Tryggve takes care of sensitive data
Researchers seeking to share biomedical data between Nordic countries face both technical and legal hurdles. The joint Nordic project Tryggve offers services that address these challenges by allowing researchers to process and share data securely across national borders – without transferring sensitive data via poorly protected means such as USB drives or personal laptop computers.
“The challenge we are working on is how to make the vast amount of data on health and well-being available to researchers in a good way,” explains Antti Pursula of the CSC – IT Center for Science in Finland and project leader of the Tryggve project. “Health and registry data are very valuable for research, and great advances are being made in genetics and medical research thanks to this kind of data. At the same time, in legal terms this type of data falls into a category of sensitive personal data requiring that proper security measures are taken to protect the privacy of the participating individuals, such as making sure that all use of these data is authorised.”
Health data used for research purposes are typically anonymised by removing personal details such as names and personal identity numbers and using registry numbers instead. Nevertheless, the data involved may be so detailed that they still can reveal which individual is hidden behind a specific registry number.
“In a typical use case, there is a hospital study collecting data from volunteer subjects,” continues Mr Pursula. “There are DNA sequences, some basic information on the volunteers such as lifestyle, diet or exercise habits, as well as whether or not they have been diagnosed with a specific condition. This is so much information that in some cases it may actually be possible to deduce the identity of specific persons. This shows why it is important to protect these data properly when used in research.”
Project development with user involvements
A key component of the Tryggve project is that the IT services are being developed through what the project calls “use cases”, i.e. concrete cases where researchers bring the projects they need assistance with. If the scientists feel their research could benefit from Tryggve’s services, they can make a request via a simple online form. There are few requirements imposed: a study must involve multiple Nordic countries and sensitive data.
If the Tryggve experts find that the requesting study fulfils the requirements, they start a more in-depth dialogue in which researchers and Tryggve team members figure out what is needed.
“Up to now we have been in a pilot phase to develop the services,” says Mr Pursula, “but now, halfway through the project, we are far enough along that it is more a matter of testing the services in real-life situations and supporting the users. Each use case has different needs and we try to accommodate them, which requires fine-tuning and additional development. But otherwise it is actually the administrative and legal aspects that are taking up more time now.”
Legal advice essential
If a researcher wishes to combine multiple data sets and if the work extends across national borders, it gives rise to challenges that are not only technical. “Sometimes different countries’ laws governing usage can be different, but there are also different regulations and practices,” says Mr Pursula. “This is a problem that is also found at the European and global levels.”
To help researchers to navigate laws and regulations, the Tryggve project has enlisted a lawyer who has reviewed the specific provisions and consent requirements regulating the individual data sets of a use case. This service is available for new cases as well. Overall there is strong emphasis on fulfilling the laws and regulations, as this is essential for being a trusted partner for Nordic data organisations and researchers.
“We have actually been somewhat surprised by the complexity of provisions governing data sets,” says Mr Pursula. “There are laws at both the European and the national levels as well as laws in various areas we need to follow. Things such as the right to privacy, the use of health data for research purposes and so on are regulated in different ways. A further complicating factor is that local authorities at times appear to be applying guidelines that are more stringent than the law requires.”
No accidental copies
The Tryggve project offers a secure means of transferring data between countries in which the transfer itself is encrypted and no temporary copies are generated underway. Most users gain access to the secure data environments by logging in to a remote desktop, similar to logging in to do online banking, and via this system, users get access to a range of scientific software and reference datasets.
This gives collaborating researchers access to a shared computer where they can store and analyse their data. Access is only granted to one’s own data, and only the person who is legally responsible for the research project can delegate permission to take data out from the system. Thus you can easily get data into the system, but the system ensures that you cannot copy-paste data out of the system by mistake. The only thing Tryggve cannot protect you from is someone taking a photograph of your computer screen.
“By and large, researchers are careful with their data,” Mr Pursula believes. “Today people know not to send data sets by email, but it can still be problematic to store data on personal laptops or USB drives and upload them to shared computers, where temporary copies might be generated. We offer a secure and easy-to-use alternative to all that.”
Entire Nordic region as a statistical base
The goal is for Nordic researchers to be able to transfer data, even sensitive data, across national borders via secure infrastructure that is readily accessible to researchers. Realising this requires cooperation and trust between countries.
“Slightly exaggerated, we can say that everyone supports the cross-border sharing of data, as long as everyone else is just sending data to their country. But it takes a lot of discussion to agree on common goals, even among the Nordic countries, and that has surprised me a bit,” says Mr Pursula. “Still, I think that in the Nordic countries we are more inclined to cooperate. Researchers in particular understand perfectly well that five or ten million people is sometimes not a large enough pool for carrying out population-based studies, such as in cases of a rare disease. Using the entire Nordic region offers a population base of 26 million people.”