Present 

 Committee Members  

• Paul Boyle (Chair)
• Ann Berrington (Independent Member) (present for items 3, 4 and 5)
• Martin Bowyer (Central Digital and Data Office)
• Mark Brewin (HM Revenue & Customs) (present for items 3, 4 and 5)
• Michael Chapman (NHS England)
• Andrew Garrett (Independent Member)
• Emma Gordon (Independent Member)
• Roger Halliday (Independent Member)
• Sarah Henry (Office for National Statistics)
• Geraint Jowers (HM Revenue & Customs)
• Paul Lodge (Department for Work & Pensions)
• Alistair McAlpine (Scottish Government)
• Andrew McHugh (University of Glasgow)
• Alexander Singleton (Independent Member)
• Philip Wales (Northern Ireland Statistics and Research Agency)

Advisors  

• Jason Riches (Legal Advisor, ONS)
• Simon Whitworth (Data Ethics Advisor, UK Statistics Authority)
• Ross Young (Data Protection Officer, UK Statistics Authority)

In Attendance  

• Sarah Fisher (ONS) for Item 1
• Cal Gott (ONS) for Item 1
• Edward Bextor (UKSA) for Item 2
• John Delaney (ONS) for Item 2
• Petros Saravakos (UKSA) for Item 2

UK Statistics Authority  

• Lewis Hopcroft 
• Natasha Kong  

Apologies  

• Chris Dibben (Independent Member)
• Tricia Dodd (Independent Member)
• Stephanie Howarth (Welsh Government) 

1. Introductions

1. The Chair welcomed the members to the twenty-eighth meeting of the Research Accreditation Panel (RAP).
2. The Chair introduced Andrew McHugh, Geraint Jowers and Martin Bowyer to the committee.
3. The Chair also welcomed Philip Wales to the committee, replacing Siobhan Carey as the NISRA’s Chief Executive and Registrar General

2. Minutes and Matters Arising from Previous Meetings

1. Members approved the minutes of the meeting held on 6 December 2022.
2. Chris Dibben, Tricia Dodd and Stephanie Howarth gave their apologies.
3. Natasha Kong updated the meeting with progress on actions from previous meetings. All actions were complete or otherwise in progress.

3. DEA Project Accreditation: Revised Project Accreditation User Testing Findings

1. Sarah Fisher (Head of IDS Customer Support Development, ONS) presented on the development of the Integrated Data Service (IDS) project application form and user testing findings. The IDS is a cross-government service which securely enables co-ordinated access to a range of high-quality data to inform policy decisions and improve public services.
2. As the IDS is committed to processor accreditation under the Digital Economy Act (DEA), the project application form has been designed to ensure research projects meet the requirements for access to data under the DEA Research Strand and direct RAP consideration, as well as to provide a more streamlined experience to users. The IDS is currently undertaking user testing of the form with key user groups such as: (1) researchers and analysts who are accessing data under the DEA and (2) data owning government departments that will be making their data available in the IDS via the DEA.
3. Sarah Fisher presented the revisions made to the form to streamline the process, and the feedback gathered from user research, content design and data owners. These were the key areas that were discussed:
   1. The DEA research project accreditation application and the UKSA’s ethics self-assessment tool have been merged into one form, meaning the data ethics of a project is considered during the project accreditation process without researchers needing to complete an additional ethics assessment.
   2. All information collected that was duplicated within other areas of the data access process has been removed to improve efficiency.
   3. Access to the data catalogue during the project application process.
   4. Questions surrounding methodology were designed to move away from requiring an in-depth explanation of research methodology. Instead, responses can be provided by researchers and analysts through predominantly multiple choice and tick box answers with follow on free text questions to justify the options selected to ensure that UKSA and the RAP are being provided with the information they require to make an efficient accreditation decision on research projects.
   5. User testing feedback on the form regarding navigation, visual design, content (cognitive load) and accessibility, and the resulting reviews and developments made to the form.
4. The Panel welcomed the presentation and made the following points in their discussion:
   1. Clarification on whether it is planned to roll out this revised form to the network of DEA accredited processing environments. The Secretariat clarified that it was an end goal, but the IDS could usefully undertake further engagement with other key stakeholders to ensure that the form is suitable for these stakeholders’ needs.
   2. Suggested that the IDS team engage with ESRC’s workshop with stakeholders (researchers and government departments) regarding project applications to be held on 22 April 2023. This is so that the IDS can obtain more extensive feedback from a broader set of stakeholders which should be presented to the June 2023 RAP meeting.
   3. Requested further updates about any relevant or related issues arising from the Central Digital and Data Office’s (CDDO) service assessment of IDS and to present this to the June RAP meeting.

ACTION: The IDS team to seek involvement in the ESRC workshop on 22 April 2023 and to present feedback obtained from stakeholders about the project application form to the June 2023 RAP meeting.

ACTION: The IDS team to present the feedback obtained from the CDDO service assessment of IDS to the June RAP meeting.

5. While the Panel was supportive of streamlining the project application process, the Panel made clear that it is important to ensure that there is sufficient information for the RAP to assess a project’s compliance with the DEA Research strand. Where possible, any streamlining of the research application process under the DEA should also be discussed and consulted on with the RAP.
6. In particular, the RAP suggested the IDS to reconsider the way in which research methodology information is collected under this revised application process to ensure that the RAP is provided with sufficient information to assess a research project’s methodology, and that researchers can benefit from the expertise that the RAP can provide in terms of methodological advice and support.

ACTION: The IDS team to share updates made to IDS application form and consult with the RAP, via the Secretariat, to ensure that the RAP is provided with sufficient information to accredit a project under the requirements of the DEA Research strand.

ACTION: The IDS, with support from the Secretariat to reconsider the way in which research methodology information is collected under this revised application process, so that it strikes a balance between the aims of streamlining a process and ensuring that the RAP is provided with sufficient information to assess a research project’s methodology.

4. DEA Processor Accreditation: UK Longitudinal Linkage Collaboration (UK LLC) Accreditation Report

1. John Delaney (DEA Processor Accreditation Security Assessor, ONS) and Petros Saravakos (DEA Processor Accreditation Capability Assessor, UKSA) presented the Panel with an overview of the accreditation report for the UK Longitudinal Linkage Collaboration (UK LLC). The accreditation report provides a summary of the assessors’ findings and recommendations regarding UK LLC’s compliance against the DEA processor accreditation framework, which was agreed by the Research Accreditation Panel and reflects the DEA Code of Practice.
2. Overall, the maturity opinion for UK LLC is Capable.
   1. For security, UK LLC is operating nine (9) controls at a Mature level, and six (6) at a Capable level.
   2. For capability, UK LLC is operating one (1) control at a Maturing level, and four (4) controls at a Capable level.
3. The assessors recommended that the Panel should accredit the UK LLC for the preparation and provision of data under the DEA.
4. The Panel was supportive of the findings and recommendation provided in the However, they requested clarification on a few points:
   1. Whether the assessment looked at not only UK LLC’s policies, but also the implementation of these policies. The assessors confirmed that the assessment took account of the end-to end process and UK LLC’s evidence for policy implementation.
   2. Whether scalability and expansion would be an issue for UK LLC and how was this risk could be addressed and managed. The assessors clarified that this risk was managed as there are other safeguards available that enables concerns or improvements regarding scaling to be spotted. This risk is also mitigated by ad hoc audits and metrics which would be reported to the Panel.
   3. If an annual review was sufficient and if more frequent reviews would be needed. The assessors confirmed that an annual review is sufficient, as UK LLC has sufficient checks to ensure their system is robust and has further improvements planned for their next accreditation review, such as guidance on specific datasets and MIs on provided evidence. The assessors have also confirmed that there will be ad hoc audits conducted for areas of concern.
5. The Panel also noted the feedback from UK LLC regarding the DEA accreditation processor review process, in particular the data capability framework as it promotes organisational maturity and drives up standards.
6. The Panel agreed to accredit UK LLC for the preparation and provision of data under Chapter 5 of Part 5 of the Digital Economy Act, based on the evidence provided in the accreditation report.

ACTION: The Secretariat to write to UK LLC to inform them of their accreditation under the Digital Economy Act 2017.

 5. Any Other Business

1. The Chair informed the Panel that the preparation of evidence by the IDS for accreditation as a DEA-accredited processor remains ongoing. Once the security and data capability accreditors have had the opportunity to undertake their reviews and to prepare a report for RAP, the Secretariat will arrange a further RAP meeting to consider this item.
2. To reach an accreditation decision, the Panel requested updates from the IDS regarding actions from the December 2022 RAP meeting, in particular how IDS’s proposed changes to research accreditation operations are compliant with the DEA’s Research Code of Practice and Accreditation Criteria.

ACTION: The Secretariat to arrange an ad-hoc RAP meeting to discuss the IDS accreditation once it is ready. In this meeting, the IDS to update the RAP on the actions from the December 2022 RAP meeting.

3. The Panel noted that the recommendations from Sir Patrick Vallance’s review into pro-innovation regulation of digital technologies were accepted in the Chancellor’s Spring 2023 Budget. The Panel suggested the Secretariat to prepare a paper for the June 2023 RAP meeting on whether the recommendations would be applicable to the DEA Research strand and its operations.

ACTION: The Secretariat to produce a paper on the recommendations from Sir Patrick Vallance’s review into pro-innovation regulation of digital technologies and their applicability to the DEA Research strand and its operations.

4. The Chair noted the ‘for information’ reports provided. The following points were raised:
   1. The Panel noted the usual report of accreditation processes undertaken by the UKSA and overseen by the Panel in the interim period between meetings. The Secretariat noted the information provided within these reports will be reviewed to ensure the RAP is receiving the evidence it requires in the most streamlined way.
   2. The Panel noted it would be useful to know why there has been a reduction in DEA project applications in the preceding months to determine if this is a strategic issue that the Panel must be made aware of. The Secretariat agreed to investigate this issue and report back to the Panel.

ACTION: The Secretariat to investigate the reason for the reduction in DEA project applications and update the RAP.

5. The Research Accreditation Panel will meet next on 15 June 2023.