1. International data sharing via standards Felix Ritchie

2. The problem Lots of interest in cross-country microdata Chicken-and-egg problem a)Technical solutions not developed until legal arguments resolved b)Legal arguments not considered without the technology in place Limited enthusiasm in NSIs for experiments –Low benefits, high risks/barriers? Can we tackle (a) and/or (b)?

3. Solving (a) tech before law In practice there are existing examples: –Cross-border data: IPUMS Mesodata models (OECD, Eurostat) –Cross-border access IAB’s RDC-in-RDC Italian access to CBS data –etc… So precedents are there - is this a question of publicity?

4. Solving (b): can the conceptual landscape be changed? No universal view on appropriate tech… –but discussions about access often focus on technical solutions –Hard to have a discussion of ‘what’ and ‘why’ without ‘how’ Proposal: decouple principle from practice –Decision-making on principle –Moving from ‘system’ to ‘network’

5. Basics of decoupling Security is the basis for any legal agreement –we know what we want to achieve Specify aims in terms of abstract principles –Detailed, but not implementation specific Agree to standards –multiple levels, multiple dimensions –Implementation irrelevant Standards become basis for discussion

6. Standards: example risk factors Safe projects Safe people knowledge incentives Safe data Safe settings access point physical environment Safe outputs Mark on a scale of low=> high protection

7. Standards: example assessment 0 1 2 3 4 Safe people - incentives Administrative processes only Check researcher background Written assent to conditions of access Passive training Active training Safe data No data protection Removal of direct idenfiers Identification within RDC unlikely Identification outside RDC unlikely Public use microdata Safe outputs No checks Random checks Random plus targeted partial checking Full checking except for ‘experienced’ Full checking

8. Standards: assessments applied Safe… projects people – knowledge people – incentives data settings – access settings – env. outputs VML 4 4 3 1 3 4 4 SDS 3 4 4 1 3 3 4 IPUMS 0 1 2 4 0 0 0 Lissy 3 2 2 3 4 1 2

9. Standards: assessments applied Safe… projects people – knowledge people – incentives data settings – access settings – env. outputs Euro “RDC” minimum 3 3 3 1 3 2 3 Euro “RDC” best practice 4 4 4 1 3 3 4

10. Why focus on standards? Agreement easier –No commitment required –No prescription on what has to be done –No ‘favoured’ technology Focuses on what aims of security are Easier to align with corporate goals

11. Why stop at security? Legal/policy standard: –“we will make our data available internationally as long as the legal basis exists and a secure solution exists”

12. Summary: the long term vision A common framework for defining standards –Covering all forms of release incl. licensing/public use? A network of secure solutions auditing to those standards –Decentralised, independent, innovative Decision-making based on principles –“We view a facility of security level X or above will meet our security requirements”

13. Questions Can we do this? How do we do this? Will it work? Does it have to work as described? –Is this a useful way forward anyway?

14. And… Q. What’s E.T. short for? A. Because he’s only got little legs

15. Felix Ritchie felix.ritchie@ons.gsi.gov.uk