Qualified research projects, qualified researchers, and qualified data and information

(a) Establishment Not later than 1 year after the date of enactment of this Act, the NSF shall establish, in consultation with the Commission, a research program to review research applications for approval as qualified research projects. (b) Research program requirements The research program established by the NSF and the Commission under this section shall— (1) provide that the NSF shall— (A) establish a process to solicit research applications in order to identify qualified research projects; (B) review research applications for scientific merit; (C) ensure research applications identify proposed qualified researchers; (D) publish guidelines and criteria to be used by the NSF in determining how it will review research applications seeking approval to be a qualified research project; (E) identify, in consultation with the Commission, what data and information in a platform’s possession will be qualified data and information for the purposes of carrying out a qualified research project; (F) ensure that approved research applications do not request data described in section 2(6)(B); and (G) prescribe and publish guidelines and criteria, in consultation with the Commission, used to determine how the NSF and Commission will identify qualified data and information necessary to conduct a qualified research project; (2) provide that the Commission shall— (A) review research applications for privacy and cybersecurity risks; (B) for each qualified research project, establish appropriate privacy and cybersecurity safeguards that a platform must implement in the provision of, and with which qualified researchers must comply to access, qualified data and information that a platform is required to share with qualified researchers pursuant to a qualified research project, and such safeguards— (i) must account for the relative sensitivity of the qualified data and information involved and be sufficient to protect such data and information; and (ii) may include alternative protections, as appropriate and in consideration of the aims of the qualified research project, including— (I) encryption of the data in transit and when not in use; (II) delivery of the data in a format that employs methods to prevent qualified researchers from identifying individuals in the dataset; (III) data access logs; and (IV) keystroke logs; (C) in the case of each qualified research project, consider whether to require the platform to provide a secure physical or virtual environment to facilitate delivery of the qualified data and information; (D) establish appropriate privacy and cybersecurity safeguards that a qualified researcher must implement when receiving, storing, or analyzing qualified data and information or generating new data using such qualified data and information, including inferential data based on such qualified data and information, and such safeguards may include a requirement that a qualified researcher delete qualified data and information after completion of a qualified research project, however any such safeguard must provide the qualified researcher the ability to retain enough information about the qualified data and information to allow the researcher or their peers to recreate the qualified research project upon request to, and approval from, the NSF and Commission pursuant to this section; (E) publish a list of criteria for determining the privacy and cybersecurity safeguards required for qualified data and information related to a qualified research project; (F) provide a platform that is the subject of a qualified research project with the opportunity to provide comment about the privacy and cybersecurity safeguards required for the qualified research project; (G) provide researchers with the opportunity to provide comment about the privacy and cybersecurity safeguards required for a qualified research project; (H) establish a process to ensure that qualified researchers will be able to comply with any such privacy and cybersecurity safeguards; and (I) publish a list of criteria for determining whether qualified researchers will be able to comply with any such privacy and cybersecurity safeguards; (3) provide that a research application may not be denied on grounds of the race, color, age, sex, national origin, political affiliation, or disability of the researcher; (4) provide that a research application shall not be approved as a qualified research project unless it— (A) has been approved by an institutional review board; (B) has been deemed exempt from institutional review board review; or (C) is excluded from the criteria for institutional review board review; (5) provide a platform the opportunity to comment on and appeal to the NSF and the Commission the approval of a qualified research project for which the platform is required to provide qualified data and information to qualified researcher the grounds that— (A) the platform cannot provide the qualified data and information; (B) providing access to the qualified data and information would lead to significant vulnerabilities in the security of the platform’s service or user privacy; or (C) the privacy and cybersecurity safeguards established by the Commission are not sufficient to protect the qualified data and information; and (6) require that any analysis by a qualified researcher derived from a qualified research project that the qualified researcher intends to publish undergo prepublication review by the Commission to ensure that the analysis does not expose personal information, or trade secrets. (c) Qualified researcher capacity A qualified research project may not proceed unless the proposed qualified researchers can demonstrate that they have the capacity to comply with the privacy and cybersecurity safeguards established for the qualified research project. (d) Aim of project A research application shall not be approved as a qualified research project unless it is in the public interest, aims to study activity on a platform, and is used for noncommercial purposes. (e) No judicial review A determination by the Commission or the NSF under this section regarding whether a research application will be deemed a qualified research project shall not be subject to judicial review. (f) No government access If a platform provides qualified data and information to a qualified researcher, no government entity may seek access to such qualified data and information from the qualified researcher. (g) Researcher consortia The Commission and NSF shall establish procedures and necessary safeguards under this section that allow for consortia of researchers to apply to seek data for the purpose of conducting a series of qualified research projects.