Research Data Request from a Health Screening Programme
The Health Promotion Unit holds 45,000 records from a non-communicable disease screening programme in three districts. The dataset includes name, national identity card number, date of birth, sex, body mass index, blood pressure, diabetes status, clinic, and mobile number. A university requests the full dataset for a three-year study. It plans to store the data on an overseas cloud service whose vendor holds the encryption keys, link it to future hospital records, and publish district-level maps. Ethics approval has been granted, but there is no data-sharing agreement. The unit has two weeks to decide. The director wants to support research but is worried about re-identification and reputational harm. Staff have not conducted a data protection impact assessment, and consent forms mention only service delivery, not research. No pseudonymisation has been applied.
1. Identify the legal, ethical and data-protection issues the unit must resolve before any data are shared. Explain how each affects the decision.
Read the worked answer
The unit faces four connected problems. First, consent covers service delivery only, so research use lacks a clear lawful basis unless another basis applies and is documented. Ethics approval is not a substitute for that legal analysis. Second, no data-sharing agreement means purpose, retention, security and breach duties are undefined. Third, the overseas cloud with vendor-held keys creates a cross-border transfer and control problem: the unit cannot guarantee access limits or timely deletion if the vendor controls encryption. Fourth, future hospital linkage and district maps increase re-identification risk, especially for small districts.
The decision should therefore be conditional, not a simple yes or no. A refusal would block useful research, but full release would be disproportionate. The unit should complete a data protection impact assessment, define the minimum dataset, and approve only if the residual risk is acceptable and the transfer rules are met.
2. Design the minimum controls you would require for approval. Include data, contractual, technical and publication controls.
Read the worked answer
Data controls. Remove name, NIC and phone number at source; replace identifiers with a study ID whose key remains with the unit; reduce date of birth to age band; generalise clinic to district; suppress or aggregate cells below an agreed small-number threshold. Do not release raw free-text fields.
Contractual controls. Use a binding data-sharing agreement covering permitted research use, no re-identification, no onward sharing, retention and deletion, breach notification, audit rights, publication review and liability. Future linkage requires a new approval.
Technical controls. Unit-controlled encryption keys, role-based access with multi-factor authentication, access logging, encrypted transfer and storage, and a cloud region and vendor assessment that satisfy cross-border requirements.
Publication controls. Require review of maps and tables to prevent small-area identification; no raw record release. These controls are proportionate because they preserve research utility while addressing the specific re-identification risk.
3. A month after transfer, the university reports that a laptop with a subset was stolen. Outline your response sequence and the judgement you would make about notification.
Read the worked answer
First contain and verify: ask the university to isolate the laptop, preserve logs, confirm whether the data were encrypted and how many records were involved. Second assess risk using the data fields, identifiability, sensitivity and likelihood of harm. Third, if the risk threshold in the applicable law is met, notify the data protection authority and affected individuals with clear guidance; do not wait for complete certainty. Fourth, document the decision, notify the unit leadership, suspend further transfers and review the agreement.
My judgement would favour notification where identifiable health or identity data are involved and encryption is uncertain. Concealment would increase harm and legal exposure, while prompt notification and support would preserve trust.