International data sharing via standards

1. International data sharing via standards • Felix Ritchie

2. The problem • Lots of interest in cross-country microdata • Chicken-and-egg problem • Technical solutions not developed until legal arguments resolved • Legal arguments not considered without the technology in place • Limited enthusiasm in NSIs for experiments • Low benefits, high risks/barriers? • Can we tackle (a) and/or (b)?

3. Solving (a) tech before law • In practice there are existing examples: • Cross-border data: • IPUMS • Mesodata models (OECD, Eurostat) • Cross-border access • IAB’s RDC-in-RDC • Italian access to CBS data • etc… • So precedents are there - is this a question of publicity?

4. Solving (b): can the conceptual landscape be changed? • No universal view on appropriate tech… • but discussions about access often focus on technical solutions • Hard to have a discussion of ‘what’ and ‘why’ without ‘how’ • Proposal: decouple principle from practice • Decision-making on principle • Moving from ‘system’ to ‘network’

5. Basics of decoupling • Security is the basis for any legal agreement • we know what we want to achieve • Specify aims in terms of abstract principles • Detailed, but not implementation specific • Agree to standards • multiple levels, multiple dimensions • Implementation irrelevant • Standards become basis for discussion

6. Standards: example risk factors • Safe projects • Safe people • knowledge • incentives • Safe data • Safe settings • access point • physical environment • Safe outputs • Mark on a scale of low=> high protection

7. Standards: example assessment • Safe people - incentives • Administrative processes only • Check researcher background • Written assent to conditions of access • Passive training • Active training • Safe data • No data protection • Removal of direct idenfiers • Identification within RDC unlikely • Identification outside RDC unlikely • Public use microdata • Safe outputs • No checks • Random checks • Random plus targeted partial checking • Full checking except for ‘experienced’ • Full checking • 0 • 1 • 2 • 3 • 4

8. Standards: assessments applied • Safe… • projects • people – knowledge • people – incentives • data • settings – access • settings – env. • outputs

9. Standards: assessments applied • Safe… • projects • people – knowledge • people – incentives • data • settings – access • settings – env. • outputs

10. Why focus on standards? • Agreement easier • No commitment required • No prescription on what has to be done • No ‘favoured’ technology • Focuses on what aims of security are • Easier to align with corporate goals

11. Why stop at security? • Legal/policy standard: • “we will make our data available internationally as long as the legal basis exists and a secure solution exists”

12. Summary: the long term vision • A common framework for defining standards • Covering all forms of release incl. licensing/public use? • A network of secure solutions auditing to those standards • Decentralised, independent, innovative • Decision-making based on principles • “We view a facility of security level X or above will meet our security requirements”

13. Questions • Can we do this? • How do we do this? • Will it work? • Does it have to work as described? • Is this a useful way forward anyway?

14. And… • Q. What’s E.T. short for? • A. Because he’s only got little legs

15. Felix Ritchie • felix.ritchie@ons.gsi.gov.uk