject.

In deciding whether a means of identifying the individual is likely to be used, you should take into account factors such as: the costs of identifying the individual; the amount of time which would be needed to do that; the technology available at the time of the processing; and technological developments.

It is sometimes possible, even when using data which appears to be anonymous, to identify data subjects from a combination of data from multiple sources. The GDPR distinguishes between anonymised and pseudonymised data.

Data are pseudonymised where they can no longer be attributed to a specific data subject without the use of additional information, that additional information is kept separately and technical and organisational measures are taken to ensure that the data are not attributed to an identified or identifiable individual.

Pseudonymised data are personal data and the GDPR does apply to their processing, but it may be easier to justify the processing of pseudonymised personal data than it is to justify processing non-pseudonymised personal data. For example, the GDPR states that pseudonymisation may justify the use of personal data for secondary purposes, i.e. not the original purpose for which the personal data were collected, or it could be a means of implementing privacy by design or data security.

The Information Commissioner’s Office (ICO has issued guidance and a Code of Practice on the Anonymisation of Personal Data.

7.4 Controllers and processors

Personal data are processed by:

• a controller (who might be an individual, company or institution) who determines the purpose(s) and means of processing the personal data - in a research context this is likely to be the sponsor; or

• a processor (who might be an individual, company or institution) who processes the personal data for a controller

Processors must process personal data for a controller only in accordance with that controller’s documented instructions. Both controllers and processors have duties under the GDPR and may be liable to data subjects for breach of the data protection legislation.

In the context of a research project with two Parties, one of the Parties may be the controller and the other its processor, or both Parties may be joint controllers if they jointly determine the purpose(s) for which the personal data are to be processed and the manner in which they will be processed. Or, if one party determines some purposes for which the personal data are to be processed and the other determines other purposes, each Party may be a controller in respect of the different purposes.

It is very important to be clear about who is a controller or who is a processor. Only if you know that will you be able to:

• know which obligations under the legislation apply to you;

• what terms you need to include in any agreement; and

• your potential liability to data subjects,

7.5 Processing

Processing has a very broad meaning; it covers almost anything you can do in relation to personal data, including collecting, recording, organising or structuring it, adapting or altering, storing it, retrieving or consulting it, disclosing it or making it available, combining it with other data, marking it with the aim of limiting its processing in future, erasing and destroying it, and using it.

7.6 The UK Data Protection Bill

In limited circumstances, the GDPR gives member states of the EU some powers to decide how the GDPR applies in that member state.

At the time of writing, the UK Data Protection Bill (PDF,1,216 KB) is making its way through Parliament. This guidance assumes that the bill will become law in the version amended in public bill committee on 23 March 2018.

The Bill is expected to become law on 25 May 2018, the date on which the GDPR starts to apply.

Once it becomes law, the UK Data Protection Act will supplement and must be read with the GDPR.

7.7 Sanctions and liability

If a data subject considers that the processing of his or her personal data breaches the GDPR, he or she has the right to lodge a complaint with supervisory authority (in the UK this is the Information Commissioner’s Office – the ICO) in the member state of his or her habitual residence, his or her place of work or the place of the alleged breach of the GDPR.

Supervisory authorities may levy fines of up to 4% of the controller’s or the processor’s annual worldwide turnover or €20 million (whichever is greater).

The ICO has a wide range of other powers, to:

• audit the processing of personal data;

• issue warnings;

• issue a temporary ban on processing personal data; and

• issue a permanent ban on processing personal data

Data subjects also have the right to be compensated for both material damage and non-material damage (e.g. distress) and to bring proceedings against a controller or a processor in the courts of the member state where the controller or processor has an establishment.

Or the data subject may bring proceedings in the courts of the member state where the data subject has his or her habitual residence (unless the controller or processor is a public authority of a member state acting in the exercise of its public powers).

Any controller involved in the processing will be liable for the damage caused by processing which breaches the GDPR. That means that the controller will be liable to data subjects for the acts and omissions of its processor(s).

By way of contrast, a processor will be liable for the damage caused by processing only where it:

• has not complied with obligations in the GDPR which are specifically directed to processors; or

• it has acted outside, or contrary to, the controller’s lawful instructions

That makes it important that the controller actually gives instructions and that those instructions are clear.

One of the aims of the GDPR is to ensure that data subjects are properly compensated if their personal data are misused. Therefore, where there is more than one controller or processor, or both a controller and a processor are involved in the same processing and they are responsible for any damage caused by processing, the GDPR makes each controller or processor liable to the data subject for all the damage.

If a controller or processor seeks to escape its liability to a data subject under the GDPR, it will have to prove that it is not in any way responsible for the event giving rise to the damage.

If a controller or processor has paid full compensation for the damage suffered, the GDPR allows that controller or processor to claim from the other controllers or processors involved in the same processing that part of the compensation corresponding to their part of responsibility for the damage.

Arrangements for the allocation of risk and liability which controllers and processors include in the agreement between them will apply only as between them and will not affect their liability to data subjects under the GDPR.

The rules in the GDPR for the allocation of liability to data subjects do not apply to responsibility for any fine levied by the supervisory authority.

7.8 Accountability and records

Controllers must comply with the legislation, including the data protection principles and must be able to demonstrate that they comply.

A controller must keep records of the following:

• its name and contact details;

• where applicable, any joint controllers, representatives and data protection officers;

• the purposes of the processing;

• a description of the categories of data subjects;

• a description of the categories of personal data collected and processed;

• the categories of recipients (people to whom the personal data will be disclosed), including recipients outside the EU or international organisations;

• details of transfers of personal data outside the EU;

• retention periods for different categories of personal data (where possible); and

• a general description of the security measures employed (where possible)

A processor must keep records of the following:

• its name and contact details and, where applicable, representatives and data protection officers;

• the name and contact details of each controller for which it processes personal data including, where applicable, their representatives and data protection officers;

• the categories of processing carried out on behalf of each controller;

• details of transfers of personal data outside the EU; and

• a general description of the security measures employed (where possible)

7.9 Privacy impact assessments

Controllers must carry out a privacy impact assessment where a type of processing is likely to create high risks to the rights and freedoms of data subjects.

High risk processing includes:

• systematic and extensive profiling which produces legal effects or significantly affects data subjects; and

• processing special category personal data on a large scale

Controllers must carry out a privacy impact assessment where there is:

• a systematic and extensive evaluation of personal aspects relating to individuals which is based on automated processing (including profiling) and on which decisions which produce legal effects concerning the individuals are based or which similarly significantly affect the individual;

• processing on a large scale of special categories of personal data (see below on special categories of personal data) or of personal data relating to criminal convictions and offences; or

• a systematic monitoring of a publicly accessible area on a large scale

The privacy impact assessment must be documented and must contain the following information:

• a description of the processing, including its purposes and any legitimate interests pursued by the controller;

• an assessment of the necessity and proportionality of the processing in relation to the purposes;

• an assessment of the risks to the rights and freedoms of data subjects; and

• the measures to be taken to address those risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with the GDPR, taking into account the rights and legitimate interests of data subjects and anyone else concerned.

The controller must seek advice from its data protection officer (if it has one) and may have to consult with affected data subjects or their representatives (but without prejudice to the protection of commercial or public interests or the security of the processing).

If the assessment indicates the processing is high risk and measures are not taken to mitigate that risk, controllers must consult the ICO. The ICO will then consider if the processing is compatible with the GDPR.

Controllers must carry out a review to assess if processing is performed in accordance with the privacy impact assessment, at least when there is a change of the risk represented by the processing.

Profiling is defined in the GDPR as any form of automated processing consisting of the use of personal data to evaluate certain personal aspects relating to a natural person (individual), in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

The ICO’s guidance on privacy impact assessments can be found on the ICO website.

The ICO has published a Code of Practice on Privacy Impact Assessments. You will find this on the ICO website.

7.10 Privacy by design and default

The GDPR introduces a new concept of privacy by design and default.

The key is to embed compliance with data protection law into the fabric of the organisation processing the personal data and its systems.

Taking into account:

• the state of the art;

• the costs of implementation;

• the nature, scope, context and purposes of processing; and

• the risks of varying likelihood and severity for rights and freedoms of data subjects posed by the processing,

controllers must, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement the data protection principles in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of the GPDR and protect the rights of data subjects.

Controllers must implement appropriate technical and organisational measures to ensure that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility.

In particular, those measures must ensure that, by default, personal data are not made accessible to an indefinite number of people without the data subject’s intervention.

7.11 Lawful bases for processing personal data

Controllers must not process any personal data unless the processing satisfies at least one of the following:

Process	Description
Consent	the data subject has given his or her consent to the processing of specific personal data for one or more specific purposes.
Necessary for performance of a contract	the processing is necessary for the performance of a contract with the data subject, or in order to take steps, at the request of the data subject, before to entering into a contract.
Legal obligation	the processing is necessary for compliance with a legal obligation to which the controller is subject. Only legal obligations under EU or member state law will satisfy this condition. The law need not be a statute or regulation - common law obligations are sufficient.
Vital interests	the processing is necessary in order to protect the vital interests of the data subject or of another individual. This is typically limited to processing in a medical emergency.
Public interest/function	the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Those functions must arise under member state or EU law. Member states may allow private organisations to use this basis where that is justified. That will be useful for research projects carried out by a public body acting as such and a private company.
Legitimate interests	the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child. This involves a careful assessment of the processing to ensure the interests of the controller or a third party are properly balanced against any potential intrusion into the data subject’s privacy. In particular, controllers should consider whether the data subject would reasonably expect his or her personal data to be processed for the purpose for which it is intended to process them.

7.12 Legitimate interests and public bodies

There is no reason why, subject to a proper assessment of the various rights and interests, research could not be a legitimate interest of the controller or a third party. When considering the old Data Protection Directive, the Article 29 Working Party (made up of representatives of each member state’s data protection authority) concluded that processing for research purposes (including marketing research) could constitute a legitimate interest, if the controller implemented sufficient safeguards.

But under the GDPR, public authorities may not use the legitimate interests basis for processing personal data in the performance of their tasks. Instead they will, where possible, rely on the public interest/function as the lawful basis of their processing.

This presents a conundrum for universities. The UK Data Protection Bill provides that a public authority (as defined by the Freedom of Information Act 2000) or a Scottish public authority (as defined by the Freedom of Information (Scotland) Act 2002) are public authorities for the purposes of the GDPR. That means that universities and their wholly owned subsidiary companies are public authorities for the purposes of the GDPR.

The House of Lords introduced an amendment to the Data Protection Bill to the effect that an authority or body is only a public authority or a public body when performing a task carried out in the public interest or in the exercise of official authority vested in it.

The result is that UK universities and their subsidiaries will be able to rely on the legitimate interests basis to justify their processing of personal data when they are not carrying out tasks in the public interest.

The post which can be found at: https://medium.com/@CASE_Europe/update-on-case-activities-to-support-members-in-their-gdpr-planning-from-jennie-moule-interim-910aa0dd3a4 reports a meeting with the ICO and distinguishes between universities’ core functions and non-core functions in the context of the GDPR.

Controllers must identify the lawful basis (or bases) on which they rely and must communicate that to data subjects. If a controller relies of the legitimate interests basis, it must inform data subjects of the nature of those interests.

The ICO has published an online tool to help controllers decide which lawful basis is most appropriate.

7.13 Special categories of personal data

This is information which relates to:

• racial or ethnic origins;

• political opinions;

• religious or philosophical beliefs;

• trade union membership;

• genetic data - personal data relating to an individual’s inherited or acquired genetic characteristics which give unique information about the physiology or the health of that individual and which result, in particular, from an analysis of a biological sample from that individual;

• biometric data - personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual, which allow or confirm the unique identification of that individual, such as facial images or dactyloscopic (finger print) data;

• data concerning health - personal data relating to the physical or mental health of an individual, including the provision of health care services, which reveal information about his or her health status; or

• sex life or sexual orientation;

These are sometimes referred to as sensitive personal data.

If special category personal data are processed, at least one of the following conditions must be met (in addition to the controller having a legal basis for processing the data):

Condition	Description
Explicit consent	the data subject has given explicit consent. (EU or member state law may limit the circumstances in which consent is available.)
Legal obligation related to employment	the processing is necessary for a legal obligation in the field of employment and social security law or for a collective agreement.
Vital interests	the processing is necessary in order to protect the vital interests of the data subject or of another individual. This is typically limited to processing in a medical emergency.
Not for profit bodies	the processing is carried out in the course of the legitimate activities of a not-for-profit body and only relates to members or related persons and the personal data are not disclosed outside that body without consent.
Public information	the processing relates to personal data which is manifestly made public by the data subject.
Legal claims	the processing relates to personal data which is manifestly made public by the data subject.
Substantial public interest	the processing is necessary for reasons of substantial public interest, on the basis of EU or member state law. The processing must be proportionate to the aim pursued, respect the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
Healthcare	the processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of EU or member state law or pursuant to contract with a health professional and subject to certain conditions and safeguards, i.e. when the data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under EU or member state law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or member state law or rules established by national competent bodies. According to clause 11(1) of the Data Protection Bill these conditions and safeguards include where the processing is carried out by or under the responsibility of a health professional or a social work professional, or by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.
Public Health	the processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of EU or member state law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy. Clause 10 and Part 1 of Schedule 1 of the Data Protection Bill provide that the processing will meet the requirement for authorisation by, or a basis in, the law of the UK only if it is necessary for reasons of public interest in the area of public health, and is carried out: (i) by or under the responsibility of a health professional; or (ii) by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.
Archiving, Research and Statistics	the processing is necessary for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes, is in accordance with Article 89(1) if the GDPR (i.e. appropriate safeguards adopted), is based on EU or member state law, is proportionate to the aim pursued, respects the essence of the right to data protection and provides for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. Clause 10 and Part 1 of Schedule 1 of the Data Protection Bill provide that the processing will meet the requirement for authorisation by, or a basis in, the law of the UK only if it is in the public interest.

Member States may introduce additional conditions in relation to health, genetic or biometric data.

7.14 Criminal Convictions and Offences

The processing of personal data relating to criminal convictions and offences or related security measures may be carried out only under the control of official authority or when the processing is authorised by EU or member state law providing for appropriate safeguards for the rights and freedoms of data subjects.

That includes:

• the commission or alleged commission of any offence; and

• the involvement in criminal proceedings for any offence or alleged offence committed by the data subject, including outcomes such as judgement and sentencing.

7.15 Consent

Although many research projects may be able to rely on another lawful basis for processing personal data, many researchers will nevertheless seek consent from data subjects.

A major drawback in relying on the data subject’s consent is that the data subject is free to withdraw it at any time.

If it relies on the data subject’s consent, the controller must be able to demonstrate that it has that consent and that the consent is valid.

Consent will be valid only if it is a:

• freely given;

• specific;

• informed; and

• unambiguous

• indication of the data subject’s wishes.

Consents must be:	Description
In plain language	a request for consent must be in an intelligible and accessible form, in clear and plain language and in accordance with the European Directive on Unfair Terms in Consumer Contracts.
Separate	where the request for consent is part of a written form, it must be clearly distinguishable from other matters.
Affirmative action	the consent must consist of a clear affirmative action; inactivity or silence is not enough and the use of pre-ticked boxes is not permitted. However, consent through a course of conduct is valid, unless the GDPR obliges explicit consent to be obtained.
Consent to each purpose	if the processing has multiple purposes, consent must be obtained for each of those purposes.
Informed	the data subject must be provided with certain information, including, who is processing the personal data and the purposes for which it will be processed. (See Providing Information to Data Subjects.)
Without detriment	consent will not be valid if the data subject does not have a genuine free choice or if there is a detriment if he or she refuses or withdraws consent. Relying on consent will be appropriate only if the data subject has a genuine choice whether or not to give consent.
No power imbalance	consent will not be valid if there is a clear imbalance of power between the data subject and the controller, particularly where the controller is a public authority.
Unbundled	where different processing activities are taking place, consent is presumed invalid unless the data subject consents to them separately.
Not tied to any contract	consent is presumed invalid if it is a condition of performance of a contract.
Withdrawable	the data subject has the right to withdraw consent at any time and must be informed of that right before giving his or her consent. It must be made as easy to withdraw consent as it was to give consent.

Consent must be explicit if the controller relies on the data subject’s consent to:

• process special category personal data; or

• transfer personal data outside the EU.

Explicit consent entails a degree of formality, e.g. the individual ticking a box containing the word ‘consent’. Explicit consent cannot be obtained through a course of conduct.

Although the GDPR says that the withdrawal of consent will not invalidate acts carried out with the data subject’s consent before the consent was withdrawn, the Institution’s or Collaborator’s research guidelines may provide that the withdrawal of consent means that the research data about that data subject may no longer be used for the Project.

The GDPR recognises that it may not be possible for researchers to identify the purpose of processing for scientific research purposes fully when the personal data are collected. Therefore it permits some relaxation to requirement for the consent to be specific; data subjects may give their consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research, but should be given the opportunity to give their consent only to certain areas of research or parts of research projects to the extent allowed by the intended purpose.

The GDPR also recognises that, subject to certain conditions, further processing for research purposes will not fall foul of the second data protection principle (purpose limitation) - see below.

The GDPR makes it clear that, for the purpose of consenting to the participation in scientific research activities in clinical trials, the relevant provisions of the Clinical Trials Regulation apply. A copy of that can be found at: https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-1/reg_2014_536/reg_2014_536_en.pdf(PDF,757 KB).

The UK Data Archive has published guidance on consent and ethics.

The ICO’s guidance on consent is available.

7.16 The Data Protection Principles

Personal data must be processed in accordance with the data protection principles. These are:

Data Protection Principle	Description
The First Principle (lawfulness, fairness and transparency)	personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.
The Second Principle (purpose limitation)	personal data must be collected for specified, explicit and legitimate purposes and not processed in a way which is incompatible with those purposes. Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes is not incompatible with the initial purposes provided the processing complies with Article 89(1) of the GDPR (i.e. appropriate safeguards are adopted). (See the section on Processing for Archiving Purposes in the Public Interest, Scientific or Historical Research Purposes or Statistical Purposes below.)
The Third Principle (data minimisation)	personal data must be adequate, relevant and limited to what is necessary for the purpose(s) for which they are processed.
The Fourth Principle (accuracy)	personal data must be accurate and, where necessary, kept up to date. Inaccurate personal data should be corrected or deleted.
The Fifth Principle (retention)	personal data must be kept in an identifiable format for no longer than is necessary (with exceptions - (See the section on Processing for Archiving Purposes in the Public Interest, Scientific or Historical Research Purposes or Statistical Purposes below.)
The Sixth Principle (Integrity and Confidentiality)	personal data must be kept secure.

Controllers must be able to demonstrate compliance with the above principles.

7.17 Providing information to data subjects

Transparency is a fundamental principle of data protection law. Data subjects should be aware of the risks involved in the processing of their data, their rights and how to exercise those rights.

Whether or not the controller is seeking the data subject’s consent to process his or her personal data, the controller must provide the data subject with certain information in a concise, transparent, intelligible and easily accessible form, using clear and plain language.

The information must be provided by appropriate means. It may be provided in writing, including electronically. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proved by other means.

Information has traditionally been provided via a privacy policy or notice. The ICO recommends adopting a layered approach - in addition to providing information through a website policy or notice, more granular information should be provided. This might take the form of providing an information sheet or webpage to data subjects whose personal data are being used in a specific project.

7.17.1 Data obtained from the data subject

Where personal data are collected from the data subject, unless the data subject already has the information, the controller must provide the data subject with the following information when the personal data are collected:

• the identity and the contact details of the controller and, where applicable, of the controller’s representative;

• the contact details of the data protection officer, where applicable;

• the purposes of the processing of the personal data;

• the legal basis for the processing;

• where the legal basis for processing is the legitimate interests of the controller or a third party, details of those legitimate interests;

• the recipients (people to whom the personal data will be disclosed) or categories of recipients of the personal data (if any);

• (where applicable) that the controller intends to transfer personal data outside the EU or to an international organisation, and the existence or absence of an adequacy decision by the European Commission or details of the appropriate or suitable safeguards adopted and how the data subject may obtain a copy of them;

• the following further information where it is necessary in order to ensure fair and transparent processing:
  
  - the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
  
  - the existence of the right to request access to and rectification or erasure of the personal data, or a restriction on processing concerning the data subject, to object to processing, and the right to data portability;
  
  - where the processing is based on the data subject’s consent, the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
  
  - the right to lodge a complaint with the ICO;
  
  - whether the provision of any personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, whether the data subject is obliged to provide the personal data and the possible consequences of failure to provide the data;
  
  - the existence of automated decision-making, including profiling, meaningful information about the logic involved, and the significance and the envisaged consequences of such processing for the data subject.

17.7.2 Data not obtained from the data subject

If the personal data have not been obtained from the data subject, for instance where a university researcher is using personal data obtained by an NHS Trust, the controller must provide the data subject with the following information (unless the data subject already has the information):

• the same information which must be given when the personal data are collected from the data subject;

• the categories of personal data;

• the following information necessary to ensure fair and transparent processing – the source of the personal data, and if applicable, whether they came from a publicly accessible source.

If the personal data have not been obtained from the data subject, the controller must provide the information:

• within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed;

• if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or

• if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.

Where the personal data have not been obtained from the data subject the controller is excused from providing information to the data subject if:

• it proves impossible or it would involve a disproportionate effort (in particular when processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes and the appropriate safeguards referred to in Article 89(1) have been put in place); or

• in so far as the obligation to provide the information is likely to render impossible or seriously impair the achievement of the objectives of the processing.

The number of data subjects involved, the age of the data and any appropriate safeguards adopted should be taken into consideration when deciding whether or not providing the information would involve a disproportionate effort.

The controller must decide which (if any) of these circumstances applies and should keep a record of the decision and its rationale.

Where the information is not provided to data subjects, the controller must take appropriate measures to protect the data subjects’ rights and freedoms and legitimate interests, including by making the information available to the public.

17.7.3 Further processing

If the controller intends to process the personal data further, i.e. for a purpose other than that for which the personal data were collected, the controller must provide the data subject with information about that other purpose before that further processing takes place. For instance, if research purposes were not a purpose for which the personal data were originally obtained, information about the research purposes should be provided before processing for research purposes.

There are, however, circumstances in which the information need not be provided when the personal data are processed for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. (See the section on Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes below.)

7.18 Data Subjects’ Rights

7.18.1

One of the key aims of the GDPR is to empower data subjects and give them control over the use of their personal data. Data subjects have the following rights under the GDPR:

Right	Description
Confirmation of Processing	an individual has the right to obtain confirmation from the controller as to whether or not his or her personal data are being processed.
Access and Information	if they are being processed, data subjects are entitled to a copy of their personal data (for free, although there may be a charge for additional copies), and information about the processing and the data subject’s rights as follows: * the purposes of the processing; * the categories of personal data concerned; * the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients outside the EU or international organisations; * where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; * the existence of the right to request from the controller rectification or erasure of personal data or a restriction of processing of the data subject’s personal data or to object to such processing; * the right to lodge a complaint with the ICO; * where the personal data are not collected from the data subject, any available information as to their source; * the existence of automated decision-making, including profiling and meaningful information about the logic involved, and the significance and the envisaged consequences of such processing for the data subject; and * where personal data are transferred outside the EU or to an international organisation, the appropriate safeguards adopted to protect the data.
Rectification	data subjects have the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data. This includes having incomplete personal data completed. The controller must communicate any rectification of personal data to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves a disproportionate effort. The controller must inform the data subject about those recipients if the data subject requests it.
Erasure (the right to be forgotten)	data subjects have the right to have personal data erased without undue delay where one of the following applies: * the personal data are no longer necessary in relation to the purposes for which they were collected or processed; * the data subject withdraws consent on which the processing is based, and there is no other legal ground for the processing; * the data subject objects to any processing necessary for: - the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; or - the purposes of the legitimate interests pursued by the controller or by a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child, and there are no overriding legitimate grounds for the processing, * the data subject objects to the processing for direct marketing purposes (including profiling to the extent it is related to direct marketing); * the personal data have been unlawfully processed; * the personal data have to be erased for compliance with a legal obligation in EU or member state law to which the controller is subject; or * the personal data have been collected in relation to the offer of information society services to which a child has given his or her consent. If a controller has made the personal data public and is obliged to erase the personal data, the controller (taking account of available technology and the cost of implementation) must take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by those controllers of any links to, or copy or replication of, the personal data. The controller must communicate any erasure of personal data to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller must inform the data subject about those recipients if the data subject requests it. The right to erasure does not apply to the extent that processing is necessary: * for exercising the right of freedom of expression and information; * for compliance with a legal obligation which requires processing by EU or member state law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; * for reasons of public interest in the area of public health; * for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1) of the GDPR (i.e. appropriate safeguards are adopted) if the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of the processing; or * for the establishment, exercise or defence of legal claims.
Restrict processing	data subjects have the right to oblige the controller to restrict processing where one of the following applies: * the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; * the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; * the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; * the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject. Where the processing has been restricted the personal data may be stored but otherwise may only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the EU or of a Member State. The controller must inform a data subject who has obtained a restriction on processing before the restriction is lifted. The controller must communicate any restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller must inform the data subject about those recipients if the data subject requests it.
Portability	data subjects have the right to receive from the controller their personal data which they have provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where: * the processing is based on consent or on a contract; and * the processing is carried out by automated means.
Object	data subjects have the right at any time to object, on grounds relating to their particular situation, i.e. the data subject must have a reason to object that relates to him or her as an individual,, to the processing of personal data concerning him or her which is based on the processing being necessary for the: * performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; or * purposes of the legitimate interests pursued by the controller or by a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child In those cases, the controller must no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. Data subjects have the right to object at any time to the processing of their personal data for direct marketing including profiling to the extent it is related to direct marketing. At the latest at the time of the first communication with the data subject, the right to object must be explicitly brought to the attention of the data subject, and be presented clearly and separately from any other information. Where personal data are processed for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, has the right to object to processing of his or her personal data, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
Not to be subject to automated decision making	data subjects have the right not to be subject to a decision based solely on automated processing (including profiling) which produces legal effects concerning them or similarly significantly affects them unless the processing: * the processing is necessary for entering into, or performance of, a contract between the data subject and a data controller; * is authorised by EU or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or * is based on the data subject’s explicit consent.

7.18.2

Controllers must inform data subjects of the action taken in response to a request to exercise the data subject’s rights without undue delay and, in any case, within one month after receipt of the request. Controllers may extend that month by two more months where necessary if the request is complex or there are numerous requests, but controllers must inform the data subject of any such extension within one month after receipt of the request, and give the reason for the delay.

If the data subject made the request electronically, the controller must provide the information by electronic means where possible, unless otherwise requested by the data subject.

If the controller does not act on the data subject’s request, the controller must inform the data subject without delay and at the latest within one month after receipt of the request of the reasons for not acting and on the possibility of lodging a complaint with the ICO and bringing court proceedings.

The information must be provided any communication made and any actions taken free of charge unless requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character. In that case, the controller may either:

• charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

• refuse to act on the request.

It is for the controller to show that the request was manifestly unfounded or excessive.

7.19 Data security

Controllers and processors must take appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including amongst other things, as appropriate:

• the pseudonymisation and encryption of personal data;

• the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;

• the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; and

• a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

In deciding what measures are appropriate, the following must be taken into account:

• the state of the art;

• the costs of implementation;

• the nature, scope, context and purposes of the processing;

• the risk of varying likelihood and severity for the rights and freedoms of data subjects; and

• the risks presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to the personal data.

That broad obligation is supplemented by obligations to take the following steps, where appropriate:

- the pseudonymisation and encryption of personal data;

- the ability to ensure the ongoing confidentiality, integrity, availability and resilience of its information technology systems;

- the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; and

- a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

These obligations do not relate only to what is commonly called data security, but also to business continuity issues.

Controllers and processors must take steps to ensure that any individual acting under their authority and who has access to personal data does not process the personal data except on instructions from the controller, unless he or she is required to carry out that processing by EU or Member State law.

Adherence to an approved code of conduct or an approved certification mechanism may be used as an element by which to demonstrate compliance with these requirements. At the time of writing there are no approved codes of conduct or approved certification mechanisms.

7.20 Personal data breaches

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. A personal data breach may take place when the data are being stored or transmitted or in other circumstances.

If the personal data breach is likely to result in a risk to the rights and freedoms of data subjects the controller must report the breach to the ICO, without undue delay and, where possible, within 72 hours after becoming aware of the breach. The controller must provide the ICFO with the following information:

• a description of the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

• the name and contact details of the controller’s data protection officer or other contact from whom more information may be obtained;

• a description of the likely consequences of the personal data breach; and

• a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

There is a risk to data subjects if processing could lead to physical, material or non-material damage. This includes profiling or processing which could lead to:

• discrimination, identity theft, damage to the reputation; or

• the reversal of pseudonymisation.

It includes any processing of:

• special category personal data or personal data about children; or

• the personal data of other vulnerable people or processing which involves large amounts of personal data.

When the personal data breach is likely to result in a high risk to the rights and freedoms of data subjects, the controller must communicate the personal data breach to the data subject without undue delay unless:

• the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption;

• the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects is no longer likely to materialise; or

• it would involve disproportionate effort but, in that case, there must be a public communication informing data subjects in an equally effective manner.

Processors must notify Personal Data Breaches to Controllers without undue delay, but processors do not have a duty to report the breach to the ICO or data subjects.

The ICO’s guidance on personal data breaches.

7.21 Using a processor

7.21.1 Sufficient guarantees

Controllers may not use a processor unless that processor provides sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of the GDPR and ensure the protection of the rights of the data subjects.

7.21.2 Written Agreement

There must be a binding written contract or agreement between the controller and the processor. That contract or agreement must state:

• the subject matter and duration of the processing;

• the nature and purpose of the processing;

• the types of data processed and the categories of data subjects; and

• the obligations and rights of the controller.

The contract or agreement must oblige the processor to:

• process the data only in accordance with the documented instructions of the controller, including with regard to transfers of personal data to a country outside the EU or an international organisation;

• ensure that anyone authorised to process the personal data has committed him or herself to keep the personal data confidential or is under an appropriate statutory obligation of confidentiality;

• take the security measures mentioned above;

• respect the conditions for engaging sub-processors mentioned above;

• taking into account the nature of the processing, assist the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights (e.g. the right to information and access and the rectification and erasure of data);

• taking into account the nature of processing and the information available to the processor, assist the controller in ensuring compliance with the obligations in relation to data security, the notification of personal data breaches to the supervisory authority and (where required by the GDPR) data subjects and carrying out privacy impact assessments;

• at the choice of the controller, delete or return all the personal data to the controller after the end of the processing service and delete existing copies unless EU law or the law of a member state of the EU requires the storage of the personal data; and

• make available to the controller all information necessary to demonstrate compliance with the above obligations and allow for and contribute to audits, including inspections, conducted by the controller or an auditor mandated by the controller.

At some point in future, the European Commission or the supervisory authority may issue standard contractual clauses for this sort of contract.

7.21.3 Processing in accordance with the controller’s instructions

Processors, and any person acting under the authority of the controller or of the processor who has access to personal data, must not process the personal data except on instructions from the controller, unless required to process the data by the law of the EU or of a member state.

Processors must immediately inform the controller if they think that any instruction to hand information to the controller is in breach of the GPDR or the data protection law of the EU or of a member state.

7.21.4 Security measures

Processors (as well as controllers) must take appropriate technical and organisational measures – see Data Security above.

7.21.5 Notification of security breaches

Processors must notify the controller of a personal data breach without undue delay after becoming aware of it. Processors are not exempted from notifying breaches to the controller if the breach is unlikely to result in a risk to the rights and freedoms of data subjects.

There is no long stop of 72 hours (or any other period) for processors notifying the controller and no indication of what undue delay might mean.

The contract or agreement between the controller and processor must stipulate that the processor will assist the controller with compliance with the controller’s obligations to notify personal data breaches, so controllers will want to mirror the requirements to provide information and document matters in their contracts with processors.

7.21.6 Engaging sub-processors

Processors may not appoint a sub-processor without the controller’s written authorisation (consent).

That may be specific or general consent but if the controller gives general consent to the use of sub-processors, the processor must inform the controller of any additional or replacement sub-processor, giving the controller the opportunity to object to the change.

Where a processor engages a sub-processor to carry out specific processing activities on behalf of the controller, the processor must enter into a written contract with the sub-processor. That contract may be in electronic form.

That contract must impose on the sub-processor the same data protection obligations as are imposed on the processor in the contract or agreement between the controller and the processor.

In particular, the contract between the processor and the sub-processor must provide sufficient guarantees that the sub-processor will implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the GDPR.

If the sub-processor fails to fulfil its data protection obligations, the processor will be fully liable to the controller for the performance of the sub-processor’s obligations.

At some point, the European Commission or the ICO may issue standard contractual clauses for this sort of contract or agreement.

7.21.7 Transfers of personal data outside the EU/to an international organisation

Although the processor is obliged to follow the controller’s instructions, no matter what those instructions may be, subject to specific derogations in the GDPR, a processor may transfer personal data to a country outside the EU or to an international organisation only if:

• the European Commission has decided that that country, territory, one or more specified sectors within that country or the specific international organisation ensures an adequate level of protection; or

• the controller or processor has provided appropriate safeguards and on condition that data subjects have enforceable rights and effective legal remedies.

The processor must exercise a degree of independence from the controller when deciding whether or not it can transfer personal data outside the EU and the contract between the controller and processor should allow for that.

It is envisaged that appropriate safeguards may involve the use of binding corporate rules or standard contractual clauses adopted by the European Commission or the supervisory authority.

If the processor is to transfer personal data outside the EU or to an international organisation, the contract or agreement between the controller and the processor should stipulate:

• the countries or international organisations to which the transfers are to be made;

• whether any derogation under the GDPR applies to those transfers; or

• (if no derogation applies and the European Commission has not decided that that transfer is to a country, territory, one or more specified sectors within that country or an international organisation which ensures an adequate level of protection) the safeguards to be put in place; and

• who is responsible for putting those safeguards in place.

7.22 Data sharing

If a controller shares personal data with another controller, both will be responsible for how the personal data are used and how it is processed.

The ICO recommends that the Controllers put a Data Sharing Agreement in place covering how the Personal Data may be used.

This is the purpose of the second set of provisions in the Data Protection Schedule to each of the model agreements.

The ICO has published a Data Sharing Code of Practice (PDF,1,381 KB). This was published while the Data Protection Act 1998 was still inforce and, at the time of writing, it has not been updated in the light of the GDPR.

7.23 Exporting personal data outside the EU or to an international organisation

7.23.1

Controllers and processors may transfer personal data to a country outside the EU or to an international organisation (including for onward transfer to another country outside the EU or to another international organisation) only if at least one of the following conditions is met:

Condition	Description
Adequacy decision	the European Commission has decided that the country, a territory or one or more specified sectors within that country, or the international organisation ensures an adequate level of protection (an adequacy decision). Adequacy decisions which the European Commission has made before the GDPR takes effect will remain in force until amended, replaced or repealed by a decision of the Commission. To date the European Commission has made adequacy decisions for a few (very few) countries: Andorra, Argentina, Canada (commercial organisations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Jersey, New Zealand, Switzerland and, Uruguay Adequacy talks are ongoing with Japan and South Korea. The European Commission has negotiated the Privacy Shield with the US Department of Commerce in order to provide a mechanism to comply with EU data protection requirements when transferring personal data from the EU to the USA. The Privacy Shield came into force on 1 August 2016. Details can be found at: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/eu-us-privacy-shield_en and www.privacyshield.gov The Article 29 Working Party (representing data protection authorities in EU member states) has expressed significant concerns about the Privacy Shield and it may be challenged in the courts. Therefore some are wary of using it.
Appropriate safeguards	appropriate safeguards have been provided by the controller or processor and on condition that enforceable data subject rights and effective legal remedies for data subjects are available. These safeguards may be providing by binding corporate rules, internal rules approved by a European data protection authority under which multi-national companies transfer personal data from the EU to their group companies outside the EU. More details can be found at: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/binding-corporate-rules_en. To date these safeguards have often been provided by using model or standard contractual clauses published by the European Commission. However, those clauses are being challenged and in October 2017 the Irish High Court referred them to the European Court of Justice for a decision on whether they provide adequate safeguards for the transfer of personal data outside the EU. Nevertheless, at the time of writing they are the preferred means of transferring personal data to countries outside the EU unless an adequacy decision has been made. There are two sets of standard contractual clauses - one for controller to controller transfers and one for controller to processor transfers. They may be downloaded from: http://ec.europa.eu/justice/data-protection/international-transfers/transfer/index_en.htm. Except for inserting the details into the standard contractual clauses they should not be changed. If they are changed, the amended version may not ensure adequate protection for data subjects and the transfer may not be compliant with the GDPR.
Explicit consent	the data subject has given explicit consent to the proposed transfer, after having been informed of the possible risks of the transfer(s) for the data subject due to the absence of an adequacy decision and appropriate safeguards.
Necessary for a contract with the data subject	the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject’s request.
Necessary for a contract in the interests of the data subject	the transfer is necessary for the conclusion or performance of a contract between the controller and another person concluded in the interest of the data subject.
Public interest	the transfer is necessary for important reasons of public interest recognised in EU law or in the law of the member state to which the controller is subject. This derogation will apply, for example, in connection with public health, for example contact tracing for contagious diseases or in order to reduce or eliminate doping in sport.
Legal claims	the transfer is necessary for the establishment, exercise or defence of legal claims.
Vital interests	the transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent.
Public Registers	the transfer is made from a register which according to EU or member state law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, but only to the extent that the conditions laid down by EU or Member State law for consultation are fulfilled in the particular case. The transfer must not involve all the personal data or entire categories of the personal data in the register. Where the register is intended for consultation by people having a legitimate interest, the transfer may be made only at the request of those people or if they are to be the recipients.
Minor Transfers	the transfer is not repetitive, concerns only a limited number of data subjects, is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards with regard to the protection of personal data. In carrying out that assessment the controller consider the nature of the personal data, the purpose and duration of the proposed processing, the situation in the country of origin, the country outside the EU to which the data will be transferred and the country of final destination. If the processing is for scientific or historical research purposes or for statistical purposes, the legitimate expectations of society for an increase of knowledge should be taken into consideration. A minor transfer is a legitimate ground for transferring personal data outside the EU only where none of the other grounds for transfer are applicable. The controller or processor must document the assessment and the suitable safeguards. If relying on this condition, the controller must: * inform the ICO of the transfer; * inform the data subject of the transfer; and * inform the data subject of the compelling legitimate interests pursued.

Where there is no adequacy decision, EU or member state law may set limits to the transfer of specific categories of personal data to a country outside the EU or to an international organisation.

A transfer outside the EU includes someone outside the EU accessing personal data stored on servers inside the EU and researchers in the EU storing data with a cloud service provider whose servers (primary or back-up) are outside the EU.

An international organisation is an organisation and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries.

7.23.2 Processors

Although a processor is obliged to follow the controller’s instructions, no matter what those instructions may be, subject to specific derogations in the GDPR, a processor may transfer personal data to a country outside the EU or to an international organisation only if:

• the European Commission has decided that that country, territory, one or more specified sectors within that country or the specific international organisation ensures an adequate level of protection; or

• the controller or processor has provided appropriate safeguards and on condition that data subjects have enforceable rights and effective legal remedies.

The processor must exercise a degree of independence from the controller when deciding whether or not it can transfer personal data outside the EU.

If the processor is to transfer personal data outside the EU or to an international organisation, the agreement between the controller and the processor should stipulate the countries or international organisations to which the transfers are to be made, whether any derogation under the GDPR applies to those transfers or (if no derogation applies and there is no adequacy decision) the safeguards to be put in place and which party is responsible for putting those safeguards in place.

7.24 Data protection officers

Controllers and processors must designate a data protection officer in any case where:

• the processing is carried out by a public authority or body (except for the courts);

• the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or

• the core activities of the controller or the processor consist of processing on a large scale of special categories of personal data or personal data relating to criminal convictions and offences.

The controller/processor must publish the contact details of its data protection officer and communicate them to the ICO.

7.25 Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (Article 89 of the GDPR)

7.25.1 Definitions

The GDPR applies to the processing of personal data for archiving purposes in the public interest, for scientific or historical research purposes and for statistical purposes.

The expression scientific research is interpreted broadly. Examples given in the GDPR are technological development and demonstration, fundamental research, applied research, privately funded research, and studies conducted in the public interest in the area of public health. These examples are not exhaustive.

Public health is defined by reference to Regulation (EC) No 1338/2008, as all elements related to health, namely health status, including morbidity and disability, the determinants having an effect on that health status, health care needs, resources allocated to health care, the provision of, and universal access to, health care as well as health care expenditure and financing, and the causes of mortality.

Statistical purposes are the collection and the processing of personal data for statistical surveys or for the production of statistical results. The result of processing for statistical purposes must not be personal data, but aggregate data. The personal data and the results of the processing for statistical purposes must not be used in support of measures or decisions regarding any particular individual.

The results of the processing for statistical purposes may be used for a different purpose, including scientific research.

Historical research purposes include research for genealogical purposes, but the GDPR does not apply to deceased persons.

7.25.2 Special category personal data

The processing of special category personal data which are necessary for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes is permitted provided:

• appropriate safeguards are in place in accordance with Article 89(1) of the GDPR;

• it is based on EU or member state law – the UK Data Protection Bill requires the processing to be in the public interest;

• it is proportionate to the aim pursued;

• it respects the essence of the right to data protection; and

• it provides for suitable and specific measures to safeguard the fundamental rights and the interests of data subjects.

The processing will not be based on UK law unless it is in the public interest.

The onus is on the controller to show that the processing is in the public interest. Controllers should record the reasons for their deciding that the processing is in the public interest, for instance where public funding has been awarded for the project and one of the criteria for that funding is the public interest.

7.25.3 Safeguards

If you use personal data for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes, it is a fundamental requirement that you implement safeguards to protect the rights and freedoms of data subjects.

Provided those safeguards are in place, the GDPR treats the processing of personal data for those purposes favourably, allowing some relaxation of the data protection principles, giving member states of the EU the ability to derogate from certain data subject rights and, allowing the processing of special category personal data.

The safeguards must ensure that technical and organisational measures are in place, in accordance with the GDPR, in particular to ensure data minimisation. (See the third data protection principle above.)

Those measures will include, for instance, implementing data security measures which meet the requirements of the GDPR and having agreements with any processors which meet the requirements of the GDPR.

The GDPR makes it clear that:

• the technical and organisational measures may include pseudonymisation if the purposes can be achieved in that way; and

• if the purposes can be achieved by processing which does not permit or no longer permits the identification of data subjects, the data must be anonymised.

Otherwise the GDPR places the onus on member states to provide those safeguards, but as different states may impose different rules regarding the safeguards to be adopted, that will make compliance more complicated for cross-border projects.

According to clauses 19(2) and (3) of the UK Data Protection Bill, processing will not satisfy the requirement to put appropriate safeguards in place if the processing is likely to cause substantial damage or substantial distress to a data subject. It is therefore important that a privacy impact assessment is carried out and documented.

Nor will processing satisfy that requirement if the processing is carried out for the purposes of measures or decisions in respect of a particular data subject, unless the purposes for which the processing are necessary include the purposes of approved medical research.

Approved medical research is medical research carried out by a person who has approval to carry out that research from:

• a research ethics committee recognised or established by the Health Research Authority under Chapter 2 of Part 3 of the Care Act 2014; or

• a body appointed by any of the following for the purpose of assessing the ethics of research involving individuals:
  
  - the Secretary of State, the Scottish Ministers, the Welsh Ministers, or a Northern Ireland department;
  
  - a relevant NHS body;
  
  - a UK Research and Innovation or a body which is a Research Council for the purposes of the Science and Technology Act 1965;
  
  - an institution which is a research institution for the purposes of Chapter 4A of Part 7 of the Income Tax (Earnings and Pensions) Act 2003 (see section 457 of that Act);

A relevant NHS body is:

• an NHS trust or NHS foundation trust in England;

• an NHS trust or Local Health Board in Wales;

• a Health Board or Special Health Board constituted under section 2 of the National Health Service (Scotland) Act 1978;

• the Common Services Agency for the Scottish Health Service; or

• any of the health and social care bodies in Northern Ireland falling within paragraphs (a) to (e) of section 1(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009.

7.25.4 Right to erasure

Provided appropriate safeguards are in place, the data subject’s right to erasure or to be forgotten (see Data Subjects’ Rights above) does not apply if the processing is necessary for:

• exercising the right of freedom of expression and information;

• for compliance with a legal obligation which requires processing by EU or member state law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

• for reasons of public interest in the area of public health;

• for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes, and the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing.

7.25.5 Right to object

Where personal data are processed for scientific or historical research purposes or for statistical purposes, the data subject, on grounds relating to his or her particular situation, has the right to object to the processing of his or her personal data, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

7.25.6 UK derogations

Provided appropriate safeguards are in place, where personal data are processed for scientific or for historical research purposes or for statistical purposes and the following derogations are necessary for the fulfilment of those purposes, member states may derogate from the rights of data subjects to:

• have access to their personal data (Art 15);

• have inaccurate personal data rectified (Art 16);

• restrict the processing of their personal data (Art 18); and,

• object to the processing of their personal data (Art 21).

Paragraph 27 of Schedule 2 to the Data Protection Bill provides those derogations to the extent that the application of those provisions would prevent or seriously impair the achievement of the purposes in question.

The derogations apply only where the personal data are processed in accordance with Article 89(1) of the GDPR, and in in relation to the derogation from Articles 15(1) to (3), if the results of the research or any resulting statistics are not made available in a form which identifies a data subject.

Provided appropriate safeguards are in place, where personal data are processed for archiving purposes in the public interest and the following derogations are necessary for the fulfilment of those purposes, member states may derogate from the rights of data subjects to:

• have access to their personal data (Art 15);

• have inaccurate personal data rectified (Art 16);

• restrict the processing of their personal data (Art 18);

• have the controller communicate any rectification or erasure of personal data or restriction of processing to each person to whom the personal data have been disclosed (unless this proves impossible or involves disproportionate effort) (Art19);

• data portability (Art 20); and

• object to the processing of their personal data (Art 21),

in each case in so far as those rights are likely to render impossible or seriously impair the achievement of those purposes.

Paragraph 27 of Schedule 2 to the Data Protection Bill provides those derogations.

7.25.7 Processing for other purposes

Where the processing serves another purpose, any derogation applies only to processing for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes.

7.25.8 Further processing

Provided appropriate safeguards are in place, further processing of personal data acquired for a specific purpose for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes is deemed not to be incompatible with the initial purposes (see the second data protection principle, purpose limitation).

7.25.9 The fifth data protection principle (retention)

Provided appropriate safeguards are in place, despite the fifth data protection principle, personal data may be stored for longer periods if the personal data are to be processed solely for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes.

7.25.10 Other factors to take into account

Institutions and many Collaborators will have data management and ethical guidelines. Compliance with the GDPR is not a substitute for compliance with those guidelines; research projects should be carried out in accordance with the law and the applicable guidelines.

Researches should also respect any obligations of confidentiality to individuals, such as hospital patients.

The Department of Health is implementing the National Data Guardian Review of Data Security, Consent and Opt-Outs which will give patients a means to opt out of their confidential patient information being used for any purpose except their individual care and treatment. Where relevant, researchers should comply with that.

7.26 Processing for the purpose of academic expression

The GDPR leaves this to member states who must legislate to reconcile the right to the protection of personal data pursuant to the GDPR with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.

For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, member states must provide exemptions or derogations from the GDPR covering, amongst other things:

• the data protection principles;

• the rights of data subjects;

• the obligations of controllers and processors;

• the transfer of personal data to countries outside the EU or international organisations; and

• specific data processing situations,

if the derogations are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.

Paragraph 26 of Schedule 2 to the UK Data Protection Bill provides derogations for, amongst other things, processing for academic purposes.

If the processing is being carried out with a view to the publication of academic material and the controller reasonably believes that the publication of the material would be in the public interest, the following provisions of the GDPR do not apply to the extent that the controller reasonably believes that those provisions would be incompatible with the publication of the academic material:

• the data protection principles Arts 5(1)(a) to (e);

• lawful bases for processing (Art 6);

• conditions for consent (Art 7);

• child’s consent (Arts 8(1) and (2));

• the processing of special categories of data (Art 9)

• data relating to criminal convictions etc (Art 10);

• processing not requiring identification (Art 11(2));

• personal data collected from data subject: information to be provided (Arts 13(1) to (3));

• personal data collected other than from data subject: information to be provided (Arts 14(1) to (4));

• confirmation of processing, access to data and safeguards for third country transfers (Arts 15(1) to (3);

• the right to rectification (Art 16);

• the right to erasure (Art 17(1) and (2);

• the right to restriction of processing (Arts 18(1)(a), (b) and (d));

• notification obligation regarding rectification or erasure of personal data or restriction of processing (Art 19);

• the right to data portability (Arts 20(1) and (2));

• the right to object to processing (Art 21(1));

• communication of personal data breaches to the data subject (Art 34(1) and (4));

• the requirement for the controller to consult with the ICO prior to high risk processing (Art 36); and

• general principles for transfers (Art 44).

7.27 More information

Useful information on the GDPR has been published by JISC and is available at: https://www.jisc.ac.uk/gdpr.

As always, the ICO guidance produced ICO is excellent and should be consulted.

8. Anti-Bribery and corruption

Clause 10.12 of each model agreement contains an undertaking by each Party to comply with the provisions set out in Schedule 5 (Anti-bribery and corruption).

The Bribery Act 2010 prohibits:

a) active bribery - offering, promising or giving of a bribe (section 1);

b) passive bribery - requesting, agreeing to receive or accepting of a bribe (section 2); and

c) bribing a foreign public official in order to obtain or retain business or an advantage in the conduct of business (section 6).

In addition, a commercial organisation commits a criminal offence if a person associated with it bribes someone and intends to obtain or retain business or a business advantage for the commercial organisation.

The Commercial organisation will, however, have a defence if it can show that it had adequate procedures to prevent bribery by persons associated with it.

A charitable or educational body will be a commercial organisation for these purposes if it engages in commercial activities.

Section 8 of the Bribery Act makes it clear that a person is associated with a commercial organisation if that person performs services for or on behalf of the commercial organisation.

The bribery guidance (PDF,390 KB) published by the Ministry of Justice is available.

This sets out six principles and some case studies to help organisations to plan, implement and monitor adequate procedures.

Because a commercial organisation may face large fines if an associated person commits an act of bribery, the model agreements contain an indemnity in respect of any breach of the anti-bribery provisions. The model agreements envisage that liability under that indemnity is capped, although that cap may be higher than the general cap on liability in the Agreement.

9. State aid: principles and rules for collaborative searcher projects

9.1 The basics

Any aid granted by a Member State of the European Union or through state resources (in any form) which distorts or threatens to distort competition by favouring certain undertakings or the production of certain goods is, in so far as it affects trade between Member States, incompatible with the internal market and is therefore prohibited.

Not all public funding is state aid. For instance, support for the primary activities of universities relating to the provision of teaching and non-commercial research is not state aid.

The following tests (the State Aid Tests) are used to determine whether there is state aid. If the answer to any one or more of those questions is no, there will be no state aid. Therefore any analysis should start with an application of the four State Aid Tests.

(1). Is there a transfer of state resources to an undertaking?

The fundamental question is whether aid or assistance of some kind is provided by central government, a devolved administration, a regional authority or a local authority, either directly or through an intermediary.

A transfer of resources (aid, assistance or support) can take many forms. The most obvious is the provision of a grant, but it also includes: the sale of public assets at less than market value, the state buying goods or services at more than their market value, and the provision of facilities or services such as consultancy or research services for free or below market rates.

It follows that the sale of an asset such as IPR at its market value or the provision of research services at market rates will not be state aid.

An undertaking is any entity, regardless of its legal status, which is engaged in an economic activity and where there is a market in comparable goods or services. An undertaking may be not-for-profit if it carries on an activity which, in fact or in theory, has commercial competitors, and it doesn’t matter how it is financed.

It may be a private body, company, partnership, sole trader, co-operative, trade association, voluntary organisation, charity, university, research organisation, social enterprise, not-for-profit organisation, or even a public body or government department when it is engaged in an economic activity.

An economic activity is an activity which involves offering goods or services on a given market and which could (in practice or in theory) be carried out by a private operator in order to make a profit.

An entity (such as a university or research organisation) may engage in an economic activity in relation to some of its functions but not others.

(2). Does the aid confer an advantage on the recipient or beneficiary?

An advantage is an economic benefit which is the undertaking would not have received in the normal course of business, e.g. it is conferred for free or on terms which are better than normal commercial terms.

Making a grant or providing a service or allowing access to facilities or intellectual property for free or at less than the market rate may confer an economic advantage.

The purchase of goods and services at the full market price does not confer an advantage. (This is usually demonstrated by a competitive tender in accordance with the procurement rules.)

(3). Is the aid selective? Does it favour certain undertakings or the production of certain goods?

Aid is selective if it targets particular sectors, businesses, locations or types of undertaking (such as participants in a research project).

(4). Does the aid distort competition or affect trade between Member States (actually or potentially)?

Competition is distorted if the aid strengthens the competitive position of the beneficiary or recipient of the aid in relation to its competitors.

The beneficiary’s share of the market and the size of the distortion are irrelevant and the status of the beneficiary is irrelevant if it is engaged in an economic activity.

It is sufficient to affect trade between Member States if the beneficiary is involved in an economic activity and operates in a market in which there is trade between Member States. Most products and services are traded between Member States. Therefore aid for any business or economic activity may affect, or be capable of affecting, trade between Member States. This applies even if the recipient of the aid does not actually trade with other Member States.

The European Commission takes the view that most aid distorts competition and the onus is on the Member State to prove there is no distortion.

9.2 The market rate

The European Commission investigated the circumstances surrounding a software licence agreement between the Dutch Technische Universiteit Delft (TUD) and the company Delftship BV (DS). The software had been developed by an engineer and a TUD lecturer who left TUD and founded DS. TUD did not have the means to continue developing that software.

TUD granted DS an exclusive licence under which DS would develop the software, supply TUD with updates free of charge and pay TUD an annual royalty equal to 5% of the annual turnover received by DS from sub-licensing the software.

The European Commission concluded that because TUD had managed to improve its contractual position and had taken several factors into consideration (importantly that, because of the experience of the engineer who developed the software, DS was best qualified to continue developing the software and to adapt it to TUD’s needs), the 5% royalty was a market rate.

That was the case even though the market price had not been established by going out to tender or a valuation carried out by an independent expert.

Bear in mind that 5% was considered the market rate in the particular circumstances of the case and the market rate will vary from case to case.

In the context of collaborative research, the European Commission deems the compensation received by a university to be the equivalent of the market price if one of the following conditions is met:

i) the amount of the compensation has been established by means of an open, transparent and non-discriminatory competitive sale procedure;

ii) an independent expert valuation confirms that the amount of the compensation is at least equal to the market price;

iii) the university can demonstrate that it effectively negotiated the compensation, at arm’s length, to obtain the maximum economic benefit when the contract was concluded, while considering its statutory objectives; or

iv) if the collaboration agreement gives the undertaking a right of first refusal in relation to IPR generated by the university, the university exercises a reciprocal right to solicit more economically advantageous offers from third parties so that the undertaking has to match its offer accordingly.

9.3 The state aid rules

Over time the European Commission has come to appreciate that some aid is beneficial to the economy or supports community objectives and it has developed a set of state aid rules which allow the Member States (and public authorities such as universities) to assist undertakings in a way which avoids giving those undertakings an unfair advantage to the detriment of their competitors.

The state aid rules which are of general application to research collaborations are:

a) the de minimis Regulation; b) the Research and Development and Innovation (the R&D&I) Framework; and c) the General Block Exemption Regulation (the GBER).

Each of these is discussed below.

9.4 Notifying state aid

Unless an exemption to the requirement to notify applies (e.g. under the GBER or the de minimis Regulation) or the aid is granted under a scheme which has already been approved by the Commission, failure to notify the European Commission of the proposed state aid measure and to obtain the Commission’s approval before the aid is granted will result in the aid being unlawful.

9.5 The de minimis regulation

Commission Regulation (EU) No 1407/2013 of 18 December 2013 on the application of Articles 107 and 108 of the Treaty on the Functioning of the European Union to de minimis aid (PDF,848 KB) is available.

The European Commission has decided that small amounts of aid (de minimis) do not have a potential effect on competition and trade and are therefore not state aid.

The de minimis Regulation allows the award of state aid which (when added to all other de minimis state aid received by the recipient of the aid) does not exceed €200,000 (gross cash equivalent value) over three fiscal years without having to notify the European Commission before that aid is granted if all the conditions set out in the de Minimis Regulation are met.

Those conditions include obtaining a declaration about other de minimis aid received by the recipient during the current and the previous two fiscal years and notifying the recipient of the nature of the aid.

The accepted view is that, where possible, aid should be awarded under a scheme approved by the European Commission or a block exemption such as the GBER, and that de minimis aid should be given only where there is no other option. That is because an undertaking may receive de minimis aid from a number of sources and the €200,000 threshold can quickly be exceeded.

Because of the low €200,000 threshold the possibility of coming within the de minimis Regulation may often not be available, but it could prove useful in some smaller projects.

9.6 The R&D&I framework

The Framework for State aid for research and development and innovation (PDF,296 KB) (2014/C 198/01) is available.

The purpose of the Framework is to inform the public of the criteria which the European Commission will apply if proposed state aid is notified to the Commission and the Commission has to decide whether or not to permit that aid. In making that assessment the Commission balances the positive impact of the aid in reaching an objective of common interest against its potentially negative effects of distorting trade and competition.

The Framework does not provide criteria which the public may use to decide whether or not there is any state aid or whether that aid is permissible; even if it meets the conditions in the Framework, the proposed aid should be notified to the Commission and the Commission’s approval (or a decision not to investigate) obtained before the aid is provided.

The Framework talks in terms of undertakings (see above for a definition) and research organisations (such as universities, research institutes, technology transfer agencies, innovation intermediaries, research-oriented physical or virtual collaborative entities) and research infrastructures (facilities, resources and related services that are used by the scientific community to conduct research), but for the purposes of simplicity, this note simply uses the expression ‘university’.

9.7 Direct and indirect state aid

The Framework distinguishes between:

a) the public funding of universities; and

b) indirect state aid provided to undertakings through publicly funded universities.

The public funding of a university will be state aid if the university carries out an economic activity consisting of offering products or services on a given market, but the Commission normally regards the funding of the following to be non-economic, i.e. not state aid:

a) a university’s primary activities such as:

• education for better and more skilled human resources
• independent R&D (including collaborative R&D) for more knowledge and better understanding where the university engages in effective collaboration ^{[footnote 1]}
• the wide dissemination of the results of research on a non-exclusive and non-discriminatory basis, e.g. through teaching, open-access databases, open publications or open software

b) knowledge transfer activities, where those activities are conducted either by the university (including its departments or subsidiaries) or jointly with, or on behalf of other such entities, and where all profits from those activities are reinvested in the primary activities of the research organisation or research infrastructure.

If a university performs economic activities, e.g. renting equipment or lab space or supplying services to undertakings, or carrying out contract research, the public funding of those activities will usually be state aid.

The Commission will not consider the university to be a beneficiary of state aid if the university acts only as an intermediary which:

a) passes on all the advantages to the final recipients, e.g. through reduced prices; and

b) obtains no further advantage because it has been selected through an open tender procedure or the public funding is available to anyone who satisfies the necessary objective conditions, so that the final recipients may acquire equivalent services from any intermediary who satisfies those conditions.

But in those circumstances, there is likely to indirect state aid to the final recipients.

There may also be indirect state aid to an undertaking where an undertaking obtains an advantage in the context of a university carrying out contract research for it, or the undertaking and a university carrying out collaborative research.

9.8 Contract research

Where a university provides research services to an undertaking (i.e. carries out contract research) ^{[footnote 2]} , there will usually be no indirect state aid to the undertaking if the university receives adequate remuneration for its services. This applies in particular where one of the following conditions is met:

a) the university carries out the contract research at market price ^{[footnote 3]} ; or

b) where there is no market price, the university carries out the contract research at a price which:

i) reflects the full costs of the service and includes a margin established by reference to those margins commonly applied by undertakings active in the same sector as the service; or

ii) is the result of arm’s length negotiations where the university has negotiated to obtain the maximum economic benefit when the contract was concluded and at least the university’s marginal costs are covered.

If ownership of, or access rights to, IPR remain with the university, their market value may be deducted from the price payable for the contract research.

9.9 Collaborative research

This involves effective collaboration (see footnote 1).

The terms and conditions of the project (in particular contributions to its costs, the sharing of risks and results, the dissemination of results, access to and rules for the allocation of IPR) must be concluded before the start of the project. This does not mean that there has to be definite agreement on the market value of the resulting IPR and the value of the parties’ respective contributions to the project.

Where there is effective collaboration carried out jointly by an undertaking and a university, there will usually be no indirect state aid to the undertaking if at least one of the following conditions is met:

a) the undertaking bears the full cost of the project;

b) the results of the collaboration which do not give rise to IPR may be widely disseminated and any IPR resulting from the activities of the university is fully allocated to the university;

c) any IPR resulting from the project and access rights are allocated between the collaborators so as to reflect adequately their work packages, contributions and respective interests;

d) the university receives compensation equivalent to the market price for the IPR which results from its activities and which is assigned to the undertaking, or to which the undertaking is allocated access rights. The value of any contribution (financial and non-financial) of the undertaking to the costs of the university’s activities that resulted in the IPR, may be deducted from that compensation.

For the purposes of d) above, the compensation received by the University will be deemed equivalent to the market price if one of the following conditions is fulfilled:

v) the amount of the compensation has been established by means of an open, transparent and non-discriminatory competitive sale procedure;

vi) an independent expert valuation confirms that the amount of the compensation is at least equal to the market price;

vii) the university can demonstrate that it effectively negotiated the compensation, at arm’s length, to obtain the maximum economic benefit when the contract was concluded, while considering its statutory objectives; or

viii) if the collaboration agreement gives the undertaking a right of first refusal in relation to IPR generated by the university, the university exercises a reciprocal right to solicit more economically advantageous offers from third parties so that the undertaking has to match its offer accordingly.

If none of the conditions in a) – d) above is met, the full value of the contribution of the university to the project will be considered an advantage for the undertaking, and the state aid rules will apply.

9.10 Assessment by the commission

The Commission has the power to declare that state aid is compatible with the internal market and is therefore be permitted if the aid meets the criteria in Article 36 of the Framework:

• it makes a contribution to a well-defined objective of common interest
• there is a need for state intervention
• the aid is appropriate to address the objective of common interest
• the aid has an incentive effect – it changes the behaviour of the undertaking so that it engages in activity which it would not carry out without the aid or would carry out in a restricted or different manner or location
• the aid is proportionate - the amount and intensity of the aid does not exceed the minimum needed to induce the additional investment or activity by the undertaking
• the negative effects of the aid are sufficiently limited so that the overall balance of the aid is positive
• the aid is transparent - Member States, the Commission, economic operators, and the public, have easy access to all relevant acts and to pertinent information about the aid

In section 4 of the Framework (Article 41 and following) the Commission sets out how it will apply the above criteria.

9.11 Aid intensity and eligible costs

In order to ensure that the aid is proportionate, it must relate to the eligible costs (set out in Annex I to the Framework), and each task carried out under the project must fall into the category of:

• fundamental research ^{[footnote 4]}
• industrial research ^{[footnote 5]}
• experimental development ^{[footnote 6]}

The aid must be no greater than a specified proportion of the eligible costs set out in Annex II to the Framework. This is called the aid intensity. The aid intensity for each undertaking which receives state aid must be established.

The maximum permitted aid intensity depends on:

i) the closeness of the aid to the market;

ii) the size of the undertaking which receives the aid; and

iii) the acuteness of the market failure.

Aid intensities are generally lower for activities linked to development and innovation than they are for research activities.

The combination of direct public support and, where they constitute aid, contributions from universities to the same project must not exceed the applicable aid intensity for each undertaking which receives aid.

Aid for R&D&I may not be cumulated with de minimis aid (see above) in respect of the same eligible costs if that would result in the aid intensity exceeding the limits in the Framework.

Please see Annex A to this note for eligible costs and aid intensities in relation to aid for R&D&I under the Framework.

If you wish to use the Framework, the proper procedure is to:

a) use the guidance provided by the Framework to bring the project into line with the:

i) circumstances outlined in the Framework where the Commission has stated that there will be no state aid; or

ii) criteria which the Commission uses to determine that the aid is permissible; and

b) approach the European Commission so that the Commission may:

i) apply the principles in the Framework and decide that there is no state aid; or

ii) if the Commission decides that there is state aid, assess whether the aid is compatible with the internal market and should be permitted.

It can take a long time for the Commission to reach any decision and the Commission may well take the opportunity to look at other potential state aid issues.

Unless the participants in the project have the appetite to approach the European Commission for a decision under the Framework, the solution is to ensure that either:

a) there is no state aid because one of the State Aid Tests outlined above is not met; or

b) the terms of the project are such that any state aid complies with the conditions under which state aid is permitted without the need to notify the European Commission before the aid is granted. In practice that will mean complying with the de Minimis Regulation (see above) or the GBER (see below).

9.12 The general block exemption regulation (GBER)

Commission Regulation (EU) No 651/2014(PDF,651 KB) of 17 June 2014 declaring certain categories of aid compatible with the internal market in application of Articles 107 and 108 of the Treaty is available.

The GBER permits state aid if that aid falls within one of the 13 categories in the GBER (which include aid for research and development and innovation in section 4) without the need to notify the European Commission before the aid is granted if all the relevant conditions set out in the GBER are met.

Although aid under the GBER does not need to be notified to the Commission before the aid is provided, information about the aid must be sent to the European Commission within 20 working days after a scheme made under the GBER and approved by the Commission comes into force or ad hoc aid (that is aid not made under an approved scheme) is granted under the GBER.

The GBER does not apply to aid unless:

• the aid is transparent (if the aid is not in the form of a cash grant, the gross grant equivalent must be calculated)
• there must be an incentive effect (see below)
• only eligible costs are funded
• only a specified percentage of the eligible costs (known as the aid intensity) is funded
• aid over a certain amount (the maximum amount) is not granted

Please see Appendix B for details of the eligible costs, the aid intensities and the maximum amounts permitted under the GBER for research and development and innovation.

In the case of aid to an SME, an incentive effect is presumed by the GBER if the beneficiary submits the application for aid (containing the information in Article 6 of the GBER) before the activity or project starts. In the case of a large enterprise, the beneficiary must submit the application for aid before the activity or project starts and, before any aid is granted, the beneficiary must prepare documentation which establishes at least one of the following:

• a material increase in the scope of the project/activity as a result of the aid
• a material increase in the total amount spent by the beneficiary on the project/activity as a result of the aid
• a material increase in the speed of completion of the project/activity

Further Information on state aid can be found at:

• State Aid in Research, Development & Innovation: A Guide for Universities
• The draft Commission Notice on the Notion of State aid (PDF,887 KB)
• Guidance issued by BIS on the GBR
• Compilation of State aid rules in force

9.13 Annex A: Aid for research and development and innovation

Eligible Costs - Annex I of the R&D&I Framework
Aid for R&D projects	(a) Personnel costs: researchers, technicians and other supporting staff to the extent employed on the project. (b) Costs of instruments and equipment to the extent and for the period used for the project. If such instruments and equipment are not used for their full life for the project, only the depreciation costs corresponding to the life of the project, as calculated on the basis of good accounting practice, are considered as eligible. (c) Costs of buildings and land, to the extent and for the period used for the project. With regard to buildings, only the depreciation costs corresponding to the life of the project, as calculated on the basis of good accounting practice are considered as eligible. For land, costs of commercial transfer or actually incurred capital costs are eligible. (d) Cost of contractual research, knowledge and patents bought or licensed from outside sources at arm’s length conditions, as well as costs of consultancy and equivalent services used exclusively for the project. (e) Additional overheads incurred directly as a result of the project. (f) Other operating expenses, including costs of materials, supplies and similar products incurred directly as a result of the project.
Aid for feasibility studies [footnote 7]	Costs of study.
Innovation aid for SMEs	(a) Costs for obtaining, validating and defending patents and other intangible assets. (b) Costs for secondment of highly qualified personnel from a research and knowledge dissemination organisation or a large enterprise, working on R&D&I activities in a newly created function within the beneficiary and not replacing other personnel. (c) Costs for innovation advisory and support services.

Aid Intensity – Annex II of the R&D&I Framework
	Small enterprise	Medium-sized enterprise	Large enterprise
Fundamental research	100 %	100 %	100 %
Industrial research	70%	60%	50%
-subject to effective collaboration between undertakings (for large enterprises cross-border or with at least one SME) or between an undertaking and a research organisation; or - subject to wide dissemination of results	80%	75%	65%
Experimental development	45%	35%	25%
- subject to effective collaboration between undertakings (for large enterprises cross-border or with at least one SME) or between an undertaking and a research organisation; or - subject to wide dissemination of results	60%	50%	40%
Aid for feasibility studies	70%	60%	50%
Innovation aid for SMEs	50%	50%	N/A

If the aid is strictly limited to the minimum necessary, the Commission may allow higher maximum aid intensities than those laid down in Annex II, up to the following levels:

	Small enterprise	Medium-sized enterprise	Large enterprise
Fundamental research	100 %	100 %	100 %
Applied research (industrial research or experimental development)	80 %	70 %	60 %
- subject to effective collaboration between undertakings (for large enterprises cross-border or with at least one SME) or between an undertaking and a research organisation; or - subject to wide dissemination of results	90%	80%	70%

9.14 Appendix B: Aid for research and development and innovation (Article 25 and following of the GBER)

Eligible costs

• personnel costs (researchers, technicians and other supporting staff to the extent employed on the project
• costs of instruments and equipment to the extent and for the period used for the project. Where they are not used in the project throughout their life, only the depreciation costs for corresponding to the life of the project, as calculated on the basis of generally accepted accounting principles are eligible
• costs for of buildings and land, to the extent and for the duration period used for the project. With regard to buildings, only the depreciation costs corresponding to the life of the project, as calculated on the basis of generally accepted accounting principles are eligible. For land, costs of commercial transfer or actually incurred capital costs are eligible.
• costs of contractual research, knowledge and patents bought or licensed from outside sources at arm’s length conditions, as well as costs of consultancy and equivalent services used exclusively for the project;

The eligible costs for feasibility studies are the costs of the study.

The part of the project for which aid is granted must be:

• fundamental research
• industrial research
• experimental development
• a feasibility study

All eligible costs must be allocated to one of the above categories.

Maximum Amounts
predominantly fundamental research	predominantly industrial research	predominantly experimental development	Feasibility Study
€40 million per undertaking per project	€20 million per undertaking per project	€15 million per undertaking per project	€7.5 million per study

Aid Intensity
	small enterprise	medium enterprise	large enterprise
fundamental research	100%	100%	100%
industrial research	70%	60%	50%
experimental development	45%	35%	25%
feasibility studies	70%	60%	50%

The aid intensities for industrial research and experimental development may be increased up to a maximum of 80 % of the eligible costs by 15 percentage points if one of the following conditions is fulfilled:

i) the project involves effective collaboration:

• between undertakings among which at least one is an SME, or is carried out in at least two Member States, or in a Member State and in a Contracting Party of the EEA Agreement, and no single undertaking bears more than 70 % of the eligible costs; or
• between an undertaking and one or more research and knowledge-dissemination organisations, where the latter bear at least 10 % of the eligible costs and have the right to publish their own research results;

ii) the results of the project are widely disseminated through conferences, publication, open access repositories, or free or open source software.

The aid intensity for each beneficiary (e.g. the collaborators in a research project) must be established.

The contribution of a university to a project may be state aid. Therefore the combined aid (from all public sources) and the university’s/universities’ contributions may not exceed the applicable aid intensity for each beneficiary.

10. The decision guide

The decision guide has been structured as a series of questions to help identify:

• whether the Project is Contract Research and should be channelled through a subsidiary company
• the relative importance of the Results to the Collaborator and the Project’s reliance on the Collaborator’s Background
• the importance of Academic and Research use and Academic Publication to the Institution and its researchers
• the importance of the Project to future research at the Institution

By combining the responses to these questions, it is possible to identify which of the two party Collaboration Agreements may be the most appropriate starting point.

If the Project is of critical importance to the Collaborator, and cannot take place without using the Collaborator’s Background, Collaboration Agreement 4 or 5 may be the most appropriate.

If it is important for the Institution to own the IPR, Collaboration Agreements 1-3 will be most appropriate.

Where Academic Publication would have a serious impact on the competitive position of the Collaborator and the Collaborator wishes to ensure that Publication does not take place, Collaboration Agreement 5 will be most appropriate.

In this way the decision guide provides a starting point for negotiation based on the situation of the Institution and the Collaborator, rather than focusing on ownership of any IPR per se.

The decision guide is for use with the two party Collaboration Agreements. There is no decision guide for the multi-party Consortium Agreements because there are too many possible permutations.

1. Effective collaboration is where at least two independent parties undertake a project where they pursue a common objective based on the division of labour and jointly define its scope, participate in its design, contribute to its implementation and share its financial, technological, scientific and other risks, as well as its results, there will be ‘effective collaboration’. One or several parties may bear the full costs of the project and so relieve other parties of its financial risks. Contract research and the provision of research services are not forms of collaboration. ↩

2. In contract research the undertaking typically specifies the terms and conditions of the contract, owns the results of the research and carries the risk of failure. ↩

3. If the university provides a specific service for the first time on behalf of a given undertaking, on a trial basis and during a clearly limited period of time, the Commission will normally consider the price charged to be the market price where that contract research is unique and it can be shown that there is no market for it. ↩

4. Experimental or theoretical work undertaken primarily to acquire new knowledge of the underlying foundations of phenomena and observable facts, without any direct commercial application or use in view. ↩

5. The planned research or critical investigation aimed at the acquisition of new knowledge and skills for developing new products, processes or services or for bringing about a significant improvement in existing products, processes or services. It comprises the creation of components parts of complex systems, and may include the construction of prototypes in a laboratory environment or in an environment with simulated interfaces to existing systems as well as of pilot lines, when necessary for the industrial research and notably for generic technology validation. ↩

6. Acquiring, combining, shaping and using existing scientific, technological, business and other relevant knowledge and skills with the aim of developing new or improved products, processes or services. This may include activities aiming at the conceptual definition, planning and documentation of new products, processes or services. Experimental development may comprise prototyping, demonstrating, piloting, testing and validation of. new or improved products, processes or services in environments representative of real life operating conditions where the primary objective is to make further technical improvements on products, processes or services that are not substantially set. This may include the development of a commercially usable prototype or pilot which is necessarily the final commercial product and which is too expensive to produce for it to be used only for demonstration and validation purposes. Experimental development does not include routine or periodic changes made to existing products, production lines, manufacturing processes, services and other operations in progress, even if those changes may represent improvements. ↩

7. The evaluation and analysis of the potential of a project, which aims at supporting the process of decision-making by objectively and rationally uncovering its strengths and weaknesses, opportunities and threats, as well as identifying the resources required to carry it through and ultimately its prospects for success. ↩