Independent Expert Group for the Unlocking the Value of Data Programme report: SG response
Our response to the final report by the Independent Expert Group for the Unlocking the Value of Data programme. The aim of the programme is to unlock the value of Scotland’s public sector personal data in secure, ethical and transparent ways, to realise public benefit.
Recommendations
The 19 Recommendations made by the IEG are grouped under three key themes: Engage, Enable and Ensure.
While there is a degree of overlap under the three broad themes, we recognise the importance of the issues raised and outline where corresponding Scottish Government action is planned, in progress or completed (these actions are listed under Annex A).
Recommendations 1 – 3 (Engage)
1. Engage in ongoing meaningful public and practitioner involvement and review throughout the data lifecycle;
2. Engage with expert stakeholder groups including:
- The private sector
- The third sector
- Academics
3. Engage the general public
Recommendations 1-3 are in broad alignment with current plans to engage with the public, relevant stakeholders (including practitioners and experts) and industry, to explore and reach a common understanding of the terms ‘public benefit’, ‘public interest’, ‘harm’ and ‘benefit-sharing’, and approaches to safe and secure data access and benefit-sharing.
The Scottish Government deploys a range of different methods to engage the public in decision and policy-making. High-quality public engagement, providing scrutiny, challenge and validation, will be the cornerstone of the Unlocking the Value of Data programme. The Scottish Approach to Service Design[26] will frame the co-creation of deliverables with the public and practitioners, reflecting the Scottish Participation handbook[27].
Securing a social licence to operate is essential - legal compliance on its own being insufficient - and the demonstration of public benefit is a further requirement to establish and maintain public trust. This aligns with the Scottish Government’s commitment to put the people we serve at the heart of everything we do, as evidenced by developments such as:
- The development of a consistent model for public participation and engagement on the ethical and transparent use of health and social care data.
- The introduction of the Scottish AI Register for monitoring and tracking the use of AI in Scotland’s public sector in an open and transparent manner. The Register is engaging citizens and stakeholders throughout the lifecycle of AI, by encouraging participation and awareness at all levels. The public can participate in open public consultations and the register enables continuous feedback on how the Scottish Government is using this technology to improve the lives of the people of Scotland.
- The Scottish Government is in the early stages of exploring how technology could be deployed to support high-quality and scalable public participation, potentially enabling citizens to contribute views regarding data use, on a case-by-case basis. This is being actioned through the CivTech programme (Challenge 10.7)[28], announced in August 2024.
The Scottish Government’s research on public engagement (literature review) regarding the use of public sector data with or by the private sector, will inform future approaches to engagement. We are committed to including the views of marginalised or seldom-heard communities and acknowledge, accordingly, the IEG report’s recommendation to draw on the National Standards for Community Engagement[29] to enable this engagement.
We will determine the most effective ways to facilitate deeper industry engagement, to understand the benefits and challenges associated with access to data, recognising the IEG had identified the absence of such engagement during the programme’s foundation stage.
The Unlocking the Value of Data programme seeks to build on, and extend the scope of, the multi-stakeholder engagement initiated during the programme’s foundational phase, balancing stakeholder interests across private, public and third sectors and academia. We will draw on existing and evolving public sector organisations, networks and alliances, including:
- Research Data Scotland – RDS conducted a review of current operational practice[30] regarding commercial access to public sector data, for the Scottish Government, which included private sector and stakeholder engagement.
- NHS National Services Scotland (NSS)[31] – NSS plays a pivotal role in bringing together data from across the Scottish healthcare system, using the Seer 2 platform[32] to consolidate various datasets and provide a secure, trustworthy platform for data science and analytics. This enables users to unlock critical and actionable insights that can support operational improvements and patient outcomes.
- The Scottish AI Alliance[33] - a partnership between the Scottish Government and the Data Lab[34], tasked with the delivery of Scotland’s AI Strategy. The Scottish Government’s support for The Data Lab is helping to accelerate the nation’s ability to use data and AI to improve economic and societal outcomes.
- The Life Sciences Scotland Industry Leadership Group[35] and NHS Research Scotland Industry Partnership Group[36] support engagement and consultation with the life sciences sector.
Recommendations 4 – 11 (Enable)
Recommendation 4: Enable early adoption of Guiding Principles in targeted policy areas
The Scottish Government notes the IEG report’s statement that some of the guiding principles “may be more aspirational than practical for the time being”, and that the “principles can be viewed as a guide rather than as set in stone”.
In working with our partners to develop use cases to operationalise Scottish Government policy for access to public sector personal data by the private sector, we will apply the guiding principles proposed by the Independent Expert Group.
Recommendation 5: Enable awareness of the data held
The Scottish Government is aiming to create a next-generation data catalogue[37] to enhance data discovery, streamline data-handling and build a more flexible, data-driven public sector.
A federated data catalogue and metadata repository, this open source tool will enable organisations to understand the data they hold, and to share their data and metadata more easily and effectively with other organisations in the sector. This in turn will support cross-collaboration and innovation.
This pioneering project, initially being developed as a proof of concept under the CivTech programme (Challenge 10.4)[38] will link datasets safely and securely in real time. This will create enabling conditions by strengthening data governance and data management across different platforms within the sector.
This federated approach to metadata search aligns with the UK Government’s plans for a National Data Library. By developing Application Programming Interface (APIs) to link our Scottish metadata repository with the UK Government, we will contribute to a National Metadata Repository, improving data discovery across the public sector.
We will also develop clear and accessible documentation on data sources in the health and social care sector, through an integrated approach to data catalogues in health and care, that can be used to describe data that is available on an open or shared basis. This will build on existing catalogues across the sector, and develop a shared set of interconnectivities and definitions to manage data as a national dataset.
For open data (or data with open metadata), an existing portal is accessible through https://find.data.gov.scot/[39], one of the Scottish Government’s Open Government Commitments. The Open Data Institute (ODI) has produced a Data Spectrum[40] which is designed to help people understand the language of data - from closed, to shared, to open data.
The independent report, Open data in Scotland: a blueprint for unlocking innovation, collaboration and impact[41] states that rather than having a narrow focus on purely open data, we can derive benefits from sharing data in different ways, which range from granting limited access (e.g. by restricting the audience, or redacting parts of the dataset) to full access for reuse under an open licence. Sharing and opening (non-personal) data can be mutually reinforcing, as many of the organisational, technical, and policy barriers are the same.
Recommendation 6: Enable a streamlined approach to data access
The RDS Researcher Access Service[42] enables faster, simpler access to secure data for public good. Launched in April 2024, the service offers academic and public sector researchers a streamlined, end-to-end pathway to access secure data for research. Approved researchers and data users can examine data routinely collected by the NHS and other public bodies, using a system which prevents any individual from being identified. This allows research that can support work to address some of Scotland’s major health challenges.
With the development of a common operational framework, to test Scottish Government policy for industry access to data, the ambition is to develop the service to provide access to the private sector for public benefit research, in Scotland.
The Scottish Safe Haven Network[43] is moving towards a single system approach to sensitive data research in Scotland. A federated network will allow data from two or more Safe Havens to be used securely and efficiently, enabling important research for public benefit.
The national Information Governance Review[44], one of the key IG and assurance building blocks of the Digital Health and Care Strategy, has also recommended a series of steps towards IG reform to address inconsistencies in decision-making, differences in interpretation of current regulations, and variation in risk appetite among organisations, across the health and care sector.
The Scottish Government is working with RDS on their review of data access and the role of the Public Benefit and Privacy Panels (PBPPs), and considering whether improvements made in the Statistics PBPP can be further developed, and rolled out more generally across the panels.
Recommendation 7: Enable shared standards and protocols and enable high standards and best practice
The Scottish Government contributes to the development of international AI standards through our work with The British Standards Institution (BSI)[45], the UK’s National Standards Body, and the AI Register helps public organisations follow best practice for the development, procurement and use of AI. Our Data Technical Policy function is improving the quality and accessibility of data, engaging with civil society, and running a community of practice for Data Standards and Open Data.
The Scottish Government’s Data Strategy for Health and Social Care includes a commitment to setting standards for the operation of Data Safe Havens, which would be independently evaluated. This is being taken forward with a review and update of the Data Safe Haven charter.
Recommendation 8: Enable existing intermediaries and join up; and Recommendation 9: Enable collaborative research in this area including the collation of further evidence on blockages and proof of concept research
We welcome the explicit reference to joining-up intermediaries by way of building on pre-existing bodies including, for example, Research Data Scotland, and the Safe Havens. A collaborative, evidence-based approach to identifying constraints within the current system of data access (health) has already been taken by the Information Governance review.
The RDS review of operational practice interviewed data owners and those involved in decision-making about current operational practice in public sector data use. The review describes current arrangements for industry accessing public sector data for research. It also identifies issues to be addressed in order to balance greater use of Scotland’s data for research, with the public’s views on appropriate uses of personal data. In addition, the Innovative Healthcare Delivery programme (IHDP)[46] has facilitated private sector engagement, contributing to a better understanding of the industry experience in accessing healthcare data for digital health and data innovation.
Recommendation 10: Enable User-centred Approaches
Guided by the Scottish Approach to Service Design, we are taking forward user-centred approaches in a health and care context.
The ‘Scottish Approach to Service Design’ describes design as a way of exploring the problem space openly, collaboratively and with users, before a solution or service is decided. It is a method of exploring problems that remove organisational or sectoral boundaries; a way of working that should be present at the heart of government policy, bringing together otherwise disparate parts of the public sector around a common goal.
The vision for the Scottish Approach to Service Design is that the people of Scotland are supported and empowered to actively participate in the definition, design and delivery of their public services (from policy-making to live service improvement). This brings together national and local government, health, public bodies, charities and third sector, as well as the private sector.
Recommendation 11: Enable further investigation into technological opportunities
Managing data effectively requires investment in the skills and capabilities to deploy technologies to make data accessible, generate metadata to enhance data discovery and streamline data-sharing.
The Scottish Government’s investment in technical architecture and data science skills is powering the development of the first national self-service data catalogue, with the potential to transform data discovery and linkage in the Scottish public sector (see Recommendation #5).
Ensure: Recommendations 12-19
Recommendation 12: Ensure action plans, resources and conditions are in place
There are two aspects to this recommendation, as stated in the IEG Report:
1. “The Scottish Government should develop action plans for the next phases of the UVOD programme based on these principles and recommendations.”
2. “The Scottish Government must ensure that the enabling conditions as outlined in Principle #6 are in place in Scotland’s public sector and that the resources are provided to facilitate these conditions.”
We recognise that enabling conditions (Principle #6) include the provision of appropriate resourcing and skills to facilitate private sector requests for public sector personal data access. This has been discussed at recommendation #4, which specifically referred to the early adoption of the guiding principles.
The Scottish Government’s response will be evidence-led. As previously stated, the evidence demonstrates conditional public support for private sector use of personal data for public benefit – support being conditional on the consequent benefits being shared between the public and private sectors.
Informed by the IEG report recommendations, the evidence gathered from the associated literature reviews, and public engagement activity, the Scottish Government will take steps to pilot a benefit-sharing model (see our response to recommendation #18).
Recommendation 13: Ensure reasonable public benefit rationale provided by those seeking data access, informed by publics and reviewed and verified over time
The Scottish Government’s position is that public benefit should be the predominant rationale for the provision of access to public sector personal data, not just for private sector organisations, but for all organisations accessing this data.
According to the authors of the UVOD literature review on benefit-sharing, “Public benefit cannot be obtained in the absence of (benefit) sharing. However, the absence of common principles for trusted G2B personal data-sharing may lead to restrictions on data flows resulting in detrimental economic impacts. Legal certainty is key for such sharing to take place.”
The Literature Review’s recommendation that public benefit should outweigh private benefit will be considered in the course of the programme. We also note the IEG Report’s reference to the recommendation of respect for “proportionality, transparency, accountability, and respect for ethical values and norms in designing frameworks for public sector personal data (benefit) sharing. Value co-creation should also be promoted in the construction of benefits.”
The Scottish Government will clarify the terms for access and use of data for industry projects, including the approval and controlled access pathways to ensure ethical use in the public interest (see Recommendation #18).
Recommendation 14: Ensure Data Protection (DPIAs) and Equality Impact Assessments (EQIAs)
The Scottish Government has developed a Data Protection Impact Assessment (DPIA) template, which will be shared with public sector partners. There is a need to clarify the role of DPIAs and EQIAs in the data access process for different types of projects. An EQIA will be completed for the UVOD programme and it will be considered, and in some cases required, for future work that is undertaken.
Recommendation 15: Ensure red lines on access for certain purposes
We recognise there are situations in which the provision of access to public sector personal data is not appropriate and permission for public sector personal data access is only given if it is both legal - fully compliant with UK GDPR - and in accordance with strict information governance (IG) processes.
The Scottish Government’s stringent approach to IG is embodied by the Statistics Public Benefit and Privacy Panel (SPBPP) and the Public Benefit and Privacy Panel (HSC-PBPP) for Health and Social Care. These processes ensure that requests for public sector personal data are scrutinised by a panel of experts and members of the public.
Together with the secure environments provided by Scotland’s Safe Havens in accordance with the Charter for Safe Havens[47] (currently under review, as explained above), this ensures robust, transparent, consistent, appropriate and proportionate IG and scrutiny of data access. This approach prioritises the IG principles of: safe people, safe projects, safe data, safe places and ensures that public benefit and privacy are prioritised.
RDS is working on an approach to IG for research based around ‘effective anonymisation’, which should apply to whomever is accessing data. It is important to recognise that the existing PBPP processes will not be the only way of making decisions on data access, though it will be important to have independent scrutiny by a panel of experts.
Recommendation 16: Ensure transparency from public sector in data access provisions and from private sector about their access to this data
The UVOD programme will maintain an open government approach and will examine the utility of a data use registry. We will consider if the PBPPs could serve this purpose, through the published list of projects it has approved, or the RDS data use registry. Recognising that transparency is critical to building public confidence in data practice, ongoing public engagement and public involvement will be central to the development of outputs under the UVOD programme. Patient and Public Involvement and Engagement (PPIE)[48] will be central to the development of a data use registry as well as the outputs.
Recommendation 17: Ensure oversight is appropriately resourced; and Recommendation 18: Ensure collaboration and further input around benefit-sharing
Providing public sector data controllers and others involved in decision-making and governance processes with the support they need is critical to ensuring the highest standards of data practice are followed.
Properly resourced oversight is important for ensuring accountability for safe data access processes (and sanctions for breaches) and the delivery of public benefits. It will be for public sector organisations to consider what constitutes an appropriate level of resource to meet this requirement.
The Scottish Government has assessed a range of existing benefit-sharing models and approaches, in a national and international context. We recognise the potential value of a benefit-sharing model that addresses challenges associated with data access and use, whilst ensuring the public benefit arising from this collaboration outweighs private profits and interests.
Preliminary work on definitions and attitudes to various types of benefit-sharing has been carried out though a deliberative public dialogue exercise on the sharing of data outside of the public sector[49].
The Scottish Government will explore the feasibility of piloting a benefit-sharing model, focused on a controlled access pathway to NHS Scotland data by the commercial sector, an area where there is a stronger, well-documented demand for access to data. Public participation and oversight will be an essential precondition for evaluating public benefit, and ensuring data is shared for the common good.
We will continue to review existing practice across governments, sectors and policy areas, aligning with good practice where possible. Furthermore, we will consider how implementation of the NHS England Value Sharing Framework for NHS Data Sharing Partnerships[50] could inform this approach, recognising Scotland is distinct in a number of important ways.
Recommendation 19: Ensure public can trust the companies accessing the data
The notion of restricting access to data to ‘trusted private sector organisations’ raises the question of whether public sector organisations could adopt a ‘fit and proper’ organisation test as part of the data access process, and whether it would be helpful to have the concept of a ‘trusted’ private organisation which adheres to a code of conduct around privacy and data.
This recommendation goes beyond the international best practice ‘Five Safes’ framework for safe and ethical data handling, where accountability is through accredited researchers undertaking public benefit research. As such, we are not recommending a change to this framework. UK legislation does not require organisational accreditation in addition to researcher accreditation.
With the development of a common operational framework, RDS will consider the level of experience and expertise within organisations and their commitment to the ‘five safes’ practices, as well as transparency and accountability in project agreements involving private sector companies.
Conclusion
In conclusion, the report by the Independent Expert Group highlights key issues and challenges for government and public bodies to consider in developing approaches to the ethical use of personal data by the private sector, for public benefit.
The report underscores the primacy of public trust in this process, correctly asserting that “meaningful public involvement and engagement is the cornerstone of acceptable data access and use.”
As previously highlighted, our Public Dialogue on the Use of Data initiative mobilised a public engagement panel to inform approaches to data use by Government and public bodies. This illustrated the vital role the public can play in shaping how data is used - and the value of deliberative engagement in producing nuanced and actionable insights.
In a challenging financial climate, we need more than ever to explore innovative, cost-effective and methodologically robust ways of engaging the public, as exemplified by the CivTech 10.7 Challenge. The Scottish Government-sponsored challenge asks: How can technology help us deliver high-quality, scalable, public participation in decision-making, inspiring trust around ethical data use and sharing, AI, and wider public good activities?
Recognising the crucial role played by the private sector - alongside academia and public bodies - in delivering data-driven research and innovation, we support the development of an operational framework for controlled access to public sector data, led by Research Data Scotland on behalf of the Scottish Government.
Assessing potential public benefit from personal data use must be balanced with mitigation of the associated risks, in order to prevent inappropriate data-sharing. Our longer-term objective, to pilot a benefit-sharing model focused initially on health data, will generate use cases for industry access to data, ensuring clarity on governance and transparency about the benefits and risks to the people of Scotland. This will aim to build confident, consistent decision-making by data controllers in this area.
In designing these initiatives, our intention would be to test the guiding principles proposed by the Independent Expert Group. A key component, for instance, would be the co-creation of the concept of ‘value’ and ‘public benefit’ through public engagement. This will help build a social licence to ensure that controlled access to personal data can act as a catalyst for public good. This would align with commitments in Scotland’s Health and Social Care strategy, and the evolving work of Research Data Scotland and other partners, in supporting innovation and research through the safe, secure and ethical use of data.
We believe that public sector personal data is an asset that should be used to benefit every part of society. As we navigate this complex landscape, with significant pressures on public finances, we will adopt an agile approach - drawing on the full range of evidence and emerging good practice in this area - to unlock the value of Scotland’s public sector personal data.
Contact
Email: Christopher.bergin@gov.scot
There is a problem
Thanks for your feedback