ASSURED Training useful vocabulary

Administrative Data are data collected about people when they interact with public services. 

Aggregate Data are data combined from several measurements or individuals. When data are aggregated, groups of observations are replaced with summary statistics based on those observations.

The adjective "anonymised" is used to describe data that has undergone a process of manipulation—such as the removal of direct identifiers, aggregation, or suppression—to ensure it no longer relates to an identified or identifiable person. This means that truly anonymised data cannot be linked back to the original individual through any reasonable means. For this reason, anonymised data is no longer considered personal data and is no longer subject to data protections laws like the GDPR. 

As defined in Article 4 of the GDPR, a Controller is a natural or legal person, who is responsible for defining the purposes and means of data processing.
 

The Article 4 of the GDPR outlines that a Data Breach occurs where ‘there has been the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed’. 

A Data Protection Impact Assessment (DPIA) is a formal process used to identify, assess, and minimise the privacy risks associated with data processing activities. Under the GDPR, a DPIA is legally mandatory before starting any new research or project that is likely to result in a high risk to the rights and freedoms of individuals (such as large-scale monitoring or processing sensitive health data).

A Data Subject is the observation about whom the data relates. 

Usually a Data Subject is a natural person, but in the context of ASSURED, we expand this definition to refer to an observation that is represented by a single row in microdata. Under this definition, a Data Subject could also be a commercial entity, a group of people such as a family, a sensitive habitat, etc. 

To ensure the clarity and readability of the text, we tend to refer to the Data Subject as if they were a natural person (i.e. referring to Data Subjects as 'they') but it should be understood that the principles expressed also apply to other types of Data Subjects.   

This is the idea that one observation could account for most of the value in a statistical measure, and therefore be identifiable. It can sometimes apply to individuals,but is more of a concern for business statistics where firms might dominate a market or sector, or might be making large investments in a particular year.

Source: SDC Handbook 2019, V1: https://securedatagroup.org/guides-and-resources/sdc-handbook/

When used in reference to data: identifiable data are all types of data or any piece of information that can be used to identify or reidentify an individual.

It can be also used in reference to a person. Particulary in legal texts, it appears in the following combination "identifiable natural person". From the legal perspective, an identifiable natural person is a living individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. 

Microdata refers to raw, unit-level data collected from individuals, households, or businesses via surveys, censuses, or administrative records. It contains detailed, unaggregated information about specific entities and is used to create custom tabulations, perform in-depth analysis, and generate statistics.

Output Checkers assess outputs produced from sensitive data to ascertain if they can be considered 'Safe', because they are unlikely to lead to a disclosure that harms the Data Subjects, or not.

Many Trusted Research Environments require outputs to undergo a check before they are removed from the Safe Setting.

A Global Persistent Identifier (PID) is a long-term digital reference to a resource. Unlike a standard web URL (which can break if a website moves), a PID is a permanent link that ensures your data remains findable forever.

A Procedure Breach occurs where data has been handled contrary to the institutional policies (e.g. the rules of a Research Data Centre) but not such that it reaches the level of Data Breach.

As defined in article 28 of the GDPR, a Processor is a natural or legal person, who processes data on behalf of a Controller. A processor might have other subordinated entities supporting the data processing, which we refer to as Sub-processors.

The adjective "pseudonymised" is used to describe data from which directly identifying information has been removed and replaced with artificial identifiers (pseudonyms). Unlike anonymised data, the connection to the original data source is maintained via a "key" held separately, meaning the data remains potentially identifiable under specific conditions. That means that individuals might be still indirectly identifiable and for this reason, pseudonymised data is still generally classified as personal data.

Remote access in principle is just a tweak to the concept of a Safe Room, meaning that it is a physical room with controls and restrictions. However, with remote access, this room is placed at a partner organization instead of at the data provider's location. Thus, while keeping up strict security measures, remote access allows for more flexibility in data access. This access can be enabled via bilateral agreements and secure technical connections.

With a remote desktop, access happens via a secure, encrypted internet connection from a user's own office​. This approach makes data much more accessible for researchers compared to Safe Rooms. While the control cannot be as tight as in physical Safe Rooms, several measures can be taken, such as disabling any further Internet connection, copying files outside the environment or transferring them to another drive.

In a remote execution setting, users work from their own offices without directly accessing the data themselves. Instead, the users submit their data analysis code e.g. to the data provider, who then runs the analyses and returns the results to the user.

Also known as RDC, a Research Data Centre is an organisation or intitution that provides researchers with access to official or sensitive microdata. They act as the "gatekeeper," ensuring that data access complies with legal and ethical standards. One example in Germany is the RDC (Forschungsdatenzentrum - FDZ) of the Federal Employment Agency (BA) at the Institute for Employment Research (IAB). It provides high-quality labour market data to the scientific community.

A safe room is a secure room in the premises of the data provider​ in which researchers can work with sensitive data. Such a setting allows for the implementation of a number of physical controls. This includes, among others, clear access control, sealed virtual enrivonments, and the prohibition to bring any personal belongings (such as smartphones) into the room.

A Secure Processing Environment (SPE) is the specific technical "container" or physical room where the actual data processing happens. While a TRE is the broader framework, the SPE is the strict technical implementation—often involving air-gapped computers, disabled USB ports, or encrypted virtual machines that prevent data leakage.

Sensitive Data refers to any form of data that has the potential to cause harm to the Data Subjects if it is misused. Whilst usually such concerns relate to the possible impact upon people, for example by revealing private information about someone, there are other reasons why a dataset may be sensitive including for commercial or environmental reasons. 

ASSURED has been designed to be as discipline-agnostic as is possible, that is to say that many of the principles will be the same whether the harm is to a person, business, or rare species. We therefore prefer to use the term Sensitive Data, as data that requires protection may not be personal data.  

Sensitive Data in our context are microdata, containing information at the individual-level. Each row in such a dataset will represent a single observation, be it a person, a household, or a business. Microdata are typically obtained from surveys, censuses, or administrative systems.

In order to reduce the likelihood that descriptive statistics and frequency tables could reveal sensitive information about the Data Subjects, they should be based on a minimum number of observations.

This minimum number of observations is sometimes referred to as a 'Threshold Rule'.

A Trusted Research Environment (TRE) is a secure, cloud-based or server-based platform where researchers can analyse sensitive data without ever downloading the raw files to their own devices. The "trust" comes from a controlled environment where the data, the researchers, and the outputs are all verified.