The governance of data access
This section of the Policy and Guidance on Sharing of Research Data from Population & Patient Studies covers the criteria and processes for governing sharing and access requests for research data.
The graph below illustrates the possible principal steps and work flows in processing a data-sharing or access request, based on existing MRC cohort studies, without prescribing a standard workflow.
Requirements
R8. Study governance of access, the criteria and processes, are appropriate and proportionate to the nature and scale of the study, the level of risk and the likely demand for access.
R9. The access process includes independent advice and/or oversight.
R10. The criteria and processes governing access are transparent and readily discoverable.
Expectations
Transparency
1. How a study manages access is transparent, informative and readily discoverable, in a manner sensitive to the interests of the cohort participants.
- Summary information on the study website covers the criteria by which sharing/access requests are assessed as well as the processes and timeframe by which the requests are assessed.
- Additional details on how data selection and use is facilitated by the study team are readily available on the website (see Facilitation).
2. Governance is effective, appropriate and proportionate to the following:
- Anticipated demand, e.g. number, scale and complexity of data-sharing requests
- The lifecycle stage of the study (collection, PI-led primary analysis, curation of the data as an available resource)
- Risks related to the sensitivity of the data (e.g. the potential for harm and distress to participants from the release of certain data or deductive disclosure)
- The time period over which the data are expected to have research value (especially for genetic analyses data can become outdated as new assay techniques are developed)
- The anticipated scale of study team facilitation and resources required to meet the request.
Roles and responsibilities
3. The Study policy defines the role of the Director/PI and study staff in decisions about access and facilitating sharing. It also sets out the responsibilities on external users (which are reflected also in the Data-sharing Agreement).
Independent advice and oversight
4. The access governance process is subject to independent oversight of (a) external requests for data (and related materials, such human tissue and DNA, if appropriate); and (b) new investigation requests from within the study team for uses that are not already approved by MRC (or other relevant funder or sponsor) as part of the study’s research programme.
5. The terms of reference and working method of the reviewers are transparent. Two possible models for the review process are given below. The rules of public accountability operate, such that an external advisor plays no part in decisions in which they have an interest by virtue of their professional or other relationships.
6. The review process may provide for additional, external advice on specialist topics if the need arises.
7. The policy sets out the study arrangements for re-review or other form of internal appeal after a decision not to provide the data (or not as requested). The policy includes provision for the details of a request, the review process and outcome to be referred to the study’s MRC programme officer in the event that a review of the decision and process by the independent committee or advisor does not resolve concerns or dissatisfaction.
8. To achieve efficiency and consistency, studies may choose to share a common oversight committee (or advisor). In doing so they should consult their MRC programme manager.
Resources
- The eight principles of the Data Protection Act (1998).
- The NCRI has created a template for access policy development for data and tissue samples.
- The Digital Curation Centre has developed guidance on how to appraise and select research data for curation and sharing.
- Guidance on controlling access to shared research data is available from the UK Data Archive.
