Licensing of Published Datasets and Scripts

1. Why License?

The Default Status of Creative Works

• Copyright is Automatic: The moment you write a script or compile a database, copyright applies automatically. You are the copyright holder.
• “All Rights Reserved” by Default: Under standard copyright law, no one may copy, modify, distribute, or run your work without explicit permission.

Who Owns Academic Outputs? (The Institutional caveat)

• German Employment Law (UrhG §69b): If you are employed by a university (e.g., as a research assistant, doctoral candidate, or postdoc), the exclusive economic rights to the software you write in the scope of your employment automatically belong to the employer (the University of Cologne).
• The Rule: You cannot legally choose to license your university-work under GPL/MIT on your own; institutional clearance is required.

The Impact on Open Science

• Without a license, your “open” code on GitHub is legally unusable for reproducibility.
• Key Principle: A license does not restrict you; it grants explicit, legally binding permissions to others (Morin et al., 2012).

Code vs. Data vs. Content

Research projects consist of distinct assets. One license does not fit all.

Key Distinction: Database Rights vs. Copyright

• CC 4.0 is Critical: Always use Creative Commons Version 4.0 or later for data. Older versions (CC 3.0 or earlier) do not cover or waive European sui generis database rights (EU Directive 96/9/EC), leaving users in legal ambiguity.
• Why not use CC for code? CC licenses do not address software-specific issues such as source code distribution, compiled binaries, patent rights, or execution environments. Using CC for software is strongly discouraged.

2. Software Licensing (choosealicense.com)

Software licenses are split into two major classes depending on how they handle derivatives:

Permissive: The MIT License

The MIT License is the most common permissive license in research software.

Copyright (c) [Year] [Copyright Holders]

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software...

Key Advantages

• Short, simple, and easy to read.
• Compatible with almost all other licenses (you can import MIT code into GPL code).
• Highly recommended for academic packages where maximum usage and industry integration are desired.

Copyleft: GNU General Public License (GPL)

The GPL is the standard strong copyleft license.

• The “Viral” Property: If you modify GPL-licensed code or link your code to GPL-licensed components, your entire project must be distributed under the GPL.
• GNU LGPL (Lesser GPL): A “weak” copyleft license. It allows other programs to link to your library (e.g., import your R package) without forcing their own software to become GPL, but modifications to the library itself must remain open.

The R / CRAN Landscape

• Many base R packages and dependencies use GPL-2 or GPL-3.
• If your package relies heavily on a strict GPL-2 library, your package may be forced to adopt GPL-2 or later.

3. Data Licensing (creativecommons.org)

Unlike software, databases and content are usually licensed under the Creative Commons framework.

The CC Modular Structure

• BY (Attribution): Users must give you credit.
• SA (ShareAlike): Adaptations must be licensed under the same terms.
• NC (Non-Commercial): Only non-commercial use is permitted.
• ND (NoDerivatives): No modified versions can be shared.

       CC BY (Attribution)
       CC BY-SA (Attribution-ShareAlike)
       CC BY-NC (Attribution-NonCommercial)
       CC BY-NC-SA (Attribution-NonCommercial-ShareAlike)

Recommended Data Licenses

For research data, the goal is to minimize legal friction for data mining, metadata harvesting, and cross-disciplinary aggregation.

The “Non-Commercial” (NC) caveat

Many researchers choose CC BY-NC believing it protects their work from commercial exploitation. However, in Open Science, it creates massive compatibility issues:

• Vague Legal Definition: “Non-commercial” is not clearly defined in copyright law. Does use by a private university, a state-funded research institute, or a researcher on a commercially funded grant count as commercial?
• Prevents Integration: You cannot combine a CC BY-NC dataset with a CC BY dataset into a unified database without violating the NC clause of the former or the BY clause of the latter.
• Blocks Commercial APIs: CC BY-NC data cannot be fed into commercial language modeling APIs (like OpenAI or Anthropic) or indexed by commercial academic search engines.
• Funder Non-Compliance: Many major funding bodies (e.g., DFG, Horizon Europe) mandate open access datasets that conform to the Open Source Definition (OSD). OSD Clause 6 prohibits “Discrimination Against Fields of Endeavor” (including commercial use). An NC clause violates this and can result in funding non-compliance.

ConversationAlign Technical Architecture

The package structure involves runtime links to external repositories and aggregated third-party datasets:

%%{init: {'theme': 'base', 'themeVariables': {'fontSize': '10px'}}}%%
graph TD
    CA["R Package:<br/>ConversationAlign"]
    CA -->|Imports| TS["textstem package<br/>(GPL-2)"]
    CA -->|Fetches at Runtime| CAD["GitHub:<br/>ConversationAlign_Data"]
    CAD -->|Contains| DB["lookup_Jul25.rda"]
    DB -->|Aggregates| NRC["NRC Emotion Lexicon<br/>(Proprietary/NC)"]
    DB -->|Aggregates| BN["Brysbaert Concreteness<br/>Norms (Academic OA)"]

Issue 1: Upstream Dependency Conflict

ConversationAlign is licensed under LGPLv3 (weak copyleft). However, it lists textstem (strictly GPL-2) under its Imports in the DESCRIPTION file.

Two Licensing Interpretations

• The Lenient View: Wickham & Bryan (Wickham & Bryan (2023)) note that merely calling functions from an imported/suggested package at runtime does not require license compatibility, as no source code is bundled or compiled.
• The Strict View (FSF / Corporate Compliance): Loading and executing GPL-2 functions inside an LGPLv3 package in the same process memory space creates a combined work at runtime (German & Hassan, 2009). Under this view, GPLv2 and LGPLv3 are incompatible, making the package legally non-distributable.
• Downstream Barriers: Even under the lenient view, users are forced to install the GPL-2 library textstem, which blocks / locks out users from companies with strict anti-GPL policies.

Issue 2: Data-Software Seperation

ConversationAlign downloads the database lookup_Jul25.rda from GitHub during package startup. The database aggregates several third-party resources:

Resolution Workflow: Download on Demand

Shifting data-fetching to a user-initiated sequence ensures the package author doesn’t redistribute restricted materials:

sequenceDiagram
    participant User
    participant CA as "ConversationAlign (R Package)"
    participant NRC as "NRC Lexicon Server"
    
    User->>CA: run_analysis()
    Note over CA: Check local directory for database
    CA-->>User: Error: Database missing!
    User->>NRC: Accept Terms & Download Lexicon
    User->>CA: load_custom_database(path)
    User->>CA: run_analysis()
    Note over CA: Analysis succeeds legally

5. Navigating Repositories (GitHub vs. OSF)

Where you host your project determines how you manage your licenses.

GitHub & GitLab

• Optimized for code.
• Rule: Place a single LICENSE file in the root. GitHub will automatically detect it and display a badge.
• Avoid committing raw, third-party databases. Use a .gitignore to keep data out of your code repository.

Open Science Framework (OSF) & Zenodo

• Optimized for mixed media (preprints, code, raw data).
• Rule: Apply granular licensing. Set the overall project page to CC BY, but include a sub-folder for scripts containing an MIT LICENSE file.
• Provides a persistent DOI, making your dataset and scripts citable separately.

6. AI Licensing & Institutional Policies

Linguistics researchers increasingly train, fine-tune, or query Large Language Models (LLMs) and ASR systems. These models are composite works that require careful licensing.

The Components of an ML Release

• Source Code: Training architecture, scripts \(\rightarrow\) MIT or Apache 2.0.
• Training Data: Annotated datasets/corpora \(\rightarrow\) CC BY 4.0 or CC0.
• Model Weights/Parameters: The actual numbers (tensors). Legally ambiguous, as they represent mathematical outputs rather than creative expressions.
• Responsible AI Licenses (OpenRAIL): Integrate open access permissions with behavior-based restrictions (e.g., RAIL-M for models, RAIL-D for data).
• Note: RAIL licenses are not OSI-approved Open Source because they restrict field-of-use.

Open-Washing & The European OSAI Index

Because there is no single agreed-upon standard for “Open Source AI”, “open-washing” is widespread.

The European Open Source AI Index (OSAI)

• Developed by Radboud University to track the actual openness of generative AI systems.
• Evaluates models across 14 dimensions (including data transparency, code availability, and licensing terms).
• Open-washing: Many models (e.g., Mistral Large 3, Proton’s Lumo) are marketed as open but hide training datasets, pre-processing pipelines, or enforce restrictive terms.

The EU AI Act Connection (2025/2026)

• The EU AI Act regulates generative AI based on systemic risk.
• Exemptions: Generative AI models released under a free and open-source license enjoy significant regulatory exemptions (unless they pose a systemic risk).
• The Risk: Claiming “openness” without full compliance with open-source criteria is a major regulatory loophole that the EU AI Office is actively addressing.

Institutional AI Policies: UoC Guidelines

If you are at the University of Cologne, AI use is governed by central policies and infrastructures.

The UoC AI Directive (KI-Richtlinie)

• Legal Framework: Ratified by the UoC Rectorate and staff councils to govern compliance, data privacy, and intellectual property.
• Confidentiality Classes (Vertraulichkeitsklassen): Guidelines dictating which types of research or administrative data can be input into public vs. private AI services.

UoC Central AI Services

• OSKI.nrw (chat.kiconnect.nrw): A collaborative NRW university project providing open-source models on local HPC hardware (RAMSES).
  • DFG-Compliant: Can be legally used for reviewing and writing DFG proposals.
• Local AI (Pillar 5): Using tools like LM Studio, Jan, or GPT4All to run lightweight models locally.
  • Maximum Privacy: Ensure zero data leaves your local device.

Contributor Governance & Relicensing

What happens when your project grows and multiple researchers contribute code or data?

The Relicensing Dilemma

• Joint Copyright: Unless rights are transferred, every person who writes a line of code holds copyright over their contribution.
• Relicensing Blocks: If you want to change your license later (e.g., from LGPL to MIT to resolve a conflict), you must get unanimous approval from every single contributor. If one contributor has left academia and cannot be reached, the project is locked.

Solutions: DCOs & CLAs

• Developer Certificate of Origin (DCO): A lightweight way for contributors to certify they have the right to submit code under the project’s open license (used by Linux).
• Contributor License Agreement (CLA): A legal contract granting the project leader/institution the right to re-license the contributions in the future.