We recommend that companies interested in collaborating around data, undertake a six-step process for planning a data sharing arrangement via data trusts. This should be progressed in parallel and aligned with a more technical and operational focussed workstream which will look at the structure, format and quality of data.
Define the objective
The first step construction companies should take is to establish a clear and comprehensive objective which can be referred to when making decisions about how the data trust is to be established. Thought should be given to:
- The purpose of the arrangement? For example, whether it is for research, regulatory compliance or commercial benefit.
- The types of data that will be shared? For example, personal data, data about physical assets, or other information.
Identify the data provider stakeholders
Data sharing arrangements only work as intended if they are attractive to participate in for the intended data providers. Questions to ask yourself include:
- Who are the intended data providers now and into the future and can they be “categorised” by common characteristics?
- Does the nature of the data providers give rise to any regulatory, legal or other special considerations?
- What are the risks and concerns in connection with the data sharing for the providers and how will they be incentivised or remunerated for data sharing?
Identify the data user stakeholders
The third step is to identify the data users. Relevant questions to consider will include:
- Who are the intended data users now and into the future and can they be “categorised” by common characteristics?
- Does the nature of the data users give rise to any regulatory, legal or other special considerations?
- How will data be accessed by the users and will they have any specific concerns over the access and use of data that need to be accommodated?
Consider a data custodian
Data sharing arrangements may be enabled through the appointment of a central custodian to manage the arrangement, making decisions and granting access to data users in accordance with any agreed rules. It is recommended to consider:
- Additional responsibilities the custodian should be subject to. For example, due diligence, technical assurance, operational and technical decisions, access control etc.
- The legal nature and composition of the data custodian. What is the nature of the custodian? Will it require the establishment of a new legal entity?
Establish any rules of participation
The rules of the data sharing arrangement are most likely to be set out in the documents enshrining the rights and obligations of the stakeholders and form part of the formal legal/contractual relationship. The following should be considered:
- Objective and scope of dealing;
- Collective obligations;
- Specific obligations, including the obligations of the data custodian;
- Board of directors – power and responsibilities;
- Becoming and ceasing to be a member – requirements to be a data provider or data user;
- Categories of membership
- Termination and suspension of members
- Commercial arrangements
- Liability of each party
- Reliance
- Conduct of claims
- Decision making – voting rights
- Change control
- Dispute resolution procedure and potential for use of data for e-discovery and litigation
- Third party policy adherence
- Intellectual property rights
- Confidential information
- Compliance with laws and regulations, including data protection and competition
Define any rights and obligations between stakeholders
While data sharing arrangements are unlikely to require the establishment of a standalone legal entity, the detail of the relationship between the data providers, the data custodian and the data users may be enhanced by the use of judicious contractual regulation across the stakeholders.
The detail of the regulation will depend on the earlier considerations on the objective, providers and users and the rules to apply. It should be considered on a case-by-case basis against all of these parameters.
If it is appropriate to establish a separate corporate vehicle for the data sharing purpose, there is also likely to be a need for contractual arrangements. However, this will be in addition to the corporate documentation and governance underpinning the special purpose organisation.
In each case, the preferred rights and obligations to be agreed will be driven heavily by issues of accountability and liability between the parties. Appropriate guidance for stakeholders should be prepared to assist in the successful implementation in accordance with the shared vision.