Open Data and GDPR in Science: Lab Meeting Insights

As open as possible and as closed as necessary. Open data and GDPR VCG lab meeting & discussion 15 Nov 2018 1

How to be Open in Science Panel Kora Korzec, Community Manager, eLife Robert Kiley, Head of Open Research, WT Daniel van Strien, Research Data Support, UCL 1. Open science 2. Open data 3. What in the world do we do? 4. Concluding thoughts Discussions with... Dr Kirstie Whitaker, Research Fellow, Turing Institute Josh Cowls, PhD student, OII & Turing Institute Daniel van Strien, Data Management, UCL Myriam Fellous-Sigrist, Data Management, UCL 2

Open Science is... [T]he practice of science in such a way that others can collaborate and contribute, where research data, lab notes, and other research processes are freely available, under terms that enable reuse, redistribution, and reproduction of the research and its underlying data and methods. FOSTER PLUS website: https://www.fosteropenscience.eu/taxonomy/term/6 3

Open data allows researchers to verify our work, and conduct analyses that could not be carried out by one group alone. - Dr Whitaker Whitaker, K. (2017, February 1). Checking your working: a reproducible and replicable neuroimaging study of adolescent brain development. (Version 1). figshare. https://doi.org/10.6084/m9.figshare.4602232.v1 4 https://blogs.plos.org/neuro/2018/01/31/open-science-sharing-is-caring-but-is-privacy-theft-by-david-mehler-and-kevin- weiner/

Collaboration Why should we care? Speed of scientific progress 5

Routes to Open Data technically open legally open Findable Accessible Interoperable Reusable Non-GDPR GDPR https://www.ukdataservice.ac.uk/news-and-events/newsitem/?id=4615 https://www.nature.com/articles/sdata201618 https://www.fairdata.org.uk/ https://upload.wikimedia.org/wikipedia/commons/b/b7/Implementing_FAIR_Data_Principles_-_The_Role_of_Libraries.pdf 6

Two Types of Data Non-GDPR GDPR Where data has been robustly anonymised it can be released. 7

Anonymised Data Non-GDPR Negligible risk of collapsing Recital 26 definition of anonymisation: information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. 1. Directly identifiable 2. Indirectly identifiable https://www.ucl.ac.uk/legal-services/gdpr-anonymisation-pseudonymisation http://ukanon.net/ukan-resources/ukan-decision-making-framework/ http://ukanon.net/wp-content/uploads/2015/05/The-Anonymisation-Decision-making-Framework.pdf https://ico.org.uk/media/1061/anonymisation-code.pdf 8

Two Types of Data Non-GDPR GDPR Where data has been robustly anonymised it can be released. While there may be incentives for some organisations to process data in anonymised form, this technique may devalue the data, so that it is no longer of useful for some purposes. https://www.ucl.ac.uk/legal-services/gdpr-anonymisation-pseudonymisation 9

Pseudonymised Data GDPR 1. Consent 2. Contract 1. Legal considerations 3. Legal obligation 2. Ethical considerations 4. Vital interest 5. Public task https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful- basis-for-processing/public-task/ 6. Legitimate interests UCL is a public authority for the purposes of data protection legislation and it has taken the view that the public task basis should generally be relied upon in a research context. https://www.ucl.ac.uk/legal-services/sites/legal-services/files/guidance_paper_for_researchers_0.pdf 10

The Motivated Intruder Test Disgruntled employee Your worst research enemy The 2nd place applicant you beat for funding Someone who wants to take down UCL Investigative journalists https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/public-task/ https://www.ucl.ac.uk/legal-services/gdpr-anonymisation-pseudonymisation 11

Processing personal data as a public interest 1. Legal basis 2. Identify risk (Motivated Intruder Test) 3. Decide if further action is needed 4. Document all decisions with a responsible party Sharing some pseudonymised data is legal as long as you consult with your institution, funders, etc. and document your informed decisions. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/public-task/ https://ico.org.uk/for-organisations/resources-and-support/data-protection-self-assessment/ https://www.openaire.eu/legal-barriers-to-open-data-sharing 12

Processing personal data as a public interest 2. Ethical considerations a. UCL integrity of data statement b. Researcher accountability to participants, funders, and universities Zero risk is not a realistic possibility if you are to produce useful data. It is easy to say that anonymisation is impossible and that re-identification can always take place. It is just as easy to be complacent about the privacy risk posed by the availability of anonymised data. It is more difficult to evaluate risk realistically and in the round and to strike a publicly acceptable balance between access to information and personal privacy. The Anonymisation Decision-Making Framework 13

Main Points Openness is good. Keep legal and research jargon separate. Consult and document Share what you can - it might be more than you think. Plan ahead. As open as possible and as closed as necessary. 14

Resources Data & Coding Tutorials https://software-carpentry.org https://data-carpentry.org https://www.coursera.org/specializations/jhu-data-science https://www.coursera.org/learn/python/home/info Blogs https://www.nature.com/nature/journal/v529/n7584/full/nj7584-117a.html#ref1 https://www.nature.com/naturejobs/science/articles/10.1038/nj7461-243a GDPR https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2016.119.01.0001.01.ENG https://www.europeandataportal.eu/en/highlights/protecting-data-and-opening-data http://www.open.ac.uk/library-research-support/sites/www.open.ac.uk.library-research-support/files/files/Guide_RDM_GDPR- HowDoesThisAffectRDM.pdf https://www.ukri.org/files/about/policy/ukri-gdpr-faqs-pdf/ https://mrc.ukri.org/documents/pdf/gdpr-key-facts-for-research/ Anonymisation http://ukanon.net/wp-content/uploads/2015/05/The-Anonymisation-Decision-making-Framework.pdf https://ico.org.uk/media/1061/anonymisation-code.pdf Specific Open Data Info https://libraryguides.umassmed.edu/OpenAccess/OpenData http://opendatahandbook.org/ 15

Resources continued Great tools https://www.protocols.io/view/meld-protocol-3-freesurfer-quality-control-pdadi2e (Open methods) https://figshare.com/ (Open lectures) https://github.com/ (Open code) https://dmponline.dcc.ac.uk/ (Data management plans) http://researchonline.lshtm.ac.uk/3716764/1/WellcomeTrust_DMP_Guide.pdf (WT data managemenet plan example) UCL Support Resources https://www.ucl.ac.uk/isd/services/research-it-services https://ethics.grad.ucl.ac.uk/ https://www.ucl.ac.uk/library/research-support/research-data-management http://www.ucl.ac.uk/library/research-support https://www.ucl.ac.uk/legal-services/sites/legal-services/files/guidance_paper_for_researchers_0.pdf Wellcome Trust Stuff https://wellcome.ac.uk/sites/default/files/governance-of-data-access-eagda-jun15.pdf https://wellcomeopenresearch.org/about/policies#dataavail Other stuff https://thenib.com/repeat-after-me https://www.newyorker.com/tech/annals-of-technology/sharing-is-caring-is-sharing https://www.bbc.co.uk/programmes/p051b9zg https://ico.org.uk/for-organisations/resources-and-support/data-protection-self-assessment/ https://www.neuroscience.cam.ac.uk/news/article.php?permalink=61c7ae59f5 16