Legal and Privacy Toolkit v1.0
Sophie Stalla-Bourdillon, Alison Knight · ePrints Soton (University of Southampton) · 2017
The legal and privacy toolkit is a crucial component of the Data Pitch project (the Project). The aim for this first version of the toolkit is to address the question - “What are the critical things to consider when sharing and reusing data for defined innovative purposes under the Project?” The focus of the toolkit is on ensuring that legal rights in relation to shared data are respected, and legal obligations in respect of such data are followed in the Project. In particular, the toolkit provides information on how personal data will be anonymised before it is shared for analysis by SMEs taking part in the Project, and will describe techniques to mitigate the risk of harm befalling data subjects as a consequence of data relating to them being processed in new ways (for secondary purposes). As a project deliverable, this toolkit also provides an overview of the legal and regulatory framework that applies to data sharing and data reuse, including setting out key considerations governing the data sharing arrangements between the parties involved in the Project. The toolkit provides a ‘map’ of the relevant legal issues arising in the context of data sharing, and an outline of a methodology for handling these in a suitably risk-averse manner. This framework aims to treats data ethically and responsibly, with comprehensive, yet pragmatic guidance on data disclosure and its handling. The need for a toolkit under the Project is against a backdrop of emerging legal complexities in handling and repurposing data in a ‘big data’ environment in ways that are fair. This is especially important where personal data are to be subject to secondary processing. The vast power of data analytics means that absolute anonymisation of personal data may not be possible, so organisations have to focus on mitigating the risks associated with data sharing to the point where they are remote. Finding the correct balance between innovation and data protection without running the risks of over-reaction can be extremely difficult. This toolkit sets out a structured strategic approach to managing those potential issues that arise upfront, our goal is to make it easier to innovate safely and fairly. In this way, the toolkit hopes to present solutions to achieve legally-compliant data use in technically-enhanced and risk- aware ways, which also allows organisations to obtain high levels of utility from analysing shared datasets not currently in the public domain and hence to bring better services, products and research to the public.