Present 

 Committee members  

• Paul Boyle (Chair)
• Martin Bowyer (Central Digital and Data Office)
• Mark Brewin (HM Revenue & Customs)
• Michael Chapman (NHS England)
• Chris Dibben (Independent Member)
• Steve Ellerd-Elliott (Deputising for Paul Lodge, Department for Work & Pensions)
• Andrew Garrett (Independent Member)
• Roger Halliday (Independent Member)
• Geraint Jowers (HM Revenue & Customs)
• Alistair McAlpine (Scottish Government)
• Andrew McHugh (Independent Member)
• Alexander Singleton (Independent Member)

Advisors  

• David Butler (Deputising for Keith Nicholson (Security Advisor, ONS))
• Ross Young (Data Protection Officer, UK Statistics Authority)

In Attendance  

• Edward Bextor (UKSA) for Items 2 & 3
• Colin Farrell (ONS) for Item 2
• Ed Humpherson (OSR) for Item 4
• Matt Short (UKSA) for Item 5

UK Statistics Authority  

• Lewis Hopcroft  

Apologies  

• Ann Berrington (Independent Member)
• Tricia Dodd (Independent Member)
• Emma Gordon (Administrative Data Research UK)
• Sarah Henry (Office for National Statistics)
• Stephanie Howarth (Welsh Government)
• Philip Wales (Northern Ireland Statistics and Research Agency)

1. Minute and matters arising from the previous meeting

1. The Chair welcomed the members to the thirty-second meeting of the Research Accreditation Panel (RAP).
2. Members approved the minutes of the meeting held on 7 December 2023.
3. Ann Berrington, Tricia Dodd, Emma Gordon, Sarah Henry, Stephanie Howarth and Philip Wales gave their apologies.
4. Lewis Hopcroft updated the meeting with progress on actions from previous meetings. All actions were complete or otherwise in progress.

2. DEA Processor Accreditation Annual Reviews

UK Longitudinal Linkage Collaboration (UK LLC)

1. Colin Farrell (DEA Processor Accreditation Security Assessor) and Edward Bextor (DEA Processor Accreditation Capability Assessor) presented the Panel with the outcomes of the UK LLC’s processor accreditation annual review against the Digital Economy Act 2017 (DEA) processor accreditation framework, which was agreed by the Research Accreditation Panel and reflects the DEA Code of Practice.
2. Overall, the maturity opinion for UK LLC is Capable. Of the controls review as part of this assessment:
   1. In terms of security, UK LLC is operating five control areas as Capable and ten control areas as Mature, which is summarised as a Capable level of maturity.
   2. In terms of capability, UK LLC is operating Data Governance (two controls) and Service Provision (one control) as Capable. Research Governance (two controls) and Processor Accreditation Obligations (four controls) control area as Maturing, which is summarised as a Capable level of maturity.
3. Edward Bextor informed the panel of new technology which UK LLC is looking to implement to improve how researchers request the data they wish to access in the TRE. It was recommended that an ad-hoc assessment of the pre-release version of this new technology is undertaken to ensure it meets UK LLC’s DEA accreditation.
4. The assessors recommended that the Panel should allow the continuation of UK LLC’s accreditation under the DEA and provided clarity to the RAP on a number of issues raised in the report, namely on findings relating to physical security and the implementation of feedback provided as part of the UK LLC’s initial accreditation.
5. The Panel supported the findings and recommendations provided in the report and agreed to continue UK LLC’s accreditation for the preparation and provision of data under Chapter 5 of Part 5 of the Digital Economy Act, based on the evidence provided in the accreditation report. This accreditation is set to expire on 17 March 2028.
6. Given the significant volume of information provided in accreditation reports, the RAP requested that the DEA accreditation assessors review reporting templates to ensure clarity in the presentation of findings following such reviews.

Action:

Secretariat to write to UKDA to confirm the continuation of accreditation under the Digital Economy Act 2017, following the successful completion of this annual review.

Action:

The assessors to review accreditation reporting templates to ensure clarity when presenting pertinent control findings in future DEA accreditation review reports.

UK Data Archive (UKDA)

1. Colin Farrell and Edward Bextor presented the Panel with the outcomes of the UKDA’s processor accreditation annual review against the DEA processor accreditation framework, which was agreed by the Research Accreditation Panel and reflects the DEA Code of Practice.
2. Overall, the maturity opinion for UKDA is Capable.
   1. In terms of security, UKDA are operating eleven control areas as Mature and four control areas as Capable. Which is summarised as a Capable level of maturity.
   2. In terms of capability, under the controls reviewed, UKDA is operating Research Governance (two controls), Data Governance (one control) and Processor Accreditation Obligations (three controls) controls as Capable and People Capability (one control) and Service Provision (one control) control area as Maturing, which is summarised as a Capable level of maturity.
3. Edward Bextor informed the Panel that as part of this review, the UKSA became aware that UKDA had the ability to provide a specific function in line with data preparation under the Research Code of Practice and Accreditation Criteria. As the UKSA is currently accredited for the provision of data under the DEA Research powers, it was recommended that UKDA apply for the preparation of data accreditation, subject to the appropriate controls, should they wish to perform this function on behalf of data providers in the future.
4. Subject to the above, the assessors recommended that the Panel should allow the continuation of UKDA’s accreditation for data provisioning under the DEA.
5. The Panel was supportive of the findings and recommendations provided by the DEA assessors and agreed to continue UKDA’s accreditation for the provision of data under Chapter 5 of Part 5 of the Digital Economy Act. This accreditation is set to expire on 31 March 2025. The RAP agreed that should the UKDA wish to employ a specific data preparation function under the DEA Research powers in the future, the UKDA must apply to the UKSA for proportionate data processing accreditation in scope of the processing activities undertaken.

Action:

The Secretariat to write to UKDA to confirm the continuation of accreditation under the Digital Economy Act 2017, following the successful completion of this annual review.

Action:

The UKDA to consider the potential requirement to apply for proportional accreditation for the preparation of data under the DEA, and apply to the UKSA for this accreditation at their earliest convenience, if required.

3. Initial Findings from the DEA Accreditation Data Capability Feedback Form 

1. Edward Bextor presented the Panel with an introduction to the recently implemented DEA accreditation data capability feedback form, followed by a discussion of high-level findings taken from the TRE responses.
2. A revised Data Capability TRE Accreditation Framework was implemented in January 2023 with support from the RAP. As part of this work, the Data Capability team agreed to review the process for the roll-out and implementation of this revised framework with DEA accredited TREs. The Panel was informed that this feedback exercise focused on the successes and challenges of the accreditation process and how we conduct capability reviews, and not the specifics of the revised data capability controls themselves.
3. This item presented initial findings from this feedback exercise, following receipt of 50 percent of responses from accredited TREs. Further discussion of this issue will be presented at a future RAP meeting once comprehensive feedback has been provided by all accredited TREs.
4. Edward Bextor sought the RAP’s views on the proposed courses of action based on feedback provided as part of this work. This includes:
   1. A review of the existing guidance to identify and address areas that require improved clarity and accessibility to support TREs with understanding the key aims, responsibilities, and requirements for the DEA accreditation exercise.
   2. A review into alternative technical solutions that could support the application process to address the challenges that existing tooling creates.
5. The Panel supported the overall approach and proposed actions. The Panel recognised suggestions in the initial feedback that DEA accreditation is considered to be a gold standard framework in the way it is supported and operationalised through the UKSA accreditation team, which highlights the value that the Data Capability framework revision has provided to accredited TREs. The Panel agreed that it was clear from the feedback that additional support provided to TREs during the roll-out of the revised data capability accreditation framework from DEA Assessors and UKSA Secretariat had been a great support to DEA accredited TREs, and recognised the benefits of strong communication between organisations.

Action:

Edward Bextor to perform a comprehensive analysis of the TREs full responses and present full findings to a future meeting of the Research Accreditation Panel.

4. Research Project Accreditation Services and Data Accessed under the DEA Metrics

1. Lewis Hopcroft (UKSA) presented the Panel with a series of metrics to illustrate the current operation of Research Project Accreditation Services and an overview of Data Accessed under the DEA in accredited projects over time to understand what further information the RAP would find beneficial to evaluate the extent to which the opportunity for public good cross-government data access provided by the DEA has been realised.
2. The key findings from the metrics include:
   1. The number of projects accredited thus far in 2024 is comparable with 2023.
   2. The majority of research projects submitted for DEA accreditation are accredited by the UKSA team via the Project Accreditation Tool process, which was approved by the RAP in June 2021. The suspected reason for this is that more DEA data providers are content for projects using their data to be accredited via the Tool, suggesting trust in this process has been built.
   3. Some DEA accredited TREs have never used the DEA Research powers to process or provide access to data for public good research.
   4. The spread of data available under the DEA from government departments across Whitehall and the Devolved Administrations has continued to grow. However, most data being accessed in projects continues to be ONS-owned data.
3. The Panel welcomed this work and noted that this information would be useful in supporting future discussions relating to uptake of the DEA Research powers among data providers across the UK. The following points were raised during discussions:
   1. The Panel acknowledged that it is possible that some accredited TREs see value in receiving DEA accreditation to highlight the security and capability of their environment, while never intending to utilise this accreditation for its intended purpose of making public authority data for public good research available via the DEA Research powers. It is recommended that UKSA is mindful about how TRE accreditation is prioritised moving forward to ensure the DEA project accreditation and data access services are being supported as a priority, particularly whilst the UKSA team faces resourcing pressures.
   2. The Panel welcomed the increase in the volume of data available under the DEA as a positive continuing trend, however noted that they currently have limited ability to assess the overall success of the DEA Research powers in unlocking access to government data without an improved understanding of government data holdings that would be potentially valuable for public good research. The Panel requested improved understanding of those data that currently aren’t shared to assess how the RAP and the DEA might support with unlocking access to this.
   3. While absolute numbers of projects accredited are helpful, the Panel requested further information to assess the impact that accredited projects are having on UK society and the economy to ensure public good benefits, pivotal to this work, are being realised.

Action:

UKSA to work with key stakeholders across government and the academic community to understand and measure the extent of currently unavailable and potentially research-ready data which could provide significant public benefits if accessed by accredited researchers under the DEA.

Action:

UKSA to work with Trusted Research Environments (TREs) to maintain and develop case studies on how DEA research projects are positively contributing to public good and present this at a future meeting of the Research Accreditation Panel.

5. Office for Statistics Regulation’s (OSR) Work on Data Sharing and Linkage for the Public Good

1. Ed Humpherson (Director General for Regulation, Office for Statistics Regulation) presented this item.
2. This item provided the Panel with recommendations following key findings from the OSR’s July 2023 report titled ‘Data Sharing and Linkage for the Public Good’ and Ed Humpherson’s February 2024 blog regarding the Five Safes model.
3. The presentation outlined the following points:
   1. The OSR found that the Five Safes framework was highly praised as an effective tool however, new technologies used to share and link data along with TREs consideration of streamlining the application process for analysts highlight the need to review the framework. The OSR has recommended that the UKSA review the framework to consider whether there are any elements or supporting material that could be usefully updated.
   2. Ed Humpherson discussed a suggestion from his blog which refers to a change from the “safe projects” aspect of the Five Safe framework to “safe programmes”. It was suggested that a “safe programmes” focus would allow for less rework on approved projects if data set variables do not reflect prior understanding, less upfront work for both researchers and approvers, and more effort on reviewing “safe outputs”. It was stressed that this was not a recommendation and only an invitation to explore RAP’s views.
   3. Recognising the RAP’s ongoing discussions relating to transparency of accredited research results, Ed Humpherson outlined the OSR’s intelligent transparency approach that supports equality of access to data used by government in the public domain, enhancing understanding of information through citation and clear communication, and independent decision making free from political considerations.
4. The Panel welcomed the discussion, and the following points were raised during discussions:
   1. The Panel agreed with the recommendation for UKSA to review the framework to ensure that guidance and supporting material is up to date whilst taking into consideration that the Five Safes framework is an international standard. The Panel agreed that the Five Safes is a conceptual framework that aims to assist reasoning on data access policies and processes, rather than providing specific guidance on implementation of “safe” controls. The Panel’s view is that a review of the framework should avoid recommending changes that are implementation- or organisation-specific.
   2. The Panel noted that greater flexibility in the project accreditation approach through implementation of “safe programmes” brought greater researcher responsibility to show the evolution of planned analyses to allow for research traceability. Regardless of the terminology used to classify the scope of accredited research, the Panel noted that it remains important for researchers to clearly state the research questions and pre-specify the starting point for their planned statistical analyses and subsequently explain how these evolved once the data were made available.
   3. The Panel noted that in the health data landscape, there is a spectrum of data sharing from tightly defined projects to much broader programmes in a particular area. A research programme approach, as opposed to a research project approach, requires appropriate justification, detail about how particular analysis will be selected and how it’s use will be communicated to data subjects, and the wider public.

Action:

Ed Humpherson to discuss the work relating to a review of the Five Safes framework in greater detail at a future meeting of the Research Accreditation Panel. The Secretariat to work with Ed Humpherson in scoping and supporting a UKSA-led review of the Five Safes framework.

6. Observing the highest ethical standards: Appropriate consideration of ethics in accredited research projects

1. Matt Short (Centre for Applied Data Ethics (CADE), UKSA) presented this item.
2. This item seeks a view from the Panel on the spectrum of institutional ethics reviews that are submitted in support of DEA research project applications, and what is appropriate to fulfil the ethics requirement under the Research Code of Practice and Accreditation Criteria.
3. The CADE informed the Panel that they have identified a common occurrence whereby institutional review processes use a tiered review model. Within the tiered review model, many institutions classify secondary analysis of data, particularly administrative data, as ethically benign and therefore, this is automatically approved subject to basic information from the researcher. It is CADE’s view that that ethics reviews of this nature do not always meet the standard for ethical considerations set out in the Research Code of Practice and Accreditation Criteria.
4. The CADE sought the Panels view on the issue and whether an ethics policy or improved guidance on what is considered appropriate ethical scrutiny for DEA accredited projects could be established.
5. The Panel recognised the value of CADE’s discussion on appropriate consideration of ethics in accredited research projects and acknowledged that there is a clear value to ethics in DEA research project applications.
6. While the RAP recognises the need to uphold the ethics requirement in the Research Code of Practice and Accreditation Criteria, it was keen to ensure that DEA ethics requirements are fulfilled in a streamlined and efficient way. The Panel recommended further work for CADE to assess various institutional ethics approvals that provide differing levels of ethical review.
7. The Panel recommended that the CADE work with representatives from the research community to further understand processes undertaken to obtain ethics approval before academic researchers engage with the DEA research accreditation process. It was requested that the CADE returns to the RAP following this work to set out differing researcher journeys when obtaining ethics approvals for DEA accredited projects and provide a view to the RAP on how it can be ensured that the ethics requirement in the Research Code of Practice and Accreditation Criteria is fulfilled, while maintaining an efficient service for the research community.

Action:

The CADE to undertake further work on this issue by engaging with stakeholders across the research community to provide some case studies on the different levels of ethical scrutiny that projects seeking to use the research strand of the Digital Economy Act are exposed to.

Action:

The CADE to work with the RAP secretariat to develop a proposed policy to ensure DEA project applications are meeting the ethics requirements within the Research Code of Practice and Accreditation Criteria, while prioritising an efficient application service to researchers. The findings of this work to be presented at a future RAP meeting.

7. Any other business

1. The Chair noted the ‘for information’ reports usually provided by UKSA were not provided due to a lack of resource within the team.
2. The Research Accreditation Panel will meet next on 28 June 2024. This will be a shorter meeting than usual to accommodate the RAP Strategic Workshop which is scheduled to take place on the same day.