Obligations and immunity for qualified researchers

(a) Scope of permitted use of qualified data and information Each qualified researcher who accesses qualified data and information shall use the qualified data and information— (1) only for the purposes of conducting research authorized under the terms of the qualified research project involved; and (2) in accordance with the privacy and cybersecurity safeguards prescribed by the Commission for the qualified research project. (b) Protection of personal information A qualified researcher that is provided access to qualified data and information for purposes of a qualified research project may not— (1) attempt to reidentify, disclose, publish, or use for commercial purpose personal information derived from such qualified data and information; or (2) disclose such qualified data and information to a third party for any reason. (c) Effect of violation of information and privacy standards Qualified researchers who intentionally, recklessly, or negligently violate the privacy and cybersecurity safeguards prescribed by the Commission for a qualified research project may be subject to both civil and criminal enforcement, under applicable Federal, State, and local laws. The Commission may refer any such violation to the Department of Justice or the appropriate State law enforcement agency.