managing sensitive data for sharing − the uk data archive experience...
TRANSCRIPT
MANAGING SENSITIVE DATA FOR SHARING
− THE UK DATA ARCHIVE EXPERIENCE……………………………………………………....................................................................................................
VEERLE VAN DEN EYNDEN………………………………….UK DATA ARCHIVEUNIVERSITY OF ESSEX………………………………….
MANAGING AND CITING SENSITIVE DATA, BRITISH LIBRARY
29 OCTOBER 2012
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
TOPIC
The challenges of managing and citing sensitive or personal data within the repository context
• Legal / ethical background• UK Data Archive strategy• Suggestions for citation & repositories
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
OUR STRATEGY
Shared responsibility & trust relation:• Researchers producing data
• Researchers (re)using data
• Data centre / archive / repository
A COMBINATION OF GAINING CONSENT FOR DATA SHARING, ANONYMISING AND REGULATING ACCESS TO DATA WILL INCREASE THE POTENTIAL FOR MAKING PEOPLE-RELATED RESEARCH DATA MORE READILY AND WIDELY AVAILABLE
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
PERSONAL DATA
Protection of personal information legislation :
Data Protection Act 1998
•relate to a living individual•the individual can be identified from those data or from those data and other information•include any expression of opinion about the individual
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
SENSITIVE DATA
DPA 1998 defines ‘sensitive personal data’ :
data regarding an individual's race or ethnic origin, political opinion, religious beliefs, trade union membership, physical or mental health, sex life, criminal proceedings or convictions,...
• Data that may incriminate a person• Data a person prefers not to share with wider society
e.g. business, income, health, medical details
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
DATA PROTECTION ACT PRINCIPLES
Personal data should be:•processed fairly and lawfully •obtained and processed for a specified purpose •adequate, relevant and not excessive for the purpose •accurate •not kept longer than necessary •processed in accordance with the rights of data subjects
e.g. right to be informed about how data will be used, stored, processed, transferred, destroyed, … & right to access information and data held
•kept secure •not transferred abroad without adequate protection
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
DPA PRINCIPLES
• Personal data only disclosed if consent has been given to do so (exception e.g. legal reasons)
• Every individual has the right to access info and data held
• If data are anonymised (personal identifiers removed) then DP laws will not apply as these no longer constitute ‘personal data’
Data protection is not intended to, and does not, inhibit ethical research
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
DPA EXCEPTIONS
Personal data collected as part of research: • can be retained indefinitely (if needed)• can be used for other purposes in some circumstances,
but people should still be informed• sensitive personal data can only be processed for
research purposes if:• explicit consent (ideally in writing) obtained; or• medical research by health professional or equivalent with duty
of confidentiality; or • analysis of racial/ethnic origins for equal opportunities
monitoring; or• substantial public interest and not causing substantial damage
and distress
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
FREEDOM OF INFORMATION ACT
Right to request access to recorded information held by public sector organisations
incl. research data from universities and publicly funded research organisations
Sensitive / personal data - exceptions• personal data cannot be requested
• information that is subject to a confidentiality agreement (e.g. signed consent form) or sensitive data held under restricted access by a data archive
• there must be a real likelihood that disclosure would open the public authority to legal action for breach of confidence
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
RESEARCH ETHICS
• duty of confidentiality towards informants/participants • duty to protect participants from harm by not
disclosing sensitive information • duty to treat participants as rational, autonomous
beings, who can decide (via informed consent) how the information they provide (in research) can be used, shared and made public
• duty to inform participants how information and data will be used, processed, shared, disposed of
• duty to wider society to make available resources produced by researchers with public funds e.g. data sharing required by research funders
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
SHARING & RE-USING SENSITIVE DATA
• Obtaining informed consent, also for data sharing, preservation, curation, re-use
• Protecting identities e.g. anonymisation, not collecting personal data
• Restricting / regulating access where needed (all or part of data) e.g. by group, use, time period
• Securely storing personal or sensitive data
Consider jointly and in dialogue with participants
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
ROLE OF DATA ARCHIVES
• Provide trust • Enable and support ethical re-use of data• Rights framework• Enable maximum accessibility / least restrictions –
optimum access• Disclosure checks and data anonmyisation checks
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
ROLE OF DATA ARCHIVES
Regulate user access to data - UK Data Archive:• archived data NOT in public domain• data use for specific purposes after user registration
(UK Federation)• data users sign legally binding End User Licence
e.g. not identify any potentially identifiable individuals• stricter access regulations for sensitive / confidential
data (case by case): • access to approved researchers only• data access authorisation from data owner prior to data
release• embargo for given time period• secure access to data / data enclave
Secure Data ServiceMetadata & documentation always open access
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
ROLE OF RESEARCHERS
When ‘producing’ data:• consider methodology
e.g. collect personal data or sensitive data in research?
• consider data sharing & re-use during ethical review• informed consent procedures• anonymise data
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
DATA CITATION
• Metadata: provide info about rights, restrictions, access conditions, use conditions
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
REPOSITORIES
• Discuss with depositors:• consent
• anonymisation
• choose right access
• Checks:• anonymisation
• DPA breaches
• Legal framework – deposit licence & use licence• Set access conditions (repository / depositor)• Administer user access (depositor)
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
EXAMPLES
• Labour Force Survey• End User Licence version
• Special Licence with extra variables
birth month &year, NUTS2, 4-digit Standard Occupational Classification, unitary authority/local authority, urban/rural indicator
• British Household Panel Survey• main survey End User Licence (GOR)
• Secure Data Service: geography variables, grid references
• Special Licence: geography variables, wards, SOAs
• SN 4596 Conflicts and Violence in Prison, 1998-2000• methods undisclosive re. English prisons studied, minimal
anonymisation, explicit detail in data
• Data Owner Permission access
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
EXAMPLES
• SN 5407 Health and Social Consequences of the Foot and Mouth Disease Epidemic in North Cumbria, 2001-2003 (qualitative data)
• data archiving discussed extensively with participants, consent sought, minimal anonymisation (pseudonyms)
• standard End User Licence access to interview transcripts and diaries
• Data Owner Permission access to audio files
• 20 year embargo for selected interviews / diaries
• SN 5827 Rape in the 21st Century: Old Patterns, New Behaviours and Emerging Trends, 2000-2002 (quant. data)
• some removal of variables, rounding of dates
• combined with Data Owner Permission access
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
ESRC DATA STORE
Online (self) archiving system for ESRC-funded research data: manage, make accessible & discoverable
http://store.data-archive.ac.uk/store/
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
ESRC DATA STORE ROLES
• Depositors:• upload data files & send for review & publication• set access conditions
• all registered users
• collaborators only
• administer access to collaborators
• UK Data Archive:• user registration (UK Federation)• licensing: Deposit & End User Terms & Conditions• disclosure & documentation checks• advice to depositors• publish data
• Users:• agree to Terms & Conditions (click) prior to access• request collaborator status for access
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
……………………………………………………………………………………………………………………………….……………………………..
……………………………………………………………………………………………………………………………….…………………………..…
UK DATA ARCHIVE
CONTACT
RESEARCH DATA MANAGEMENT SUPPORT SERVICESUK DATA ARCHIVEUNIVERSIY OF ESSEXWIVENHOE PARKCOLCHESTERESSEX CO4 3SQ……………………………….………….
T +44 (0)1206 872001 E [email protected]/sharing