Appendix 4: A risk based system for application approval by the UKRR This risk based approach aims to ensure that CAG, in line with the ICO Anonymisation Code of Practice, have appropriate referral of applications that have high risk linkage, high risk data content, or high risk context of use. Risk Risk definition factors Actions Approval Estimated study volume Low 4 or fewer linked data UKRR only UKRR can approve <20 sources None of the complicating factors listed below Medium 5-7 linked data sources UKRR plus UKRR can approve, <5 and/or 1 of the following additional but should note any complicating factors:* comments to potential Geographically researchers issue defined dataset with and ensure that the population between researcher(s) are 100,000 and 1M made aware of Return of linked data issues and are to a data controller or reminded of their associated researcher legal obligations who may have access to identifiable data Use of a data field that has a potential risk for or specific population with risk of small cell counts based on rarity of outcomes or exposures and proposed stratifications *If there is >1 complicating factor it will be classed as risk’ ‘High High 8 or more linked data UKRR checks for Specific CAG <5 sources and/or 1 of the scientific integrity approval required following: and refers matter Geographically to CAG for either defined dataset with a study level population between approval or 10,000 and 99,999 overall approval Use of a data field that that similar has an identified risk protocols in the for re-identification future are also Any other reasons not acceptable (or stated above not)
Appendix 4: A risk based system for application approval by the UKRR This risk based approach aims to ensure that CAG, in line with the ICO Anonymisation Code of Practice, have appropriate referral of applications that have high risk linkage, high risk data content, or high risk context of use. Risk Risk definition factors Actions Approval Estimated study volume Low 4 or fewer linked data sources None of the complicating factors listed below UKRR only UKRR can approve <20 Medium 5-7 linked data sources and/or 1 of the following complicating factors:* Geographically defined dataset with population between 100,000 and 1M Return of linked data to a data controller or associated researcher who may have access to identifiable data Use of a data field that has a potential risk for or specific population with risk of small cell counts based on rarity of outcomes or exposures and proposed stratifications *If there is >1 complicating factor it will be classed as ‘High risk’ UKRR plus additional comments to researchers UKRR can approve, but should note any potential issue and ensure that the researcher(s) are made aware of issues and are reminded of their legal obligations <5 High 8 or more linked data sources and/or 1 of the following: Geographically defined dataset with population between 10,000 and 99,999 Use of a data field that has an identified risk for re-identification Any other reasons not stated above UKRR checks for scientific integrity and refers matter to CAG for either a study level approval or overall approval that similar protocols in the future are also acceptable (or not) Specific CAG approval required <5
UKRR_individual_level_data_application_pack_v1.9.docx