Public engagement and social licence: Update on recommendations

Overall, there has been good progress made against our recommendations in the areas of public engagement and social licence. Ensuring public confidence in data sharing and linkage remains crucial, and developments over the last year indicate that increasing attention is being paid to maintaining social licence to use these data as demands for data use grow. However, meaningfully engaging with the public on decisions made about using data for research and people’s awareness of data as a public asset could still be improved, and public attitudes towards data sharing could be better monitored.

The Public Engagement in Data Research Initiative (PEDRI) has undertaken positive work to develop guidelines to help researchers conduct public engagement which, when published, will strengthen this important aspect of research activity. The Five Safes Framework remains a widely recognised and employed tool, helping organisations and individuals approach data sharing safely and legally. UKSA is taking forward initiatives to determine if the Five Safes can be usefully updated.

The public’s key concern regarding data use remains data security. It is therefore likely that many people’s attitudes towards data sharing and linkage continue to be influenced by concerns around data security, particularly when data are identifiable. A UK-wide public dialogue report produced by OSR and ADR UK showed that the public support the use of government data in research and statistics, as long as they’re informed of their use and what safeguarding is in place. As such, the significant advances made in the creation and trialling of privacy-enhancing technologies (PETs) over the last year represent promising and important developments in increasing public and institutional confidence in data sharing for the benefit of all. The establishment of the Department for Science, Innovation and Technology (DSIT) in 2023 has resulted in positive initiatives to overcome the technical and policy-based barriers to data sharing, which should be maintained and enhanced.

To reflect the progress made, as well as stakeholder feedback, our recommendations on public engagement and social licence have been updated to continue to guide system-wide approaches to these areas of data sharing and linkage.

Recommendation 1: Social Licence

Original recommendation:

The government needs to be aware of the public’s views on data sharing and linkage and to understand existing or emerging concerns. Public surveys such as the ‘Public attitudes to data and AI: Tracker survey’ by the Centre for Data, Ethics and Innovation (CDEI) provide valuable insight. They should be maintained and enhanced, for example to include data linking.

Key findings

• It remains vital to engage the public to track attitudes towards data sharing so that the social licence for greater data sharing and linkage is understood and maintained.
• Wave 4 of the government’s public attitudes to data and AI tracker survey (2024) will provide valuable and novel insight into public opinion surrounding data sharing.
• Clear and consistent communication supported by meaningful public engagement is key. Government and public bodies should publish and amplify positive stories of data sharing and linkage in action to inform the public of what their data has helped improve and to increase understanding of the value of data as a public asset.
• Public bodies should continue to look for opportunities to seek public feedback on specific data sharing proposals, as well as attitudes towards data use in general.

Summary of findings

The importance of having and maintaining social licence through government understanding of public views on data sharing and linkage was highlighted in our first recommendation in our last report. Through our research for this follow-up report, our findings on the role of social licence have been reinforced. While Wave 3 of the Public attitudes to data and AI tracker survey (2023) published by the Responsible Technology Adoption Unit (RTA) did not seek to measure public attitudes towards data linking specifically, it continues to provide valuable insight into how society views data use. Notably, the 2023 survey found that significant sections of the population continue to feel a lack of control over how their data are used and believe that not all groups in society benefit equally from data use. These findings align with consistent feedback from our partners around the need to involve the public in decisions made about data and the ongoing challenge of raising awareness of the public benefit of increased data sharing. But the findings also show that linking and sharing initiatives must be done transparently and with public engagement whenever possible. We also know that transparency with the public as to the use of their data is important. Moreover, we heard that there continues to be some nervousness among senior leaders regarding the potential for increased data sharing to lead to a negative public response. In addition, more can be done to promote the benefits of ‘opting in’ to data sharing initiatives among the public, especially in sensitive areas such as health research. As such, we consider that our recommendation remains relevant, and have updated it to reflect stakeholder feedback.

During interviews it was suggested that government could have a role in improving public understanding of data sharing and its positive impacts, with much of the current public discourse focussed on legitimate data security concerns. Open, consistent and clear communication with the public using understandable terminology will be key to informing them of the benefits of wider data use. To aid public understanding and awareness of the value of data as a public asset, government and public bodies should publish and amplify positive stories of data sharing and linkage in action. The current strategic role of the Department for Science, Innovation and Technology (DSIT) in developing and cohering policy towards data access for the benefit of all of society and across the economy will help bring cross-government attention to the importance of social licence. There is value in ongoing conversations in government around the concept of the ‘public good’ in data use, and we encourage data producers and users to ensure that the public good guides their approach to all sharing and linkage initiatives.

The Office for National Statistics (ONS) has undertaken several initiatives related to social licence and public engagement over the last year. The June 2023 outreach research by ONS, What we know from engaging with the public on data, highlighted important opportunities and issues in enhancing public trust in data use and sharing. The research found that people are more likely to be at ease and consent to data linkage and sharing if it is being carried out for the benefit of society. In August 2023, the ONS also publicised the findings of the ONS Data Debate, which asked people aged 18 to 24 years old for their views on data sharing. ONS’s blog post on its refreshed Data Strategy, Future-proofing our valuable commodity, reflects a transparent approach to data sharing which will help encourage public confidence. Initiatives such as these both increase awareness of data sharing in society and build public trust in the organisations which hold, analyse and share data for the public good. Public bodies must continue to look for opportunities to seek public feedback on specific data sharing proposals, as well as attitudes towards data use in general, such as through the ONS stakeholder forums (case study below) and the planned Public attitudes to data in the NHS and social care programme of public engagement. OSR also notes the value of greater research into specific cases of social licence and data linkage, such as the Parental social licence for data linkage for service intervention project funded by the Economic and Social Research Council.

OSR has an ongoing role to play in championing data sharing and linkage in the public domain beyond this report. We welcome RTA’s consideration of our recommendation that future tracker surveys should include specific questions on public attitudes to sharing and linkage, and at the time of writing, a question on this topic is being developed for Wave 4 of the survey. The results of the Wave 4 tracker survey are due to be published in November 2024.

Recommendation 2: Guidelines and Support

Original recommendation:

When teams or organisations are undertaking data sharing and linkage projects, there is a growing practice of engaging with members of the public to help identify concerns, risks and benefits. To help teams or organisations who are undertaking public engagement work, best-practice guidelines should be produced, and support made available to help plan and coordinate work. This should be produced collaboratively by organisations with experience of this work for different types of data and use cases and brought together under one partnership for ease of use. We consider that, given its current aims, the Public Engagement in Data Research Initiative (PEDRI) could be well placed to play this role.

Key findings

• The work of PEDRI in developing guidelines for public engagement activity is welcome progress towards our recommendation.
• More can be done to foster a culture in which the value and importance of public engagement in research projects is recognised.

Summary of findings

Our previous report highlighted the importance of public engagement to improve the transparency of research work and public confidence in data sharing and linkage more generally. We also reported, however, that there can be a lack of understanding about how to carry out public engagement in a meaningful way, and that this could be helped by publishing best-practice guidelines.

There has been significant and welcome progress towards our recommendation to produce guidelines for those in research and data services who undertake public engagement work. The Public Engagement in Data Research Initiative (PEDRI) has led sector-wide collaboration on developing principles for public involvement and engagement over the last year, and our recommendation has influenced the decision of some stakeholders to remain involved with the initiative. In summer 2023, PEDRI held a public consultation on the draft Best Practice Standards for Public Involvement and Engagement (PIE) in data research and statistics. This was supplemented by workshop consultations carried out from December 2023, with the public consultation findings published in April 2024. The draft standards will be refined before the publication of a final report. PEDRI also intends to create a resources hub on its website dedicated to signposting and creating new resources where gaps are identified. PEDRI aims to avoid duplicating existing efforts by concentrating specifically on data and statistics, leveraging the platform to enhance the use of current resources. These developments are extremely positive, and OSR hopes that the momentum can be maintained by future phases of PEDRI. In addition to guidelines, PEDRI should showcase exemplars of public engagement to provide role models for its engagement policies.

In addition, the Administrative Data Research UK (ADR UK) Learning Hub, which contains useful resources on Public engagement in practice to guide users on PIE principles to follow, was launched in September 2023. Beyond PIE, the Learning Hub brings together information on skills and resources for those using administrative data and data linkage and has already received positive feedback from users.

While the outlook is positive, there is still work to be done to foster a culture in which those working in data recognise the implicit value of public engagement. The publication of more supporting materials around PIE would make it easier for researchers and organisations to consistently consider public engagement requirements when planning their work. However, we also see a role for project funders in stipulating the need for PIE activity when developing projects alongside researchers.

When being transparent with the public, consideration should be given to how aspects of data sharing and linkage are described to ensure they are understandable and consistent. Following feedback, we came to recognise that guidelines describing ‘good’ practice are more appropriate than attempting to define ‘best’ practice. Standards and guidelines should therefore always be evolving, and we will make our terminology consistent with that being adopted by PEDRI. PEDRI also suggested that our recommendation could refer to ‘affected groups’ in addition to the public in general, to demonstrate that data access and research often impact specific demographic groups which may require tailored and sensitive approaches to engagement. This complements PEDRI’s important findings on prioritising equity, diversity and inclusion in effective PIE. We have updated our recommendation accordingly.

Recommendation 3: The Five Safes Framework

Original recommendation:

Since the Five Safes Framework was developed twenty years ago, new technologies to share and link data have been introduced and data linkage of increased complexity is occurring. As the Five Safes Framework is so widely used across data access platforms, we recommend that UK Statistics Authority review the framework to consider whether there are any elements or supporting material that could be usefully updated.

Key findings

• The Five Safes Framework remains positively recognised and widely employed by the UK research community.
• There remains an appetite for a review of the framework to determine its effectiveness in enabling safe access to data for research.
• UKSA have led a strategic workshop to discuss the current trusted research environment accreditation framework, to include the Five Safes.
• More can be done to promote the Five Safes in the UK research community.

Summary of findings

For over 20 years, the Five Safes Framework has been voluntarily adopted by data services to help them provide safe research access to data. Last year, we recommended that, owing to advancements in technology and ever-increasing data sharing requirements, the Five Safes Framework should be reviewed to consider whether there are any elements or supporting material that could be usefully updated. We considered that the UK Statistics Authority (UKSA) was best placed to lead any such review.

To date, no formal review of the Five Safes has taken place, in part owing to resourcing at UKSA. In November 2023, researchers at the University of West England published a paper describing the Five Safes and looking to the future of the framework. The framework’s principles of safe data, safe projects, safe people, safe settings and safe outputs remain highly valued by users and an effective tool for ensuring the security of a data service. The model continues to be widely implemented across the UK research community. Nonetheless, there is still an appetite for a conversation about how the Five Safes could be amended or updated to reflect the needs of today’s users. In February 2024, OSR published a blog post titled The success and potential evolution of the 5 Safes model of data access. Some of the views we heard from stakeholders, particularly around the concept of ‘safe programmes’, reflected suggestions made in the blog post. Some stakeholders, however, raised valid concerns about the risk of changing recognised definitions.

Stakeholders also told us that more could be done to operationalise the framework, in the form of improved guidance, and that the Five Safes could be better promoted among the research and analyst communities. The flexibility of the Five Safes was both lauded and raised as a concern, with an acknowledgement that organisations self-regulate their use of the framework. Good-quality and accessible guidance on the framework, such as that published by Research Data Scotland, is important in helping data providers implement it. The Standard Architecture for Trusted Research Environments (SATRE) provides knowledge and best practices for trusted research environments (TREs), covering information governance, computing technology and data management. SATRE aims to bring together and enable the implementation of standards and frameworks that apply to TREs, including the Five Safes.

The range of views reflects the continued value in having an open discussion on the framework. As such, the UKSA’s Research Accreditation Panel (RAP) arranged a strategic workshop in June 2024 to consider the effect of new technologies and concepts in the data access space. The workshop aimed to understand how these could impact the existing trusted research environment accreditation framework under the Digital Economy Act 2017. It is hoped that this initiative will prompt a community-wide conversation around the Five Safes, even if the conclusion is that the framework remains fit for purpose. OSR also recommends that, following this discussion, UKSA lead promotional work to ensure continued adoption of the Five Safes across the research community. Our report recommendation has been updated to reflect these developments.

Recommendation 4: Privacy-Enhacing Technologies (PETs)

Original recommendation:

To enable wider sharing of data in a secure way, government should continue to explore the potential for Privacy-Enhancing Technologies (PETs) to be used to enhance security and protect privacy where data are personally identifiable. The Office for National Statistics (ONS) Data Science Campus is well placed to lead and coordinate this work.

Key findings

• There has been significant progress in the development and trial application of PETs over the last year.
• PETs remain developmental and expensive to design, which are barriers to their wider adoption.
• Government should continue to invest in PET research and explore their potential, coordinated by the Department for Science, Innovation and Technology (DSIT).

Summary of findings

Our previous report highlighted the benefits of Privacy-Enhancing Technologies (PETs) and recommended that government continue to explore their potential for enabling organisations to share and use people’s data responsibly, lawfully and securely. These new technologies aim to mitigate the risks associated with sharing and linking datasets, particularly the risk of data breaches. We have seen significant progress in technological and collaborative work in this area over the last year. There is growing interest in PETs, with private sector investment in PET development complementing government-led initiatives.

The ONS Data Science Campus (DSC) has conducted important exploratory work on PETs in the UK. In April 2024, DSC released an experimental Privacy Preserving Record Linkage toolkit, which combines secure cloud computing with innovative data linkage methods to achieve accurate linkage capabilities without sharing personal information. In the last year, DSC has also been working with the Integrated Data Service (IDS) to investigate how synthetic data can be used more effectively. In November 2023, it published a technical report setting out how it synthesised the linked 2011 Census and deaths dataset while preserving its confidentiality. These innovations demonstrate significant progress in what remains a challenging and expensive, but important, area of technological development. Although resourcing is likely to constrain further PET development by DSC in the short term, OSR recommends that ONS continue to invest in PETs and would welcome the production use of the Privacy Preserving Record Linkage toolkit in the future.

There is widespread enthusiasm for PETs and acknowledgment of the role they could play in increasing the feasibility and security of data linkage. This interest has been reflected in the Responsible Technology Adoption Unit (RTA)’s and ONS DSC’s jointly run cross-government PET community of practice, which was organised to discuss case studies and risks and share ideas on potential developments. However, PETs remain developmental, with significant costs associated with research in this area and the underlying risk of data leakage remaining, albeit reduced. These difficulties can make it difficult for organisations both within and outside government to develop business cases for the adoption of PETs. Furthermore, it was emphasised that users should not regard PETs as a silver bullet to meet all data protection requirements. Organisational controls remain as important as technical controls and data processing must be lawful, fair and transparent as well as secure.

Building on the Information Commissioner’s Office (ICO) publication of guidance on PETs in June 2023, the RTA is working with ICO to develop a tool to support organisations in assessing the costs and benefits of adopting PETs. This tool will encourage potential users to consider how PETs can help them meet their data sharing requirements under a privacy-preserving federated learning method, while also highlighting the strengths and limitations of these new technologies. The coordinated approach being taken towards PETs across government is welcome, and OSR looks forward to further guidance and resources being published on technical approaches to securing data. Innovation and collaboration are also taking place around PETs in wider society, as demonstrated by the Privacy Enhancing Technologies Symposium organised by the University of Bristol and REPHRAIN and the Royal Society’s Privacy Enhancing Technologies programme. Furthermore, there have been positive developments in exploring the implications and potential benefits of synthetic data, such as the funding for two projects announced by ADR UK in April 2024.

During interviews for this report, our stakeholders told us that our recommendation had directly influenced the strategic direction adopted by DSC and others in relation to PETs over the last year. Since PETs sit at the intersection of data privacy and data innovation, the DSIT RTA can play a vital role in fostering a culture of innovation, alongside partners such as the ONS. Our recommendation has been updated to reflect this. To ensure developments are acceptable to users, DSIT must involve data owners and trusted research environments in this work.