Web UI for upload file requires 2 decisions: 1.Pick the file 2.Set data use restrictions We have zero observed cases of people selecting “Any Use” when data should be Restricted / Controlled. We have large support burden of people selecting “Restricted / Controlled” when it is not actually needed

Confusion on existing File Upload Users are confused between “Sharing Settings” and “Data Use Restrictions” – Sharing Settings are completely controlled by end user, like Dropbox / Google Drive / SharePoint etc. Sharing can be with named users, or “public” – Restrictions enforce Terms of Use on those who are listed in Sharing Settings (including “public”) Typical error is to set an data use restriction, when user just intends to set sharing to be non-public.

Difficulty configuring the files to which Data Use Restrictions apply Currently, data use restrictions apply to a flat list of files, which can be located in potentially multiple projects / folders. This list is editable and visible only through analysis clients which is cumbersome, and difficult to keep up to date with changing project content. Proposed: Data Use restrictions apply to exactly 1 entity. However, that entity may be a file / folder / project. Data use restrictions on a folder / project apply to all files contained within. – Need to check on data use restrictions for whole tables but should be feasible. We can not support row-level data use restrictions.

Showing Sharing and Data Use Restrictions in Folders Folder level Sharing (current) Folder level data use restrictions (proposed) B Set data use restrictions (change) A Access same Sharing and Data Use Restriction dialogs from main Synapse pages. Sharing: Data Use Restrictions:

Proposed Data Use Restrictions Dialog Unrestricted files can accessed by anyone listed in the Sharing Settings with no additional requirements. Restricted files can only be accessed by those listed in the Sharing Settings. Anyone who accesses restricted use files must also agree to abide by the Terms of Use associated with the files. Controlled files can only be accessed by those listed in the Sharing Settings. Anyone who accesses controlled use files must also apply for access to the Sage Access Control Team, and agree to abide by the Terms of Use associated with the files. Cancel OK Show Terms of Use Set Data Use Restrictions Review Terms of Use Currently, no terms of use are set for these files. If you change the settings to restricted or controlled use, the Sage Access Control Team will help configure these terms. Set Where Data Use Restrictions Apply Data Use restrictions may be set to apply to all files in a Project or a particular Folder within a Project. Currently, these restrictions apply to My Subfolder My Project > My Folder > My Subfolder Change

Proposed Data Use Restrictions Dialog Unrestricted files can be freely accessed by anyone listed in the Sharing Settings. Restricted files can only be accessed by those listed in the Sharing Settings. Anyone who accesses restricted use files must also agree to abide by the Terms of Use associated with the files. Controlled files can only be accessed by those listed in the Sharing Settings. Anyone who accesses controlled use files must also apply for access to the Sage Access Control Team, and agree to abide by the Terms of Use associated with the files. Cancel OK Show Terms of Use Set Data Use Restrictions Review Terms of Use Currently, no terms of use are set for these files. If you change the settings to restricted or controlled use, the Sage Access Control Team will help configure these terms. Set Where Data Use Restrictions Apply Access restrictions may be set to apply to all files in a Project or a particular Folder within a Project. Currently, these restrictions apply to My Subfolder My Project > My Folder > My Subfolder Change Text would change to match state Eliminate separate list of files under access control. Instead, apply access restrictions to folders (and whole projects?) Does not handle edge case where there are multiple access restrictions at different levels of folder hierarchy. Radio buttons default to match current settings. Default to any use for creating a new project. No button for unrestricted data. Otherwise ability to review text of Terms of Use agreement

Existing Sharing Dialog Dialog needs to include where the settings apply in Project / Folder hierarchy. When dialog is launched from file upload it could be not clear. This area should show it explicitly.

Proposed File Upload Upload Files FileLink to URL Browse Cancel OK Sharing Settings You are uploading these files into a File / Project in which the Public is allowed to download these files. more about sharing Change Sharing Data Use Restrictions People who are allowed to access these files have no additional data use restrictions that need to be satisfied before they can proceed with download. more about data use restrictions Change Data Use Restrictions

Proposed File Upload Upload Files FileLink to URL Browse Cancel OK Sharing Settings You are uploading these files into a File / Project in which the Public is allowed to download these files. more about sharing Change Sharing Data Use Restrictions People who are allowed to access these files have no additional access restrictions that need to be satisfied before they can proceed with download. more about data use restrictions Set Data Use Restriction This works the same Icons and text would change to match actual settings Optional, default is to keep unchanged

Proposed File Upload Upload Files FileLink to URL Browse Cancel OK Sharing Settings You are uploading these files into a File / Project in which the Public is allowed to download these files Change Sharing Data Use Restrictions People who are allowed to access these files have no additional data use restrictions that need to be satisfied before they can proceed with download. Set Data Use Restriction Launches existing dialog

Proposed File Upload Upload Files FileLink to URL Browse Cancel OK Sharing Settings You are uploading these files into a File / Project in which the Public is allowed to download these files. more about sharing Change Sharing Data Use Restrictions People who are allowed to access these files have no additional data use restrictions that need to be satisfied before they can proceed with download. more about data use restrictions Set Data Use Restriction Option to change sharing, using new dialog

Open Questions How much self-service can we let users perform in setting up data use restrictions? – Edit text of ToU? OR Pick standard ToU components from a menu? (e.g. CC license types?) – Let users set up their own Restricted (Tier 2) files, or does ACT need to actively review these? How dynamic are Data Use Restrictions – What happens when restrictions are edited after people start agreeing to them? (Assume existing agreements should be voided?) Or do we not allow editing once they’re set up? Seems most editing is changing the set of files to which the agreement applies, not changes the actual text of the agreement. Prefer not allowing edits to restrictions once set, only delete / create new.

Governance Implications Initial radio button design was intended to force people to make a decision on data use restrictions. We don’t force a decision at point of upload now. – Can’t force decision at API level anyways – Functionality only accessible to trusted user class now New approach is that default is to keep sharing settings and data use restrictions unchanged from whatever structure already exists. – New projects start out private (not shared with anyone) – New projects start out with no data use restrictions – Only trained users can add new content, and alter sharing settings and data use restrictions. Presumably training includes a test to show they understand this system.