MANAGING SENSITIVE DATA FOR SHARING − THE UK DATA ARCHIVE EXPERIENCE …………………………………………………… VEERLE VAN DEN EYNDEN …………………………………. UK DATA ARCHIVE UNIVERSITY OF ESSEX …………………………………. MANAGING AND CITING SENSITIVE DATA, BRITISH LIBRARY 29 OCTOBER 2012

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE TOPIC The challenges of managing and citing sensitive or personal data within the repository context Legal / ethical background UK Data Archive strategy Suggestions for citation & repositories

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE OUR STRATEGY Shared responsibility & trust relation: Researchers producing data Researchers (re)using data Data centre / archive / repository A COMBINATION OF GAINING CONSENT FOR DATA SHARING, ANONYMISING AND REGULATING ACCESS TO DATA WILL INCREASE THE POTENTIAL FOR MAKING PEOPLE-RELATED RESEARCH DATA MORE READILY AND WIDELY AVAILABLE

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE PERSONAL DATA Protection of personal information legislation : Data Protection Act 1998 relate to a living individual the individual can be identified from those data or from those data and other information include any expression of opinion about the individual

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE SENSITIVE DATA DPA 1998 defines ‘sensitive personal data’ : data regarding an individual's race or ethnic origin, political opinion, religious beliefs, trade union membership, physical or mental health, sex life, criminal proceedings or convictions,... Data that may incriminate a person Data a person prefers not to share with wider society e.g. business, income, health, medical details

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE DATA PROTECTION ACT PRINCIPLES Personal data should be: processed fairly and lawfully obtained and processed for a specified purpose adequate, relevant and not excessive for the purpose accurate not kept longer than necessary processed in accordance with the rights of data subjects e.g. right to be informed about how data will be used, stored, processed, transferred, destroyed, … & right to access information and data held kept secure not transferred abroad without adequate protection

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE DPA PRINCIPLES Personal data only disclosed if consent has been given to do so (exception e.g. legal reasons) Every individual has the right to access info and data held If data are anonymised (personal identifiers removed) then DP laws will not apply as these no longer constitute ‘personal data’ Data protection is not intended to, and does not, inhibit ethical research

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE DPA EXCEPTIONS Personal data collected as part of research: can be retained indefinitely (if needed) can be used for other purposes in some circumstances, but people should still be informed sensitive personal data can only be processed for research purposes if: explicit consent (ideally in writing) obtained; or medical research by health professional or equivalent with duty of confidentiality; or analysis of racial/ethnic origins for equal opportunities monitoring; or substantial public interest and not causing substantial damage and distress

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE FREEDOM OF INFORMATION ACT Right to request access to recorded information held by public sector organisations incl. research data from universities and publicly funded research organisations Sensitive / personal data - exceptions personal data cannot be requested information that is subject to a confidentiality agreement (e.g. signed consent form) or sensitive data held under restricted access by a data archive there must be a real likelihood that disclosure would open the public authority to legal action for breach of confidence

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE RESEARCH ETHICS duty of confidentiality towards informants/participants duty to protect participants from harm by not disclosing sensitive information duty to treat participants as rational, autonomous beings, who can decide (via informed consent) how the information they provide (in research) can be used, shared and made public duty to inform participants how information and data will be used, processed, shared, disposed of duty to wider society to make available resources produced by researchers with public funds e.g. data sharing required by research funders

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE SHARING & RE-USING SENSITIVE DATA Obtaining informed consent, also for data sharing, preservation, curation, re-use Protecting identities e.g. anonymisation, not collecting personal data Restricting / regulating access where needed (all or part of data) e.g. by group, use, time period Securely storing personal or sensitive data Consider jointly and in dialogue with participants

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE ROLE OF DATA ARCHIVES Provide trust Enable and support ethical re-use of data Rights framework Enable maximum accessibility / least restrictions – optimum access Disclosure checks and data anonmyisation checks

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE ROLE OF DATA ARCHIVES Regulate user access to data - UK Data Archive: archived data NOT in public domain data use for specific purposes after user registration (UK Federation) data users sign legally binding End User Licence e.g. not identify any potentially identifiable individuals stricter access regulations for sensitive / confidential data (case by case): access to approved researchers only data access authorisation from data owner prior to data release embargo for given time period secure access to data / data enclave Secure Data Service Metadata & documentation always open access

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE ROLE OF RESEARCHERS When ‘producing’ data: consider methodology e.g. collect personal data or sensitive data in research? consider data sharing & re-use during ethical review informed consent procedures anonymise data

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE DATA CITATION Metadata: provide info about rights, restrictions, access conditions, use conditions

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE REPOSITORIES Discuss with depositors: consent anonymisation choose right access Checks: anonymisation DPA breaches Legal framework – deposit licence & use licence Set access conditions (repository / depositor) Administer user access (depositor)

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE EXAMPLES Labour Force Survey End User Licence version Special Licence with extra variables birth month &year, NUTS2, 4-digit Standard Occupational Classification, unitary authority/local authority, urban/rural indicator British Household Panel Survey main survey End User Licence (GOR) Secure Data Service: geography variables, grid references Special Licence: geography variables, wards, SOAs SN 4596 Conflicts and Violence in Prison, methods undisclosive re. English prisons studied, minimal anonymisation, explicit detail in data Data Owner Permission access

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE EXAMPLES SN 5407 Health and Social Consequences of the Foot and Mouth Disease Epidemic in North Cumbria, (qualitative data) data archiving discussed extensively with participants, consent sought, minimal anonymisation (pseudonyms) standard End User Licence access to interview transcripts and diaries Data Owner Permission access to audio files 20 year embargo for selected interviews / diaries SN 5827 Rape in the 21st Century: Old Patterns, New Behaviours and Emerging Trends, (quant. data) some removal of variables, rounding of dates combined with Data Owner Permission access

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE ESRC DATA STORE Online (self) archiving system for ESRC-funded research data: manage, make accessible & discoverable

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE ESRC DATA STORE ROLES Depositors: upload data files & send for review & publication set access conditions all registered users collaborators only administer access to collaborators UK Data Archive: user registration (UK Federation) licensing: Deposit & End User Terms & Conditions disclosure & documentation checks advice to depositors publish data Users: agree to Terms & Conditions (click) prior to access request collaborator status for access

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE

……………………………………………………………………………………………………………………………….…………………………….. ……………………………………………………………………………………………………………………………….…………………………..… UK DATA ARCHIVE CONTACT RESEARCH DATA MANAGEMENT SUPPORT SERVICES UK DATA ARCHIVE UNIVERSIY OF ESSEX WIVENHOE PARK COLCHESTER ESSEX CO4 3SQ ……………………………….…………. T +44 (0) E