Workspace to Workspace Airlock

DARE Airlock Process and Workspaces in TRE

Overview:
The DARE Airlock Process aims to manage and control data movement within the Trusted Research Environment (TRE). The TRE operates based on the "5 safes of data," with a focus on safe outputs to ensure that the Clinical Practice Research Datalink (CPRD) maintains control and visibility over all data leaving the environment, regardless of the workspace.
Data removal from the TRE requires approval from a CPRD Airlock manager to ensure proper oversight and compliance. However, there is a consideration to create exceptions for clients with Multi-study License (MSL) workspaces and associated Research Data Governance (RDG) workspaces. In the future, these clients should be allowed to move data between their workspaces without involving a CPRD Airlock Manager. This exception is made because the movement of data within the client's workspaces is of lower risk and will give responsibility to the client. Managing data movement within the TRE is resource-intensive, so allowing clients to handle their workspace data can improve efficiency.
To address the need for control and auditing, CPRD requires the implementation of spot checks and auditing mechanisms, leveraging available logs within the TRE. This would enable CPRD to ensure clients use the data appropriately within their workspaces. The plan is to enforce appropriate usage through contractual and technical controls, which would reduce the need for CPRD to manually monitor every data movement, thus saving resources.

Issues:
• Client Data Movement and Airlock Manager Role:
The proposal to introduce a new Airlock Client Manager role separate from the CPRD Airlock Manager (current Airlock Manager app role) is crucial for managing data movement between MSL and RDG workspaces within a client's environment. This role would approve data movement requests within the client's workspace. However, it is vital to enforce restrictions to prevent data transfer from RDG workspaces to MSL workspaces to ensure compliance with data handling policies. Also, the requests which are approved by the new Airlock Client Manager role should not have the possibility to leave the TRE environment. There shouldn’t be a possibility to download files outside of TRE.
Setting up individual workspaces for specific researchers or organisations is extremely important to prevent unauthorised access to data from other organisations involved in collaborative studies. This would enhance data security and privacy.

• Types of Data Transfer
The movement of identifiable data should not be permitted. Some of the non-sensitive data examples are listed below:
o Aggregated Data
o Scripts and Codes
o Metadata
o Statistics – summary
o Synthetic Data

• Automated Data Checks for PII and Small Cell Counts
The implementation of automated data checks will ensure the integrity and privacy of data within the TRE. Automated scripts and algorithms can be developed to scan datasets for potential Personally Identifiable Information (PII) and small cell counts, which are essential for data anonymisation.
When the automated data checks identify any potential issues like PII or small cell counts, they will promptly flag these instances to the designated CPRD Airlock Manager.

Alternative Methods
• Storage Account Management:
Utilising temporary storage accounts for data movement between MSL and RDG workspaces is an effective solution. However, careful management of shared storage accounts is essential to maintain data privacy and prevent unauthorised access by other clients.
• Data Sharing and Collaboration Tools:
The use of Gitea as code collaboration and version control tools for data sharing between clients is promising. However, the limitations of Gitea, allowing only one-way data transfer, need to be addressed to ensure efficient collaboration among clients while maintaining data security. Current user testing is being conducted to understand the movement of data.

No files, tests, or entry points are identified. Start by turning the proposed Airlock Client Manager, workspace-direction restrictions, in-TRE-only approvals, and automated PII and small-cell checks into an agreed design. Done means the requirements, audit controls, and data-transfer boundaries are specified and validated.