New solutions for transnational access to secure use files

David Schiller (IAB)Richard Welpton (UKDA)

Microdata Access in European Countries – Cooperation between National Statistical Institutes and Data Archives, Athens, October 16-17, 2014

2

Cooperation between an National Statistical Authority and an CESSDA Data Archive

AgreementbetweenIAB, NurembergandUKDA, Colchesterabout access to Secure Use Files

Institute for Employment Research (IAB)• Research Data Centre (FDZ) of the German Federal

Employment Agency (BA) at the Institute for Employment Research (IAB) BA = National Statistical Authority

• Responsible law: German Social Code Book• Detailed labour market data on institutions, persons

and households (secure use files)• Access via guest stay and remote execution

Guest stay: data stays in Nuremberg access via remote desktop solution form “locations” (currently only in Germany)

UK Data Archive (UKDA)• Provides access to Secure Use Files via UKDA Secure Lab• Responsible law: depends on data owner

Secure Lab provides access to data from 6 different data owners within UK (one of them ONS)

• Provides access to confidential/sensitive information:Business organisations, social survey data,

administative records, children and young people• Access via Remote Desktop (to academic researchers at

their institutions in the UK – almost 600 users)

Short description of the solutionUKDA,

United KingdomIAB,

Germany • Remote Desktop based on Citrix – users can work “live”.

• Safe Rooms within the facilities of both partners.

• Agreement between partners to undertake services.

• Achievement:• First European location

to work with IAB data outside of Germany.

• First European location to work with UKDA data outside the UK.

Intended results – working with NSIs

What had to be doneSimilar institutions but different workflows and understandings

Spoke to each other Saw equivalences in how things are done Found a common understanding Set up a reciprocal Memorandum of Understanding (MoU)This MoU can be used as a template for

further extension of existing solution and new partnerships using safe room remote access solutions

All findings will be available at www.dwbproject.org

The Memorandum of Understanding (MoU)

Equivalence, Trust, ReciprocalContent of the MoU:• Services of Parties (The basic MoU)• Description of Safe Room Remote Desktop Service• Application process• Available research data• Fees• Relevant legislative texts• Pledge on Data Secrecy

Obstacles• No common language• No law for transnational access

Law of country where data is stored vs. law of country where data is accessed

• Trust is hard to measure and validate for the people in charge of data protection need to demonstrate ‘equivalence’

• Need for compromising in a working environment• Accreditation of the system

Penetration tests; international standards (ISO 27001); IT security tests……providing confidence

• UK researcher need training; IAB users not

Next Steps• Get it up and running – likely within this year• Extend the solutions with more partners (CASD,

France; CBS, Netherlands)• Use the MoU to create an consortium agreement

Need for a European wide agreement about transnational access

• Build technical frameworks that supports transnational access to confidential data (Proof of Concept is on the way)

European Remote Access Network (EuRAN)

European Remote Access Network (EuRAN)

13

Questions & CommentsAgreementbetweenIAB, NurembergandUKDA, Colchesterabout access to Secure Use Files

Thanks for ListeningQuestions & comments

Contact: contact@dwbproject.orgdavid.schiller@iab.de

Website: http://www.dwbproject.org/