Rights Management (CPP-020)

Definition and scope

Rights Management is the process of performing rights assessments for Objects and Metadata preserved by the TDA, and managing a rights registry that describes rights basis applicable to these. The rights assessment process must investigate and, if possible, obtain rights applying to both the TDA for retaining and performing its preservation activities, and the consumer for accessing and reusing the Objects.

The entity responsible for creating rights statements is the TDA, based on input from the rights stakeholders. Managing rights can be complex and involve multiple and conflicting perspectives. For example, a TDA will typically seek the rights to preserve its holdings and provide open access to the widest possible community, but it also needs to respect rights that limit what it can do and what access it can provide (e.g. data privacy under GDPR). This adds extra complexity, for example a TDA will often be a data processor for the data it is holding and providing access to on behalf of others, but it may also be a data controller if ownership has been assigned to it or if it is directly involved in data collection. Furthermore, in order to perform its mission, it may collect further data about its users (e.g. to allow it to better understand and meet the needs of its designated community) and this usage data also has rights associated with it.

The process of rights assessment consists in determining the rights status of a specific Object or Metadata regarding different rights basis. Rights basis, as defined as PREMIS, are of different types:

• Copyright and intellectual property
• Laws
• Licenses
• Patents
• TDA institutional policies
• Contracts and service level agreements with the TDA partners
• Etc.

The output of rights assessment is a rights statement that defines:

• The rights basis applicable to the Object and Metadata;
• The period of time during which the Object is governed by said rights basis;
• The rules these rights basis prescribe.

Rules are actions (e.g. migrate, give access to, reuse, share, etc.) allowed, prohibited or required by a certain agent (e.g. rights holder, grantor, data controller etc.) to a certain agent (i.e. assignee), and conditions or restrictions limiting the scope of such rules. Among these actions, retention is a crucial one that might be limited in time as Objects may be subject to a retention schedule. After that time they can become a liability and may be deleted.

The output of Rights Management is used to define the rights of the TDA to perform several other processes. Only the most obvious ones are mentioned as direct customers for the rights statement: Ingest, Enabling Access, Format Migration, Normalisation, File Repair, Enabling Discovery, and Disposal. In other words, TDAs must ensure to obtain the right to perform preservation actions from laws, licenses or explicit rights assignment from rights stakeholders (i.e. rights holders, data subjects, data controllers, regulators, funding bodies, etc.). They should also clarify to their consumers the actions they are allowed to perform with the Objects. This implies that TDAs must provide rights statements to the consumers.

Although Rights statements are commonly attached to Intellectual Entities (IE), they may also apply to specific Representations of such IEs. They should also apply to all Metadata provided to internal users or consumers, in particular to discovery Metadata. This is especially important in cases where the Metadata contains personal data. Complying with the restrictions set in rights statements forms a part of how a TDA manages information security.

Rights management, as the production of rights statements, is a recurrent activity. A minimal rights assessment must be performed at the ingest phase, but a more comprehensive assessment may be postponed to a later time in the Object’s life cycle, in particular, when a request for access is made to the TDA. In some cases the outcome of a rights assessment process triggers a TDA to facilitate the update and management of Metadata (e.g. cases where data must be pseudonymised or anonymised) or even disposal, if the legal basis for preserving the data has changed. External events can also trigger rights re-assessment activities (e.g. legislative holds for compliance reasons, changes in consent, or notifications of possible infringement for example copyright). In other cases, rights management can trigger or schedule changes in access given to Objects for a designated community (e.g. embargoes and leases on research data). A lease is the opposite of an embargo. An embargo restricts access until a given time, for example a dataset can be publicly accessible but only after a given date. A lease says that a dataset can be made accessible but only before a given date and afterwards access is restricted or removed. Likewise, rights may inform retention schedules that trigger future events such as transfer or disposal. Therefore, it is important that the temporal aspect of rights are properly tracked and managed.

A single rights basis usually applies to several Objects or Metadata (e.g. a Creative Commons license). Thus, the Rights Management process also consists in managing a rights basis registry.