Public sector personal data sharing: framework and principles

This report considers frameworks and practices of providing access to personal data by public sector organisations to private organisations.


Adams, C., & Allen, J. (2014). Government databases and public health research: Facilitating access in the public interest. Journal of Law and Medicine, 21(4), 957–972.

The Alan Turing Institute (2017). Independent Digital Ethics Panel for Police. Ethics Advisory Report for West Midlands Police. July.

Australian Government - Department of the Prime Minister and Cabinet. (2018) New Australian Government

Australian Government (n.d.). Australian Privacy Principles guidelines.

Bampoulidis, A., Bruni, A., Markopoulos, I., & Lupu, M. (2020). Practice and Challenges of (De-Anonymisation for Data Sharing. In F. Dalpiaz, J. Zdravkovic, & P. Loucopoulos (Eds.), Research Challenges in Information Science (pp. 515–521). Springer International Publishing.

Biddle, N, Edwards, B, Gray, M, McEachern, S. Public attitudes towards data governance in Australia (2018). Centre for Social Research and Methods, Australian National University. 12.

Big Data Value Association (2019). Towards a European Data Sharing Space. April.

Cavallaro, F., Lugg-Widger, F., Cannings-John, R., & Harron, K. (2020). Reducing barriers to data access for research in the public interest—Lessons from covid-19. The BMJ. July 6.

Combe, C. (2009). Observations on the UK transformational government strategy relative to citizen data sharing and privacy. Transforming Government: People, Process and Policy, 3(4), 394–405.

Danish Data Protection Agency (n.d.). What We Do.

DataLoch (n.d.). FAQs.

De Fauw, J., Ledsam, J. R., Romera-Paredes, B., Nikolov, S., Tomasev, N., Blackwell, S., Askham, H., Glorot, X., O'Donoghue, B., Visentin, D., van den Driessche, G., Lakshminarayanan, B., Meyer, C., Mackinder, F., Bouton, S., Ayoub, K., Chopra, R., King, D., Karthikesalingam, A., … Ronneberger, O. (2018). Clinically applicable deep learning for diagnosis and referral in retinal disease. Nature Medicine, 24(9), 1342–1350.

DeepMind (2016). Announcing DeepMind Health research partnership with Moorfields Eye Hospital. 5 July.

Deloitte (2020). D01. Study on public sector data strategies, policies and governance. Data analytics for Member States and Citizens. 15 May.

Equality and Human Rights Commission (n.d.). The Human Rights Act 1998.

European Commission (2022). AI Watch - National strategies on Artificial Intelligence.

European Commission (2021). The AI Act.

European Parliament (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance).

U.S. Federal Data Strategy (2020). 2020 Action Plan.

Finland Government (2019). Act on the Secondary Use of Health and Social Data (552/2019).

Finland Ministry of Social Affairs and Health (n.d.). Secondary use of health and social data.

Godlee F. (2016). What can we salvage from BMJ. 354:i3907 doi:10.1136/bmj.i3907

Hamza, H., Sehl, M., Egide, K., & Diane, P. (2011). A Conceptual Model for G2G Relationships. In M. Janssen, H. J. Scholl, M. A. Wimmer, & Y. Tan (Eds.), Electronic Government (pp. 285–295). Springer.

Harmony Alliance (n.d.). FAQ.

Henriksen-Bulmer, J., & Jeary, S. (2016). Re-identification attacks—A systematic literature review. International Journal of Information Management, 36(6, Part B), 1184–1192.

Hern, A. (2017). Royal Free breached UK data law in 1.6m patient deal with Google's DeepMind. The Guardian. 3 July.

Ipsos MORI Social Research Institute (2016). The One-Way Mirror: Public attitudes to commercial access to health data. March.

Japan Personal Information Protection Commission (2020). Act on the Protection of Personal Information. June.

Kumazawa, H. (2019). Joint Statement by Haruhi Kumazawa, Commissioner of the Personal Information Protection Commission of Japan and Věra Jourová, Commissioner for Justice, Consumers and Gender Equality of the European Commission.

Laurie, G. & Stevens, L. (2016). Developing a Public Interest Mandate for the Governance and Use of Administrative Data in the United Kingdom. September. Journal of Law and Society, Vol. 43, Issue 3, pp. 360-392, 2016, Available at SSRN: or

Mikhaylov, S. J., Esteve, M., & Campion, A. (2018). Artificial intelligence for the public sector: Opportunities and challenges of cross-sector collaboration. Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences, 376(2128), 20170357.

Moorfields Eye Hospital (n.d.). DeepMind Health Q&A.

NHS Digital (2020). NHS Digital Data Uses Register.

NHS Digital (2006). Protecting patient data.

NHS Scotland (n.d.). Data Safe Haven.

Nishimura, K. (2021). Diet enacts data bills despite concerns raised over privacy. The Asahi Shimbun: Breaking News, Japan News and Analysis. 12 May.

Norwegian Ministry of Local Government and Modernisation (2020). National Strategy for Artificial Intelligence.

OECD (2021). Drivers of Trust in Public Institutions in Finland, OECD Publishing, Paris,

U.S. Office of the Chief Technology Officer (2018). The State of Data Sharing at the U.S. Department of Health and Human Services. U.S. Department of Health and Human Services, September.

OpenSAFELY (n.d.). About OpenSAFELY.

Parliament of Australia (2020). Data Availability and Transparency Bill 2020.

The Paypers (2020). More than half of Europeans don't trust public authorities with their data. December 21.

Richter, H. (2020). The Law and Policy of Government Access to Private Sector Data ('B2G Data Sharing') (SSRN Scholarly Paper ID 3594109). Social Science Research Network.

Sail Data Bank (n.d.). Overview.

Savirimuthu, J. (2021). The GDPR, AI and the NHS Code of Conduct for data driven health and care technology. In: Personal Data Protection and Legal Developments in the European Union.

SaxInstitute (n.d.). SURE.

Scottish Government (2015a). Charter for Safe Havens in Scotland: Handling Unconsented Data from National Health Service Patient Records to Support Research and Statistics. 16 November.

Scottish Government (2015b). Open Data Stategy. 25 Feb.

Scottish Government (2013). Public Acceptability of Data Sharing Between the Public, Private and Third Sectors for Research Purposes. 4 October.

Sentinel (n.d.). About the Food and Drug Administration (FDA) Sentinel Initiative.

Shahaab, A., & Khan, I. (2020). Estonia is a 'digital republic' – what that means and why it may be everyone's future. The Conversation. 7 October.

Singapore Competition and Consumer Commission (2019). Data: Engine for Growth – Implications for Competition Law, Personal Data Protection, and Intellectual Property Rights.

Singapore Government (2012). Personal Data Protection Act 2012.

Singapore Personal Data Protection Commission (2019). Trusted Data Sharing Framework.

Sitra (2016). Survey of attitudes to welfare data in Finland.

Statistics Denmark (2020). Data for research. Addressing trust in public sector data. 20 July.

Street, J., Fabrianesi, B., Adams, C., Flack, F., Smith, M., Carter, S. M., Lybrand, S., Brown, A., Joyner, S., Mullan, J., Lago, L., Carolan, L., Irvine, K., Wales, C., & Braunack-Mayer, A. J. (2021). Sharing administrative health data with private industry: A report on two citizens' juries. Health Expectations, 24(4), 1337–1348.

Tierney, M. (2019). Data Privacy Laws by State: The U.S. Approach to Privacy Protection. August 27. Https://Blog.Netwrix.Com/.

Thuermer, G., Walker, J., Simperl, E. (2019). Data Sharing Toolkit. Data Pitch.

UK Centre for Data Ethics and Innovation (2020). Addressing Trust in Public Sector Data Use.

UK Department for Digital, Culture, Media & Sport (2021). Data: a new direction. 10 September.

UK Department for Digital, Culture, Media & Sport (2016). Digital Economy Bill Part 5: Digital Government. 5 July.

UK Department for Business, Energy & Industrial Strategy (2019). AI Sector Deal. 21 May.

UK Department of Education (2022). External data shares.

UK HM Revenue & Customs (n.d.). internal manual. Information Disclosure Guide.

UK Information Commissioner's Office (2018). Guide to the UK General Data Protection Regulation (UK GDPR).

UK Information Commissioner's Office (n.d.a). What we do.

UK Information Commissioner's Office (n.d.b). What is personal data?

UK Information Commissioner's Office (n.d.c). Special category data.

UK Information Commissioner's Office (n.d.d). Controllers and processors.

UK Information Commissioner's Office (n.d.e). Data protection impact assessments.

UK Information Commissioner's Office (n.d.f). Data sharing agreements.

UK Information Commissioner's Office (2017). Royal Free - Google DeepMind trial failed to comply with data protection law. 3 July.

UK Office for National Statistics (n.d.a). Accessing secure research data as an accredited researcher.

UK Office for National Statistics (n.d.b). ONS research and data access policy.

UK Office for National Statistics (2015). ICO review: Data sharing between the public and private sector to prevent fraud. 16 April.

UK Public General Acts (2018). Data Protection Act 2018.

UK Public General Acts (2017). Digital Economy Act 2017.

UK Public General Acts (2005). Commissioners for Revenue and Customs Act 2005.

United States Census Bureau. Research Data Centres.

van Panhuis, W. G., Paul, P., Emerson, C., Grefenstette, J., Wilder, R., Herbst, A. J., Heymann, D., & Burke, D. S. (2014). A systematic review of barriers to data sharing in public health. BMC Public Health, 14(1), 1144.

Vanska, R., & Halenius, L. (2019). People value having the power to make decisions about the use of their data. Sitra. January 17

Zajc, T. (2021). From eHealth week: Open data models – enablers for easier secondary use of data. 14 September.



Back to top