ODiP: Reproducibility, open data and GDPR

ODiP: Reproducibility, open data and GDPR

• 1.
  Reproducibility, open data,& GDPR Cylcia Bolibaugh, Education, CReLLU
• 2.
  Data sharing inEducation EROS (Education Researchers for Open Science) (UYSEG, CRESJ, PERC, CReLLU) • qualitative • quantitative (experimental) • quantitative (individual differences) • Various goals for sharing data -- today’s focus on reproducibility – Verifiability of a publication’s findings -- data and code
• 3.
  GDPR & DataProtection Act complicate sharing of research data… – Co-regulatory approach: a shift in accountability from data protection authorities to data controllers and data processors (us!) – Adoption of open science practices hindered by worries about compliance (funder, university requirements, legal, ethical),
• 4.
  Personal data &identifiability “‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”
• 5.
  The ‘motivated intruder’test: To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. (Recital 26 EU GDPR)
• 6.
  Differentiating between personal andanonymised data: A balance between (1) risk of disclosure/ re-identification (2) consequences of disclosure (“perceived value of the information”)
• 7.
  A toy dataset(Polish immigrants to the UK) -- accuracy scores on language measure -- reaction times on language measure -- score on cognitive measure -- score on cognitive measure -- Age -- Native language -- Age of arrival to UK -- Length of residence in UK
• 8.
  Assessing risk ofreidentification (Klein et al 2018)  Small population and rare traits  Dyadic data  Hierarchical data (e.g., small subsamples of students, co-workers)  Motivated intruder test (e.g., jealous partner, nosy neighbor, envious co-worker, insurers, criminals)
• 9.
  questions, questions… 1) dothe biographical variables constitute indirect identifiers? (1b) how can I systematically calculate the risk of re-identification (e.g. what is the risk of reidentification for a Polish immigrant to the UK, based on their age, length of residence in UK and age at time of immigration?) (2) If there is only a very slight possibility that an individual could be indirectly identified, is it still personal data? (3) What if the perceived value of the information that might be linked to that individual is actually quite low (e.g. how many milliseconds an individual took to identify an English word, or their rating of how acceptable a particular phrase or grammatical construction is)? (4) How would one go about documenting their consideration of these factors?
• 10.
  solutions? Reproducibility Open DataUsability Binning ✗ ✓✓ ✓✓✓ Permutation ✓✗ ✓✓ ✓✓✓ K-anonymity tools (e.g. R package sdcMicro) ✗ ✓✓ ✓✓ Synthesized dataset (e.g. R package Synthpop) ✓✓ ✗ ✓ Encrypted data with script (e.g. OSF) ✓✓✓ ✗ ✓ Restricted access depository ✓✓✓ ✓✓✓ ✓✓
• 11.
  OSF approved ProtectedAccess repositories which are GDPR compliant - Research Data Center of the SOEP (DE) - Datorium (DE) - DataFirst (DE) - PsychData (ZPID, Leibniz) - University of Bristol Research Data Repository - The UK Data Service (ESRC)
• 12.
  Anonymisation • Europe-wide standardsfor anonymisation are needed. – OpenAire  European Data Protection Board could issue guidelines concerning anonymisation. • Nationally, codes of conduct to differentiate between personal and anonymised data. – may only be binding for members – involvement of umbrella orgs -- UKRN • Institutionally, researcher friendly guidance (decision trees, case studies, tools for documentation of risk assessment etc)
• 13.
  Anonymisation • Europe-wide standardsfor anonymisation are needed. – OpenAire  European Data Protection Board could issue guidelines concerning anonymisation. • Nationally, codes of conduct to differentiate between personal and anonymised data. – may only be binding for members – involvement of umbrella orgs -- UKRN • Institutionally, researcher friendly guidance (decision trees, case studies, tools for documentation of risk assessment etc) Thanks! Questions?
• 14.
  The Open Databadge is earned for making publicly available the digitally- shareable data necessary to reproduce the reported results.