Managing Scotland’s public sector data for public benefit

The work is being carried out under the Administrative Data Research Scotland (ADR Scotland) partnership, which EPCC has been part of since 2018. 

Five Safes

The initiative involves working with sensitive and personal data and it is underpinned by the guiding principles of the “Five Safes” framework developed by the Office for National Statistics (ONS). This framework defines five dimensions of safety that must be considered when enabling researchers to access sensitive data:

• Safe data: data is treated to protect any confidentiality concerns.
• Safe projects: research projects are approved for the public good.
• Safe people: researchers are trained and authorised to use data safely and may need to undergo background checks.
• Safe settings: a secure environment prevents unauthorised use.
• Safe outputs: screened and approved outputs that are non-disclosive.

National Safe Haven

EPCC’s role is to provide a safe setting for hosting the data sets that are held and for the researchers to carry out their analysis. This safe setting is the National Safe Haven, a computing environment that meets stringent physical and digital security requirements. The NSH operation has been accredited by the UK Statistics Authority (UKSA) under the Digital Economy Act 2017 (see link below).

Protecting identities

A key part of the ADR Scotland service is to provide the ability to link personal data from different sources without revealing an individual’s identity. This is carried out in a secure manner by means of separating roles and activities between NRS, which carries out indexing of individuals but does not handle ‘payload’ data, and EPCC which does not hold the personal identifiers. The resulting workflow, designed by the partners, allows EPCC to connect records for the same person using a look-up from NRS and pass these on (provided they pass the ‘safe outputs’ disclosure check) to the researcher. Neither the researchers nor anyone at EPCC ever knows the identities of the individuals in a study cohort.

The partnership has been slowly building up the datasets that are held ready for linkage, and the service is being managed by Research Data Scotland (RDS) as part of the Researcher Access Service. Based on experience gained from early operation of the service, the partners are looking to streamline and automate the processes, continually evaluating any change against the Five Safes and subject to risk analysis.

When the service is operating at scale, it will enable research on a suite of critical issues in Scotland, including children's lives and outcomes, lifelong health and wellbeing, health and social care, poverty and fair work, and building safer communities.

Links

ADR Scotland (Administrative Data Research Scotland): 
https://www.adruk.org/about-us/our-partnership/adr-scotland

Five Safes framework
https://ukdataservice.ac.uk/help/secure-lab/what-is-the-five-safes-framework

NSH accreditation by the UK Statistics Authority (UKSA)
https://uksa.statisticsauthority.gov.uk/digitaleconomyact-research-statistics/better-access-to-data-for-research-information-for-processors/list-of-digital-economy-act-accredited-processing-environments/#pid-edinburgh-parallel-computing-centre

Researcher Access Service
https://www.researchdata.scot/our-work/current-projects/researcher-access-service