Example case 7: Sensitive data reuse

 

7.1 Secondary use of health and social data (register data)

7.2 Reuse of research data published under controlled access

 

7.1 Secondary use of health and social data (register data)

In this research project, we want to access and analyze register data. We work in Finnish academic organizations.

We want to combine our findings with the register data and also need specific software/scripts for the analysis. At the end of the research, we will retrieve non-sensitive results from the secure environment. At the same time, the data needs to be accessible for a short time frame (in case we need to perform additional analysis as required during the manuscript submission).

CSC offers services for managing data in all phases of the research project. As in this case, we are working under the Act on the Secondary Use of Health and Social Data, we can use:

Note: A restricted version of SD Desktop is provided for secondary use of health and social data. In this case, the virtual Desktop is entirely isolated from the internet and other Sensitive Data services: you can only access the data/files you have requested from Findata during the permit application. You can not directly import any file in the secure environment.

Service Links to necessary documentation and tutorials Benefit for this case Requirements for the user
Prerequisite Requires a permit issued by the Health and Social Data Permit Authority (Findata).  

 

The permit request to Findata needs to be planned well in advance and include a list of all the files/scripts/software required in the secure environment.

Contact servicedesk@csc.fi  to verify if the software necessary for the data analysis is available on SD Desktop.

MyCSC portal

For creating an account

 

servicedesk@csc.fi

For requesting access to the service

We first create a CSC account. Then, as we are processing sensitive data, we complete the description of processing activities form and  enable two-step verification for our accounts.

After providing the Findata certificate via email, we will receive instructions on how to access a specific CSC project and the SD Desktop service.

Use HAKA to create a CSC account.

 

In this case, only CSC  can manage data access and verify the user's identity.

SD Desktop for secondary use

For analysing the data

 

We access the service and launch a virtual Desktop. Here we can finally access the data and import software and scripts requested.

 

When the analysis phase is completed, we can delete the virtual Desktop.

The service allows users to easily start and access a private and secure computing environment to analyze sensitive datason demand.

 

The service will not consume additional resources.

At the end of the research/permit application, all data are stored for 90 days and then deleted.

servicedesk@csc.fi

For export of non-sensitive results

When the analysis phase is completed, we send an export request to retrieve our findings.

    

 

7.2 Reuse of research data published under controlled access

New studies have just been published. We want to access the original datasets used in these studies: they seem very interesting and might be helpful in our research. We found the studies via the EGA webpage, Etsin or Pubmed.

Guidelines for data access illustrate that the datasets contain sensitive data. They are stored in Finland under controlled access and are accessible for reuse with CSC's Sensitive Data service. We also want to combine these datasets with our findings and use specific software and scripts during the analysis.

CSC offers services for managing data in all phases of the research project. As in this case, we want to access sensitive data published under controlled access, we can use:

  • MyCSC portal for creating an account and CSC project.
  • SD Apply for applying for access rights.
  • SD Desktop for accessing and analyzing the data.
  • SD Connect for importing scripts, software or other data into the secure environment.

 

Service Links to necessary documentation and tutorials Benefit for this case Requirements for the user

SD Apply

For applying for access rights (pilot phase)

Once we follow the instruction provided, we are redirected to the catalog in SD Apply listing all the available datasets. 

This service will allow us to  submit a research plan and accept the necessary legal agreements for data approval.

When the Data Access Committee (representative of the Data Controller) approves our request, we will receive a confirmation email. Now the datasets is immediately available for data analysis with SD Desktop.

The process is automated and completely traceable.

Data access is granted for a limited period of time.

Login to the service via identity provider (HAKA, CSC Login or Life Science Login).

MyCSC portal

For creating an account.

 We first create a CSC account and set up a CSC project. Next we complete the description of processing activities form, add service access to Allas and SD Desktop and  enable two-step verification for our accounts.

 

 

Access CSC's services on demand via a self-service portal.

 

Comply with CSC's General terms of use and Data Processing Agreement.

If necessary, consult the academic organization's legal service for advice regarding agreements, DPIA, or adding CSC project members from non-EU/EEA areas.

SD Desktop

For data access and analysis with open source software.

Once we log in to SD Desktop we can set up a virtual computer that will be available to all the project members. Now can access the datasets and analyse it.

We can also use the same service to import additional files/ software/ scripts via SD Connect (see below).

At the end of our analysis, we can export non–sensitive findings and delete the computing environment.

The service allows users to easily start and access a private computing environment to analyze sensitive data on demand.

Data access is provided in an automated and secure way.

When the access period granted by the DAC (or data Controller) via SD Apply expires, the datasets will no longer be visible or accessible.

Modern web browser.

No expertise is required. However users must become familiar with the necessary steps in the user guide.

Only open-source software are available in SD Desktop.

Data stored in SD Connect and SD Desktop will be deleted 90 days after account termination or project closure, after which it cannot be retrieved.

SD Connect

For importing additional files/software/scripts in the secure computing environment

We can use SD Connect/ Allas to import in the secure environment additional files or software. Files need to be encrypted to be visible in the virtual Desktop.

Users can directly customise their virtual Desktop.

 Adding software requires importing singularity containers. Our expert can help with this operation.