Foster limited forms of access where necessary

In cases where access needs to be partially or totally restricted to conform to legal rights, ethical principles and/or to protect legitimate private, public, or community interests, and with the ultimate objective of facilitating access which is as open as possible: 

a. Foster more limited forms of access, such as access to aggregated or de-identified data, restricted access within safe and secure environments to certified users with clearance adapted to the sensitivity of data, or access via analyses that share only de-identified results

b. Foster searchable access to metadata that describes those datasets while respecting legal rights, ethical, principles, and/or, legitimate interests. 

Options and conditions for restrictive access may be included as part of National Open Science Strategies and Research Data Management Plans. These Strategies and Plans may include initiatives or measures that encourage any or all of the following:

• Share sensitive data may within a specific domain based on co-operative research projects in a secure environment (e.g. Korean KSTAR sharing data with the US NERSC for AI/ ML)

• Provide research data networks and infrastructures for disciplines (e.g. GESIS, ELIXIR) that offer robust, scalable options for implementing restrictive access where necessary.

• Provide trusted research environments (e.g. UK DARE) to enable trust and limited forms of access where applicable, alongside mechanisms which rely on explicit consent or other relevant statutory approval. 

• Use data trustee models and provide relevant funding. For this purpose, data trustees may be entitled with a legal role.

• Incentivise the use of techniques such as confidential computing and provide training resources for anonymising research data.

• Identify a disclosure range through the use of a systematic authentication mechanism (e.g. NII Research Data Cloud in Japan).

• Outline ways to provide mediated or tiered forms of access. Level of access to data may as such range from highly restricted (e.g. commercial in confidence, patient level, culturally sensitive, national security) to fully open access. In mediated access access is not granted automatically but requires an intermediary such as a Data Access Committee, administrator or custodian (e.g. ELIXIR). In tiered access data is classified into tiers or levels of accessibility (e.g., open, registered, restricted).

• Include cross-government initiatives to support the development of infrastructure which makes data valuable government data available to researchers and data scientists in a responsible way through a secured cloud environment, ethical protocols and robust security.

Implementing limited access to sensitive data poses several challenges. Additional resources are needed to train researchers in data anonymisation and to develop secure, trusted research infrastructures and repositories.

Ensuring compatibility between open data policies and other legitimate interests, such as commercial use or privacy, requires careful balance to protect taxpayer benefits and public trust. Establishing frameworks for restricted access, such as safe environments for certified users, is complex and resource-intensive.

Moreover, fostering searchable access to metadata while respecting legal and ethical considerations demands robust policies and infrastructure to balance accessibility with protection of sensitive and private data.

They are also challenges and costs associated to the operation and maintenance of mediated or tiered access models (e.g. human resources and technical functionalities needed for mediation and manual access review/provision as well as for data access-tier categorisation).