Who is responsible for what needs to be made explicit.
In essence the Data Provider (or the projects Principle Investigator) is ultimately responsible for their data.
The Data Receiver should not make any changes without explicit permission from the owner of the data.
This should be said upfront at the beginning of collaboration, and then we
can go on to talk about the sort of checks and modifications the receiver might run, etc.