Managing sensitive data at the University of Bristol
•Download as PPT, PDF•
1 like•965 views
Presentation on managing sensitive data at the University of Bristol by Kellie Snow, Research Data Librarian for the Research Data Network event, May 2016, Cardiff University.
Report
Share
Managing sensitive data at the University of Bristol
- 1. Managing sensitive data at the University of Bristol Kellie Snow Research Data Librarian, Research Data Service Jisc Research Data Network Workshop, 18th May 2016
- 2. Background • Research Data Repository (data.bris) went live in July 2014 • For open data only • Immediately apparent some researchers would require restricted access • Studies wanting to share, but not knowing how – informal processes 2
- 3. Initial thoughts • What would any restricted access level(s) be? • How should they be applied? • Would this fit with the ethical policies and workflows of the University? • How would we objectively decide who to grant access to? • What would be the processes that needed to be in place? • What would be the technical challenges? • Did we have the capacity as a service to administer this? 3
- 4. First steps • Issue raised by Research Governance • Number of meetings and discussions over several months • November 2014 – report put forward by RDS and Governance to University Ethics Research Committee: • Suggested data access levels • Request to establish Task & Finish Group 4 Image: Sharyn Morrow
- 5. Data Access Task & Finish Group • Established to investigate the feasibility of a Data Access Committee (DAC), as recommended by the EAGDA report • Representation from IT security, Governance, Secretary’s Office (DPA/FoI), senior academics • Met three times – matters addressed: • Scope of a DAC • Data Access Agreements (drawn up by external lawyers) • Processes for controlled datasets • Many of proposed procedures based on EAGDA recommendations and UKDA 5
- 6. Data Access T&F Group recommendations • October 2015 – produced set of recommendations: • Access levels embedded in ethics application process • Processes for handling restricted and controlled datasets piloted • Permanent DAC is formed • Further consideration around retention of copies of requested data • Consideration of data access levels at contracts stage (commercial research) • Passing through University committees – DAC soon to be approved 6
- 8. Data Access Levels 8 Open Restricted Controlled Closed Online and available to anyone without restriction. No sensitivities. Available to bona fide researchers. Repository staff will check credentials. Only available after panel of senior staff (DAC) have assessed request. Highly sensitive or older studies where appropriate permissions have not been sought. Data not available for sharing (except regulators) because of ethical, IPR, prior exclusive agreements or other constraints (requests handled by Information Rights Officer).
- 9. At the start of a project… • Researcher identifies likely access level(s) that will be used • Outlined in DMP • Allocated as part of ethics application • Included in contracts with external partners (where necessary) 9
- 10. At the data deposit stage… • Researcher assigns access level in metadata record (verified by RDS) • DOI landing page/repository record directs third party to RDS to request access form • Dataset itself is stored either within Research Data Storage Facility or with research group 10
- 11. When a request is received… 11 Restricted Controlled
- 12. Unforeseen challenges • Procedure for checking if applicants ‘bona fide’ • Procedure for retaining Data Access Agreements • Storage location of datasets • Supplying large datasets • Researchers with controversial papers 12
- 13. Advice for other institutions • Never underestimate time involved getting agreement across the institution • You’re unlikely to have covered every eventuality – be prepared to be reactive • Process will allow you to build better relationships with other University services • Your researchers will be grateful! 13
- 14. Future plans • Software system to deal with requests process (audit trail) • Online request form • Data Access Agreement repurposed by existing studies • Further procedures around commercial data (contract issues, IP) • Further knowledge and procedures around clinical data (esp. NHS) – where do sharing responsibilities lie? 14
- 15. Thank you for listening! data-bris@bristol.ac.uk @databris 15