The Dataset That Followed Me
You are research director at a boutique agency. Six months ago you delivered a segmentation study to Client A, a regional health insurer: n=2,400, respondent-level raw data with a unique ID, plus verbatim comments. The contract says deliverables are licensed to Client A for internal use and that the agency retains ownership of raw data. The respondent consent language said responses would be used "for this research project only" and that answers would be reported in aggregate. Client B, a direct competitor of Client A, now commissions a similar segmentation and suggests you "just re-use the respondents you already have - it saves field cost and time." You discover a junior analyst has already copied the Client A file to a shared drive that the new project team can access. Client A has not been asked, and their procurement team is known to be aggressive about data rights.
1. Assess Client B's proposal and the shared-drive copy.
Read the worked answer
Two separate problems. First, the shared drive: regardless of what the contract permits, moving identifiable respondent-level data from a completed Client A project into a workspace visible to a team working for Client A's competitor is a confidentiality failure. Access should be revoked immediately, the copy deleted from the shared drive with the deletion logged, and the analyst spoken to - not punitively at first, but clearly, because this is how breaches happen.
Second, re-use for Client B. Agency ownership of raw data does not override the consent promise made to respondents. They were told "this research project only" and aggregate reporting; using their answers to build a segmentation for a different company, especially a competitor, is outside that consent even if the contract is silent. It also breaches the reasonable expectation of confidentiality that underpins Client A's willingness to share a respondent list. The fact that the data is technically yours does not make the use ethical or, in many jurisdictions, lawful.
The correct answer to Client B is no, with a short explanation: the respondent consent does not extend to new research purposes. Offer a fresh sample, and if re-contact is genuinely valuable, propose it only after Client A agrees and respondents opt in again for the new purpose.
2. If you wanted to re-contact the original respondents for new research, what would have to be true?
Read the worked answer
Four conditions, all of them necessary. (1) The original consent must have contemplated re-contact - a line saying the agency may contact you about future research is standard and usually sufficient for re-contact, but it must actually have been in the script, not added later. (2) Client A must be asked, because the respondent relationship was formed under their project and their procurement team will treat unannounced re-use as a breach regardless of the contract's ownership clause. (3) The re-contact must be for a purpose compatible with the original consent; a competitor's segmentation is not, while a methods study or a genuinely anonymous benchmark might be. (4) Respondents must be able to decline, and the new contact must say who is sponsoring it.
Even then, the data itself should not be handed over. Re-contact is permission to invite, not permission to transfer the file. The new project should collect fresh consent and fresh answers, with only the contact details carried forward and preferably via a vendor that does not expose Client A's list to Client B.
Document the decision either way. If Client A says no, that is the answer; the commercial value of Client B's project does not create a right to override it.
3. What contractual and operational changes do you recommend?
Read the worked answer
Contractually, stop relying on an ownership clause to do work it cannot do. Add three things: a purpose-limitation clause stating that respondent data may be used only for the project defined in the statement of work; a re-contact clause that says whether and how respondents may be approached again, and who must approve it; and a data-handling schedule covering storage, access, retention and destruction. On the client side, make clear in proposals what you will and will not do with raw data after delivery.
Operationally, apply need-to-know access. Each project gets its own workspace; the Client A file should never have been reachable from the Client B team's drive. Use role-based permissions, log access to respondent-level files, and require a named owner for every export. Add a short data-handling module to onboarding so analysts learn that "the agency owns the data" is not a licence to move it.
Finally, build a decision rule for re-use requests: new purpose plus old consent equals new consent. That rule is simple enough to be applied by a junior analyst at 5pm on a Friday, which is when these problems actually occur.