Synthetic Data Governance: UK Report on Trusted Research Environments

The word “open” has acquired a reassuring moral tone in discussions about data. In research, public health, and policy, Open Data is frequently presented as a straightforward good. Datasets are released, repositories are created, and sharing initiatives multiply. The underlying assumption is that wider access naturally leads to better science, stronger transparency, and more responsible innovation. Openness and responsible use do not describe the same institutional condition. Opening a dataset changes who can reach the data. It does not determine how the data will be interpreted, recombined, or operationalised. The technical and legal work required to enable access is visible and auditable. The conditions under which data are later mobilised are far less structured. This distinction explains why data sharing initiatives often concentrate their effort on infrastructures of availability. Portals, metadata standards, and licensing frameworks are designed to remove barriers to entry. They succeed at what they are meant to do: they make data reachable. What they do not establish is a corresponding architecture of accountability. Once data circulate beyond their original context, the relationship between those who produced the data and those who act on them becomes diffuse. The governance problem shifts from permission to responsibility. When openness is treated as equivalent to responsible use, that shift disappears from view. The conversation remains focused on whether data should be accessible, rather than on how institutions remain answerable for decisions built on data they did not generate. Open Data resolves a question of access while leaving a different question largely implicit. The issue is not whether data can be shared, but how responsibility travels once they are. #OpenData #DataGovernance #DataPolicy

💡 Commenting on the EU Data Act Draft Guidelines on Reasonable Compensation The European Commission’s draft Guidelines on Article 9 of the Data Act provide detailed guidance on calculating reasonable compensation when sharing data under regulatory obligations. Key takeaways include: 1️⃣ Balancing Costs, Investments & Margins Compensation can include costs directly linked to fulfilling a data request and, in some cases, a margin reflecting investments in data collection/production. For SMEs and non-profit research organisations, only the costs of making data available can be charged — margins are excluded. 2️⃣ FRAND & Non-Discrimination Principles Compensation must remain fair, reasonable, and non-discriminatory (FRAND). Differentiation is allowed only for objective reasons such as additional technical efforts, confidentiality, or volume/format requirements. 3️⃣ Bundling & Access Mechanisms Data holders may bundle datasets to reduce overhead, but cannot force recipients to pay for unnecessary data. Pro-rata sharing and periodic adjustments are recommended to ensure fairness and avoid first-mover disadvantages. 4️⃣ Transparency & Confidentiality Article 9(7) enables recipients to request sufficient detail on compensation calculation. Data holders can protect sensitive information (trade secrets, internal costs) while still demonstrating the logic of their pricing. 5️⃣ Payment Models & Non-Monetary Compensation Flexible approaches, including subscription, per-transaction, hybrid models, or non-monetary compensation (e.g., reciprocal data sharing), are allowed. 6️⃣ Enforcement & Dispute Resolution Disputes can be resolved through national courts, certified dispute settlement bodies, or complaints to competent authorities, ensuring a fair process across Member States. These Guidelines aim to boost Europe’s data economy, encourage continued investment, and create a fair, transparent, and innovation-friendly framework for data sharing, particularly for SMEs and research organisations. Feedback is open until 20 February 2026 — an important opportunity for stakeholders to shape the implementation of the Data Act. #DataAct #EUCommission #DataEconomy #OpenData #DigitalPolicy #Innovation #FRAND #SMEs #ResponsibleData

We obsess over whether data should move. The better question is whether it ever needs to. The UK-US PETs pilot for childhood cancer research challenged a default assumption I still see in boardrooms. That collaboration means transfer. That insight requires centralisation. That progress comes with legal drag. It does not. In this pilot, patient-level data never left its home system. Yet researchers accessed combined UK-US insights on ultra-rare tumours. Analytical power increased. Suppressions reduced. Standard deviation dropped. Public value rose. What changed was not the law. It was our posture. We treated governance as design material. Not paperwork. At the outset, we mapped purpose, roles and data flows before code. We translated federated querying into data minimisation. Trusted execution into confidential processing boundaries. Differential privacy into measurable anonymisation, with explicit parameters, epsilon at 1 and small-count suppression under five. That precision shifted the conversation. Boards saw control. Regulators saw proportionality. Lawyers saw no overseas transfer of personal data, therefore no transfer risk assessment spiral. The result. Twelve-month approval cycles became two. Not because we cut corners. Because we reduced ambiguity. My reflection for UK leaders is this. PETs are not just technical tools. They are governance instruments. They allow us to redesign trust itself. If we stop asking how to move data safely, and instead ask how to generate insight safely where data already sits, we unlock a different model of digital government. One that is faster. Calmer. More confident. Are we ready to design systems where privacy is not the trade-off, but the enabler? #Privacy #Data #DataSharing #UK

𝗪𝗵𝗮𝘁 𝗱𝗼𝗲𝘀 “𝗿𝗲𝘀𝗽𝗼𝗻𝘀𝗶𝗯𝗹𝗲 𝗱𝗲-𝗶𝗱𝗲𝗻𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗶𝗼𝗻” 𝗿𝗲𝗮𝗹𝗹𝘆 𝗺𝗲𝗮𝗻 𝗶𝗻 𝟮𝟬𝟮𝟲? In October 2025, the Ontario Information and Privacy Commissioner (IPC) updated its de-identification guidelines—setting a clearer and more rigorous standard for how personal data should be transformed, assessed, and governed before reuse. This update matters. As more health, social, and public-sector data is reused for research and innovation, regulators are making one thing clear: de-identification is not a checkbox exercise. It is a process—one that must account for risk, context, governance, and ongoing accountability. This is exactly where 𝗔𝗻𝗼𝗻𝘆𝗦𝗼𝘂𝗿𝗰𝗲 positions itself. At AnonySource, we believe the question is no longer whether data can be de-identified, but how well it is done—and whether it can stand up to regulatory, ethical, and public scrutiny. Static techniques and one-time masking are no longer enough. Responsible de-identification must be: 𝗰𝗼𝗻𝘁𝗲𝘅𝘁-𝗮𝘄𝗮𝗿𝗲, 𝗿𝗶𝘀𝗸-𝗮𝗱𝗮𝗽𝘁𝗶𝘃𝗲, 𝗮𝘂𝗱𝗶𝘁𝗮𝗯𝗹𝗲, 𝗮𝗻𝗱 𝗰𝗲𝗻𝘁𝗲𝗿𝗲𝗱 𝗼𝗻 𝘁𝗿𝘂𝘀𝘁. Our platform is designed to align with exactly this direction. By combining adaptive anonymization, re-identification risk assessment, bias and demographic analysis, and strong governance controls, we help institutions move from minimum compliance to defensible, ethical data practice. As regulators raise the bar and public expectations around data rights continue to grow, organizations will be judged not just on innovation—but on responsibility. 𝗧𝗿𝘂𝘀𝘁 𝗶𝘀 𝗯𝗮𝗿𝗻 𝗶𝗻 𝘁𝗵𝗲 𝗱𝗲𝘁𝗮𝗶𝗹𝘀—𝗮𝗻𝗱 𝗶𝗻 𝘁𝗵𝗲 𝘀𝘆𝘀𝘁𝗲𝗺𝘀 𝗯𝗲𝗵𝗶𝗻𝗱 𝘁𝗵𝗲𝗺. 👉 If you’re working with sensitive health or social data in Ontario (or beyond), this update is a signal worth paying attention to. Let’s talk about what responsible data reuse looks like in practice. #DataPrivacy #DeIdentification #PrivacyByDesign #DataGovernance #HealthData #ResponsibleAI #AnonySource

🤝 Partnering with Stakeholders: No One Governs Data Alone Here's a truth that doesn't get said enough: the biggest barrier to good data governance isn't technology. It's fragmentation. When governments, businesses, academia and civil society operate in data silos, everyone loses. This module drove home why strong partnerships aren't a "nice to have", they're structurally necessary. Effective data partnerships require: 🔹 Shared data infrastructure: secure, controlled environments for access and exchange. 🔹 Data collaboration platforms: where public and private actors can integrate, analyze and act together. 🔹 Data intermediaries: trusted third parties that broker data sharing across sectors. 🔹 Civil society engagement: to ensure transparency and protect public interest. And the global dimension matters too. Aligning national data governance with international standards on privacy, protection and interoperability enables seamless cross-border data flows, critical in a world where challenges like climate, health and migration don't respect national borders. Data altruism, where organizations voluntarily share data for the public good, is an emerging and powerful model worth watching. The bottom line: unlocking the full value of data requires building trust between actors who don't always naturally trust each other. That's the governance challenge. #DataPartnerships #OpenData #DataSharing #CrossSector #CivilSociety #GlobalGovernance #ITUAcademy

There is a familiar refrain in Brussels circles: #dataprotection does not harm #innovation. We heard it in 2016. We heard it in 2018. We still hear it now. The line is delivered with serene confidence, as if complexity were a myth and compliance friction a psychological condition. Then along comes the #DigitalOmnibus. The stated aim? #Simplification. #Legalcertainty. Making the framework workable for researchers and innovators operating across borders. And then comes the #JointOpinion of the European Data Protection Board and the EDPS - European Data Protection Supervisor. If the European Commission attempts to calibrate scope, the Opinion re-expands it. If the #Omnibus seeks definitional clarity, the #JointOpinion introduces conceptual opacity. If the political objective is simplification, the institutional response is perimeter defence. In my latest analysis, I examine what happens when “scientific research” stops being treated as a governance category and starts being treated as a suspicion trigger. The GDPR contains a carefully constructed research architecture. It recognises methodological #safeguards, ethical oversight, and #proportionality. It does not require #research to be public, independent, or divorced from commercial context in order to qualify as scientific. Yet the Joint Opinion edges toward precisely that framing. The consequence is not theoretical. When qualification as scientific research becomes unpredictable, research teams over-comply. They avoid secondary use. They abandon linkage. They fragment datasets along jurisdictional lines. Cross-border collaboration shrinks because divergence between supervisory authorities makes risk assessment impossible to model. Large sample sizes suffer. Diverse cohorts shrink. Methodological robustness weakens. The EDPB claims to want systematic and methodological rigour. Yet by destabilising the research exemption and stretching #identifiability logic beyond workable limits, it risks undermining the very conditions that make systematic science possible. Here is the paradox. We are told data protection does not harm innovation. We are told simplification is needed. The Commission proposes simplification. The Joint Opinion responds by re-constitutionalising scope and re-complicating research. Precision is not #deregulation. Clarification is not rights erosion. #Governance design is not heresy. If #Europe wants leadership in #AI, health research, and data-driven science, it cannot treat every definitional refinement as an existential threat to #fundamentalrights. Rights protection and scientific progress are not enemies. But regulatory inflation can make them appear so. Link to the piece in the comments. #DigitalOmnibus #GDPR #EDPB #EDPS #EULaw #ScientificResearch #Innovation #DataProtection

Under which circumstances does the GDPR consider scientific research compatible with existing purposes of personal data processing? Recent positions by regulators and legislators show it is still a hot topic - one with major implications for R&D globally. Recital 159 of the #GDPR states that "the processing of personal data for scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research", showing that commercial research is also relevant. But what are the limits? Is research to identify better ways to achieve your commercial goals "scientific research"? Some have suggested that not all commercial research should be taken into account. It's an essential question, because the more limited the definition, the less can be done based on the "purpose limitation" principle. Plus, Article 89(1) GDPR provides a framework to make that processing work while limiting #privacy risks. In the proposal for a Digital Omnibus on the GDPR & #ePrivacy, the Commission has proposed the following definition for "scientific research": "any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest." The EDPB & EDPS (so all EU #dataprotection authorities), in their joint opinion on the Digital Omnibus proposal, have taken another view: "scientific research should: 1. be conducted following a methodological and systematic approach of the relevant scientific research field [...] be conducted in an autonomous and independent manner; 2. lead to verifiable and transparent results", and "product research and development may support innovation, but does not necessarily constitute scientific research". I believe that an emphasis on transparency is a slippery slope towards de facto exclusion of commercial research, especially where no patents are (or can be) obtained as a result of that research. When I pointed this out, I was told that my reading is incorrect and that the joint opinion "does not exclude commercial interest from research and promote transparency without requiring to publish the pseudonymised data". Yet I am not alone in this view, and Dr M.R. (Mark) Leiser's excellent in-depth analysis of the question explains very well why it is a dangerous position. Whatever your field, from AI to clinical trials, these rules should not evolve to de facto create a distinction between commercial research and other forms of research. Mark's analysis on his Substack, a must-read: https://lnkd.in/em_TtvZt

If Scotland wants faster research. It needs fewer gates and more trust. 2026 is not about new data platforms. It is about fixing how decisions get made. Right now, researchers lose months navigating fragmented routes, duplicated governance, and unclear ownership. That friction is not protecting the public. It is slowing public good. The direction for Scotland’s research data services in 2026 is refreshingly different. Align first. Simplify next. Then scale with confidence. A single, intelligible entry point for research data. Governance that is consistent across safe havens. A Research Access Service that proves speed and assurance can coexist. And a serious commitment to linking data to tackle real-world problems, not just academic ones. This matters beyond research. Health innovation. Economic growth. Public service reform. All now depend on trusted data access done well. Privacy is often framed as the constraint. That is lazy thinking. Good governance is an accelerator when it is clear, proportionate, and human. It creates confidence for data owners. Certainty for researchers. And legitimacy with the public. What I see in the 2026 plans is a shift from permission culture to stewardship culture. From “who says no” to “who makes this safe and possible”. That is how mature data nations behave. The opportunity now is leadership. Across Scotland. Across the UK. Alignment is not glamorous. But it is how you go fast without breaking trust. My challenge to leaders reading this. If your data service disappeared tomorrow, would researchers notice less friction or more? If the answer is unclear, 2026 is your moment. #DataGovernance #Privacy #DataSharing #UK

Cross-border data transfers underpin the modern digital economy, but by 2025, the regulatory landscape governing them had become more complex and fraught than ever. Can we reconcile privacy, security and economic growth, or are we headed toward permanent fragmentation? Senior fellow Sarvashreshth Yash Kalash's new CIGI paper provides a comprehensive examination of cross-border data-transfer frameworks as they stood in 2025, breaking down the analysis into key jurisdictions (EU, US, China, India and emerging economies in Asia, Africa and Latin America) alongside multilateral initiatives and regional trade agreements. Divergent regulatory philosophies shaped by competing imperatives of privacy, security and economic growth produce both innovation and friction in global data flows. To address this challenge, by drawing on comparative legal analysis, policy review and case studies, Kalash’s paper maps the current landscape and explores emerging trends; privacy-enhancing technologies, data intermediaries, and the growing role of geopolitics in shaping data governance. The paper projects plausible scenarios for the evolution of cross-border data regimes through 2030 and offers the strategic implications for governments, international organizations and enterprises navigating this shifting terrain, including: 🔸 A growing need for bridging frameworks that allow divergent regimes to recognize each other’s protections without requiring identical laws 🔸 An essential multi-track compliance strategy, one that combines contractual clauses, certifications and technical safeguards such as encryption and localization where required 🔸 Organizations such as the G20, the OECD and the WTO must advance concrete proposals, such as global adequacy principles or a model cross-border data agreement, to prevent further fragmentation The core argument is that the future of cross-border data transfers will hinge on achieving greater interoperability while safeguarding fundamental rights and national security interests. With these insights, it seems achievable. Get the full picture: https://lnkd.in/d9ckJ4Az

Pleased to share that our paper is now published! 🎉 Have you ever seen this happen? A team develops a “robust” risk prediction model… and then it never gets externally validated. Either the right datasets aren’t accessible, patient-level data can’t be shared, or the work simply doesn’t get enough international attention to move further along the risk-prediction pipeline. The result: promising models risk stalling out (or feeling “wasted”). That’s exactly the gap we set out to address. In our paper, we propose and implement Reciprocal External Validation: research teams validate each other’s risk prediction models using their own local datasets—without sharing patient-level data—by exchanging saved/frozen models instead. Why it matters: ✅ more independent validation ✅ better reproducibility ✅ stronger real-world credibility ✅ fewer data governance + privacy roadblocks #MachineLearning #ClinicalPrediction #HealthDataScience #ReproducibleResearch #Privacy #ModelValidation #DigitalHealth