COVID-19 Data Research Hub: Your questions answered

What the Central Statistics Office’s (CSO's) COVID-19 Data Research Hub is

The CSO hosts a COVID-19 Information Hub on its website which hosts all COVID-19 related releases and publications. Separately, and in accordance with the Statistics Act, 1993, the CSO also hosts a secure COVID-19 Data Research Hub which contains individual level administrative data sets obtained from the Health Service Executive (HSE).

The datasets within the Research Hub contain pseudonymised individual level data on those who have been diagnosed with COVID-19, been referred for testing, been treated in hospital for COVID-19 or have been identified as being a close contact of a confirmed case.

What is changing

Previously, only certain CSO staff had access to this data for statistical purposes and it was shared with named individuals involved in the Irish Epidemiological Modelling Advisory Group (IEMAG) of the National Public Health Emergency Team (NPHET). After extensive consultation, the Health Research Board (HRB) is collaborating with the Department of Health (DoH), and the CSO to make this data available for research too. Now, registered researchers from registered research organisations can now apply to access this pseudonymised data after a rigorous application process. Central to this initiative is the establishment of the Research Data Governance Board (RDGB).

What the RDGB is

The RDGB is an independent body and a key safeguard in this new mechanism to facilitate access to data in the CSO COVID-19 Research Hub, and is an independent body established jointly by HRB and the CSO, in close collaboration with the DoH. The RDGB acts as a central point for application receipt, screening, review and prioritisation of data requests, prior to applications being assessed by the CSO, and oversees a transparent process to facilitate secure and controlled access to this COVID-19 data for research. The RDGB Secretariat is provided by the HRB and supports the RDGB in all aspects of its work.

Why researchers can now apply to access these sets of data

Health research has played an important role nationally and globally during the current public health emergency. From rapid reviews of existing evidence to expedited research projects to clinical trials of new treatments and vaccines, Ireland is playing a key role on the international stage, facilitated greatly by the work and support of the HRB.

Using the best available research evidence and data to guide public health and health systems decisions is integral to an effective and efficient response in public health emergencies. Enabling approved research projects involving the processing of relevant COVID-19 data for statistical purposes in compliance with the Statistics Act and data protection law can ensure that researchers have the potential to enhance our understanding of the epidemiology, progression (or decline) and implications of this disease in Ireland and internationally and guide optimal interventions and decision making.

The role that researchers have in this public health emergency

Researchers have an important role to play during the current public health emergency. Facilitating access to these data for researchers allows for research enabling linkage of health and social care data that could support clinicians, service managers, policy makers and researchers further understand and better tackle COVID-19. For example, trends and associations between COVID-19 interventions and patient outcomes might be identified, as well as the cost effectiveness and impact of such interventions. This data sharing is also expected to inform evidence-based decision-making and public policy in Ireland during the pandemic.

What researchers will have access to the information

Only registered researchers from registered research organisations in Ireland can apply to access the COVID-19 Data Research Hub for valid research purposes. Applications for access will not be considered from commercial bodies.

What the application process involves

Researchers applying to access the COVID-19 Research Hub will go through a robust application process. Separate approvals from the Research Data Governance Board, Research Ethics Committee(s), and a consent declaration from the Health Regulations Consent Declaration Committee will be needed before the CSO will consider final approval. The Director General of the CSO will only then make a determination as to whether the research project is in the public interest and within the scope of the Statistics Act, 1993.

The legal basis upon which researchers can access these data

The legal basis for this is Section 20(c) of the Statistics Act, 1993, and the Data Protection Act 2018/Health Research Regulations 2018.

Whether these approved researchers will be able to see personal information

No. All direct identifiers such as names, addresses and date of birth will have been removed. This process is referred to as pseudonymisation. Additionally, once in receipt of HSE data, the CSO converts the identifier numbers in each dataset that remain to a Protected Identifier Key (PIK). The PIK is a unique and non-identifiable number which is internal to the CSO. Using the PIK enables the CSO and approved researchers to link and analyse data for statistical purposes, while protecting the security and confidentiality of the individual data.

What is being done to protect an individual’s data protection and privacy rights

Only registered researchers from registered research organisations in Ireland are permitted to apply for access to these data. Researchers applying to access the COVID-19 Research Hub will go through a robust application process. Separate approvals from the Research Data Governance Board, Research Ethics Committee (s), and a consent declaration from the Health Research Consent Declaration Committee will be needed before the CSO will consider final approval. The Director General of the CSO will only then make a determination as to whether or not the research is in the public interest and within the scope of the Statistics Act, 1993.

Sharing of data with third parties

Access to personal data held in the CSO COVID-19 Data Research Hub is restricted to nominated CSO staff and approved researchers. The CSO never shares any personal data with any third parties whether they are private entities or commercial operations.

Confidentiality of personal data

All information supplied to the CSO is treated as strictly confidential. The Statistics Act, 1993 sets stringent confidentiality standards: Information collected may be used only for statistical purposes and no details that might be related to an identifiable person may be divulged to any other government department or body.

Where the data is stored

The CSO is accepting multiple data flows from the HSE during the COVID-19 pandemic. The incoming data is being processed, pseudonymised and stored securely on CSO servers. As governed by the CSO Data Management Policy, the data flows are stored in the Administrative Data Centre (ADC) warehouse.

What technical safeguards are in place for this researcher access

Approved researchers gain access to data via the CSO Researcher Data Portal (RDP). The CSO technology in facilitating secure access to microdata is in keeping with best practice internationally. The RDP is a locked-down Citrix environment from which no data can be extracted without the approval of the CSO. The researcher logs on using a unique username, PIN and password. As well as this, the researcher’s access may be restricted to a specific IP address. The microdata always remains on a CSO server. The RDP was developed under the headings of the Five Safes:

• Safe Projects (RMF approval process)
• Safe People (Researcher and Research Organisation registration process)
• Safe Settings (RDP security)
• Safe Data (RMF construction in compliance with CSO Statistical Disclosure Control policy)
• Safe Outputs (Outputs checked in accordance with CSO Statistical Disclosure Control policy by Data Custodian)

How long COVID-19 data will be stored for

There will be a post pandemic review which may make certain recommendations regarding the duration of the data storage element for COVID-19 related data sources.

Will vaccine data be part of the Research Hub at some point

Yes, the CSO will host vaccine data when the database is available from the HSE. As with all researcher data, there is a time gap between data availability and the ability to share it given the stringent data protection protocols involved. The CSO also provides documentation describing the data to researchers which can take some time to prepare for new data sources.

Whether researchers in other countries have similar access to health information

Yes. Ireland has lacked the infrastructure and services required to support an environment that exploits health information to its full potential and so is an outlier in this area. The type of infrastructure which this initiative proposes is modelled on best international practice and has been available for many years in the UK, most European countries, Canada, Australia and New Zealand. It aims to maximise the value of national data sets - particularly in the area of health where there is much sensitive data.

Has a Data Protection Impact Assessment (DPIA) been prepared

Yes, to ensure compliance with the General Data Protection Regulation a DPIA and a Transparency Notice have been prepared.

Whether there been consultation with the Data Protection Commissioner’s Office

Yes, there has been consultation with the Data Protection Commissioner’s Office, and the Office is satisfied with the researcher access proposal subject to the implementation of the Data Protection Impact Assessment and the safeguards outlined therein.

Have individuals given their consent to this use of their data

Individuals have not given their consent for the use of their data that is held within the COVID-19 Data Research Hub, for health research purposes. To seek such consent would not be practicable or possible for researchers.

As explicit consent from an individual is a mandatory safeguard under the Health Research Regulations, all RMF researchers must therefore apply to the Health Research Consent Declaration Committee (HRCDC) for a lawful consent declaration where explicit consent of the individual is not possible or practicable, and where the public interest in carrying out the research significantly outweighs the public interest in requiring the explicit consent of the individual.

A consent declaration shall only be made by the HRCDC for a research study, when it is satisfied that all the data protection safeguards and technical and organisational measures have been met, and the public interest in carrying out the health research significantly outweighs the public interest in requiring the explicit consent of the individual who owns the personal data. For more information, please visit www.hrcdc.ie.