Data and legislation

"Two forces are currently impacting the research community - the need to protect individual privacy regarding information and the push towards open access to data - and the outcomes are not yet clear." - Barbara Jasny(1)

  Main points

Until recently, access to research data in the Netherlands was only regulated by The Netherlands Code of Conduct for Academic Practice(2). This code demands raw research data to be saved for a minimum of ten years and made available to third parties upon request.
In 2011, the NWO (Netherlands Organisation for Scientific Research) substantially expanded the drawn-up principles. Scientists with an NWO grant are now required(3) to disclose their data for further scientific research, even after these ten years.

Granting access to research data is not enough to be actually allowed to use the data. The information below shows the rights and obligations that you as a data generator and data user may encounter (cf. the report ‘The legal status of raw data: a road map for research practice'(4)).


Data in a database can be partially or completely protected under copyright laws. This concerns the content. The database may contain copyrighted texts or images. For copyrighted materials, you could think of a scientific article, a movie or a book. Someone who writes, draws, photographs, composes or produces something owns the fully automatic copyright to their ‘work’ or ‘intellectual creation’ until seventy years after their death. For copyright to apply, the ‘work’ must be made in an original form and contain a personal dimension. ‘Original’ in this sense means that the work is not a (partial) copy of another work. The work may resemble another work, but this must be the result of chance. A personal dimension means that creative choices were made and that it is impossible that two creators would have arrived at the same work.

For example: If you put naked facts in a table, copyright does not apply. Any other researcher could have made that table. A selection or organisation of facts can be protected under the database act if it concerns a selection or organisation with a personal dimension.

Who is the copyright holder when copyright does apply? In principle it is the person who came up with the work. However, there are exceptions:

  • if the work was created as part of employment, the copyright falls to the employer.
  • if the party commissioning the study stipulates in the contract that copyrights and/or database rights are transferred to them.
    This is, for example, what the NWO arranged for in its grants.(3)
Database rights

In principle, there is no copyright(4) on raw research data (naked facts). Facts are free. Only the shape or form that the facts are processed in is liable for protection. This can actually occur quite quickly, even in scientific research, as there is always some kind of organisation of these ‘naked facts’. This means that, even though the naked facts are free, you could still encounter database rights.

Database has nothing to do with creativity or originality of the contents of the database. It is solely meant to protect those who invested time and/or money to collect the data and make it available. For such databases, you need permission for requesting and reusing a substantial part of the database and/or repeatedly requesting a non-substantial part of the database.

See also 'A brief guide to determining what consent is necessary to reuse someone else’s research data' [pdf].(5)

Private copy, right to quote and impersonal protection of writing

Imagine you want to use not only the naked facts but a copyright-protected form of research data as well. In those cases, you’ll only need the creator’s permission if you intend to publish and/or duplicate. You do not need permission for a private copy for your personal use or study.

You can furthermore always invoke a right to quote, but you may not quote more than absolutely necessary for your goals, and you must report the name of the author and the source of the quote.

There is a specific Dutch obstacle that may obstruct the sharing of research data, the so-called impersonal protection of writings (onpersoonlijke geschriftenbescherming, Dutch legislation). When copyright and database right don’t apply, you could still encounter this regulation. This protection is solely meant to prevent unprotected materials from being copied. The Dutch government recently announced the intention to scrap this regulation, which would benefit sharing/reusing scientific data.



Privacy and personal data

How to handle the publishing of research data containing personal data?

Privacy can be an obstacle in making research data freely available. In the Netherlands, it involves the Dutch Data Protection Act (Wet Bescherming Persoonsgegevens (Wbp) in Dutch).(6) This act is translated into research practice by the Code of Conduct for the Use of Personal Data in Scientific Research (Gedragscode voor gebruik van persoonsgegevens in wetenschappelijk onderzoek(7) (Dutch only)).


The personal data of test subjects/interviewees/patients used in data sets may, in principle, only be published with the explicit consent of the people concerned. Within interview projects, for example, every interviewed person and every interviewer must give their permission for the publication of the interview. Any photographs may only be published under conditions (see the 'Photographs and portrait rights'(8) (Dutch) on the Ius Mentis blog).

As a researcher or data archive you can ask the test subject for permission, but the question then becomes: what exactly are you asking permission for? (cf. the section Licence agreements). Asking permission only for storage doesn’t suffice. You must also gain consent for processing the data with a certain objective in mind. It is therefore vital to have a broadly formulated objective description for which you request permission, allowing for unexpected future usage to also fall within the permission. The interviewee must at least know what their personal data will be used for. This is called informed consent.

In certain cases one can decide to publish without the proper consent of the interested parties. This will involve a weighing of interests. Does the social or scientific interest outweigh the possible damage to individuals?

  Case privacy and personal data


Click to open/close


  1. Jasny, B.R. (2013). Realities of data sharing using the genome wars as case study - an historical perspective and commentary. EJP Data Science. 2:1. Retrieved from 
  2. VSNU. (2014). The Netherlands Code of Conduct for Academic Practice. Retrieved from
  3. NWO. Regulation on granting. Retrieved from
  4. SURF (2009). The legal status of raw data: a guide for research practice. Retrieved from
  5. SURF. A brief guide to determining what consent is necessary to reuse someone else’s research data. Retrieved from
  6. CBP. Dutch Data Protection Act. Retrieved from
  7. VSNU. Gedragscode voor gebruik van persoonsgegevens in wetenschappelijk onderzoek. Retrieved from
  8. Engelfriet, A. (2013, January 27). Foto's en het portretrecht.  Retrieved from
  9. DANS. Oral history website getuigenverhalen online. Retrieved from
  10. Tjalsma. H. Rapport m.b.t. de authenticiteit en juridische aspecten van de kerncollectie Getuigen Verhalen. Retrieved from
  11. van Dongen, B.F. (2011). Real-life event logs - Hospital log. Eindhoven University of Technology. [dataset].

Additional reading