8.12 Types of dataset
In short
- The governance knows three types of dataset: 1+MG compliant, 1+MG cohort and externally governed. The type decides who takes the access decision, and who is controller for it.
- For 1+MG compliant datasets, a 1+MG Data Holder in the country decides. For 1+MG cohort datasets, the Genome EDIC decides, after a national review where the Member Country provides one. Externally governed datasets follow their own rules, outside the 1+MG data governance.
- Every dataset states its type in the catalogue, and the system supports all three types, so that Users follow one procedure whatever the type.
The problem
Users often need data from several countries at once. For the access decision, the governance describes two alternative scenarios: the legal responsibility is at national level, or it lies with the Genome EDIC legal entity DG II.1. It also allows datasets that don't follow the 1+MG data governance at all DG VII.2.1.
If the system doesn't know which case applies to a dataset, it can't send an access request to the right reviewers, name the right controller, or tell the User what to expect.
The three types
The glossary gives the governance definitions word for word. In short:
| Type | What it means | Who decides on access | Controller for the access decision |
|---|---|---|---|
| 1+MG compliant datasets | Made available under the 1+MG data governance, with the legal responsibility for the access decision at national level | A 1+MG Data Holder in the Member Country DG VII.5.4 | The 1+MG Data Holder DG III |
| 1+MG cohort datasets | Made available under the 1+MG data governance, with the legal responsibility for the access decision at the Genome EDIC | The Genome EDIC: the Genome EDIC CC adopts and documents the decision DG VII.5.5 | The Genome EDIC DG III |
| Externally governed datasets | Can be found in the catalogue if they meet inclusion criteria on quality and ELSI, but are not made available under the 1+MG data governance DG III | Their own data provider, or a health data access body under the EHDS DG VII.3.1 | Outside the 1+MG data governance |
The rule
- Every dataset must state its type in the catalogue, and with whom the data access application is shared. For 1+MG cohort datasets, the 1+MG NCP provides this information DG VI.4.4; for 1+MG compliant datasets, the 1+MG Data Holder does DG VI.4.5.
- The Member Country chooses the type of its datasets. The governance asks each Member Country to decide on a national strategy for the responsibility of downstream data disclosure, and to nominate, where applicable, its 1+MG Data Holders DG VI.1.3. The architecture decision record ADR-0002 proposes to read this as the choice between the two 1+MG types. The level of the choice (country, 1+MG Data Provider or dataset) is still open (see the open points).
- The system must support both decision paths for every dataset, and one access request may cover datasets of both types.
- Users must follow one procedure, whatever the type. The Genome EDIC CC remains their one-stop shop and tells them the outcome DG VII.5.5.
- Externally governed datasets must not enter the 1+MG review. The Genome EDIC CC lets the User contact the data provider of these high value datasets directly, or sends them to the EU dataset catalogue DG VII.3.1. A 1+MG secure processing environment (SPE) must let the User import the data DG VIII.3.3.
How it works in each phase
| Phase | 1+MG compliant datasets | 1+MG cohort datasets | Externally governed datasets |
|---|---|---|---|
| Inclusion and catalogue | The 1+MG Data Provider includes the data, as controller for the inclusion DG VI.2.2 DG VI.4.3. The 1+MG NCP checks them and sends the metadata to the Genome EDIC catalogue DG VI.4.4. The 1+MG Data Holder receives the data and holds them legally for secondary use DG VI.4.5; a 1+MG Data Host that is not the 1+MG Data Holder signs a data processing agreement DG VI.4.6 | Same inclusion and checks. The Genome EDIC holds the data legally; a 1+MG Data Host holds them on its behalf DG III | Listed in the catalogue if they meet the inclusion criteria on quality and ELSI DG III |
| Discovery (research, policy development, QM in healthcare) | Subject-level data discovery is already processing of personal data. The User states the purpose and the inclusion criteria first DG VII.2.4. The User Organisation and the 1+MG Data Holder, as controller for the disclosure, are joint controllers DG VII.1.3. The 1+MG Data Holder performs the DPIA; the Genome EDIC may prepare it where it is joint controller DG VII.2.2 | Same, with the Genome EDIC as controller for the disclosure DG VII.1.3. The Genome EDIC CC performs the DPIA DG VII.2.2 | Found in the catalogue, labelled as external DG VII.2.1. No subject-level discovery under the 1+MG data governance |
| Access request | Submitted through the Genome EDIC CC DG VII.3.1 | Same | The User is sent to the data provider or to the EU dataset catalogue DG VII.3.1 |
| Review (research, policy development, QM in healthcare) | By an internal or external local DAC without conflicts of interest, as the 1+MG Data Holder organises it, considering the opinion of the 1+MG DAC DG VII.4.6 | By 1+MG Data Providers and/or Local DACs, as the Member Country determines DG VII.4.7, and by the 1+MG DAC. A national veto is possible where applicable DG VII.5.1 | Outside the 1+MG data governance |
| Decision (research, policy development, QM in healthcare) | The 1+MG Data Holder DG VII.5.4 | The Genome EDIC CC adopts and documents it, and informs stakeholders through the 1+MG NCP DG VII.5.5 | Outside the 1+MG data governance |
| Data protection impact assessment (DPIA) | The 1+MG Data Holder, with prior consultation of the data protection authority before the first access DG VII.5.4, supported by the Genome EDIC CC DG VII.5.5 | The Genome EDIC CC, with prior consultation of the data protection authority DG VII.5.5 | Outside the 1+MG data governance |
| Use | In a 1+MG SPE. The User Organisation is controller for the downstream use DG VII.1.3 | Same | Imported into a 1+MG SPE, under the dataset's own rules DG VIII.3.3 |
| Healthcare reuse | No formal access decision per request: access rests on the framework data use agreement of the User Organisation DG VII.5.4. The 1+MG DAC checks the plausibility of the request within 1 to 3 working days, and the Genome EDIC CC arranges with the 1+MG Data Holder who co-reviews, so that two people check it DG VII.4.3. The 1+MG NCP informs the 1+MG Data Holder of the request and of the outcome at once DG VII.4.5 | Same: no access decision per request DG VII.5.5. At least two people in the 1+MG DAC check the request DG VII.4.3. The 1+MG NCP channels the information to the national stakeholders after the 1+MG DAC's check DG VII.4.5 | Not applicable |
Where it applies
These pages ask what differs per type of dataset? and build on this page:
- Context: 3.3 European, national and User Organisation scopes.
- Building blocks: 5.1.1 User Portal and central data catalogue, 5.1.2 Access request management, 5.2.2 Access review and decision support.
- Runtime: 6.1 Data inclusion, 6.2.1 Registration of the User Organisation, 6.2.3 Data access request, 6.2.4 Review and decision, 6.3.1 Data use agreement, 6.3.3 Healthcare reuse.
- Concepts: 8.2 Controllers, processors and responsibilities, 8.6 Legal basis, consent and objection, 8.10 Metadata and semantic interoperability.
- Requirements: 1.1 Requirements overview.
Legal and governance basis
- Governance: three lifecycle phases, each with its own controller(s), and two scenarios for the access decision DG II.1; the definitions of the three types DG III; the Member Country's national strategy for the responsibility of downstream disclosure DG VI.1.3, taken before inclusion because it becomes part of the consent DG VI.1.5; why externally governed datasets were added DG VII.2.1. The sections cited in the tables above give each responsibility.
- GDPR: the controller (Art. 4(7)) and the data protection impact assessment (Art. 35) [GDPR].
- EHDS: for data made available through the EHDS, the User applies through the EU dataset catalogue, to a health data access body DG VII.3.1 [EHDS].
Open points
- At which level the type of a dataset is chosen. The Member Country decides the national strategy for downstream disclosure DG VI.1.3. Whether it chooses once for the country, per 1+MG Data Provider or per dataset, and whether it may nominate no 1+MG Data Holder at all, is open. See chapter 11.
- Whether one dataset can be of more than one type, for example part of it disclosed as 1+MG compliant data and part as 1+MG cohort data. The governance doesn't say. See chapter 11.
- When a national veto applies to 1+MG cohort data ("where applicable") DG VII.5.1: to be detailed in 6.2.4. See chapter 11.