June 10, 2019
Ver. 5.0

Introduction

An enormous amount of human data is being generated as advancements are made in analytical techniques such as next-generation sequencing. Rules and systems are therefore needed for storing such data in an organized manner and for effectively utilizing them to make progress in life sciences and to improve public health.

To promote sharing and utilization of human data for the above purposes while considering protection of personal information, the National Bioscience Database Center (NBDC) of the Japan Science and Technology Agency (JST) established a platform for sharing various human-related data (hereinafter, the NBDC Human Database) and developed rules and guidelines (hereinafter, the Guidelines) for operating it.

The Guidelines are designed to be applied to human data in general that were generated using public funds. Because the relevant guidelines, policies, and laws are amended as necessary to appropriately reflect, the consistency has not been verified between the Guidelines and all of them. In addition, global trends concerning life science data as well as the attitude of the general public toward scientific data are expected to change. To respond to such changes, the Guidelines are reviewed and revised whenever it becomes necessary.

Contact information:

For information on the Guidelines

NBDC Data Sharing Subcommittee Office
https://humandbs.biosciencedbc.jp/en/contact-us

For information on data use or data submission for the NBDC Human Database

NBDC Human Data Review Board Office
https://humandbs.biosciencedbc.jp/en/contact-us

Contents

1. Principles
2. Definitions
3. Acceptable Data
4. Data Submission to the NBDC Human Database
5. Using Data in the NBDC Human Database
6. Procedure for Revising the Guidelines
7. Other Topics

1. Principles

1. The NBDC Human Database is administered toward the following goals.
   • 1: Collecting human data generated using public funds as much as possible
   • 2: Promoting wide sharing of collected data
   • 3: Respecting to the greatest extent possible the rights of individuals who are research subjects
2. The NBDC performs the following in administering the NBDC Human Database.
   1. Maintaining the Guidelines and reexamining them as the need arises
   2. Reviewing applications for data use and data submission
   3. Maintaining a means to access data, e.g., website maintenance

2. Definitions

1. Human data
   • Data generated as a result of a study using human-derived specimens. Such data include genomic and genetic information, clinical information, image information, and so on.
2. Public funds/grants
   • Funds provided by national and local governments, incorporated administrative agencies, and equivalent organizations.
3. Research subject
   • A person who has provided a sample such as his/her own tissue, blood and urine, or his/her own data, for an activity such as a study or research project.
4. Data submitter
   • A principal investigator (hereinafter, PI), who provides human data to the NBDC Human Database.
5. Data user
   • A PI and his/her research collaborators, who use human data from the NBDC Human Database. Research collaborators must belong to the same organization as the PI, and have been registered as data users in the application (Form 2 / Form 7) for data use filed by the PI.
6. Principal investigator (PI)
   • An investigator responsible for the study. (The investigator who submitted a research protocol to the Ethical Review Committee of his/her affiliated or an equivalent organization and obtained its approval, or a research collaborator who is listed in the application for the ethical review of the study.)
7. Unrestricted-access data
   • Data available for use without any access restrictions. Examples include statistical data or reference data previously disclosed in a published paper.
8. Controlled-access data
   • Data available only to investigators for use for research purposes. The access-granted investigators must have research experience in related studies and can use the data for their studies, after clarifying information such as the purpose of data use and data users. For use, approval is required at the review by the NBDC Human Data Review Board. Controlled-access data include individual data like nucleotide sequence data containing an output from next-generation sequencer, genome-wide variant data, image information, answers to a questionnaire, and so on.
9. Data for future release
   • Data that are planned to be released as unrestricted-access data or controlled-access data after the data submitter makes the results public, e.g., by publication of a paper, acquisition of intellectual property rights, and so on.
10. Secondary data
    • Data that are processed not to be able to restore primary data.
11. Available server outside of affiliated organization (“Off-premise-server”)
    • A server that is not owned by data users’ affiliated organization and that is available to the data users to store and/or process controlled-access data, which “off-premise-server” has a computing environment for analyzing human data. The computing environment is owned by an organization that has concluded with JST/NBDC a memorandum concerning operation including the compliance with the NBDC Security Guidelines for Human Data (for Database Center Operation Managers and “Off-Premise-Server” Operation Managers). In addition, and measures necessary for high level (Type II) security are being implemented in the “off-premise-server.”
      (“Off-premise-server”: http://humandbs.biosciencedbc.jp/en/off-premise-server)

3. Acceptable Data

Overview of acceptable data

The NBDC Human Database accepts a wide range of human data generated in projects that receive public funds. Because this database is aimed for data utilization among many investigators, it cannot be used as a repository for data shared among only limited collaborators of a research group or a consortium. Therefore, data that are provided for such a purpose cannot be accepted.

Data are classified into the following three types according to the state of data release and the level of access restriction (see the figure below).

1. Unrestricted-access data
2. Controlled-access data
3. Data for future release

The NBDC Human Database accepts: 1) unrestricted-access data, 2) controlled-access data, and 3) data for future release. The NBDC Human Database accepts only these data that have been pseudonymized by the data submitter by replacing a part or all of personal information which enable identification of a specific individual (including a specific deceased individual) with descriptions, e.g., a code or number which is unrelated to the specific individual, and then by assigning another code or number again.

4. Data Submission to the NBDC Human Database

4.1 Rights of the Data Submitters

1. Data submitters can designate data use restrictions that conform to those specified in the informed consent form (e.g., limitation on the scope of diseases for data use).
2. Data submitters, while being asked to agree with prompt release of their data, can request that the data be designated as data for future release for the purpose of publication of research results, acquisition of intellectual property rights, etc. It is noted, however, the release may be delayed only for a term reasonable and necessary for such purposes. Concrete details are determined in a consultation with the NBDC Human Data Review Board.

4.2 Responsibilities of Data Submitters

1. The data submitter must obtain permission from the head of his/her affiliated organization after taking the following steps: (1) Explain the required descriptions in the “Examples of Content for Informed Consent Forms” (shown below) to a research subject from whom the human data are collected; (2) Obtain written consent from the research subject regarding submission of the data to databases and sharing of the data by domestic and/or foreign investigators; and (3) Obtain approval regarding such data submission and data sharing from the Ethical Review Committee of the affiliated or an equivalent organization. However, if the data submission and data sharing were approved for the entire research project after an ethical review conducted at the start point of the project, then another review is not required.
2. When the data submitter provides data to the NBDC human database collected from specimens, e.g., human biological specimens, diagnostic specimens, that were obtained without prior intention to submit such data to databases (e.g., in cases where the informed consent form does not refer to data submission or data sharing), the data submitter must follow procedures that conform to the ethical guidelines that must be complied with in conducting the research (for example, the data submitter obtain re-consent. Alternatively, if it is difficult to do re-consent, he/she must ensure information disclosure and opportunities of rejections (opt-out), and obtain permission from the head of his/her affiliated organization after obtaining approval of the Ethical Review Committee of the affiliated or an equivalent organization).
3. When the data submitter provides data that is clearly not the subject of “Ethical Guidelines for Human Genome/Genetic Analysis Research” or “Ethical Guidelines for Medical and Health Research Involving Human Subjects” ^*[1] to the NBDC Human Database, the data submitter must submit a “statement requesting a simplified review of application for data submission” (in an arbitrary format) signed by the PI (see, examples). Submission of this statement can be a substitute for submission of documents concerning ethics review of the affiliated organization (e.g., research protocol, informed consent form, and notice of approval).
   *[1]: In “Ethical Guidelines for Human Genome/Genetic Analysis Research,” a tissue, cell, body fluid and excrement as well as DNA and so forth extracted therefrom, whose scientific value is fixed and, at the same time, whose research achievements are fully recognized, and which is used commonly and broadly in research and is commonly available. In “Ethical Guidelines for Medical and Health Research Involving Human Subjects,” specimens and information, the value of which has already been established academically, widely utilized in research and generally available.
4. While the NBDC Human Data Review Board reviews the descriptions of the informed consent form submitted at the time of application for data submission in terms of the consistency with the restrictions on data use, the data submitter is responsible for ensuring that the data are provided in accordance with the conditions of the consent.
5. The data submitter must provide data according to the content of the Application Form for Submitting Data to the NBDC.
6. The data submitter must confirm that the data to be submitted have been pseudonymized by replacing a part or all of personal information which enable identification of a specific individual (including a specific deceased individual) with descriptions, e.g., a code or number which is unrelated to the specific individual and further by assigning another code or number. In case of withdrawal of consent, in order to delete the data derived from the corresponding research subject, in principle, the data submitter must keep the decoding index.
7. After selecting the type of data such as unrestricted-access data, controlled-access data, or so on based on consultation with the NBDC Human Data Review Board, the data submitter must provide the NBDC with the data along with any necessary accompanying data (e.g., metadata that explain the main data, as well as information needed for quality control). In addition, for controlled-access data, the data submitter must designate an appropriate security level (Type I or Type II) based on consultation with the NBDC Human Data Review Board.
8. In case the data registered by the data submitter is found to be data that violate the NBDC Human Data Sharing Guidelines etc. or found to be data that contain a defect (including hidden defects) intentionally or with negligence, the NBDC will suspend publication of the registered data. The data submitter must re-register the data within a certain period of time after fixing data and/or necessary procedures. If re-registration is not done, the NBDC will cancel the accession number for the data.
9. When there is a rejection by opt-out or a withdrawal of consent from a research subject from whom the data provided to the NBDC Human Database were derived, the data submitter must cooperate in the disposal of the data in order to avoid subsequent data use.

In case the data submitter provided human data in violation of the NBDC Human Data Sharing Guidelines etc., or provided human data that contain a defect (including hidden defects) intentionally or with negligence, the NBDC may take one or more further actions such as reporting of the fact to the head of the organization to which the data submitter belongs, announcing of the fact on the website etc., and so on. Besides, the NBDC may seek compensation from the data submitter, if the NBDC determines that due to these reasons it has suffered damages such as inability of operation of “the NBDC Human Database” as stated in the section “1. Principles.”

4.3 Procedure for Data Submission to NBDC Human Database

1. The data submitter confirms that the responsibilities listed in the above section “4.2 Responsibilities of Data Submitters” are fulfilled.
2. The data submitter consults and agrees with the NBDC Human Data Review Board Office, with regard to the data classification (unrestricted-access data or controlled-access data), the timing of release in the case of data for future release, and so on.
3. The data submitter applies for data submission in accordance with the procedure for data submission application. At the time of application, a copy of the research protocol (the application form for ethical review), a copy of the ethical review approval notification, and the informed consent form must be attached. If, however, data submission and data sharing have been approved by an ethical review or equivalent examination held at the beginning of the entire research project, a document indicating that fact may be used instead of a copy of the approval notification.
4. The NBDC Human Data Review Board decides whether the data can be accepted.
5. When the data submission application is approved, the data submitter prepares the data set to be provided (unrestricted-access data and/or controlled-access data).
6. The data submitter sends the data with required accompanying data as instructed by the NBDC.
7. Changes to data, such as those due to updating or reclassifying the data, are made as the need arises based on consultation between the data submitter and the NBDC Human Data Review Board Office.

5. Using Data in the NBDC Human Database

5.1 Eligibility for Data Use

5.1.1 Unrestricted-access data

Anyone can use unrestricted-access data.

5.1.2 Controlled-Access Data

An investigator can apply for data use as the PI if he/she satisfies the data user requirements indicated in the limitation added for each data set. When applying for data use, the investigator must present the mail address issued by his/her affiliated organization.

1. An investigator who has research experience in relevant studies (one who belongs to a university, public research institute, private-sector company or the like and who have research experience in conducting relevant studies). The use is limited to academic research or research that contributes to improvement of public health. At the time of application, publications related to the data that the investigator plans to use must be presented.

5.2 Rights of Data Users

5.2.1 Unrestricted-access data

1. Data users can freely make the result of the study for which data from the NBDC Human Database are used public, as long as the responsibilities of data users and the limitation added for each data set are fulfilled.
2. Data users can freely acquire intellectual property rights based on the result of the study for which data from the NBDC Human Database are used, as long as the responsibilities of data users and the limitation added for each data set are fulfilled.

5.2.2 Controlled-Access Data

1. Data users can freely make the result of the study for which data from the NBDC Human Database are used public, as long as the responsibilities of data users and the limitation added for each data set are fulfilled.
2. Data users can freely acquire intellectual property rights based on the result of the study for which data from the NBDC Human Database are used, as long as the responsibilities of data users and the limitation added for each data set are fulfilled.
3. Data users can download, store, and use the data from the database center in the designated area of an “off-premise-server,” in addition to the data server connected to the affiliated organization LAN.

5.3 Responsibilities of Data Users

5.3.1 Unrestricted-access data

1. In using data, the data user must utilize the data with his/her own responsibility and evaluation of the quality, content, and scientific validity of the data.
2. The data user must comply with the following rules.

   Basic rules to be complied with in using data

   • The use of data is limited for research purposes only.
   • Identification of individuals is prohibited.
   • The latest data should be downloaded and used.
3. When the research results including data downloaded from the NBDC Human Databases (the DDBJ Sequence Read Archive, the NBDC Human data Archive, the Genomic Expression Archive, and so on) are made public in a publication or a presentation, the data user must state the accession number of the data set used. In addition, a statement such as the following** must be included as reference to the paper in which the data set was originally reported, or as acknowledgment.

   ** Example of acknowledgement

   (A part of) The data used for this research was originally obtained by AAAA research project/group led by Prof. /Dr. BBBB and available at the website of the National Bioscience Database Center (NBDC; http://biosciencedbc.jp/) of the Japan Science and Technology Agency (JST).

5.3.2 Controlled-Access Data

1. In using data, the data user must utilize the data with his/her own responsibility and evaluation of the quality, content, and scientific validity of the data.
2. The data user must take data with full responsibility (including responsibilities to third parties) for using data. The data user should understand that his/her responsibility will be extended to the head of his/her affiliated organization in case any problem occurs in data management and handling.
3. When using controlled-access data contained in the NBDC Human Database, the data user must comply with the “Ethical Guidelines for Human Genome/Gene Analysis Research” in Japan.^*[2] That is, the data user must go through a review by the Ethical Review Committee of his/her affiliated or an equivalent organization, with regard to the use of the NBDC Human Database, and obtain approval from the Ethical Review Committee. The application form for ethical review (the research protocol) must contain statements that are equivalent to the following.

   Examples of Content of Application Form for Ethical Review (research protocol)

   Descriptions included in the application form for ethical review

   Required description

   • Data contained in the NBDC Human Database (e.g. JGAS***********/hum******) are used for analysis in this research.
   • *[2]: “Ethical Guidelines for Human Genome/Gene Analysis Research” in Japan
     • Section 5: Handling of Specimens/Information
     • 15. Use of Existing Specimens/Information from External Institutions
     • (1) In cases where research is to be conducted using an existing specimen/information received from an external institution (excluding where the specimen/information is collected and distributed), the principal investigator shall include in the research protocol details of the existing specimen/information being donated and the need for receiving the donation, and shall obtain authorization of the ethical review committee and approval of the director of the research institution.
4. The data user must comply with the following rules.

   Basic rules to be complied with in using data

   • The data users must be limited. (Access is granted only to the PI and his/her research collaborators who belong to the same organization as the PI.)
   • The purpose of data use must be explicitly stated.
   • The use of data for purposes other than those stated in the application is prohibited.
   • The use of data is limited for research purposes only.
   • Identification of individuals is prohibited.
   • Redistribution of data is prohibited.
5. The data user must securely handle data, complying with the NBDC Security Guidelines for Human Data (for Data Users). Attention should be paid to the fact that the security level to be maintained varies for different data.* The data user must accept an audit conducted by the NBDC Human Data Review Board or a third party commissioned by the NBDC with regard to the state of implementation of security measures.

   * Security levels:

   Standard-level (Type I) security is required in principle, but high-level (Type II) security may be required based on consultation between the data submitter and the NBDC Human Data Review Board.For details on Type I and Type II security, see the NBDC Security Guidelines for Human Data (for Data Users).

6. The data user must establish a security control system depending on the security level (Type I, Type II) and submit Form 5 (Checklist for the NBDC Security Guidelines for Human Data) to the NBDC Human Data Review Board Office in order to demonstrate that the system conforms to the standards set forth by the NBDC.
7. The data user must follow the terms of each ”off-premise-server” use in addition to the NBDC Human Data Sharing Guidelines and the NBDC Human Data Security Guidelines when using the ”off-premise-server” for his/her data use.
8. Should a security incident such as data breach occur, the data user must immediately disconnect relevant devices from the network and report the incident to the NBDC. The data user must promptly implements post-incident measures, following instructions from the NBDC. When the “off-premise-server” is used, the data user must immediately take measures according to the terms of use etc.
9. When the data user is informed of withdrawal of consent, rejection by opt-out in relation to the data that he/she downloaded from the NBDC Human Database and is using, the data user must not use the relevant data thereafter.
10. When finished with using data, the data user must delete all data obtained from the NBDC Human Database (whole data, or any part of the data stored) and all the data that can restore the data in accordance with the NBDC Security Guidelines for Human Data, and report on the use (and deletion) of the data, using Form 3 (Report on the Use (and Deletion) of Controlled-Access Data). With regard to keeping secondary data (e.g., results of calculations or statistical analyses based on controlled-access data), see the section on the procedure for using controlled-access data (“5.4 Procedure for Data Use”; Subsection “5.4.2 Controlled-Access Data”). When the secondary data contains genetic data, the data must be properly managed as personal information and redistribution of the secondary data is prohibited.
11. When the research results including data downloaded from the NBDC Human Databases (the Japanese Genotype-phenotype Archive, the NBDC Human data Archive, and so on) are made public in a publication or a presentation, the data user must state the accession number of the data set used. In addition, a statement such as the following** must be included as reference to the paper in which the data set was originally reported, or as acknowledgment.

    ** Example of acknowledgement

    (A part of) The data used for this research was originally obtained by AAAA research project/group led by Prof. /Dr. BBBB and available at the website of the National Bioscience Database Center (NBDC; http://biosciencedbc.jp/en/) of the Japan Science and Technology Agency (JST).

    When the service of JGA was used, it is desirable to refer to the following paper: Nucleic Acids Res. 2015, 43 Database issue: D18-22.

12. The data user agrees that the NBDC may make certain statistical information or information about data user public upon release of the utilization conditions of the NBDC Human Database. Such information on data user that may be laid open includes the Dataset ID of the data used, the data user’s name, the data user's affiliated organization, the period of the data use, and the research title.
13. The data user agrees that, for the purpose of release of the utilization conditions of the NBDC Human Database, the NBDC holds information on data usage, including information on the data users that is obtained from the time of application to the time of reporting the end of data use and information gathered at the time of incidents.

In case the data user used human data in violation of the NBDC Human Data Sharing Guidelines etc., or caused information leakage etc. in using data intentionally or with negligence, the NBDC may take one or more further actions such as rescinding of permission for data use, reporting of the fact to the head of the organization to which the data user belongs, announcing of the fact on the website etc., and so on. Besides, the NBDC may seek compensation from the data user, if the NBDC determines that due to these reasons it has suffered damages such as inability of operation of “the NBDC Human Database” as stated in the section “1. Principles.” The above conditions are applied to not only the PI but also his/her research collaborators. The PI is responsible for his/her research collaborators' compliance with the Guidelines (this document) and the NBDC Security Guidelines for Human Data (for Data Users).

5.4 Procedure for Data Use

5.4.1 Unrestricted-access data

The data user can freely use unrestricted-access data available from the website for the NBDC Human Database (https://humandbs.biosciencedbc.jp/en/), as permitted under laws and regulations.

5.4.2 Controlled-Access Data

1. The data user applies for data use in accordance with the procedure of application for data use. If multiple investigators from different organizations conduct a collaborative study, an application for data use must be submitted for each organization.
2. After going through a review by the Ethical Review Committee of his/her affiliated or an equivalent organization with regard to the use of the NBDC Human Database and obtaining approval from the Ethical Review Committee, the data user submits, at the time of application for data use, a copy of a notification of permission obtained from the head of his/her affiliated organization. However, if the Ethical Review Committee decided to waive the review, the data user submits a document such as a notification of the fact.
3. At the time of application for data use, the data user submits Form 5 (Checklist for the NBDC Security Guidelines for Human Data) as well as other information and documents required by the NBDC Human Data Review Board.
4. The NBDC Human Data Review Board decides whether access to the controlled-access data may be granted.
5. After the NBDC Human Data Review Board approves the application for data use, information necessary for accessing data is provided. The data user accesses data with that information.
6. In principle, the data user reports on data use status in every August, using Form 3 (Report on the Use (and Deletion) of Controlled-Access Data). In addition, at the time of reporting, the data user resubmits Form 5 (Checklist for the NBDC Security Guidelines for Human Data). However, if the end of first August comes within six months from the starting date of the data use, the submission of the documents in that August is exempted.
7. When the data user needs to use the data set beyond the term originally stated in the application for data use, the data user may apply for continued data use by filing, at least a month before the original expiration day, a document such as the approval notification by the Ethical Review Committee of the affiliated organization or an equivalent organization (by which document the term approved can be confirmed) and a statement of desired term to be extended with the NBDC Human Data Review Board Office.
8. When the data use is finished, the data user must promptly delete all data (all data downloaded from the NBDC Human Database or all of the data if part of the data is stored) and all data that can restore the data according to the NBDC Human Data Security Guidelines and report his/her data use (and deletion) to the NBDC Human Data Review Board Office, using Form 3 (Report on the Use (and Deletion) of Controlled-Access Data). At the same time, the data user may apply for retention of secondary data (e.g., results of calculations based on controlled-access data) by submitting Form 4 (Application for Permission to Keep Secondary Data Derived from Controlled-Access Data) to the NBDC Human Data Review Board Office, and may retain the secondary data. Depending on the degree of data processing and the storage period, however, the application may be rejected.

5.5 Cost of Data Use

The data user bears costs incurred in connection with data use, if any (e.g., in cases where data media are needed for sending data or where an ”off-premise-server” is used).

5.6 Termination of Data Use

If the data user is suspected of a breach of any of responsibilities listed in the section “5.3 Responsibilities of Data Users” or the NBDC Security Guidelines for Human Data, the NBDC investigates the matter. The NBDC Human Data Review Board makes a judgement on whether there was any misconduct, based on the result of the investigation, and if it is determined that misconduct occurred, the JST/NBDC:

1. Orders the data user to stop using the data and revokes the permission to access the data set being used.
2. Do not accept, for a certain period, a new application for data use from the data user who committed the misconduct. This period is determined by the NBDC Human Data Review Board.
3. Report the misconduct to the head of the data user's affiliated organization, if necessary.

Depending on the situation, termination of data use may be ordered at the stage when suspicion is raised. Upon receiving an order to terminate data use, the data user must immediately delete all data that have been obtained and all secondary data. In addition, the data user must promptly report the state of data deletion to the NBDC Human Data Review Board Office, using Form 3 (Report on the Use (and Deletion) of Controlled-Access Data).

6. Procedure for Revising the Guidelines

6.1 Proposal for Revision

Data submitters, data users, and potential users who are considering data use may propose revision of the Guidelines to the Office if they think it may lead to smoother provision or use of human data. It is requested to provide concrete proposals and references to the relevant parts of the Guidelines.

6.2 Review of Revision Proposals

Upon receipt of a revision proposal, the NBDC Data Sharing Subcommittee promptly reviews its content and decides whether the proposal is adopted or rejected or should be modified.

6.3 Announcement and Implementation of a Revision

Once the details of a revision are decided, they are promptly announced on our website and will be implemented after a certain period set by the NBDC Data Sharing Subcommittee. It should be noted that the revised Guidelines are retroactively applied to those entities or persons who have already obtained approval for their application for data submission or data use, unless they notify the NBDC of their objection.

7. Other Topics

7.1 Disclosure of Information Obtained from Applications for Data Submission and Data Use

From the applications received regarding the NBDC Human Database, the NBDC discloses some input items for which applicants' consent is obtained. The members of the NBDC Human Data Review Board and the staff of the NBDC Human Data Review Board Office must not disclose any other information on applications than the information disclosed by the NBDC to anyone other than those who are concerned.

7.2 Notification of Inaccurate Data

The NBDC Human Data Review Board accepts notifications about inaccurate data in the NBDC Human Database from data users and informs the relevant data submitters of the issue to discuss the response. Similar actions are taken in cases where people who gave consent point out a possibility of improperly obtained consent or fabricated consent.

Contact information: the NBDC Human Data Review Board Office

7.3 Investigation concerning Research Fraud by Fabrication or Falsification etc.

1. The NBDC may cooperate on an investigation of research fraud regarding data stored in the NBDC Human Database, when requested.
2. The head of the fraud investigation committee etc. should inform the NBDC of the Dataset ID of data necessary for conducting the verification and the necessity for verification, and report the security status of the server for storing the data using Form 5 (Checklist for the NBDC Security Guidelines for Human Data).
3. The Data should be used under full responsibility of the head of the fraud investigation committee etc.
4. The head of the fraud investigation committee etc. should comply with rules under “Basic rules to be complied with in using data,” item (4) of “5.3.2 Controlled-Access Data” in “5.3 Responsibilities of Data Users.”

See also:

The NBDC Security Guidelines for Human Data