It s 10 o clock. Do you know where your data are?

Size: px

Start display at page:

Download "It s 10 o clock. Do you know where your data are?"

Dale Reed
5 years ago
Views:

1 It s 10 o clock Do you know where your data are?

2 This page intentionally not left blank.

3 Before the deep-dive Why are we really here?

4 A simple goal Facilitate Research.

6 Privacy exposing

7 personal Information It depends: PIPEDA (ca): information about an identifiable individual. FPA (ca): information about an identifiable individual that is recorded in any form MFIPPA (on): recorded information about an identifiable individual (excluding business/professional contact information) PIPA (bc): information about an identifiable individual and includes employee personal information but does not include contact information FIPPA (on): recorded information about an identifiable individual FIPPA (bc): recorded information about an identifiable individual other than contact information.

health Information It depends even more: PHIPA (ON): means identifying information about an individual in oral or recorded form, if the information: a) relates to the physical or mental health of the

8 health Information It depends even more: PHIPA (ON): means identifying information about an individual in oral or recorded form, if the information: a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual s family, b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual, c) is a plan of service within the meaning of the Home Care and Community Services Act, 1994 for the individual, d) relates to payments or eligibility for health care, or eligibility for coverage for health care, in respect of the individual, e) relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance, f) is the individual s health number, or g) identifies an individual s substitute decision-maker. E_HEALTH (BC): recorded information about an identifiable individual that is related to the individual's health or the provision of health services to the individual;

9 Anonymous: never collected unmasking data Definitions Anonymized: collected but replaced De-Identified: collected & separated (pseudonymised)

10 It s all about Consent

11 Plan for other uses International Sharing Derivative Work Be Future Proof! Plan for the Future eg: GA4GH: Your data will be shared with other researchers around the world and used in future biomedical research projects after ethics approval.

13 But, does research data Security? really need It s all going to be published anyway right right? Hint: It s a trap

14 YES!

Spear phishing messages, according to the indictment, would appear to be from another professor inquiring about one of the target's articles and would include a link.

15 Spear phishing messages, according to the indictment, would appear to be from another professor inquiring about one of the target's articles and would include a link. Clicking on the link would take the victim to a confusingly similar domain to the victim's university and present a fake login page. They would collect names and addresses for employees and then try lists of commonly used passwords. The indictment does not reveal how many accounts were compromised in this way. With credentials stolen in this manner, the attackers were able to exfiltrate 31.5 terabytes of academic data and intellectual property. Just one recent Example

16 Examining Security Components Governance Operations Response Confidentiality Integrity Availability

18 Is compliance driving you crazy?

19 So many Policies Federal Laws Regional Laws Data Owners Data Custodians/Stewards Institutions (multiple) Funding Agencies Ethics / Consent

20 Other Factors Budget Resources (Infrastructure) Human Resources Timelines Collaborations Publication/Presentations

21 Stop that! It s Too Silly

22 and now Research Data Management

23 Tri-Agency Data Management Policy Is coming 2013: Capitalizing on Big Data: Toward a Policy Framework for Advancing Digital Scholarship in Canada 2016: Tri-Agency Statement of Principles on Digital Data Management 2018: Draft Tri-Agency Research Data Management Policy

25 There s Work To Do 1. Institutional Strategy 2. Data Management Plans 5. Data Deposit

26 Good Thing! It s a honest!

27 Your Leaders some for 1. Institutional Strategy

28 some for The long term 5. Data Deposit

29 I ll have the buttered scones for tea and a Data Management Plan!

30 Storage? Backup/Restore? Speed? Capital vs Operational? Future Accessibility? Consent Removal? Sharing? Retention Requirements? Destruction Requirements? data Lifecycle

31 Eventually... The Audit Will Come

32 Don t Panic!

33 Don t fear (good) Auditors

34 Policy Is not a 4 letter word

35 the message must be Understood Policies Standards Guidelines Procedures

36 Have good Documentation

37 Enjoy the opportunity for Enlightenment

38 TL;DR Futureproof Consent Data Management Plan Privacy Matters Security Matters Good Policy Document Follow Your Processes Never Give Up!

39 supplementary Datum

POPULATION DATA BC. Privacy in Health Research. Caitlin Pencarrick Hertzman Population Data BC University of British Columbia CFRI, April 2012

POPULATION DATA BC. Privacy in Health Research. Caitlin Pencarrick Hertzman Population Data BC University of British Columbia CFRI, April 2012 POPULATION DATA BC Privacy in Health Research Caitlin Pencarrick Hertzman Population Data BC University of British Columbia CFRI, April 2012 OUTLINE Introduction Compliance Legislation Current 2011 Amendments