Public Acceptability of Data Sharing Between the Public, Private and Third Sectors for Research Purposes

5 DELIBERATIVE RESEARCH FINDINGS

SENSITIVITIES AROUND DATA SHARING BETWEEN THE PUBLIC, PRIVATE AND THIRD SECTORS

5.1 This chapter presents the findings from the deliberative events. It begins by exploring participants' perceptions of data sharing between the public, private and third sectors before going on to explore attitudes towards benefit-sharing and empowering citizens in decision-making.

5.2 At the outset of each deliberative event, an introductory presentation was given to participants, which provided relevant contextual information on data linkage and sharing for research and statistical purposes (A copy of the presentation is provided in Appendix D). Key themes covered included:

• the scope of data linkage and sharing (including the focus on anonymised data about individuals, as opposed to data about identifiable individuals)
• a summary of the Scottish Government's Data Linkage Framework and Guiding Principles
• the emphasis in the Framework on public acceptability and the public interest
• what is already known about public attitudes to data linkage and sharing from the 2012 research
• the need for an improved understanding of public attitudes towards data sharing between the public, private and third sectors

5.3 Following the presentation, participants were asked for their initial reactions to what they had heard and, subsequently, whether they regarded data sharing (including the sharing of linked data) as more or less acceptable depending on: the sector and specific type of organisation(s) involved in the process; the type of data being shared; and the planned use(s) of the data. Prompt cards containing examples of organisations, data types and data uses were used to facilitate the latter discussions (see Appendix F).

Initial reactions

5.4 Initial, unprompted reactions to the presentation centred in the main around the themes of data security and privacy. As in the 2012 research, there was a significant level of concern about the potential for linked and/or shared personal data to be hacked or otherwise obtained by unauthorised individuals or groups. This concern was largely informed by past high profile cases of public officials leaving laptops, data sticks or hard copy documentation in public places, and, to a lesser extent, by incidents such as the Wikileaks and Edward Snowden disclosures.

A couple of years ago, there was a big issue with the Council here shredding information and it was all found; files everywhere.
(Male, oldest age group, Galashiels)

Well, we have heard all the news about DVDs and laptops being left on trains by people working; ministers and that sort of thing, with all your stuff on it, so [it will] maybe get into the wrong hands the information about you.
(Male, middle age group, Glasgow)

5.5 When reminded that data shared for research purposes would be anonymised, most participants appeared to feel reassured that this would mitigate against personal details falling into the wrong hands - "If it's anonymous, what does it matter" was a typical remark. However, a significant minority were more sceptical and expressed concern that, even with anonymisation, the potential would remain for personal details to be "leaked" (whether through accident or malice) or obtained through hacking. Such views were again underpinned by consideration of high profile data losses and breaches, but also by the perceived ease with which commercial organisations in particular appear to come into possession of individuals' details for use in direct marketing campaigns. As in the 2012 research, participants commonly recounted personal experiences of receiving unsolicited but personalised sales calls or emails from a range of companies, particularly insurance firms.

They are saying that [personal details] will no' be accessible but they've got to think. … It's scary what they can get hold of.
(Female, oldest age group, Glasgow)

I seem to be getting phone calls from America, how have they got my number, how they got their data? … It's obviously through [my] going on an internet website and sign[ing] up for something.
(Female, youngest age group, Glasgow)

5.6 Aside from voicing concerns around data security and privacy, initial responses across the events often indicated unease about - or in some cases opposition to - private sector involvement in data sharing for research, as compared with public sector involvement. There was repeated suggestion that the private sector is motivated solely by the pursuit of profit and therefore would likely use data to this end, for example by selling it on to third parties. Public sector organisations, in contrast, were often described as being "for the people" and more inclined to draw on data with the aim of delivering some form of public benefit. (There was very little spontaneous mention of the third sector in these initial discussions). The view that data sharing for research should lead to public benefit was a dominant theme across the events and one that participants returned to time and again.

If the integrity of the whole system was there, then I don't think there would be many people at this table would have any issues with the likes of the NHS having their data, the police, because they're there to protect people, and the Scottish Government because it is in everyone's interest.
(Male, middle age group, Oban)

I would be more wary about the private sector in particular if they are sharing data, even if it's anonymised. It's for their benefit rather than the benefit of society.
(Male, oldest age group, Edinburgh)

5.7 Notwithstanding such views, some older participants commented, or alluded to the fact, that the distinction between the public and private sectors is becoming progressively less "clear cut" owing to an increase in the privatisation and contracting out of public services. They regarded this shift as having negative implications for the security of personal data.

You're forever reading in the paper about things that went wrong. In fact we have it the now… I think it was the hospital… they found [information] in a bin and they said: "Oh no, that was the company that did the cleansing; it wasn't the actual members of staff".
(Male, oldest age group, Galashiels)

5.8 When participants were presented with some examples of public, private and third sector organisations, their views on data sharing for research became more nuanced and considered. While they continued to regard private sector involvement as less acceptable overall than public or third sector involvement (for reasons explored in further detail below), they also drew some notable distinctions between different organisations within each of the three sectors. These distinctions were underpinned by consideration of the relative trustworthiness of the organisations and, again, of the extent to which each could be expected to act in the public interest. The concept of the public interest was initially invoked rather that defined, although participants went on to discuss it in terms of specific benefits and disbenefits that might flow from research.

The public sector

5.9 There was near universal acceptance of public bodies - including the Scottish Government, the NHS, Local Authorities and the police - having access to anonymised data about individuals from other organisations (whether public, private or third sector) for research purposes. There were two main factors underpinning this support.

5.10 Firstly, and as already mentioned, there was a commonly held view that public sector organisations were concerned with delivering public benefits or promoting the "public good" and that any research they undertook would be similarly oriented. Further, there was suggestion that by having access to more data and research, public bodies will be better placed to identify and meet the support needs of particular segments of the population - the unemployed, children and people with chronic health conditions received specific mention amongst others- and to deliver improvements to local areas and services. As is discussed further below, a perceived need for better local services was a recurring theme of the discussions and one that, in Galashiels especially, reflected experiences of service cuts and closures over recent years.

5.11 Secondly, and despite concerns expressed at the outset of the events about public officials misplacing or losing data, there was a common assumption that public bodies had more stringent data protection and security procedures in place than other types of organisation - or at least were more accountable to the public than those other organisations when a breach occurred. These assumptions tended to be based on personal experiences of working for, or otherwise interacting with, public bodies, particularly the NHS and local authorities.

I don't mind if [data] went to the NHS because you know there usually is a system in place that will protect anonymity. I know when I worked with the city council we had a system: You can't do this, you can't do that. If you disobeyed that you would get sacked. So, I would assume that if your information was going to the NHS they would work under the same restrictions.
(Female, oldest age group, Aberdeen)

At the end of the day, if you're not satisfied with the way the Government is running things, then we have the option of having an effect on that. The Government has to rely on us to keep them in a job.
(Female, oldest age group, Galashiels)

5.12 However, participants often expressed reservations about (though rarely outright opposition to) the police having access data from other sources. These reservations seemed to reflect a deeper distrust of the police due to perceived corruption and other forms of malpractice, for example, the inappropriate use of stop and search. There was uncertainty and unease over how the police might use data from other sources and, specifically, over the potential for Big Brother-esque surveillance of the population.

5.13 A small number of participants also expressed reservations about the Scottish Government being able to access data from other sources. While they sometimes struggled to articulate the precise reasons for their concern, unease over how the Government might use the data and concerns about the potential for a Big Brother society again appeared to be important considerations. At the same time, a degree of ambivalence in the attitudes of these participants was apparent, with some of them acknowledging the Scottish Government's need for high quality data.

…Too much information is being held by the Government, but at the same time we can't just do like a stab in the dark and hope for the best. [We] have to have some kind of information gathered to direct the right policy or funding to whatever.
(Male, middle age group, Galashiels)

5.14 Across the events, there was a view that public bodies in general need to be more transparent about the data sharing that is taking place and/or about how research has contributed to particular outcomes. In some cases, this view was underpinned by a perceived need for the public to be reassured that their data are being used appropriately. In others, it reflected a belief, also evident in the 2012 research, that public bodies do not always do enough with the information they have and ought to be more accountable in this regard.

What are they going to do with the information once they have got it because the Government seem to have a lot of information on you but don't actually do anything with it?
(Male, youngest age group, Aberdeen)

It's okay sharing [but] it's not enough. [The] outcome is more important.
(Male, middle age group, Oban)

The private sector

5.15 As already mentioned, private sector involvement in data sharing was a contentious issue. There was a great deal of concern that private companies would sell data to each other for mutual benefit - a practice that was seen as already widespread - although this concern did lessen when participants were reminded that the data would be anonymised so individually targeted sales or marketing campaigns could not be based on such data. More generally, there was strong spontaneous opposition to data being used by the private sector for the sole purpose of profit maximisation. This is not to say that participants were entirely opposed to private sector organisations accessing data, or that no level of profit was acceptable. Rather, the consensus was that private sector access to (anonymised) personal data should only be granted where this is likely to result in some form of public benefit.

I think when it's being done for services; say, social work, to target where you need to do some kind of youth outreach work, that's fine and that sits comfortable with me, but if that then becomes, okay, supermarkets can find out that in this area, there is loads of young families with young children, and end up using that information to do a kind of targeted [campaign] on toys and kids' stuff, that doesn't sit so comfortably with me.
(Male, middle age group, Aberdeen)

I think you maybe get concerned if you think that your information is going to earn somebody else a profit that's not maybe going to benefit society as a whole…I know I am quite willing to give information about me, anonymised, if I thought it would help other people in research but my expectation would be that services to me would be improved because of it.
(Female, older age group, Aberdeen)

5.16 As the above comments serve to illustrate, public benefit continued to be conceived of primarily in terms of improvements to local services, local areas or public health, rather than individual-level or direct financial benefits. However, there was some unprompted suggestion that the private sector should be required to pay for access to data and/or to share any profits resulting from research with the relevant data owner(s), so as to generate funds that can be reinvested towards the public good. Invariably, these suggestions met with strong support from others in the group and laid the foundation for later, prompted discussions of benefit-sharing.

Development is such a huge part of the process of making [a] product; I would say the most important, so if [companies] want to create something that will generate a profit, they need the information, so I think they really should pay for the information.
(Female, oldest age group, Edinburgh)

[Male 1:] If private companies want access to this information…[they] should have to pay to get access to that information and pay quite a bit.

[Male 2:] Then money should go back in

[Male 1:] Exactly, yes, feed back into the services.
(Middle age group, Aberdeen)

There should be some criteria [for] sharing the profit if they are going to make these profits.
(Male, middle age group, Oban)

5.17 In terms of the specific types of private sector entity that participants were invited to consider, pharmaceutical companies were the only type that the great majority felt should be able to access data from other sectors. Ultimately, this reflected a view that research by pharmaceutical companies contributed towards improved understanding of diseases and conditions, and to new drugs and treatments. At the same time, several participants expressed unease at the scale of profits made by pharmaceutical companies and it was this unease that prompted the spontaneous suggestions for profit sharing, mentioned above.

5.18 In contrast with views on pharmaceutical companies, there was overwhelming opposition to banks, other financial institutions, internet service providers and social media companies being able to access data from other sources. Participants expressed strong distrust of these entities - banks and other financial institutions because of their perceived role in the financial crisis; and internet service and social media companies because of personal or proxy experience of online fraud and a related perception that the online sphere is "impossible to police". There was a widely held view that personal information, even if anonymised, would not be secure in the hands of these types of company and, as such, ought not to be shared with them.

5.19 Two other categories of company; supermarkets and other retailers, and security and surveillance firms, divided opinion at each of the events, although for different reasons.

5.20 Supermarkets and other retailers were commonly perceived to be purely profit driven, and this led to many participants rejecting outright the idea of their being able to access data. At the same time, there was some suggestion that, by having better intelligence about local populations, supermarkets could deliver more tailored products and services, and potentially contribute to public health improvement; for example, through targeted healthy eating campaigns.

Big [companies] like Tesco, Asda, whatever…they're going to go and say: "Oh well, there is a great sale of fags here, there is a great sale of booze, so we will just put all these offers on in that area" and they're going to sell more, they're not in it for the health.
(Female, oldest age group, Galashiels)

It does help with things like having the right stuff in the shops… If you're in an area where there is less money and then they have products that people can afford to buy, rather than everything being Tesco's Finest or something.
(Female, youngest age group, Oban)

If there is a higher rate of heart attacks in an area, [they would know] whether they should promote and sell fruits at a cheaper rate or something, so, in that context, I wouldn't mind them having that information.
(Male, middle age group, Glasgow)

5.21 Security and surveillance firms were commonly distrusted owing to the recent high profile G4S failures, as well as personal experiences of perceived heavy-handed or threatening tactics on the part of bailiffs. Nonetheless, there was also some suggestion that these entities need to have access to high quality data in order to guard against terrorist threats and ensure public safety more generally.

5.22 It is worth noting that, as well as drawing distinctions between different company types, a small number of participants contrasted companies of a similar or the same type. For example, at the Aberdeen event, a distinction was drawn between Langstane Housing - a social enterprise - and Stewart Milne Homes, with the former trusted more as it was seen to be motivated by social needs. Similarly, at the Galashiels event participants felt that Asda was a more socially responsible company than Tesco on account of its charitable work in the local community. Such views suggest that assessments of the private sector and individual entities are by no means clear cut but reflect the interplay of a range of considerations from general trustworthiness, to local contextual factors and personal experiences.

5.23 During the discussions of different company types, participants at times questioned how data owners would know that a company, having been granted access to data, would use the data solely for the original purpose. Transparency was seen as crucial in this regard to mitigate against potential data misuse and to instil public confidence in the process.

The third sector

5.24 In general terms, third sector access to data was seen as more acceptable than private sector access but somewhat less so than public sector access. There was a widely held assumption that many third sector organisations, like public bodies, are concerned with promoting the public good and, indeed, often work with those bodies towards shared objectives, such as tackling homelessness or improving services and support, for example for LGBT people. At the same time, there was a perception of the third sector as something of an unknown entity, which prompted feelings of unease about its organisations having access to data. Some participants questioned whether third sector organisations would have robust data protection and security standards in place. Others were concerned that some organisations might be tempted to use data in direct marketing campaigns or sell it to raise funds.

I think there is a lot to gain from these organisations having access to data, because there might be issues that people are unaware of completely…If these [organisations] had access to that sort of information, they could then make a case for funding.
(Male, youngest age group, Edinburgh)

There are companies within the third sector, Barnardos and these companies, that you should trust but have we been suckered into something that we believe has helped children … Do we actually know what they're doing? Nothing is really ever publicised, there's nothing ever publicised, are they making a profit?
(Male, youngest age group, Glasgow)

5.25 There was a tendency for participants to distinguish between charities on the one hand and pressure groups on the other, with the former generally trusted more than the latter. It was commonly suggested that pressure groups, by definition, had "agendas" to advance that may or may not reflect the interests of the general public. Some participants contended that any requests for access to data from pressure groups should be subject to very close scrutiny. Others argued, more strongly, that such requests should be refused as a matter of course.

There is a certain lack of control over groups like that, so for them to have access to data could be damaging because you don't know what their agenda is….I mean, who are those people, how are they controlled, how are they governed, and what are they doing with [the data]?
(Female, oldest age group, Aberdeen)

The English Defence League [is] classed as being a pressure group, so I'd really rather they didn't have any information… you really have to judge case by case, what are the motives of the organisation, what are [they] actually going to use [the data] for and make the decision whether or not they get it.
(Male, middle age group, Aberdeen)

'Hybrid' organisations

5.26 Participants did not engage to any significant degree with the concept of hybrid organisations. This was partly due to the complexity of some of the issues involved and partly because they often had very little prior awareness of some types of hybrid organisations, particularly university spin-out companies.

5.27 To the extent that views were forthcoming, these tended to relate to public-private partnerships (PPPs). For several participants, PPPs raised no new issues in respect of data sharing. They assumed that in any such partnership, the public sector partner would have overall accountability for the operation of the partnership and/or that therefore more stringent data protection and security procedures would apply. There was also some suggestion that PPPs could result in more cost-effective service delivery.

5.28 However, other participants were concerned that PPPs widened the scope for unauthorised data sharing between private sector organisations and, consequently, for data misuse. They contended that measures would need to be put in place to ensure that private partners in PPPs used data solely for purposes agreed within the terms of the Partnerships.

[There] could be [a company] that you really trust and then they are obviously in cahoots with another company which is going to take that information and use it and that's not something you want that company to do.
(Male, youngest age group, Galashiels)

How do you control that information - what [the private partner] is doing with it and stuff? There would have to be another external audit to keep an eye on it.
(Female, youngest age group, Edinburgh)

Data types

5.29 When participants were asked about the relative acceptability of different data types being shared for research purposes, they tended to begin by saying that it depended on who would be accessing the data and for what purpose, reinforcing the centrality of trust as a determinant of views. They were keen to reiterate that private companies should not be able to use data for purposes aimed solely at profit maximisation, and that access to data should only be granted where this is likely to result in public benefit(s).

5.30 Still, they did distinguish between different data types, with three types in particular provoking considerable discussion and debate across the events: postcode data; some socio-demographic data; and commercial data.

Postcode data

5.31 There was widespread concern that a focus on postcode data in research could result in areas being negatively labelled - for example as "deprived", "rough" or low-achieving - and, subsequently, in residents of those areas experiencing stigma or discriminatory treatment. While this was most commonly discussed with reference to insurance companies blacklisting or setting higher premiums for those living in particular areas, there was a perception that public bodies similarly make assumptions and decisions about people based on where they live (or have lived).

If you've using [Burnfoot] as a statistic area for smoking, for alcohol, for child problems, social work, how many benefits are claimed, it's a bad area. Therefore, anybody accessing that information for likes of insurance purposes is going to go ["no".]
(Female, older age group, Galashiels)

Some universities might feel: "we don't want to involve people from areas of deprivation, because we know they are less likely to finish their course and that's bad for us, for our figures".
(Male, oldest age group, Edinburgh)

5.32 A potential, reverse effect was also identified, with participants expressing concern that their postcode area could lose out on important services or support in the event of not being labelled as deprived or otherwise 'in need'.

We don't want a postcode lottery again, which happens in schooling sometimes. There needs to be consistency across all areas, instead of just concentrating on a deprived area, there are people who might be deprived within a non-deprived area … It has to be accurate enough to reflect the society as a whole.
(Male, middle age group, Glasgow)

5.33 In addition to concerns about labelling, there was a view that postcode information was potentially disclosive. This view was most common among people in the more rural locations of Oban and Galashiels, several of whom contended that individuals could "quite easily" be identified within a dataset focusing on a small geographic area from a combination of their postcode and other types of data, such as basic socio-demographic characteristics or service usage.

I think, when you live in a big city and nobody knows one another, this is a great idea … but to people who live in a smaller community, it's not all that good an idea. It's a bit like Big Brother watching you, it's a bit like George Orwell isn't it?
(Female, oldest age group, Galashiels)

Socio-demographic data

5.34 Very few participants expressed any concern about the sharing of data on an individual's sex, age, ethnicity, disability and maternity/pregnancy. Data on sexual orientation and, to a lesser extent religion, proved more contentious, however.

5.35 As might be expected, data on sexual orientation was most commonly a focus for LGBT participants, most of whom expressed ambivalence on the matter of such information. On the one hand they emphasised a need for better, more accurate data on sexual orientation to increase understanding of LGBT issues and inform improved service provision for these groups.

I think, in general, NHS surveys are quite a good thing, because I think there is a lot of generalisations made about people, especially like around sexuality and gender identity, and I think that there is not really a lot of sort of education within the health service.
(Male, youngest age group, Edinburgh)

Data is valuable...The NHS currently uses the fact that transgender people fail to self-identify in surveys as an excuse not to provide us services.
(Female, oldest age group, Edinburgh)

5.36 On the other hand, there was trepidation about the potential for such data to fall into the wrong hands and be misused, particularly in the event of it being 'de-anonymised', rendering individuals potentially identifiable. Among some of the older LGBT participants, this concern was grounded in historic and more recent instances of gay men (as well as other minority groups) being "rounded up" or otherwise persecuted under particular political regimes - there was specific reference to Nazi Germany and the current Putin government in Russia. They contended that such instances could be repeated anywhere at any point in the future and that the ready availability of sexual orientation data could be facilitative in this regard.

It is hugely important to be 'out' at all times if one possibly can, otherwise nobody would know there were LGBT communities… but at the same time, in the old days, it was always taking a big risk… In my lifetime, [things] have improved hugely, so, yes, that's wonderful of course it is, but I'm just worried that although it is wonderful it could all change again.
(Male, oldest age group, Edinburgh)

If this isn't totally anonymised and the same lurch to the right wing happens in Scotland; I'm not saying it would but, theoretically, the same thing could happen. I was sitting in an office in one of the charities I work with and it's like, okay, if we were to take Aberdeen back to the 1930's all of us would be rounded up and that concerns me about any, even [anonymised], data.
(Male, oldest age group, Aberdeen)

5.37 Other LGBT participants were more concerned that the sharing of sexual orientation data could lead to an increase in homophobic discrimination, including on the part of public services.

[Male:] A particular postcode in Edinburgh might be a primarily LGBT neighbourhood, so perhaps a certain homophobic group of police officers may choose not to patrol that area as much.

[Female:] Or patrol it far too much.
(Oldest age group, Edinburgh)

5.38 With regard to data on religion, participants at a few of the events felt this was "too personal" to be shared. At the same time, most of them - in common with many other participants - struggled to see the relevance of religion to research, typically posing such questions as: "What has religion got to do with it?" or "Why do they need that?" To some extent this spoke to the way those participants conceived of research, which was primarily in terms of its potential to inform the design and delivery of services.

I understand that [research] needs to be done [but] again I question religion and why that's particularly relevant to public services.
(Male, oldest age group, Aberdeen)

5.39 Such views were not widely held however, with the majority of participants fairly unconcerned about the collection and sharing of data on religion.

Commercial information

5.40 Despite participants' initial assertions that they were happy for public and some third sector organisations to have access to data from private companies for research purposes, it became clear that they regarded some types of commercial data as more acceptable than others.

5.41 There was general recognition of the potential value to the public and third sectors of data held by supermarkets and other retailers. Participants were particularly receptive to the idea that loyalty card information could enable the Government and other authorities to develop an improved understanding of people's eating habits, which in turn could inform public health campaigns. There was a sense in which loyalty card data was seen as much less personal, and therefore less private, than other types of information, especially those held by public sector organisations. Indeed, a few people said that, when they began using a loyalty card, they had fully expected that the information it generated would be used for research and development purposes, and had been comfortable with that.

Public sector information could be much more personal, like your health, your criminal activity, anything like that, whereas what you eat is not that important is it?
(Female, middle age group, Oban)

I think if you sign up for a loyalty card then you're actually giving them permission to use that data.
(Female, oldest age group, Aberdeen)

5.42 In contrast with these views, there was general opposition to the idea of banking and other financial information being shared with any third party organisation, whether public, private or third sector. This reflected a view that financial data, even in anonymised form, is very private and should remain so. Some participants were concerned that the sharing of financial data between organisations and sectors would widen the scope for fraud and other types of financial crime.

5.43 There was a similar level of opposition to the sharing of data held by internet providers and social media companies. This data was also seen as too private to be passed from one sector (or organisation) to another - although several participants were keen to point out, usually with some disapproval, that the Police already made considerable use of social media channels such as Facebook when conducting investigations.

Data uses

5.44 Specific examples of data uses presented to participants (most of which had already been raised and discussed spontaneously albeit to varying degrees earlier in the events) were:

• to develop new drugs or products
• to plan and improve services
• to understand the public's behaviour
• to understand health, illness and disease
• to inform and test the effect of policy

5.45 There was a consensus that all of these uses were potentially positive in the sense that they could result in public benefits. At the same time, there was further reiteration of the view that it would depend on who is using the data and their precise reasons for doing so, with participants once again voicing their objection to the private sector being able carry out research aimed solely at profit generation.

5.46 Accordingly, much of the discussion around the examples of data uses centred on 'research to develop new drugs or products'. Participants reiterated the view that any private sector companies wishing to carry out this type of research using personal data (anonymised) should be required to pay for access to the data or share any resulting profits with the data owners. During these discussions it became clear that fairness was a key consideration underpinning views: across the events there was repeated suggestion that the public sector devotes considerable funds to the collection of data and therefore should be able to recoup some of those funds from other parties wishing to access the data.

I think it is only fair that the public purse gets something back if [the public sector] paid to get statistical information gathered, otherwise [the private company] would use some of its own millions and gather data.
(Female, oldest age group, Aberdeen)

5.47 'Research to plan and improve services' also prompted further discussion. While there was general recognition of the importance of this type of research, there was also some debate around how the data might be interpreted. Whereas some participants assumed that the focus would be on identifying areas where additional or better services were required, others - most of whom were at the Galashiels event - reiterated their concerns about possible service closures. Again, these concerns may largely have been a product of recent health service closures in the Borders area.

5.48 Beyond the above-mentioned perspectives, very few additional comments were made about data uses that had not already emerged at earlier points in the discussions.

Factors that would mitigate concern

5.49 As discussed earlier in this report, and despite the presentation explicitly stating that only anonymised data would be shared, participants continued to raise specific concerns around data security and privacy. A number of actions were identified by participants to mitigate these concerns.

5.50 Similar to findings in the 2012 research, the consensus was that anonymisation and guarantees that individuals could not be identified were essential prerequisites for public acceptance of data sharing. Participants felt it vital that anonymity was maintained at all stages of the data-sharing process, by all organisations and individuals involved, to prevent personal details being inadvertently disclosed, sold or misused. Further, it was felt that reassurance over anonymity should be a key facet of information provided to the public about data sharing.

I wouldn't mind any of these [public] services having access to totally anonymised information, but it is never going to be totally anonymised unless the system is really put in place.
(Male, middle age group, Aberdeen)

[The public need] reassurance about anonymity because that's what people worry about.
(Male, older age group, Oban)

5.51 Suggested safeguards for ensuring data security were also similar to those indentified in the 2012 research and included:

• the establishment of an oversight body to control access to, and use of, data
• clear procedures and protocols to govern the handling of data, such as ensuring that data are destroyed after use
• stringent vetting of organisations and individuals who would have access to data
• the imposition of firm sanctions in the event of organisations or individuals being found guilty of misusing data.

5.52 As already indicated, mechanisms for ensuring that public, private and third sector organisations are more transparent about data sharing and its outcomes were also deemed essential. This was perceived to be important, not only in demonstrating to the public that research involving data sharing was producing its intended outcomes, but also in enabling the public to monitor and/or challenge research being conducted. There was a specific focus on ensuring transparency around the level of profit that private companies accrue from research and the extent to which their research is contributing to the public good.

I think it has to be more transparent as to what information the organisation holds and has to be made mandatory for [organisations] to say; "this is the information we hold [and this is how it has been used] for the public benefit".
(Male, middle age group, Glasgow)

It is good to do research and it is beneficial, but is there not anywhere that you can see the current research? There should be a public place that people can actually see what research has been carried out.
(Male, middle age group, Oban)

5.53 Some of the above suggestions made by participants to mitigate concerns were developed more fully during later discussions concerning benefit-sharing models and methods for empowering the public in decision making.

BENEFIT-SHARING

5.54 As discussed throughout the previous section, participants spontaneously mentioned potential benefits of data sharing. These were predominantly: societal benefits achieved through improved public services and wider knock-on benefits, such as the potential for a healthier society; and the sharing or reinvestment of profits accrued as a result of research based on shared data.

5.55 To facilitate more in-depth discussion of such issues, participants were given a second presentation, which introduced the concept of benefit-sharing - including the range of potential benefits arising from research and methods for sharing benefits - and provided specific examples of existing models of benefit-sharing identified in the literature review. The models included those developed as part of the Generation Scotland study^[5]; the SHARE database project^[6]; and a programme of genetics research in the province of Newfoundland and Labrador in Canada^[7]. (A copy of the presentation is provided in Appendix E and a handout for participants summarising the three models is provided in Appendix G).

5.56 Following the presentation, there was almost unanimous agreement among participants that benefit-sharing was important and necessary to ensure public acceptance of data sharing. Further, participants felt that the requirement to share benefits should apply to the public, private and third sectors, although it was clear that they thought of benefits differently in relation to the public and third sectors' use of personal data compared to private sector use.

5.57 As discussed previously, the promotion of the public good - whether in terms of improving public services or delivering wider societal benefits (for example, improved public health) - was very much seen as the raison d'être of public bodies and many third sector organisations, and consequently as an inevitable goal of the research these sectors conduct.

It's in all our interest [for the public sector] to be as efficient as it possibly can be. With more information on how to target resources, they are going to be more efficient, so the benefit is there, it's not complicated. The charities [have] pretty much the same thing, having information will make them more efficient in what they do, so everyone gets the benefit of it.
(Male, middle age group, Aberdeen)

5.58 In contrast, participants perceived the ultimate goal of private sector organisations - and by extension of the research they undertake - as profit generation (albeit they did recognise that such research can also deliver public benefit). Thus they felt that private sector access to data should be more strictly controlled and subject to pre-agreed conditions.

5.59 Accordingly, benefit-sharing models were commonly seen as more relevant in the case of data sharing involving the private sector as compared with the public or third sectors. It was felt that benefit-sharing models would ensure research conducted by private companies was squarely focused on the public interest and that those companies had a duty of care towards data subjects.

Benefit-sharing models

5.60 Participants identified both advantages and disadvantages in each of the example models of benefit-sharing, but did not generally regard any of the examples as being ideal for all types of data sharing. Some participants noted that all of the models related to medical research among people who had opted in to the process and, as such, regarded the models as only really relevant in that context. Still, across the events participants did identify desirable features of a benefit-sharing model, sometimes drawing on the examples provided. These features related primarily to who should benefit from data sharing and how they should benefit. The discussions focused mainly on data subjects, data users and groups that might be termed 'secondary beneficiaries', namely other countries and future generations.

Data subjects

5.61 Participants drew a clear distinction between research requiring the proactive participation of subjects (for example, research involving genetic samples) and research that draws on routinely collected administrative or statistical data (such as health records or census data).

5.62 Where research requires proactive participation, the prevailing view was that data subjects should benefit directly. Participants felt this was particularly appropriate in research studies conducted among small and well-defined populations, where administering direct benefits would be relatively straightforward.

It kind of depends on how the research is being done and how much effort is required from the person who is providing the data [that should determine] what benefit the individual should be entitled to.
(Male, middle age group, Aberdeen)

If I was just going to the doctor's surgery for an appointment and they said, can you fill out the questionnaire, and it was to do for something generally, I wouldn't want personally paid for it, but if it was something more specific … maybe if I had an illness or something and they wanted to use [me] as a guinea pig, and they said we'll give you this...
(Female, oldest age group, Edinburgh)

5.63 Direct benefits for data subjects were conceived of in different ways, from financial incentives to advice and access to services. Many participants found the model of benefit-sharing used in the Generation Scotland project - wherein research subjects were provided with health advice through their GP - particularly attractive.

5.64 At the same time, a common view was that incentivising or rewarding data subjects, as in the SHARE example, might encourage only particular types of people to take part in research, which, in turn, might have implications for the representativeness of any findings. In support of these views, a few participants discussed personal experiences where they had either been invited to participate in medical research but declined due to the lack of recompense offered, or had friends and colleagues who regularly took part in such research where a substantial financial incentive was offered.

5.65 In terms of research that draws solely on routinely collected data, the prevailing view was that individual data subjects should not necessarily benefit directly and, instead, society in general should be the main beneficiary. That said, participants went on to acknowledge that not all research would have relevance to all members of society, which in turn led them to refine their views and suggest that members of the specific population to which the data relates (for example, cancer patients or deprived communities) should be the main beneficiaries.

It depends where [the data] comes from. If [researchers] are getting information [from] the NHS and the government... then it should benefit services we get in the long run, not necessarily the individuals [who provided the data].
(Female, youngest group, Oban)

Every piece of research is not going to affect the whole of society at that particular time, but particular research is going to [benefit] alcoholics, is going to [benefit] the homeless. So, I don't mean everybody at the same time, but I do mean the whole of society depending on their needs.
(Female, middle age group, Glasgow)

5.66 'Societal benefits' were conceived of in terms of primary and secondary benefits. Primary benefits were outcomes that arose directly from research and included new and improved products and services - for example, drugs to treat diabetes or more integrated public transport networks. Participants also discussed the potential for products and services to be better targeted at those who need them most, though this view was tempered by concern, discussed previously, about the potential for services to be reduced or removed from particular areas.

5.67 Secondary societal benefits were conceived of in terms of broader and longer-term benefits, such as better public health or improved education levels. Some participants referred specifically to Generation Scotland and SHARE as programmes that could lead to a better understanding of health issues. There was a view that such benefits would save the government money in the long run. For example, improvements to public health would result in reduced pressure on the NHS.

I think [the] government benefits in terms of financial benefits. Health [is] a big portion of the amount of money spent in the country. Therefore, if all these things are working, that should actually reduce the money spent [on health, which could be spent] in a different way.
(Male, oldest age group, Glasgow)

5.68 As previously discussed, participants also felt there should be greater transparency around research involving shared data and that data subjects should receive feedback on how their data has been used, regardless of the type of data collected (that is, whether collected routinely or through the proactive participation of subjects). There was a view that such feedback would provide a means of thanking data subjects for providing data and demonstrating to them that the information was being put to good use.

Transparency [is] the key. [By being transparent, organisations are] going to gain more trust in the community and it's going to be a nice circle, building trust and providing more benefit for people.
(Female, youngest age group, Edinburgh)

Data users

5.69 Discussions pertaining to data users focused primarily on private companies. Despite participants' initial aversion to the idea of companies profiting from research using shared data, the discussion of benefit-sharing led to the emergence of more nuanced views. There was general recognition that profits provided an incentive for private companies to invest in and conduct research, which, in turn, contributed to wider economic benefits, such as job creation and infrastructure development, as in the Newfoundland and Labrador example. In addition, it was felt that profits would likely be reinvested in future research, which would continue the cycle of product and service improvement whilst safeguarding jobs.

I also want the [researchers] who take the sample from me, to have enough money, so they can go [on to] the next idea.
(Female, oldest age group, Oban)

5.70 Despite acknowledging that profit could be beneficial, participants remained concerned about the potential for private companies to make excessive profits. Further, there was a view that, in a bid to maximise profits, private companies may refuse to share profits or make products and services unaffordable.

As long as it's not really excessive profit. We all know how we feel about the banks in terms of the amount of money they make at our cost and it's really angering to think that certain people have actually made that kind of money, profited out of other people's suffering.
(Female, oldest age group, Glasgow)

5.71 Consequently, participants felt it was important that benefit-sharing models incorporated clear provisions to curb the level of profits made from research. Specific suggestions commonly made in this regard included provisions to ensure that private companies:

• pay to use data - participants reiterated the view that this would provide recompense to data-holding bodies to cover data collection costs, particularly in cases where it might take years for profits to be generated. Participants continued to argue that private companies, particularly pharmaceutical companies and supermarkets, made vast profits and could afford to pay for access to data. There was also some suggestion that costs for accessing data could vary according to the type of organisation seeking access - for example, public and third sector organisations could be given data for free or at a lower cost than private sector companies
• share profits - in line with the Generation Scotland model, participants felt that, where appropriate, benefit-sharing models should include agreements to directly share profits with data holders (for example the NHS) and other research organisations involved (for example universities), thus contributing towards the cost of data collection and providing funds to reinvest in further research. Some participants suggested imposing a limit or cap whereby profits would be shared after reaching a pre-defined level
• provide affordable products and service - participants felt that private companies should provide products and services to public bodies and/or data subjects at lower costs. The main example cited in this regard was pharmaceutical companies providing cheaper cancer drugs to the NHS. Some participants suggested this provision could be administered using a sliding scale, whereby costs were reduced proportionate to the level of profit accrued
• reinvest in communities - where research focuses on specific communities, participants felt that a proportion of any profits should be reinvested in those communities, for example, to build community centres or provide initiatives for young people

[With profits from] medical research and that kind of [research] the money should be put back into the government for the NHS, because it is something everybody uses and it's about us and it's trying to make things better for us, so we should reap the rewards of it rather than just some pharmaceutical company [making profits].
(Female, youngest age group, Galashiels)

If a company develops a drug and it's through the help of data from different people with a condition, if they are making enormous excessive profit from that drug, the government should be able to bring the price of that drug down.
(Female, oldest age group, Oban)

Secondary beneficiaries

5.72 Aside from data subjects and data users, participants identified two further groups who might become beneficiaries of research, namely:

• other countries - there was a view that new or improved products and services resulting from research - cancer drugs received particular mention - could be sold or applied in other countries. Some participants were particularly keen that developing countries where research funding and infrastructure is limited, should benefit
• future generations - it was felt that future generations could benefit from research conducted now in much the same way as current generations had benefitted from research conducted in the past

…We wouldn't have the national health service, we wouldn't have drugs, we wouldn't have anything, if it hadn't have been for people being allowed to try things out in the past. So, I suppose, when you look at it like that, it is almost as if you have a moral duty to say, we have benefited, so why shouldn't we contribute for [future generations?]
(Female, oldest age group, Glasgow)

5.73 There was a view that recognising these groups in benefit-sharing models, particularly in cases where it is difficult to identify an immediate benefit to data subjects or wider society, would go some way towards demonstrating that the research is in the public interest.

5.74 In considering benefit-sharing models, participants not only discussed who should benefit from research and how, but also who should be involved in decision making about the development of these models. As is discussed more fully in the next section, these views invariably reflected, or formed part of, wider discussions about where decision-making power around data sharing in general should lie.

EMPOWERING CITIZENS IN DECISION MAKING

5.75 There was unanimous agreement that public involvement in decision making on data sharing, including the development of benefit-sharing models, was important and appropriate. A common view was that, as the data relates to the public, it is important that they are involved in deciding how they are used.

It is such an attractive idea to know about it and to have some kind of control over it.
(Female, oldest age group, Edinburgh)

Well [the public] certainly contributed to the data so why shouldn't they be involved to some degree?
(Male, oldest age group, Aberdeen)

5.76 However, participants often struggled to articulate what form public involvement should take or who should be involved. To stimulate discussion of these issues, each group was given a handout outlining five broad forms of involvement identified in the literature review, and asked to consider the relative appeal of these^[8] (A copy of the handout is provided in Appendix H). The five types can be summarised as:

• Transparency - the public as recipients of general information about how data are used and shared for research purposes
• Feedback - the public as recipients of feedback relating to how their data is used and the outcomes of specific research
• Agenda-setting - opportunities for the public to influence the specific types of research that is carried out
• Informing policy - mechanisms for public views to be taken on board in policy-making and to shape how data are shared and used
• Representation - opportunities for individuals to act as representatives of the wider public in decision making

5.77 Whilst views varied across and within the break-out groups, there was a stronger appetite for the transparency, feedback and informing policy forms of involvement than for agenda-setting and representation.

Forms of public involvement: transparency, feedback and informing policy

5.78 As discussed previously, there was strong support for mechanisms to ensure transparency around how data are used and shared. Participants were keen to have openness and transparency in relation to the following aspects specifically:

• the overall rationale for sharing data
• what data about the public are held and being shared
• how data sharing works in practice
• how decisions are made in relation to types of research that are carried out and who is allowed access to data
• which organisations are sharing data
• what research is being carried out.

5.79 In terms of feedback, participants were keen to be informed about how research carried out using their data had benefited society; for example, how it had helped to inform the development of a new drug or led to service improvements.

5.80 Significantly, there was a view that transparency and feedback may help foster greater levels of public trust in, and support for, data sharing by:

• providing reassurance that those involved in decision making were competent and acting in the public interest
• pre-empting any negative scare stories about data sharing from unofficial sources
• generating a 'feel good factor' amongst research subjects about the fact that their data has been used in a positive way.

[Transparency is] where you get trust. I don't think anyone would hold back information [if they have been told] what it was being used for and […] what the outcome would be.
(Female, middle age group, Oban)

5.81 Levels of support for public involvement in policy-making were similar to support for transparency and feedback. Participants felt strongly that the public should be involved in setting the rules or guidelines that govern how data are shared, with whom and, less commonly, for what purpose. Crucially, they felt this would enable the public to retain some degree of control over their data. Indeed, during the discussions around different models of benefit-sharing, participants spoke in particularly positive terms about the way in which residents in Newfoundland and Labrador were afforded a degree of control over their data.

[If] the public gets to be involved in setting the standards…then we all know what anybody can pluck out about us and we can reasonably expect, if people are following that, that anything we consider too personal, nobody knows about us unless they directly ask us.
(Female, oldest age group, Edinburgh)

Informing policy, because it just makes you feel like… you actually get asked about it and then your decision is taken into the mix.
(Male, younger age group, Galashiels)

Forms of public involvement: Agenda-setting and representation

5.82 The more active forms of public involvement in decision making - agenda-setting and representation - were less popular than transparency, feedback and involvement in policy-making. There seemed to be two main reasons for this.

5.83 First, while participants felt that the public would be able to contribute to more general discussions about how their data are used, there was also a view that most members of the public did not have the requisite knowledge and expertise to contribute to more specific decisions concerning the types of research that should be carried out, and other similarly complex issues. It was often said that such decisions should be entrusted to experts - there was specific reference to the Scottish Government, scientists and researchers in this regard. Some participants expressed concern that too great a focus on the public's views may result in the wrong, or less essential, types of research being carried out.

I kind of think to myself, you need more of an expert knowledge on the subject rather than Joe Public. I'm not saying we're all stupid and can't understand things, but some aspects of some processes need more of a government think tank to be working that out [rather] than opening it up to the general public so much.
(Male, middle age group, Galashiels)

I don't think the general public know what research should be done, I think that should be left to the scientists and the professionals. They are the people who know what needs to be researched.
(Female, oldest age group, Glasgow)

5.84 Second, it was commonly felt that most people were either unwilling or unable (due to family and work commitments) to devote time to acting as public representatives. A corollary of these views was that people who do take up such positions are the "usual suspects" or "busybodies" and thus unrepresentative of the public as a whole. Participants in Glasgow and Edinburgh had particular doubts about the effectiveness of representation in larger, more urban settings, compared with areas such as Newfoundland and Labrador, due to the fact that urban populations are very diverse and therefore cannot be easily reflected in small decision-making forums.

5.85 Of the small number of participants who were in favour of public involvement in agenda-setting and public representation on decision-making bodies, most were in the older Galashiels break-out group. This may reflect the group's evident feelings of disempowerment at having not been consulted about a number of important decisions over recent years; particularly local decisions such as the Borders Railway project and the closure of local health services.

5.86 Other participants who were in favour of more active forms of public involvement tended to be people who were less trusting of government and/or who had a philosophical belief in public participation.

Governments tend to say something and do the very opposite and they need the public or a body or committee, somebody to keep them in line [and] just to say, "Look this is the way you're supposed to go".
Male, oldest age group, Galashiels)

Methods of involvement

5.87 Reflecting participants' views on potential forms of public involvement in decision making, commonly suggested methods of involvement were:

• regular consultation work by any body charged with overseeing data sharing
• an online information resource and
• a television-based information campaign

5.88 Views around methods of involvement tended to be framed by consideration of two factors: whether the method would be inclusive of people from different sections of society (particularly in relation to age) and, albeit less commonly, cost-effectiveness.

Regular consultation work by any body charged with overseeing data sharing

5.89 There was strong support for the idea of setting up an oversight body - or a "committee" as participants often referred to it - comprising a range of stakeholders, independent of organisations involved in research, to oversee issues relating to data sharing, including models of benefit-sharing. It was commonly suggested that this oversight body would have no agenda and would ensure that decisions were not made to suit vested interests.

5.90 While participants felt that most members of the public did not have the skills and experience to be part of an oversight body, they nonetheless felt that public interests should be represented in an indirect way. A popular idea was for a third party organisation to regularly consult with the public on key areas of decision making and report back to the oversight body accordingly. Specific forms of consultation suggested included polls/surveys and other types of research, such as the deliberative events in which participants were taking part.

5.91 Reinforcing points made earlier in this section, participants felt that consultation should inform general principles around data sharing (including rules on what information is made available, who should be able to access it and governance arrangements) rather than to solicit views on specific requests for access to data.

5.92 There was also a view that any oversight body should operate an open-door policy, enabling members of the public to seek more information should they wish to do so, or to ask questions or give feedback on latest developments.

Online information source

5.93 The internet was frequently suggested as another potentially useful means of engaging the public in developments around data sharing. Internet-based communications were regarded as having two main benefits over other, more traditional methods of engagement.

5.94 First, these were widely perceived as being a cost-effective method, particularly when compared with leaflet and television-based communications. A few participants expressed concern that an expensive information campaign would only mean that reduced funds were available for research.

5.95 Secondly, a common view was that an online approach would give people the choice over whether and when to seek (more) information. Some people felt strongly that they should not be inundated with unsolicited information (leaflets posted through their door received specific mention in this regard).

Having a website is cost-effective because if people are interested they can go on it and have a look; if they're not then they don't have to. Leaflets and things like that, I think, are expensive and unnecessary because 95 per cent of them will just end up at the bottom of a bird cage.
(Female, oldest age group, Aberdeen)

5.96 Consistent with findings from the 2012 research, a popular suggestion was that a website could act as a "one-stop shop" for information on data sharing, of the type described in paragraph 3.79. Others suggested a more interactive website that would allow people to ask questions, feed back their views, and review what data about them is held (in a similar way to reviewing credit history, for example) and whether it has been shared. As an extension of this, a small number of people felt that the website should allow people to set personal preferences around the types of information that is shared, with whom, and for what purpose.

5.97 Less commonly, participants suggested that social media could be used to both inform the public about data sharing and to engage them in the process by enabling them to ask questions, comment on posts or start discussions.

5.98 However, consistent with views reported in earlier sections, many participants, including those from younger groups, were generally distrustful of social media companies and consequently had doubts as to whether social media sites would be regarded as reliable sources of information on data sharing. There was specific concern about the potential for information on social media sites to "grow arms and legs", making it difficult for people to distinguish fact from rumour.

5.99 More generally, participants were mindful of the limitations of using solely an online approach to disseminate information about data sharing. A common view, particularly among older participants, was that online communication would exclude those who do not routinely use the internet.

5.100 Further, a number of participants were keen to point out that people would only access a website about data sharing if they were made aware that such a site existed. There was a clear sense in which the Data Linkage Framework was seen as something that needed to be more proactively brought to the attention of the general public as a first step in promoting engagement with the subject.

A television-based information campaign

5.101 Reflecting these views, participants often felt any online resource should be supplemented with an initial public awareness-raising campaign delivered using more traditional methods of communication. Television was felt to be a particularly effective method on the grounds of its perceived inclusivity.

We don't know what is available, don't know where to go what to look for, whereas if it is a big TV campaign, you will see it, the majority of people will see it.
(Female, oldest age group, Galashiels)

5.102 It was widely felt that a TV-based information campaign should take the form of a short programme or advertisement rather than a longer documentary that people would be less likely to watch. A popular suggestion was for a programme in the style of a party political broadcast or a public health campaign.

See likes of the campaigns they did for the AIDS campaign and all these kind of things…where they can inform the public very quickly about what's happening.
(Female, oldest age group, Glasgow)

5.103 Regardless of the specific method used, participants felt strongly that the public should be communicated with in layman's terms. A number of people criticised communications provided by government departments as often difficult to understand.

It would be good if there was a central point of information that's unbiased and easy to understand, but not in a condescending way.
(Male, oldest age group, Edinburgh)