10 IASSIST QuArTerly FAll 2011 IASSIST Quarterly Abstract Remote data access, defined as the ability of a researcher to access and evaluate restricted micro data via a secure internet connection from his home desktop computer at any time, has not been implemented by a German Research Data Centre (RDC) so far. Privacy regulations and especially the problem of access control are reasons why German RDCs are not able to offer restricted data via remote data access to the research community. By initiating the “RDC-in-RDC” approach, the Research Data Centre (FDZ) of the German Federal Employment Agency (BA) at the Institute for Employment Research (IAB) in Nuremberg, Germany, aims to bring data access in Germany closer to the ideal perception of remote access. The basic idea is to allow remote data access from designated institutions with comparable standards at locations other than Nuremberg. In a first step, access to BA and IAB data will be granted from four sites in Germany and one site in the US. Moreover, the RDC- in-RDC approach represents a change of paradigms in two respects. First, data access will be decentralised and the FDZ literally brings its data closer to the researchers. Second, data of the FDZ will be accessible from abroad so the dissemination of micro data will be no longer restricted to national borders. The RDC-in-RDC approach may therefore be regarded as a first step towards remote access in Germany and may also represent a blue print for an intensified international data sharing. Keywords: micro data, remote data access, international data access Introduction Fostered by the rapid developments in technologies and methodologies, statistical institutions and authorities have experienced a growing demand for high-quality micro data by both the scientific community and policy- makers over the past years. Despite the fact that the dis-semination of micro data for scientific purposes is part of their legal mandate, the preservation of the confidentiality in the data (i.e. to prevent the disclosure of single entities) stands above all when outsiders are granted access to micro data by the statistical authorities. In order to ensure privacy for individuals and to serve the needs of the scientific community, statistical authorities usually apply a combination of different access strategies (see Lane et al. 2008). These strategies may include for example the approval of projects by (statistical) authorities and/or scientific boards, the training of researchers, the anonymisation of data or the establishment of ‘safe’ settings for on-site use. Widely-used examples of these strategies are Public Use Files for off-site use or Research Data Centres (RDCs) and secure data enclaves in order to allow on-site analyses of confidential micro data. The most efficient and for researchers most convenient type of off-site use is remote data access defined here as means by which an approved researcher may access restricted micro data for her approved project via a secure internet connection (see Grim et al. 2009 and Hundepool et al. 2009). She is able to do all preparations of the data and analyses off-site but the restricted micro data never leave the safe setting of the statistical authority or an RDC. After the program codes of the researcher have been processed with the data, the outputs are screened and sent back. Depending on the prevailing national data protection acts, remote access systems may even allow researchers to actually see the underlying data. Statistical authorities in many countries have undertaken efforts to make micro data accessible for the scientific community and to establish remote data access The Research- Data-Centre in Research-Data- Centre Approach A First Step Towards Decentralised International Data Sharing by Stefan Bender, Jörg Heining1 RDC-in- RDC IASSIST Quarterly Fall 2011 11 IASSIST Quarterly systems over the past years. In contrast to other countries in Europe, North America or Oceania which have already succeeded in the implemetation of remote access systems, however, Germany still lags behind this development. Legal Concerns still prevent the implementation of such access ways to confidential data. Besides the varying stages of development of remote access sys-tems, the diversity of national data protection legislations leads to considerable differences in the scope of performance and services provided by the particular data access sytems. The systems may be limited in terms of statistical analysis tools or only provide data access to a limited number of, or only parts of, data products. Moreover, remote access to micro data is usually restricted to national borders. As pointed out by Ahmad et al. 2009/2010, the limited enforceability of contractual terms and penalties abroad, virtually restricts data access to resident researchers due to high transaction costs for non-residents. With the Research-Data-Centre in Research-Data-Centre (RDC-in-RDC) approach the Research Data Centre (FDZ) of the German Federal Employment Agency (BA) at the Institute for Employment Research (IAB) in Nuremberg, Germany tries to overcome the existing legal barriers and to bring micro data access in Germany closer to the ideal perception of remote access. The basic idea of this approach is to allow data access from designated national and international institutions with comparable standards as the FDZ site in Nuremberg. By using a secure internet connection, researchers can link to a server and access the whole scope of micro data available for on-site use in Nuremberg. In a first step, FDZ data may be accessed from four RDC sites of the Statistical Offices of the Länder2 in Germany. Moreover, a fifth site at the Michigan Center for the Demography of Aging (MiCDA) Enclave3 at University of Michigan’s Institute for Social Research (ISR) in Ann Arbor, Michigan, USA represents the international component of the RDC-in-RDC approach. The sole aim of the project is not merely the facilitation of access to FDZ data in Germany or the US. It is intended to gather experiences and by doing so, to build expertise among statis-tical authorities, researchers and data protection officials in decentralised ways of data access. The RDC-in-RDC approach may not be equivalent to remote data access, but it may serve as stepping stone, especially for countries where legal concerns are still hindering the establishment of decentralised access ways to restricted micro data. Moreover, due to its international aspect and the insights gained from it, this project may be beneficiary for statistical authorities all over the world. It may represent a blue print for data sharing beyond na-tional borders. The paper is organized as follows: Section 2 provides a short overview of the international state of developments with regard to remote access, as well as a brief description of both the German situation and the FDZ. The technical implementation of the RDC-in-RDC approach is sketched in section 3. Finally, section 4 concludes. Applications of Remote Data Access International developments The German “research data centre movement” is quite a recent development (see KVI 2000 or Bender et al. 2009). Other countries, often with less stringent data protection legislation, have a longer tradition of operating RDCs and have already implemented remote data ac-cess systems or are currently working on it. Moreover, some countries have also taken first steps towards international data sharing. Several examples of remote data access systems are briefly described in what follows. One of the oldest remote data access systems for micro data is the Lissy System of the Lux-embourg Income Study (LIS)4. The project began in 1983 and was extended to include the Luxembourg Employment Study (LES). The main aim of Lissy has always been to make mi-cro data of a large number of countries available for comparative social research. Lissy is a fully automated system running 24 hours a day, seven days a week. The users submit their statistical requests under the form of specific statistical package programs (SPSS, SAS, Stata) via the internet mailing system or a secure graphical user interface. LISSY will automatically process jobs and return the outputs to the e-mail address given during the registration process. Although not operated by a national statistical authority, the IPUMS- International Project (Integrated Public Use Microdata Series)5 is another old example of a remote data access system. IMPUS is a collaboration of the Minnesota Population Center, National Statistical Offices, and international data archives. It was set up in 1999 in order to obtain frequency counts from diverse censuses that are in compliance with data protection regulations. Data are made available through a data extraction system in which users select the variables and samples they desire. They download the data and analyze them on their local computer. The Cornell Restricted Access Data Center (CRADC) was established 1999. As part of the Cornell Institute for Social and Economic Research (CISER) in Ithaca, NY, the CRADC provides secure access to confidential research data. Researchers of the Cornell University can acquire, house, and use restricted data in CRADC’s secure computing environment. After signing a CRADC data user agreement, researchers can access confidential data hosted at CRADC by using either a Windows terminal services client, a terminal services client software or a remote desktop client6. Besides the IMPUS-International Project and the CARDC another example of a non-governmental institution providing access to confidential micro data via remote data access systems in the US is the National Opinion Research Center (NORC)7. NORC is private entity and located at the University of Chicago. The NORC data enclave runs a remote data access system which mainly provides access to firm data of several governmental and non-governmental data producers and collectors, including the Annie E. Casey Foundation or the U.S. Department of Agriculture among others. Several governmental authorities in the US have successfully established online systems providing researchers with frequency counts and tabulations, too. In this context, the Data Analysis System (DAS) of the National Center for Education Statistics (NCES) stands out. Besides tabulations the researcher may also calculate simple covariance analyses online8. The implementation of an own remote access system is currently also considered by the US Census Bureau. In collaboration with external experts from academia the so called Microdata Analysis System (MAS) is planned, offering access for limited statistical analyses on full Census micro data sets (see Foster et al. 2009/2010). Statistics Denmark first disseminated micro datasets to researchers in 1986 under an “in-house researcher arrangement”. In 2001, remote data 12 IASSIST QuArTerly FAll 2011 IASSIST Quarterly access was introduced and 55 access points had already been set up by the end of 20039. Statistics Netherlands, too, has a long tradition of making micro data available to researchers (since the early 1990s). After the demand by researchers for on-site access had reached a very high level, remote data access was introduced in 2006 (OnSite@Home). Researchers can access Dutch micro data by means of some special software which is installed on a regular desktop computer, located in a separate and lockable room at the researcher’s institution. By 2009, this special software has been installed on 45 terminals, one even located in Italy. (see Hoeve 2009/2010). The Australian Bureau of Statistics also operates a remote data access system (RADL), which was set up in April 2003 (see Tam et al. 2009/2010). The RADL system works in three steps. Researchers submit their programs via a secure website, where they are first checked for illegal commands. If this check finds no such commands the program is run and the out-come is automatically checked. There is an additional audit process in which output is manually inspected to ensure that the analysis using the micro data does not violate any legal regulations10. Since 2009, the Australian Bureau of Statistics and Statistics New Zealand are providing mutual access to anonymised micro data by using the RADL system. Australian data may be accessed in New Zealand and vice versa (see Upfold et al. 2009/2010 and Tam et al. 2009/2010). Statistics Sweden has had a remote data access system (MONA) since 2005. This system provides researchers with the possibility of remote access from any computer with Internet access11. The MONA system is based on communication between a terminal server and a terminal client. By using a secure internet connection users access a terminal server where they can start applications remotely. For more extensive processing a batch environment is available. In the United Kingdom, two remote data access applications are currently operated (see Ritchie 2009/2010). The Virtual Microdata Laboratory (VML) by the Office of National Statistics (ONS) allows ONS and governmental staff access to micro data through their desktop computers. Researchers from other institutions use designated thin terminals at government offices instead. To overcome this disadvantage for non-ONS and non-governmental staff, the Secure Data Service (SDS) hosted by the UK Data Archive has become fully operational in 2010. The SDS enables safe and secure remote access for approved researchers to the data of the British Household Panel Survey. The SDS operates using thin-client and Citrix technologies, whereby data are available only via a controlled network (see Wright 2009). Statistics Canada introduced the so called “Real Time Remote Access“ (RTRA) in 2010. RTRA is partially based on the RADL model developed by the Australian Bureau of Statistics. Researchers will submit their requests through a secure portal to a protected server located on the secure Statistics Canada network. After a check for forbidden commands, the syntax will be processed with the data. Disclosure control will be automated as well as notifications to the submitting researcher (see Goldmann 2009/2010). Also in 2010, the French remote access centre CASD (Centre d’Accès Sécurisé Distant aux donnés) became operative. Designed and developed by the National Institute of Statistics and Economic Studies (INSEE), CASD provides access to household data in France. The CASD system is exceptional since it is a hardware-based solution using the so-called SD-Box (patent pending). After being installed in the researcher’s institution, the SD-Box provides a secure biometric access between the researcher and a secure server hosting confidential data. About thirty research projects in France and one project in the United Kingdom have already used CASD (see Gadouche 2011). The implementation and operation of remote access systems is not limited to national authorities or organisations. Comparable developments are also taking place on the transnational level. To access micro data sets of the European Union (EU)/Eurostat researchers still have to visit the safe centre of Eurostat in Luxembourg. In order to facilitate data access the Essnet-project “Decentralised Access to EU Microdata Sets” 12 was established. The idea is to develop decentralised access by which a researcher from a certain EU member state can use European datasets in his member state. The concept of research data centres which has been already realized in some European countries as well as (the concept of ) the safe centre of Eurostat could be examples for a decentralised access to European micro data sets. The Essnet-project has showed first results of allowing access to European micro data in safe centres (on site). It included the methodology, guidelines and requirements which are essential to implement an access to European micro data in safe centres in the member states. A follow-up project is planned. For an overview on all these activities on the European level see Bujnowska et al. 2009/2010. The Data without Boundaries (DWB) project is another transnational initiative which started in May 2011 and is funded by the 7th Framework Programme for Research and Technological Development (FP7) of the European Commission. The project brings together data archives, national statistical institutions and universities. The objective of DWB is to develop an integrated model where the best solutions for micro data access are available irrespective of national boundaries but are flexible enough to fit national arrangements. Hence, DWB aims to achieve standardization and harmonization of micro data access methods as a concerted effort on a European scale. Situation in Germany Access to restricted micro data stemming both from administrative processes and surveys was rather limited in Germany until ten years ago. In 2001, the Commission to Improve the Informational Infrastructure by Cooperation of the Scientific Community and Official Statistics (Kommission zur Verbesserung der informationellen Infrastruktur zwischen Wissenschaft und Statistik, KVI) finally recommended the foundation of research data centres for public producers of micro data in Germany (see KVI 2001). The establishment of RDCs at the Statistical Offices, the German Pension Insurance Fund and the Federal Employment Agency (Bundesagentur für Arbeit, BA) resulted in standardised access methods for restricted data collected by the Federal Statistical Office, its regional offices and by the labour and social security administration (see Bender et al. 2009). German RDCs currently provide two methods of access to restricted or weakly anonymous micro data: either by controlled remote execution or on-site use at the premises of the RDC. Controlled remote execution is a limited mode of remote data access. It means that external researchers send evaluation programs to the RDC, where RDC employees conduct the evaluations, check the results for compliance with data protection regulations and send the tested results to the researcher. In contrast to remote data access, remote execution is general not automated. Hence, it may be regarded as a sequence of single tasks conducted by RDC employees rather than as an integrated IASSIST Quarterly Fall 2011 13 IASSIST Quarterly and automated system as operated by Statistics Canada or the Australian Bureau of Statistics. Remote execution is inefficient in two respects. First, as the researchers have no direct contact with the data, they sometimes program “blindly”. As a consequence, programs have to run several times until the desired evaluation is obtained. Second, the level of support required from the RDC staff is high. Research visits for on-site use at special separate workplaces for guest researchers at the RDC avoids these problems as the researcher has direct access to the data. However the researchers have to travel to the RDC, a growing number of them even from abroad. This often entails high travel and accommodation expenses. Although not strictly forbidden by law, the implementation of true remote data access systems which provide access to weakly anonymised micro data in Germany was hindered by the concerns of data protection officers so far. Their main concerns focus on the additional information available from the internet and on the question of access control. Since remote access systems allow data access from outside a safe environment like an RDC, the usage of additional information cannot be controlled. Nowadays, a vast amount of (additional) information is easily accessible via the internet for everyone. It is almost impossible to prevent information from the internet from being used to disclose a single entity in the data. As a consequence, only absolutely anonymised data may be accessed by remote access systems in Germany (see Schaar 2009). Moreover, when processing confidential data outside an RDC via a remote data access system, the problem of how to ensure access control arises. It is questionable whether in the environment of the researcher’s home office or workplace only the approved researchers will have access to the confidential data. Since the mere visual inspection of the data represents a transmission according to German law (§ 67, subpar-agraph 6, number 3, second sentence of the Social Code X), an individual, for example a family member may get unauthorized access to confidential micro data by just glancing on the computer screen at the home office of the approved researcher. The Research Data Centre (FDZ) of the German Federal Employment Agency (BA) at the Institute for Employment Research (IAB) When the FDZ was founded in December 2003, there had been no systematic access to social data up until that point. Following a positive evaluation by the German Council for Social and Economic Data in April 2006, the FDZ was permanently established as an independent research data centre of the BA at the IAB. An evaluation by the German Council of Science and Humanities in 2007 confirmed that the FDZ was an internationally unique institution: “The Research Data Centre (focusing on methods and data access) is an internationally visible, indispensable service institution, unique in Europe and a prime example to other institutions, possessing large datasets of scientific importance.” (Wissenschaftsrat (German Council of Science and Humanities) 2007, p.55) The FDZ prepares individual datasets developed in the sphere of social security and in employment research and makes them available for research purposes – primarily for external researchers. With its website (http://fdz.iab.de), the documentation and working tools available online, and its workshops and users’ conferences, the FDZ makes it easier for external researchers to work with the datasets. The micro datasets available at the FDZ include the IAB Establishment Panel, the Sample of Integrated Labour Market Biographies (SIAB), the BA Employment Panel (BAP), the Establishment History Panel (BHP), the Linked-Employer-Employee Data from the IAB (LIAB) and the panel study “Labour Market and Social Security’” (PASS) among others. The FDZ serves not only the national but also the international market. One important step towards internationalisation in 2007 was releasing web pages in English and having almost all of the data documentation translated (see Bender et al. 2009). In addition to this, members of the FDZ have given numerous talks on the FDZ, the projects of the FDZ and the available data at international conferences and foreign universities. As a consequence, the number of users from abroad constantly increased over the past years. Several of these international data users also participated in one or more of the four users’ conferences orga-nized by the FDZ. Besides these activities the FDZ is also involved in several international projects focusing on the creation of new data products or the further development of data access ways. For the project BLUE-Enterprise and Trade Statistics13 (BLUE-ETS) the FDZ cooperates with the University of Southampton and the Italian Institute of Statistics (ISTAT) in the development of better test data for complex Linked-Employer- Employee-Data. These new test data not only reproduce the structure and content of the original and confidential data, they also share the same statistical properties. Due to the higher resemblance of this new kind of test data with the original data, researchers can prepare their program codes for remote execution in a much more efficient way. The FDZ is also (co-)organizer of the “Workshop on Data Access” (WDA). Representatives of several national and international RDCs meet at WDA to discuss new developments and to exchange practical experiences. Three workshops have been held already. Other international projects of the FDZ include the Data without Boundaries (DwB) project as described above and, of course, the RDC- in-RDC approach. Implementation of RDC-in-RDC The central idea of RDC-in-RDC approach is to enable data access from other RDCs or institutions (called “guest-RDC” in the following) which share comparable security standards as the RDC (called “data-RDC” in the following) where the data are actually stored, but which are located at different sites. In doing so it does not matter whether the guest-RDCs are located in Germany or abroad. The data are accessed in a similar way to the on-site use at the RDCs. The only difference is that the guest researcher’s room is not at the local (data-)RDC (for instance in Nuremberg) but at another (guest-)RDC. In the pilot project the FDZ is the data-RDC. The guest-RDCs can be institutions which fulfill the security requirements of the FDZ. These include all German RDCs14 as well as comparable institutions in other countries. In order to improve access to the data of the BA and the IAB in Germany, the RDC of the German Statistical Offices of the Länder and the FDZ are working together on this project. The Statistical Offices of the Länder in the federal states of Berlin/Brandenburg, Bremen, North- Rhine Westphalia and Saxony are participating in the project as pilot locations. Data access for researchers abroad is to be improved by means of cooperation between FDZ and the MiCDA data enclave at University of Michigan’s Institute for Social Research (ISR) (see figure 1). In the following sections various aspects regarding the “RDC-in-RDC” mode of data access are explained in more detail, in particular the division of tasks between the data-RDCs and the guest-RDCs and issues concerning the technical implementation. 14 IASSIST QuArTerly FAll 2011 IASSIST Quarterly Applying for data access The work of the German RDCs is influenced by different legal framework conditions (Social Code and Federal Statistics Act). For instance, by legal definition the data available at the FDZ are so called social data. The dissemination of social data is regulated by the Social Code (Sozialgesetzbuch - SGB). On the other hand, data from the Statistical Offices are not defined as social data and are made available on the basis of the Federal Statistics Act (Bundesstatistikgesetz - BStatG). Because of this difference in the legal definitions, access procedures differ, too. When applying for social data, for example, researchers have to out-line to what extent the project is related to the social security system in Germany. This is definitely not necessary when applying for data of the Statistical Offices since they are by definition no social data. It will therefore be very difficult to standardise the respective access mechanisms or to transfer these different regulations between the RDCs. As a consequence it is necessary for users to continue to submit their applications for data access to the data-RDC. At the FDZ all external researchers continue to submit an application for data access in accordance with the Social Code . After the application has been approved by the German Federal Ministry for Labour and Social Affairs (Bundesministerium für Arbeit und Soziales - BMAS), the FDZ concludes a data access agreement with the institution of the user and the user itself. In this agreement the user undertakes to comply with the data protection regulations recorded in the agreement and to bear the consequences stipulated by German law if the agreement is breached. Access to the authorised data In order to enable access to the requested data from a guest-RDC it is necessary to develop a new technical concept: the requested data can be accessed from dedicated workstations at the guest- RDCs (see also Figure 2). For this, the same security criteria must be fulfilled at the guest-RDC as apply at the data-RDC. Data access should occur via a secure data line. From the dedicated workstation at the guest-RDC, the researcher logs onto a server of the data-RDC using the remote desktop function and a password. A researcher working at the guest-RDC has the same access rights as the researchers conducting analyses at guest workstations in the data-RDC. In this case, the researcher obtains access to certain servers and to certain directories within the local guest network on these servers. He or she is thus not given the opportunity to intrude into the home network of the data-RDC. Similar to a research visit at the data-RDC, the researcher at the guest-RDC can only look at results on the computer screen. It must be guaranteed that only authorised users work with the data at the guest-RDC. At the guest-RDCs located in Germany, the supervision is to be performed by employees of the guest-RDC whose data security expertise is regarded as equivalent to that of the staff at the data-RDC. The task of the staff at a guest-RDC is essentially data access control, i.e. they ensure that only the individuals named by the data-RDC gain access to the data. For data protection reasons the employees of the guest-RDC themselves do not gain access to the data, nor may they access the guest researchers’ directories. Hence, a researcher may only print results or transmit them electronically after approval by a member of staff of the data-RDC. A different solution for access control has to be found for the guest-RDCs which are located outside Germany. According to the requirements made by the data protection experts at the BA/IAB, the US site has to be supervised by trained on-site FDZ employees in order Figure 2: Scheme of the RDC-in-RDC approach. While the conclusion of the use agreement and the output control take place at the data-RDC, physical access control is necessary at the guest- RDC abroad IASSIST Quarterly Fall 2011 15 IASSIST Quarterly to ensure access control and to guarantee the compliance of German data protection regulations in the US. Since the hours of work in an US site differ considerably from the local office hours in Nuremberg, trained employees of the FDZ with administrator rights are required in order to maintain regular operation, too. Technical implementation for data access control In the context of the RDC-in-RDC approach a thin client solution using Citrix software will be used for data access control and data access restrictions (see Figure 3). Other methods, for example biometric authentication, webcam monitoring or hardware authentication are possible and used internationally (on this issue see also Grim et al. 2009 or Rowland 2003), but bear either technical disadvantages or, in case of webcam monitoring, are not compatible with German law. Within this technical solution, normal PCs are turned into so-called thin clients15 . Thin clients may be regarded as conventional computers which are only able to perform a limited scope of tasks. Thus, for instance, all possibilities for external copying (onto USB, CD-ROM, DVD), for Internet access (including wireless access) or for printing are disabled, the existing software is restricted and access to data is also limited. By running special software (for example Citrix), the thin client guarantees that a user only uses the approved drives and directories and also prevents him/her from being able to install additional programs. This is a component of the common solution for remote data access in other countries. Researchers connect from the data-RDC via a Citirx Access Gateway to a terminal server which stores the data. Access to this terminal server is provided by an encrypted SSL connection (see figure 3). Output control and transmission Output control continues to be performed at the data-RDCs for several reasons. First, the employees of the guest-RDC have no legal right to access the data. In addition, different legal framework conditions apply for the different RDCs, which influences the monitoring of output for statistical confidentiality. The regulations for monitoring statistical confidentiality can therefore not easily be standardised. Therefore, control remains at the data-RDC and the data-RDC transmits the monitored output to the respective researcher. Conclusion Remote access is regarded as an efficient and convenient method of data access which has already has been implemented in several countries such as the United States, Sweden or the Netherlands. Due to legal restrictions, Germany still lags behind this development. By initiating the RDC-in-RDC approach the FDZ aims to bring data access in Germany closer to the ideal perception of remote access. By allowing data access from designated institutions with comparable standards but locations other than Nuremberg. In a first step, access to BA and IAB data will be granted from four sites in Germany and one site in the US. Moreover, the RDC-in-RDC approach represents also a change of paradigms in two respects. First, before the implementation of the RDC-in-RDC approach, researchers had to come or connect to a RDC in order to access sensitive micro data. Now, “access is distributed rather than data” (Ritchie 2009/2010, p. 113). By establishing a decentralised way of data access the FDZ literally brings data access to the researchers. Second, data access will also be possible for non-resident researchers. Thus, the dissemination of micro data will be no longer restricted to national borders. The successful implementation of the RDC-in-RDC approach may not only serve as a stepping stone for statistical authorities in Germany on their way to remote data access. It may also serve as a role model for other countries with a comparable state of development in terms of micro data access. Even countries with well established remote data access procedures may benefit from the experiences gained by the RDC-in-RDC approach. Because of its international dimension, it may represent a blue print for shifting data access beyond national borders leading to intensified international data sharing. References Ahmad, N., De Backer, K., Yoon, Y. (2009/2010) An OECD perspective on microdata access: Trends, opportunities and challenges, in: Statistical Journal of the IAOS: Journal of the International Association for Official Statistics, 26, 3-4, 57 - 63 Anderson, O. (2003) From on- site to remote data access – the revolution of the Danish system for access to micro data, United Nations Statistical Commission and Economic Commission for Europe Conference of European Statisticians Working Paper No. 29. Bender, S., Himmelreicher, R., Zühlke, S., Zwick, M. (2009) Improvement of Access to Data Set from Official Statistics in: Building on Progress – Expanding the Research Infrastructure for the Social, Economic, and Behavioral Sciences, Budrich UniPress Ltd., Opladen & Farmington Hills, MI, pp. 215 – 230 Bound, J. (2008) Michigan Center on the Demography of Aging pro- posal to the National Institute of Aging (P30 AG012846-16) Borchsenius, L. (2005) New Developments in the Danish system for Access to Micro Data, Invited paper to the Joint UNECE/Eurostat work session on statistical data confidentiality (Geneva, 9-11 November 2005) Bujnowska, A., Museux, J. (2009/2010) Release of European Union microdata, ESS projects on remote access, in: Statistical Journal of the IAOS: Journal of the International Association for Official Statistics, 26, 3-4, 89 – 94 Foster, L., Jarmin, R., Riggs, L. (2009/2010) Resolving the tension between access and confidentiality: Past experience and future plans at the U.S. Census Bureau, in: Statistical Journal of the IAOS: Journal of the International Association for Official Statistics, 26, 3-4, 119 – 128 Figure 3: Technical implementation of the RDC-in-RDC approach. 16 IASSIST QuArTerly FAll 2011 IASSIST Quarterly Gadouche, K. (2011) Technological Aspects Concerned in Widening Access to Confidential Data in France, Paper presented at the New Techniques and Technologies Conference (NTTS 2011), Brussels, 23 February 2011, www.ntts2011.eu Goldmann, G. (2009/2010) From a seed to a forest: Microdata access at Statistics Canada, in: Statistical Journal of the IAOS: Journal of the International Association for Official Statistics, 26, 3-4, 75 – 87 Grim, R., Heus, P., Mulcahy, T., Ryssevik (2009) Secure Remote Access sys- tem for an upgrated CESSDA RI, metadata technology, Cessda ppp, http://www.cessda.org/project/doc/CESSDA_RI_SRA_FINAL.pdf Hoeve, F. (2009/2010) Microdata access in the Netherlands, in: Statistical Journal of the IAOS: Journal of the International Association for Official Statistics, 26, 3-4, 95 - 100 Hundepool, A., Domingo-Ferrer, J., Franconi, L., Giessing, S., Lenz, R., Longhurst, J., Schulte Norholdt, E., Seri, G., De Wolf, P (2009) Handbook on Statistical Disclosure Control – Version 1.1. A [Eurostat] Centre of Excellence for Statistical Disclosure Control, http://neon. vb.cbs.nl/cenex/CENEX-SDC_Handboo k.pdf (2009), Accessed 15 October 2009 Kommission zur Verbesserung der informellen Infrastruktur zwischen Wissenschaft und Statistik (KVI) (2000) Wege zu einer besseren informellen Infrastruktur, Nomos, Baden-Baden. Lane J., Heus P., Mulcahy T. (2008) Data Access in a Cyber World: Making Use of Cyber-infrastructure, in: Transactions on Data Privacy, 1, 2- 16 Ritchie, F. (2009/2010) UK release practices for official microdata, in: Statistical Journal of the IAOS: Journal of the International Association for Official Statistics, 26, 3-4, 109 – 117 Rowland, S. (2003) An Examination of Monitored, Remote Microdata Access Systems, presented at the NAS Workshop on Access to Research Data: ‘Assessing Risks and Opportunities‘, www7.national- academies.org/cnstat/Rowland_Paper.pdf. Schaar, P. (2010) Data Protection and Statistics – A Dynamic and Tension-filled Relationship in: Building on Progress – Expanding the Research Infrastructure for the Social, Economic, and Behavioral Sciences, Budrich UniPress Ltd., Opladen & Farmington Hills, MI, pp. 629 - 642 Söderberg, L.-J. (2005): MONA – MICRODATA ON-LINE ACCESS AT STATISTICS SWEDEN, United Nations Statistical Commission and Economic Commission for Europe Conference of European Statisticians Working Paper No.3. Tam, S., Farley-Larmour, K.,Gare, M. (2009/2010) Supporting research and protecting confi-dentiality. ABS microdata: Current strategies and future directions, in: Statistical Journal of the IAOS: Journal of the International Association for Official Statistics, 26, 3-4, 65-74 Thygesen, L., Anderson, O., Schnoor, O. (2003) The Danish System for Access to Microdata; from on-site to remote access, Paper presented at Swedish Workshop on Microdata, Stockholm, www7.nationalaca- demies.org/cnstat/Rowland_Paper.pdf Upfold, J., Ng, P. (2009/2010) New Zealand’s approach to the provision of access to micro-data, in: Statistical Journal of the IAOS: Journal of the International Association for Official Statistics, 26, 3-4, 95 - 101 Wissenschaftsrat (German Council of Science and Humanities) (2007) Stellungnahme zum Institut für Arbeitsmarkt- und Berufsforschung (IAB), Nürnberg, Drs. 8175-07 Wright, Melanie (2009) ESRC Secure Data Service: A new vision for secure data access, Talk given by at New Services for Social Science Research: The Administrative Data Liaison Service and the Secure Data Service, Royal Statistical Society, London, 14 December 2009, http://securedata.ukda.ac.uk/news/publications.asp NOTES 1. Stefan Bender, Institute for Employment Research (IAB), Regensburger Strasse 104, 90478 Nuernberg, Germany, Tel.: +49-911-179-3082, Fax: +49-911-179-1728, stefan.bender@iab.de; Jörg Heining (corresponding author), Institute for Employment Research (IAB), Regensburger Strasse 104, 90478 Nuernberg, Germany, Tel.: +49-911-179-1752, Fax: +49-911-179-1728, joerg. heining@iab.de. We would like to thank all of the involved pro- ject partners for collaboration and support, especially Ramona Voshage, Statistical Office of Berlin-Brandenburg, Sylvia Zühlke, Statistical Office of North Rhine-Westphalia and Maggie Levenstein, Institute for Social Research, University of Michigan. For many help- ful comments and discussions we would also like to thank Peter Jacobebbinghaus, Institute for Employment Research (IAB), Karen Scott-Leuteritz as well as the participants of Statistics Canada’s 2010 International Methodology Symposium and the New Techniques and Technologies in Statis-tics (NTTS 2011) conference by Eurostat. The project underlying this report was funded by the Federal Ministry for Education and Research (Bundesministerium für Bildung und Forschung) (grant number 01UW1002). The authors are respon- sible for the content of this publication. 2. A detailed description of these institutions is given in Bender et al. 2009. 3. Bound 2008 provides a description of the MiCDA Enclave. 4. http://www.lisproject.org/ 5. https://international.ipums.org/international/ 6. http://ciser.cornell.edu/CRADC/What_is_CRADC.shtml 7. http://www.norc.org/DataEnclave 8. http://nces.ed.gov/dasol/ 9. http://www.dst.dk/HomeDK/TilSalg/Forskningsservice.aspx (in Danish); see also Anderson (2003), Borchsenius (2005) or Thygesen et al. (2003). 10. http://www.abs.gov.au/websitedbs/D3310114.nsf/home/ CURF:+Remote+Access+Data+Laboratory+(RADL) 11. http://www.scb.se/Pages/List____257147.aspx (in Swedish); see also Söderberg (2005). 12. http://www.safe-centre.eu/ 13. http://www.blue-ets.istat.it 14. An overview of the German RDCs is given on the website of the German Data Forum 15. (http://www.ratswd.de/eng/dat/fdz.html). http://en.wikipedia.org/wiki/Thin_client mag