Unlocking Value of Data Strategic Advisory Group minutes: August 2025

Attendees and apologies

• Eilidh Mclaughlin, Chair, Strategic Advisory Group / Deputy Director, Digital Citizen Division (Programme SRO) 
• Chris Bergin, UVOD Secretariat, Digital Citizen Division, SG 
• Jane Allan, UVOD Secretariat, Digital Citizen Division, SG 
• Carol Sinclair, Chair of Health and Social Care Data Board
• Albert King, Chief Data Officer, National Services Scotland (NSS)
• Roger Halliday, Chief Executive, Research Data Scotland (RDS)
• Suresh Kumar, Deputy Director, Innovation and Industrial Transformation
• Colin McCowan, Professor in Health Data Science, University of St Andrews 
• Jim Squires, Head of Data and Digital Policy, The Association of the British Pharmaceutical Industry (ABPI)  
• Alison Hamilton, Manager, West of Scotland Safe Haven 
• Dr Cathy Kelly, Digital and Information Services, NHS Borders 
• Tom Barlow, Senior Research Manager, SG Health
• Ryan Anderson, Digital Health and Care, SG Health 
• Lisa Hill, Head of Information Governance, SG Health
• Octavia Field Reid, Associate Director for Public Participation and Research Practice, Ada Lovelace Institute
• Suzie Ali-Hassan, International Business Director, The Association of British HealthTech Industries (ABHI) 

Apologies 

• Mark Cook, Co-chair of the Life Sciences Industry Leadership Group
• Ruth Campbell, Associate Director, NSS

Items and actions

Welcome and arrivals

The Chair welcomed group members to the meeting. She introduced Jane Allan, who has joined the UVOD programme team. 

Approval of minutes from the first meeting of the Strategic Advisory Group (SAG) 29 May 2025

The group confirmed it was content with the proposed draft minutes from the previous meeting, without modifications. The minutes will be published on the web section of the Scottish Government (SG) website. 

The action points (AP) from the previous meeting were considered, in turn, by the group. 

Action points

AP1: Consider how the governance structure could be developed in order to ‘future-proof’ the terms of reference. (UVOD programme team). 

Actioned: The terms of reference have been updated to explicitly state that the governance structure will be kept under review. Any necessary adjustments, in line with changes to the direction of travel, will be agreed by the group.

AP2: Consider the frequency of SAG meetings and the possibility of thematic meetings. (UVOD programme team) 

Actioned: As this is only the second meeting of the group, the Chair proposed that the quarterly schedule will be maintained for the time being. The meeting schedule and group membership will be kept under review. A thematic meeting will be considered for the next (third) meeting of the group. 

AP3: Include an agenda item on challenges to personal data access by industry for public benefit (i.e. ‘what is not currently working well’) at a future meeting of the group. (UVOD programme team). 

Actioned: This item had been added to the agenda for this meeting of the SAG.

AP4: Consider how SG procurement could contribute to the development of the UVOD programme. (UVOD progamme team) 

Update: The UVOD programme team has contacted SG procurement to identify an appropriate procurement specialist who can provide input to the programme, and is awaiting their response.  

AP5: Engage with NHS England contacts to learn lessons from the UK approach, building on previous engagement. (UVOD programme team) 

Actioned: Since the last meeting, CB has met Hilary Fanning, NHS England’s Senior Responsible Officer (SRO) for the Data for Research and Development programme. He also met Becca Cosgriff who, in a previous role, established the NHS England Health Data User Group, and led engagement with a range of industry and life science partners. 

New action point: CB will share a note of key points with the group. (CB)

AP6: Consider the remaining questions, and provide feedback by correspondence. (All) 

Update: At the previous meeting, due to time constraints, the UVOD programme team had circulated a set of questions (reproduced below), seeking a written response by group members. 

Questions:

• How do we secure a more consistent, higher risk appetite among data controllers, in order to secure public benefits currently not achievable because of limitations?
• How do we ensure that the benefits of data access can accrue to the public sector, as well as commercial enterprises?   
• What else could be done to support secure private sector access to public sector personal data for public good?

Since the last meeting, group member Colin McCowan provided feedback by correspondence. His points are summarised below:

• on securing a higher risk appetite, the key issue is demonstrating the added value this approach can bring
• data controllers will need to be assured of the low risk to their data and have confidence in the processes
• as there are different models operating in different places, it will be important to ensure a consistent approach across the different data providers
• different types of industry will have different needs. Large firms may not need support, but simply access to data, whereas SMEs may also need support from Scottish Enterprise, or similar UK initiatives  
• regarding existing infrastructure, there is a lack of suitable platforms for industry to carry out analytical work within the healthcare sector. There needs to be clear guidance on whether we support a model allowing data movement to platforms, or whether data will only ever be available on approved hosted platforms (which may limit industry engagement)

Key points raised in discussion

• re the above questions: In order to fully understand the nature of the barriers/challenges to data access by the private sector for ethical innovation, and where material improvements can be made, the UVOD programme team require high-granularity feedback from group members
• this collated feedback will enable the UVOD programme team and partners to prioritise targeted actions and interventions to deliver improvements that can result in a more positive outcome for end users 

AP  - group members to consider the three questions above, and send their written feedback to christopher.bergin@gov.scot

Overview of RoboScot project

The Chair invited Albert King, the Chief Data Officer for National Services Scotland (NSS) to provide a presentation on the RoboScot project. His presentation covered the following points:

• since 2021, the SG has made significant investment in a nationwide rollout of robotic surgery machines which has enabled NHS Scotland to deliver more than 10,000 robotic surgery procedures (by January 2025)
• the RoboScot initiative is aiming to create the UK’s first national platform for linking robotic surgery data, with routinely collected NHS data and patient outcomes data. This will generate new insights, deliver enhanced capability and infrastructure and, ultimately, improved patient care and outcomes
• what makes the project distinctive, is that it combines routinely collected NHS health data with industry-derived machine data, to unlock high-value insights. This will enable practitioners to evaluate the outcomes of robotic surgery, and to maximise the utility of these valuable machines
• public benefit is at the forefront of this project. It will provide a risk prediction model for post-operative complications and identify modifiable factors that can inform practice, prototyping decision support tools that can be deployed from a research environment into an operational context
• value will accrue from the sharing of benefits: NHS and industry data are linked together in the SEER2 platform, creating an analytical dataset that is made available through a Trusted Research Environment (TRE)
• data analytics: Another distinctive feature is that it brings together academic researchers, NHS clinicians and subject matter experts (e.g. machine engineering expertise) to analyse and interpret the data, in real time 
• partners involved in the project are: NSS, Public Health Scotland, academia (Universities of Edinburgh and Glasgow), Intuitive Surgical (the industry partner who manufacture robotic surgery devices), and the SG 
• the project aligns with the Health and Social Care Data strategy, the National Programme for Robotic Surgery and the SG’s cancer policy
• the UVOD programme is helping to unlock this new model for public sector-industry collaboration to enable benefits realisation which will inform future projects
• the project team has developed a protocol which has passed through the ethics approval process; developed a draft Data Protection Impact Assessment (DPIA); engaged with Public Benefit and Privacy Panel (PBPP) and national information governance (IG) leads to seek their advice and put in place underpinning confidentiality agreements, data-sharing protocols and contracts
• as the machine-derived data is of a different character to the patient data that NHS Scotland is accustomed to working with, linkage has posed some technical challenges
• navigating complexity has necessitated a significant investment of time and effort by partners involved. One of the aims is to leverage these learnings and insights (e.g. what has worked well, what has worked less well) for the wider UVOD programme. This will enable reuse of the framework’s methodologies
• privacy and confidentiality: The project incorporates established approaches to anonymising personal data. The commercial confidentiality of the industry partner and their intellectual property (IP) are protected
• IP continues to be a point of discussion, and has been approached in a mutually respectful way by all parties
• this will not be an exclusive relationship: it is envisaged that there will be other commercial partners in this field to work with
• as the industry partner operates across different jurisdictions, there are distinct legal obligations to fulfil. This has required aligning the respective compliance requirements of the organisations involved
• for the RoboScot project, the industry-related compliance function has been equally focused on the legitimacy and ethics of this work   

The Chair thanked AK for his presentation and invited discussion among the group.   

Points raised in discussion:

• generalisability of approach: elements of the architecture and governance patterns are generalisable. However, it is anticipated that individual projects will require a distinct approach to some degree, as variables will not be uniform (e.g. organisations may have different risk appetites). This could be approached though a set of principles on a case-by-case basis
• this model demonstrates a way of engaging with industry to create value for the NHS, and to support the utilisation of data, while managing the trust of the public. Engagement with patient advocacy groups has been a priority
• one of key benefits is the ability of NHS Scotland to secure access to the industry-derived data and making this data available to the national safe haven without this data having to travel
• synthesising the huge amounts of data generated by these robotic machines into data points that are useful in a research context is a challenge. This synthesis of the streaming data is a key value-add that industry partner specialists can bring (as part of the project team)
• industry devices generate massive amounts of data. The case of the National Patient Safety Programme was cited as an example of where data (in this instance, data accruing from ICU beds) had been underutilised
• Simon White, Programme Director in NHS Scotland, is leading work on the implementation of the GS1 global data standards. Is there an opportunity for shared approaches or learning? 
• it was suggested that real value could be added for industry, if the scope were extended to encompass other datasets
• this initiative is essentially boot-strapping a number of opportunities: whilst it currently leverages routine data that the NHS currently holds, the ambition is to integrate other data in future, provided it is linked to clear benefits and outcomes. 
• benefit-sharing: A key learning will be how to effectively negotiate the sharing of benefits, not just IP
• the industry partner involved in RoboScot has been content to share their data on the NHS platform, provided the platform has the capability (computing power etc) to enable them to carry out the analytics they need and second, ensuring this does not compromise their commercial confidentiality. This is being done in a way that aligns with the realisation of public benefit
• definition of public benefit: The absence of an agreed definition of public benefit and public interest for the programme, was raised. Public benefit is critical for legitimacy and creating a licence to operate
• is there an opportunity to consider if there should be a core/common element to a definition of public benefit rather than each access request having that co-created on a case by case basis?
• the Independent Expert Group's (IEG) final report states: "a ‘bottom-up’ approach may be preferred, whereby the public interest and public benefit are terms that are co-constructed with publics, in specific contexts, rather than ‘defined’ by the IEG or a similar entity (i.e. a top-down approach). This is reflected in our recommendations that invite greater involvement of the Scottish public in the UVOD programme henceforth." 
• the recent Ada Lovelace report, 'Making good' , was highlighted. While it is agreed that a context-specific focus is required, the question was raised: are also clear shared principles that can support governance?
• ‘Public interest and public benefit’ is the second of the IEG’s guiding principles (their seven guiding principles are informing the direction of the UVOD programme)

Update on (RDS-led) operational framework 

The Chair invited Roger Halliday, the Chief Executive of Research Data Scotland (RDS) to update the group on the RDS-led operational framework, which aims to operationalise SG policy and the defining principles advocated by the IEG for the programme. 

Key points:

• the operational framework is essentially a set of principles and rules that aims to facilitate faster, simplified access to deidentified, case level public sector data in Scotland, by industry
• the clear message from industry is that faster access to public sector data is needed. The framework aims to address this requirement
• the framework aligns with the Five Safes Framework, a set of principles designed to ensure safe and secure access to data for researchers: Safe People, Safe Projects, Safe Settings, Safe Data and Safe Outputs 
• there is a need to balance the desire for increased pace with the need to work with the public to ensure arrangements meet their threshold of acceptability, and to translate principles into practical outcomes
• the right balance will be achieved when you secure the support of public sector data controllers and the general public, whilst also meeting the needs of industry
• RDS commissioned IPSOS to facilitate a deliberative public engagement exercise over the summer. This has provided further evidence of what the public considers to be acceptable. The public engagement report is scheduled for publication in September 2025
• this public dialogue exercise found a degree of apprehension among public participants, regarding direct industry access to data
• the public suggested there should be an independent assessment of companies, in order to determine the public interest. This would need to be reviewed if there was a change of company ownership during a research project
• academic/industry partnerships: The standard approach has been to include an academic partner in a research project. However, there has been no suggestion (from public engagement) that there could not be direct access for accredited researchers in the private sector, operating within a controlled environment

AP: CB to circulate the IPSOS public engagement report to the group.

• the framework will be an iterative process, and could be augmented with further work on standard-setting and training
• the aim is to finalise the first iteration of the framework in the next two months (by October 2025)
• ultimately the acid test will be to determine if the framework has addressed the challenges and barriers to industry access to personal data, leading to the realisation of improved outcomes 
• communication and transparency will be essential. It is important to understand the motivations of organisations involved and to ensure that clear public benefit accrues from data access
• data-based research is already published, via the data use register. This provides details of who is accessing what data, and for what purpose. Public engagement highlighted the need to disclose where the funding for research comes from, and the anticipated public and commercial benefits
• while there are existing models in place, consideration needs to be given to what other models might work
• there is the potential for staged governance, i.e. checks at each of the stages, followed by an assessment of benefits realisation 
• a workshop (jointly delivered by RDS and ABPI) targeted at a range of industry and academic stakeholders, is planned for 10 September. Further engagement with data controllers is also planned 
• ABHI Scotland is keen to contribute and important to make sure HealthTech voice is part of the consultation

AP: UVOD programme team to send workshop dates to SAH. 

The Chair thanked RH for his presentation and invited discussion among the group. 

Points raised in discussion:

• opt-out: A University of Glasgow-led public engagement exercise relating to patient data found strong appetite for the opt-out option. Currently, this policy applies in England, but not in Scotland. What about dynamic consent – individuals can consent at a point in time to data-sharing, but have the opportunity to withdraw their consent if they wish? 
• a challenge with opt-out has been a lack of clarity and transparency on its implications. For example, SCI-DC (Scottish Care Information – Diabetes Collaboration) offered an opt-out for individuals, but this was not shared with Safe Havens, so the public did not fully understand what opt-out meant for them
• in formulating their guiding principles, opt-out was considered by the IEG. [Their final report states: “The ‘Right to opt out’, was discussed at length among the IEG and practitioner forum stakeholders. Concerns were raised about the lack of feasibility of a right to opt out - who would enforce and regulate this right? Existing technical data systems in Scotland and data sharing practices have not been designed around such opt out. Concerns were also raised about the possibility of datasets being biased or unrepresentative if people were able to opt out, which may have detrimental impacts on research and subsequent development based on those data. Some members of the IEG remained in favour of retaining the right to opt out as a principle. However, as there was no longer a consensus or agreement on this point among the IEG, the principle was removed. Nevertheless, the group consider that facilitating people’s control and autonomy over their own personal data is a key issue for further exploration beyond the lifetime of the IEG.”]
• the UK Government (UKG) have announced a proposal for a UK-wide Health Research Service. This presents an opportunity to support UK-scale research and innovation and potentially align the UVOD programme with partnership principles

AP: The UVOD programme team to consider the proposed UK Health Research Service and opportunities this could create to advance the UVOD programme objectives.

• it was recognised that NHS England lost public trust regarding the use of GP data, a problem that has been avoided in Scotland. The consequent erosion of public trust has been a barrier to data access by industry, in England. 
• RH confirmed that public engagement will be embedded as a consideration within any new research project. One of the key aims of the RDS-led engagement is to surface specific user needs, and to formulate a development plan based on this. 
• the Ada Lovelace Institute has a model for public participation, which could inform the UVOD programme. 

AP: OFR to share details of this public engagement model with the group.

• evaluation of the framework in an operational context will be important to understand its impact and value. RDS want to capture the views of the public and data controllers on its operation, and to understand the difference the framework is making “on the ground”
• the operational framework must be relevant to multiple sectors, so engagement will need to draw on other specialist voices, beyond health and social care, to ensure a robust product that will operate across different sectors
• macro-level evaluation metrics could include the following: is public trust maintained?; is the pipeline of research projects increasing?; is the speed of access to public sector data faster than before?
• anecdotal evidence suggests there a lack of technical capability within the Safe Haven environment to allow industry to operate effectively in certain circumstances (e.g. lack of suitable platforms for the analysis of data by researchers/industry partners)
• it was recognised that Safe Haven capability needs to be strengthened (a point which has been discussed by the Safe Haven Network). Lack of IG resource has been identified as a blocker
• the question was asked: How best can we deploy our collective investment to better meet industry needs in this respect? 
• if people are operating outside of the Safe Haven environment, it is a legitimate trade-off to demand greater scrutiny from this process
• a challenge voiced by SMEs operating in Scotland, has been the requirement of having to approach different Health Boards separately. This contrasts with the approach taken in England, where the approval process is more streamlined 
• Health Data Research UK have done a lot of work on standard process/templates for accreditation and data access applications for use across UK TREs
• if a single Health Board has assessed that a particular model is safe, secure and trustworthy, then this should be sufficient for wider adoption across the system (this had been part of the rationale for creating a Safe Haven Charter)
• Health Boards have different risk appetites, which can present challenges, although some have signalled a willingness to collaborate with SMEs on pilot projects
• LH provided a short update on the National IG programme. The programme was set up to address a number of commitments in the Health and Social Care Data Strategy. Progress has been challenging and they have since revisited their approach, creating a national IG steering group, comprised of IG leads and local government  partners. IG capacity has been identified as one of the challenges that will need to be addressed. A refreshed programme, wherein a whole system approach is adopted, will determine priorities for action

AP: LH to provide a more detailed, written update on the national IG programme to the group.

Challenges to public sector personal data access by industry (for public benefit)

• the Chair explained that the SG is keen to understand more fully the challenges and barriers to accessing public sector personal datasets from an industry perspective
• the IEG for the programme acknowledged they had limited industry input to their work
• direct engagement with industry will help us to understand not only the issues/challenges regarding data access, but also the ways they would prefer us to engage with them
• the IEG advised that, “better formats for engaging with the private sector are needed, which involve a smaller commitment of time and resources than conventional consultations and expert groups request. The SG should consider what would be more effective ways to engage with industry and at what point in the policy and consultation cycle”
• the RDS-ABPI Scotland industry event (with input from SG), scheduled for 10 September, is an early opportunity to surface issues from an industry perspective. The insights generated can be used to inform productive ongoing engagement with industry

Points raised in discussion

• improving the overall service to industry: A ‘matching’ or ‘concierge’ model could help ensure that industry can benefit from the requisite expertise at the point of access
• the NHS England Research and Development programme highlighted the need for industry partners to be supported appropriately, in a timely manner (for instance, to help with meeting IEG requirements, the articulation of public benefit etc.)
• the APBI will publish a report (to be published in the next two months) focused on shaping the Health Research Service, with recommendations. This will emphasise the importance of equipping the service with the right people who understand the data (e.g. clinical expertise to interpret and validate the data, IG, contracting and legal expertise), rather than a service that simply functions as a portal for data access
• would TREs consider offering expertise (data specialists) to support companies to understanding the data that is available? This expertise could be supplied though eDRIS, or an extension of the skillset that could be developed within eDRIS
• this would extend the offer beyond the provision of access to public sector data, to supporting companies to achieve the best outcome from access to data, thus avoiding potential bottlenecks
• the absence of a standard entry point was highlighted. Global pharma companies do not possess an understanding of how to engage at a local level. The ABPI suggests there is a need to make datasets more visible to these companies
• ABPI members rely on population representative data. Local, multi-modal data can be powerful for certain purposes. A Scotland-wide offer (leading to a UK-wide offer) for these types of data would be helpful. GP data is particularly valuable as it is longitudinal
• timelines for data access: most Safe Havens/TREs operate to timelines that are more acceptable to academics (who do not face the same pressures to commercial organisations), but which may render a project unfeasible to a commercial enterprise. It was noted that, in some cases, TRE timelines and costs can also be an issue for academics
• the definition of a project can be ambiguous. Commercial companies may not conceive of their activities as ‘projects’, and will not always require an academic partner (nor will academia always have an interest) 
• this sole industry applicant model could be tested in a live environment, and public views sought on this. Conversely, where academic involvement will enhance a project, this should be encouraged 
• it was recognised that academics may understand the data and approval processes better. But industry can also help the scottish public sector to better understand the value of their data
• the question was raised: Do you need underpinning common principles for public engagement. The first IEG principle is ‘Public Engagement and Public Involvement’. The IEG advocated for the early adoption of their recommended guiding principles (on which there was broad consensus) in targeted policy areas
• recognising AI is a hot topic, the question was raised: where does AI feature in this context?
• it was explained that a big part of the West of Scotland Safe Haven’s work is AI-related. The checking of AI for a disclosure risk is substantial. The development of an AI-powered tool for the purpose of disclosure-checking is understood to be in the pipeline
• as the private sector will increasingly want to use public sector data for AI projects, clear rules/guiding principles for AI use are required
• there is also a need for increased expertise in the review of projects that utilise AI and machine learning, at a national and local level. Gaps in knowledge within a panel can also affect the risk appetite of members
• how do you meet industry needs when the technical infrastructure, knowhow or expertise to facilitate a project is insufficient? Anecdotal feedback highlighted that there was a number of algorithms that the National Safe Haven would not consider, because it would be difficult to evaluate the outputs
• in relation to the use of AI in the public sector, evidence shows that the public care about where and how this happens and, moreover, how their data is being used to train AI models

AP: OFR to share this research on the use of AI in the public sector with the group. 

Any other business

As there was no other business to discuss, the Chair thanked members of the group for their contributions, and closed the meeting. 

The next meeting of the group is scheduled for 24 November 2025 (1.30-3pm). (Rescheduled to 16 December 2025)

Action points: summary

• AP1    Consider the remaining questions and provide feedback by correspondence (SAG members)
• AP2    Consider how SG procurement could contribute to the development of the UVOD programme (UVOD programme team)
• AP3    Share note of meeting with NHS England contacts to with SAG members (Chris Bergin)
• AP4    Circulate the IPSOS public engagement report to the group (UVOD programme team)
• AP5    Send RDS-led engagement workshop dates to Suzie Ali-Hassan (UVOD programme team)
• AP6    Consider the proposed UK Health Research Service and opportunities this could create to advance the UVOD programme objectives (UVOD programme team)
• AP7    Share details of the Ada Lovelace Institute public participation model with the group (Octavia Field Reid)
• AP8    Provide a written update to the group on the national IG programme (Lisa Hill)
• AP9    Share recent research on the use of AI in the public sector with the group (Octavia Field Reid)