New report examines safeguards for businesses to access public sector data

The review, which was commissioned by the Scottish Government to inform the Unlocking the Value of Data Programme, describes the current arrangements experienced by industry in accessing public sector data for research in Scotland.

It also highlights a series of issues that need further examination to strike the right balance between greater research use and value coming from Scotland’s data with public view on appropriate uses of their data before they become operational policies.

Interviews with actual and potential users of data working in industry, academia and the public sector, with those working in Scotland’s Trusted Research Environments (also known as Safe Havens), with data owners, and panels who support decision making about use of public sector data have informed this review.

In addition, a series of workshops were arranged by the Innovative Healthcare Delivery Programme (IHDP) for private sector organisations wanting to use data. The review has predominantly focused on the use of health data by the private sector mainly because this is the area with the most clearly articulated industry demand for data relating directly to an individual, place or business (also known as case level data) to enable research in the public good.

Also included in this review, is a case study from the Industrial Centre for Artificial Intelligence Research in Digital Diagnostics (iCAIRD), which brings to life the complexity involved in commercial companies accessing public sector data for wider benefit.

Five Safes

The review found that virtually all Scottish research using routinely collected sensitive data about people happens in one of the five Safe Havens. All of the Safe Havens operate within the international best practice Five Safes framework for helping make decisions about making effective use of case level sensitive data. The five safes are:

• Safe projects: Is this use of the data appropriate, lawful, ethical and in the public interest?
• Safe people: Can the user be trusted to use it in an appropriate manner?
• Safe data: Does the data itself contain sufficient information to allow confidentiality to be breached?
• Safe settings: Does the Safe Haven limit unauthorised use or mistakes?
• Safe outputs: Is the confidentiality maintained for research outputs coming out of the Safe Haven?

Within this framework, ways of working are subtly different across the Safe Havens. This makes it difficult, at times, for researchers to navigate complex projects requiring data from different places.

Future work – areas to clarify and explore

A loss of trust in the use of public sector data for public benefit would set back the ability to use data to improve wellbeing through research, so listening and engaging with the general public on how their data is used and kept secure should be central to any future policies.

The current processes for commercial access to public data need to be refined and industry voices strongly suggest the system in Scotland should be aligned with the rest of the UK and globally, where possible – this is beneficial to researchers and would give them clarity.

Issues around transparency, governance and finance were highlighted as important factors for policy considerations.

Professor Roger Halliday, CEO of RDS and report lead, said: “The public expect to see stringent oversight, governance, and safeguard arrangements around private sector use of public sector data, especially concerning independent scrutiny of proposed uses of data, transparency and accountability processes, and arrangements for data security and safety, consent, and confidentiality.

“However, this review suggests the precise nature of what the safeguards should be is contested, and it may be that the nature of the safeguards is less important than the fact that effective safeguards exist.” 

Questions remain about how the private sector pay for access to Scottish data for research and how they might share benefits that result from that access and how new technologies used by many firms would be handled.

Professor Halliday added: “Work is required to develop clear aligned approaches that balance public concerns about appropriate use of their data with greater research that can improve lives – this review provides the groundwork for that work to take place.”