The Convention on Biological Diversity defines biodiversity as "the variability among living organisms from all sources including, inter alia, terrestrial, marine and other aquatic ecosystems and the ecological complexes of which they are part; this includes diversity within species, between species and of ecosystems" (Secretariat of the Convention on Biological Diversity Montreal 2011, Art. 2). Biodiversity studies are data-driven (Kelling et al. 2009). They rely on many and very diverse data to understand and evaluate the variability of living organisms. Biodiversity data include machine-collected sensor data, human observations, experimental data, data from museum collections, survey data, genetic data and more. The use of these data in research is possible only when both technical requirements, such as machine-readability or the availability of metadata and legal requirements, such as clear information on the data Intellectual Property Rights (IPR), are satisfied.

This paper discusses data IPR and legislation that have a direct impact on stakeholders’ access to research data. Ensuring such access is a key requirement in the pursuit of open science and to guarantee that research data can benefit society at large. Yet, legal complexities, unclear data rights, third-party IPR may transform what should be straightforward information exchange for the benefit of science and society into a frustrating experience.

Examples from biodiversity science are used to illustrate legal issues regarding research data. The discussion focuses on the role that these legal aspects play in open science and concludes with a set of open questions regarding research data IPR and open science. This contribution is written considering the legal framework for research data in the European Union (EU).

International and European legislation make available multiple legal instruments to protect IPR. In relation to research data mainly copyright and neighbouring rights, database rights, trade secrets and patents are relevant (Carroll 2015).

Copyright, as defined by the Berne Convention protects "every production in the literary, scientific and artistic domain, whatever the mode or form of its expression" until the death of the author (or the latest surviving author) and for seventy years afterwards. Copyright does not protect facts or ideas, only creative work produced by humans (Berne Convention 1886, Article 2(1)). For research data in biodiversity, this means that many, likely most, of the data produced, cannot claim any copyright protection (Egloff et al. 2016). Measurements and observations that can be repeated by multiple observers are facts and not creative works, regardless of the material and intellectual effort required to produce them. They prove the objectivity of science and are a tenet of reproducible science, but are not protected by copyright, unlike scientific publications, such as articles and monographs, which may rely on these data. Data gathered without human intervention, like sensor data or automated sequential image acquisition without any artistic design, as is often the case for specimen digitisation, cannot even prove human agency, which is a requirement for copyright protection under current laws. Similar considerations on research data can be extended to many scientific fields and are common whenever quantitative and objective data are gathered, regardless of the discipline.

In the EU, however, even when data do not have copyright, the databases used to store and manage these data can benefit from IPR protection. The EU Database Directive passed in 1996 grants a sui generis right to the organisations, private and public, creating databases (EU Database Directive 1996). The EU Directive protects IPR whenever the “maker” can prove a “substantial investment” in the database creation (ibidem, Art. 7). The IPR protection is granted for fifteen years and only refers to the database as a collection of information and does not extend to the database content. For researchers this means that, even though individual data may not have copyright, reusing them is subject to the licensing conditions of the database, as the individual data can be accessed only via the hosting database. This has been a source of ongoing frustration for researchers, as reported by a recent publication of the EU Directorate for Research and Innovation (European Union 2024). One of the survey respondents in this study did not refrain from pointing out that the risk to infringe IPR on old and minimally maintained databases is preventing the development of more modern and suitable data resources for research (ibidem, p.187). Recent EU legislation, the Open Data Directive (Open Data Directive 2019) and the Data Governance Act (Data Governance Act 2022), require public sector bodies to renounce the sui generis database right (van Eechoud 2021), but this does not solve all problems. Third-party IPR may still prevent data reuse unless public bodies are able to acquire the necessary permissions from all copyright holders.

In addition to the already-cited copyright and EU sui generis database right, also neighbouring rights can be relevant when working with research data. Neighbouring rights vary amongst EU countries and grant protection also to non-original images (Hugenholtz 2019). For instance, in Germany, non-original photographs are awarded protection for fifty years (Fabris 2022). The long term was justified with the necessity to compensate creators of images that require considerable technological investment, such as satellite images. Therefore, attention should always be paid to the licence of image data for research to avoid infringing third-party IPR. Careful judgement should be exercised when reusing scientific images, as they are often free from copyright, but they may fall under the protection of neighbouring rights.

An aspect worth mentioning in the case of biodiversity research and, more generally, in the life sciences, is the ongoing legal discussion surrounding access to Digital Sequence Information (DSI) on genetic resources (Lawson et al. 2024). Access and benefit-sharing schemes for biological resources have been developed to ensure that biodiversity-rich countries located in the Global South receive a share of the economic benefits arising from the use of their plants, animals and other natural resources (Robinson 2014). The rationale behind these schemes is preventing the repetition of cases like the one of the the compound rapamycin, extracted from a bacterium.*1 In the past three decades, the pharmaceutical industry has marketed rapamycin-based drugs with large profits that have not been redistributed in any form to the local communities on Easter Island where the bacterium was originally discovered (Powers 2022). Access and benefit-sharing schemes, however, were developed with the physical objects in mind, such as the bacterium in the case of rapamycin. Their application to DSI is not obvious because there is not yet an agreement on the legal item (the physical object, an accession number in a genetic database etc.) that should be considered as a proxy for the DSI and used to assess monetary benefits. At present, there is no straightforward solution that ensures sequence data remain open for research within current IPR regulations and safeguards economic and moral interests of the biodiversity-rich countries and their indigenous people at the same time.

While biodiversity science strives to make its data fully open access, there are situations where this is not possible. Research data may be withheld due to IPR, such as trade secrets and patents, relevant to the commercial exploitation of natural resources (Simmonds et al. 2020). Access to research data may also be restricted due to conservation issues, because it is not considered safe to make the location of rare and endangered species public (Lowe et al. 2017). The increase of citizen-science projects, relying on mobile applications that enable rapid sharing of plant and animal observations with location metadata, have exacerbated risks (Fox et al. 2025). In addition, these citizen-science projects, which are very important for supporting conservation and biodiversity research, may generate data in conflict with current legislation. For instance, they may infringe data protection regulations, like the EU GDPR (General Data Protection Regulation 2016), if recognisable individuals are included without consent in the images captured by citizen scientists. Ultimately, it is the researcher generating and/or reusing a dataset who bears the legal responsibility to ensure that the research data are created and used in agreement with current regulations and without infringement of third-party IPR.

Providing access to research data is a key requirement in promoting open science (Bullinger et al. 2003). As suggested by the Open Definition 2.1, licences that allow data use, redistribution and modification are crucial to achieve this objective (Open Knowledge Foundation n.d.). Creative Commons (CC) licences (Creative Commons n.d.) are a good example of tools that fulfil the openness requirements and provide sufficient flexibility to fit the needs of good scientific practice. They can be customised to provide author credit and indicate how derivative work should be treated. In addition, in their most recent version (4.0), they can also be applied when there is no copyright on research data, but other IPR forms, such as the sui generis EU database right or neighbouring rights, exist and, therefore, a licensing agreement is necessary to enable the legal reuse of research data. Yet, open licences are not sufficient to solve all the legal issues associated with access to and reuse of research data. A crucial aspect that can lead to controversies is the rightsholder(s) identification. If there is IPR on data, this may reside with the data collector or the researcher managing the project, who may differ from the data collector or the institution hosting the project or, less common, with the research funder. Data Management Plans are a helpful tool to clarify these IPR aspects, but they cannot be sufficient by themselves. Stakeholders of scientific data should take advantage of standard practices to manage IPR in community projects, such as contributor licence agreements and copyright assignment, which are routinely adopted by the Free/Libre and Open Source Software (FLOSS) community. These tools have proven effective in managing IPR and ensuring the long-term survival of projects based on distributed contributions (Fogel 2005). A few research institutions are developing data agreements for researchers along similar lines (e.g. Piquer-Rodriguez et al. (2025)), but these agreements are not yet systematically adopted within institutions nor programmatically shared amongst data management professionals (Wünsche et al. 2022). The management of research data IPR remains driven by a case-by-case approach rather than by standardised guidelines.

As mentioned above, many biodiversity data do not qualify for copyright and they may not enjoy other forms of IPR protection. If there is no IPR at all on the data, there is no need to license them. Yet, a common praxis for research data is to use a licence, typically a CC licence, even when data have no IPR. Strictly speaking, this constitutes copyfraud, i.e. claiming non-existing IPR (Mazzone 2020, Kreutzer and Lahmann 2021). In the context of research data, this praxis is often considered harmless by research data management services when permissive CC licences, like CC0 or CC-BY, are used and it is even valued as a tool to promote the acknowledgement of dataset creators according to established best practices in science (Brettschneider et al. 2021). Even legal experts consider the risks associated with copyfraud in research data minimal. While acknowledging that it is not legally appropriate to make use of a licence as a tool to promote best practices in science, they do not expect any real drawback because data under a CC licence can always be accessed for free (Boehm et al. (2025), pp. 306-307). Yet, data creators and institutions hosting data repositores should always be reminded that CC licences cannot be legally enforced if research data do not have IPR. That is to say, if a person or an organisation fails to comply with the terms of the licence, it cannot be brought to compliance in court or out of court because the terms of the CC licence, for instance, attribution in case of a CC-BY licence, are enforceable only when there is IPR on the data. This situation is completely different from the situation occurring with research software, which is automatically copyright-protected as long as it is non-trivial and developed by a human. This is often an aspect generating confusion because data and software go hand-in-hand in research, but their IPR can be very different.

When discussing IPR (or lack of it) on research data and tools, such as data agreements, for managing access to and responsibilities regarding research data, it is important to remember that open science needs more than just open access. As stated by UNESCO, "open science sets a new paradigm that integrates into the scientific enterprise practices for reproducibility, transparency, sharing and collaboration resulting from the increased opening of scientific contents, tools and processes" (UNESCO (2021), p. 7). Reproducibility, transparency, sharing and collaboration require close cooperation between data collectors (researchers in established positions, researchers in training, technicians and citizen scientists), scientific institutions and research infrastructures. IPR on data, if there is any and data agreements should be used to ensure that this cooperation works effectively. This may not always be the case if researchers are alone responsible for the data they generate. If a research project develops big data —Terabytes and even Petabytes of data are not unknown in many disciplines — it could be rather imprudent to place the full burden of decision on the researchers' shoulders. When data are large, technological considerations and data engineering best practices (for instance, the format adopted to store data, the best data storage solution etc.) should also be taken into account to ensure sustainable data management. Similarly, publication of research data should strike a balance between the priorities of the researchers, institutional policies about data, funders' requirements and the needs of other data stakeholders, such as local communities. The case of an ecology researcher, Denon Start, which hit the headlines a few years ago, shows the potential issues that can emerge when the researcher is solely entrusted with the data (McCarthy 2021). Start's laptop and data backup were stolen from his car and no other copies for data he had used in published papers were available at his or his collaborators' institution. As a result, the primary evidence was not available to answer questions raised by other researchers interested in replicating the experiments discussed in the papers co-authored by Start. Only part of the data had been deposited in a public repository and pressing questions about the data collected and the congruence between the described experimental methodologies and the published results could not be answered, leading to retractions and expressions of concerns.*2 A direct involvement of institutions and research infrastructures alongside researchers in managing raw data and granting access to them for reuse and post-publication peer review would greatly facilitate the pursuit of reproducibility, transparency and collaboration, which are at the core of open science. Similarly, developments in the U.S. federal research landscape, which are causing datasets in key areas such as health and environment to disappear from the public domain (Gerrard 2025), are also reminding the international scientific community about the value of sharing data IPR and responsibilities amongst researchers, institutions and funders to counterbalance politically-driven strategies that discount and undermine scientific needs. As a response to this challenging situation, the potential of technologies for decentralised data storage, such as the InterPlanetary File System (IPFS), are increasingly considered by researchers "to create a more robust and censorship-resistant scientific record" (Tamang 2025).

A last point worth mentioning is the so-called Text and Data Mining (TDM) exception included in the most recent EU legislation on copyright (Digital Single Market Directive 2019). The European legislator considers TDM "any automated analytical technique aimed at analysing text and data in digital form in order to generate information which includes but is not limited to patterns, trends and correlations" (ibidem, Art. 2(2)). The legislator grants research organisations and cultural heritage institutions permission to use the TDM exception for doing research even on copyright works they can lawfully access (ibidem, Art. 3(1)). Over the past few years, the TDM exception has become an object of great interest due to the exponential increase in bots-mining publicly accessible information and collecting data for the training of generative AI models. While discussions about the applicability of the TDM exception in this context remains (Dornis and Stober 2024), two aspects should be always considered by researchers and research organisations interested in relying on the TDM exception for collecting information. The first one is that copyright holders can opt out of TDM with an appropriate machine-readable disclaimer (Digital Single Market Directive (2019), Art. 4(3)). Therefore, it is always necessary to check for an opt-out statement before undertaking TDM. Academic publishers, such as Springer Nature, allow researchers to do TDM on the publications they can access via their institutional subscription or that are open access, but they set conditions for acceptable usage, such as the number of requests per minute or availability of secure storage for the downloaded materials that are under copyright. The second aspect to be considered is that TDM done by bots can become a problem for websites, place an unduly financial burden on them and cause disruptions to human users. DiscoverLife.org, a biodiversity data platform sponsored by a foundation and hosted by Sam Housten State University in Huntsville (Texas), publicly called out the issue in Nature (Orr et al. 2025), but it is not the only scientific organisation that has encountered the problem (Weinberg 2025). Current data legislation is unable to fully address this situation and ethical usage should always be considered a priority both by research organisations and commercial actors. Otherwise, public collections of research data may end up hidden behind a log-in interface defying, in practice, the principles of open science that prompted the creations of these public collections.

1. How can we improve management practices regarding research data IPR (or lack of) to promote open science?

Publications, software, and data are the most common forms of research output. Yet, while human-created publications and software are copyright protected, research data, especially quantitative data, may not have any IPR and require a different approach to fully contribute to open science. Despite the widespread availability of data management plans and institutional data policies, these tools have been only to some extent helpful in tracking research data IPR or its absence and recommend suitable approaches to data publication (licensing, data agreements, etc.) that do not lead to copyfraud. Similarly, rights and duties about research data remain a grey area that can lead to conflict between researchers, their institutions, and the broader scientific community, when not explicitly regulated. Lack of clarity about actors who have rights and duties in relation to research data may impede or limit reproducibility, transparency, and collaboration, undermining, therefore, the vision of open science. There is no single answer to these problems, but a starting point may be to turn to established FLOSS and open-knowledge (e.g., Wikipedia) communities, examine how they have approached these problems of IPR and shared intellectual ownership, and take inspiration for a research data management better suited to open science.

2. How can we use current data legislations to enhance research and protect open-access collections of research data from misuse?

In recent years, the EU parliament has passed multiple pieces of legislations regarding data and databases. This is not surprising given the increased relevance data have in people's life, including a researcher's life. Some of thisese legislations provides researchers with an extended freedom to use even proprietary data in their work. This is, for instance, the case with the TDM exception. In other cases, for instance, in the case of the sui generis database right, thisese legislations prompts public organisations to renounce their IPR to facilitate access to knowledge. The increase in the amountnumber of legislations, however, did not lead to more clarity about what researchers can and cannot do, but rather to a "regulatory complexity", and the related compliance costs "tend to disproportionately affect parties with less availability of financial resources, such as researchers and research organisations" (European Union (2024), pp. 28-29). This is a non-trivial problem and there is no easy solution in sight. Some research organisations are starting to offer extensive training in legal matters related to data and to establish legal help-desks that support their researchers, but often these are isolated initiatives. It would be important to have a direct involvement of the entities that provide funding and regulations for research at European and national level. They are closer to the political authorities and could better represent researchers' needs to the legislators with the aim of having data laws that are clearer to interpret and follow. Such clarity would be especially appreciated by organisations maintaining public repositories of research data and would help them to facilitate data access for humans on the one hand, and to restrict greedy bots on the other.

3. How can data legislations and transparent IPR management facilitate the access of non-scientific stakeholders to research data?

The Open Data Directive approved by the EU Parliament in 2019 provides a legal framework for data that are managed by public bodies or that are the result of publicly funded research (Open Data Directive 2019). The Ddirective wants to facilitate reuse of public data, including research data. For the first time, this legislation introduced the concept of high-value datasets, that is data of special importance from the social, environmental, and economic point of view (ibidem, Chapter 5). Biodiversity data fall within this category and, as all high-value datasets, the legislation requires that they are freely available in a machine-readable format via APIs and fulfill technical requirements for data reuse, such as metadata. The implementation guidelines for the Open Data Directive (Implementing Regulation 2023/138 2022) explicitly request data to be released under CC0 or CC-BY 4.0 licences (or equivalent/less restrictive licences). They do not really make difficultproblematise the fact that many research data do not qualify for copyright or other IPR protection and suggest standardised solutions for these situations. Organisations active in biodiversity science are now making suggestions to cover this gap, but providing general guidelines is complex due to differences existing in IPR legislations, even within the EU, especially for what concerns neighbouring rights (Benichou et al. 2023). In addition, current EU legislations does not give clear indications about how the access to research data can be facilitated for non-scientific stakeholders, who are typically not familiar with the metadata standards adopted by the scientific community. Considering that even scientific communities can be set apart by metadata choices for the same type of data (Borgman (2015), Chapter 4), this is not a minor point and should be more openly discussed, if research data want to be a real asset in the achievement of social, environmental, and economic goals.