Feasibility Study Regarding Research Access to Nordic Microdata
Total Page:16
File Type:pdf, Size:1020Kb
15 August 2014 FEASIBILITY STUDY REGARDING RESEARCH ACCESS TO NORDIC MICRODATA 1/102 Content Chapter 1. Summary and recommendations Chapter 2. Background Chapter 3. Legal aspects Chapter 4. National practices for researchers’ access to microdata in the Nordic countries Chapter 5. Access to Nordic microdata for research purposes –a common model of Nordic cooperation Chapter 6. Data security - how to handle security breaches in a Nordic model of cooperation Chapter 7. Financing (price structures) Chapter 8. Metadata Chapter 9. International perspective Chapter 10. Future work 2/102 Appendices A. National documents on National legal framework Appendix A1- Denmark. Data protection laws and regulations Appendix A2 – Finland. Data protection laws and regulations Appendix A3 – Greenland. Data protection laws and regulations Appendix A4 – Iceland. Data protection laws and regulations Appendix A5 – Norway. Data protection laws and regulations Appendix A6 – Finland. Data protection laws and regulations B. Documents on common for the model of Nordic cooperation Appendix B1 - National approval requirements Appendix B2 – Application Form Appendix B3 - Security agreement between Researcher and NSI’s Appendix B4 - Transfer Agreement between NSI C. Technical specification of the THREE National IT systems Appendix C1 - The Danish remote access system Appendix C2 - The Finnish remote access system Appendix C3 - The Swedish remote access system D. Price structure for researchers’ use of the current three remote access systems Appendix D1 –Price structure in Denmark Appendix D2 - Price structure in Finland Appendix D3 - Price structure in Sweden E. Detailed proposal for application for funding of common metadata F. Glossary and definitions of terms 3/102 4/102 1 Summary and recommendations 1.1 Background In the Nordic countries there has been a long tradition of collecting data for statistical purposes from administrative systems. This tradition has led to data covering the entire national population by means of long-term data series of high quality, which are stored and used as basis for compiling statistics. All Nordic Statistical Institutions give national researchers access to de-identified microdata and register-based research is prominent in most Nordic countries. However, cross Nordic register research is still very rarely carried out. Within these premises the research community has expressed a demand for improved possibilities of joint access to Nordic microdata, which could ease the efforts necessary to carry out analyses involving register data from more than one country. The mechanism should aim to make access easier, as regards administrative procedures, communication and information about procedures, as well as technical and economic conditions. At their meeting in Rosendal 17-19 August 2013, the Nordic Chief Statisticians from Denmark, Finland, Greenland, Iceland, Norway and Sweden decided that their National Statistical Institutions (NSI’s) should conduct a feasibility study regarding access to Nordic microdata for research. Subsequently, the NSI’s from the Nordic countries appointed a Task Force to perform this feasibility study in question. In this report the Task Force presents the results from the feasibility study. The Task Force decided from the beginning to concentrate on developing a common model of cooperation for access to Nordic social microdata 1 gathered by the NSI’s themselves for statistical purposes. Thus, health data and data on enterprises are not considered in this first model of cooperation. They may, however, be included later, if desired. 1.2 The work of the Task Force As part of its work the Task Force has made a review of the legal frameworks for researchers’ access to microdata as well as a review of national practices for researchers’ access to microdata in the Nordic countries. These reviews show that the Nordic countries have a similar legal basis to give researchers access to microdata and that legislation in all Nordic countries does make it possible to give researchers access to microdata. It also allows the transfer of de-identified data from one NSI to another under certain conditions. The Nordic countries have also fairly similar authority structures and high levels of security in the way researchers are given access to microdata. Thus, in all Nordic countries access for researchers is only given to de-identified data and always after conducting a case-by-case evaluation of which data are 1 Data on demography, education, labour market, income, earnings and living condition (welfare indicators, social benefits, housing). 5/102 needed in the research projects (the so-called principle of “need to know ”) as well as the risks of damaging and harming the research objects. Likewise, the review shows that the four existing remote access systems used for research (Denmark, Finland, Sweden and Greenland) keep all microdata safely behind the firewalls of the NSI, researchers have to sign comprehensive security agreements to get access, and data can only be accessed through safe, encrypted lines. Furthermore, output is logged and controlled by the NSI’s in all four countries. However, some countries still use on-site access and even hand out data to researchers but the latter ways of giving data access will probably be phased out in the years to come, e.g. Norway is making plans to implement a remote access system (the RAIRD system). However, the review also shows some differences between the Nordic systems of research services. A conspicuous national difference is seen with regard to the legal requirements for approval needed before researchers can get access to microdata (Appendix B1). In addition, the ownership of certain social data differs between the countries. Comparable data might be owned by the NSI in one country and by separate institutions in other countries (e.g. data on sick leave) with the implication that not all NSI’s are able to permit research access to these data. Thus, other institutions have to be requested to give permission to access before these data can be included in a research project. Similarly, national differences are seen regarding what is considered as sensitive data that calls for approvals from ethical committees. Differences can also be seen in how the data access systems are organised in practice. For instance, some NSI’s have centralised units on Research Services to handle both the requests of researchers and the extraction of the relevant data while others have a more decentralised way of handling these tasks. The differences in the access systems and the different data owners, etc. make it is very difficult for researchers to get an appropriate overview of the existing data, what permissions/notifications should be provided in advance and how to apply for them. In addition, differences in relevant registers and variables are not systematically and comparably documented in the Nordic countries. These are some of the reasons why the research society has made demands for a more user-friendly system. Via NordForsk 2, they have suggested gathering Nordic register data in a Nordic Centre from where data can be accessed directly by researchers, and reducing the number of approvals needed from data protections agencies, ethical commissions and data-owners. Both suggestions require legal changes in most Nordic countries, and are therefore outside the mandate of this report. Furthermore, a simplified approval process, where one body (NSI) could give permission to the use of cross Nordic microdata, requires that all NSI’s give up their sovereignty to decide who can access their 2 NORDFORSK is an organization under the Nordic Council of Ministers that provides funding for Nordic research coopera- tion as well as advice and input on Nordic research policy. 6/102 national data and under which conditions. The Task Force has assessed that there is no basis for doing so for the time being. 1.3. Outcome The main outcome from the present feasibility study is a model of cooperation where certain common administrative processes and security rules are described, but were the approvals for access to data are at a national level. Together with this report the Task Force has made the following deliveries: • A review of the legal frameworks for researchers’ access to microdata (Chapter 3) • A review of the existing possibilities for access to microdata in the six Nordic countries (Chapter 4) • A description of the proposed common model of cooperation for data access (Chapter 5) • A draft for a common application form (Appendix B2) • Drafts of two essential legal documents: Common Nordic security agreement between researcher and NSI’s (Appendix B3) Data-transfer agreement between NSI’s (Appendix B4) • Description of some common rules for handling breaches in data security (Chapter 6) • A draftproposal for funding from NORDFORSK for common Nordic Metadata related to cross Nordic research (Appendix E) 1.4 Future work The Nordic Task Force recommends that the output from this feasibility study is handed over to the Nordic Network for Microdata and that this network tests the model for a period of 2-3 years or if shorter until experiences with at least 5 cross Nordic research projects with some geographical distribution of data hosting NSI, origin of data and researcher included have been gained. The test period should be divided into the following partially parallel phases: • A developing phase where a short introduction as well as guidelines to the Nordic Model of cooperation is prepared,