Newsletter

This checklist guides researchers through all the different considerations required to meet all the requirements for non-public data access. We’re currently using it to draft our own applications and will continue to develop it as more information and helpful resources become available. If you have feedback or think that we missed something, please let us know!

Our checklist draws on a whole set of different resources from a variety of different stakeholders.
The main source of information is the Irish DSC, Coimisiún na Meán (CnaM), which offers a recently updated comprehensive guidance document, detailing all application criteria and what documentation can be provided to demonstrate that the applicant researchers meet them, an FAQ, and a newsletter on their webpage. We especially recommend subscribing to the “Vetted Researcher Newsletter” as it reliably includes very helpful pointers to additional resources. There, CnaM also shared a list of tips, an abbreviated version of which we are including here:

1. Quality over quantity. Submit only one application to one platform at the start. This gives you the chance to iron out all gaps or omissions first and allows you to easily scale your application to other platforms once you’ve been successful. Also, CnaM has to vet every single application it receives and does so on a purely chronological basis. This means application slop may lead to further delays by binding resources that could go into outreach or the vetting of well-prepared applications.
   
   
2. Start locally. Given that there may be specific requirements at the national level, make sure to seek information on data access from both the DSC in your member state and the DSC of the member state in which the platform is established. The German DSC for example will always have to contact the relevant data protection authority, while CnaM will only assess applications and supporting documents submitted in English or Irish. You can find an overview and contact information of all DSCs and links to their websites here.
   
   
3. Be diligent. Make sure all information, including affiliations and the contact details of your research organisation, in your application is accurate, consistent and up to date before you submit. For example: the address of your research organisation should match its address in the funding and tenders portal. Also, double check which requirements relate to your research project and which relate to everyone that applies. Each individual researcher must demonstrate their affiliation to a research organisation and independence of commercial interests, so make sure to provide documents for all applicants, or that they are signed by everyone (where relevant).
   
   
4. Evidence, evidence, evidence! Make sure to back up any statements made in relation to aspects of their application with the relevant evidence. For example, if you say that you have specific funding in place for this research, you must attach a copy of the funding supporting evidence. Similarly, if you state that your research has ethical approval in place, you also need to attach documents that prove that.
   
   
5. Call for backup. You will need institutional support from your research organisation – especially the Data Protection Office, Research Offices and ICT teams – to show that your application meets the data security, data protection and confidentiality requirements. Reach out to them as early as possible and let them know what you need for your application (our checklist includes a set of documents that you can ask them about).

In a recent article for the Forum section of Political Communication the Collaboratory’s own Jakob Ohme and LK Seiling provide some additional notes to keep in mind when drafting an application, which we have adapted below:

6. Refine your request. You should have a well-defined question that is unambiguously anchored in identifiable systemic risks. Starting with a clear idea should allow you to formulate a tight and well-scoped data access request. After all, to fulfill the necessity and proportionality requirements you need to be able to clearly show how the data that you have requested contributes to your investigation. At this point in time it’s probably strategically smarter to not be overly ambitious in the amount of data you request.
   
   
7. Form functional teams. You may want to collaborate across institutions, or even continents. While this is theoretically possible, you should keep in mind that the required documentation will increase with the amount of researchers and organisations on the application. Think twice about who really needs to access the data to run analyses – and who may be part of the research project developing the research questions but does not necessarily need to be vetted as part of the application.
   
   
8. Be realistic about timelines. When planning your research project, you need to account for ~80 working days of regulatory review, potential rejection, platform-initiated amendment or mediation procedures (max. ~75 working days), and potential delays in data provision. Also, you may be asked to provide additional information during the initial 80 working day vetting phase  – so perhaps don’t submit your application right before taking your vacation. Additionally, you should be realistic about the timeframe for which you are requesting access to the data. After all, you don’t want to lose data access half-way through the review process. A generous research project timeline with estimates for data cleaning, analysis, writing, and peer review can go a long way to demonstrate that your requested access is necessary and proportionate.
   
   
9. Ensure replicability. Sharing the data you get granted access to is not an option. This means that anyone planning a replication of your research will have to submit new access requests for the same data. Given these constraints, you should plan for replication from the outset and document your research project accordingly. Procedural clarity and open source code for data processing and analysis can go a long way towards replicability.
   
   
10. Sharing is caring. Only reasoned requests resulting from successful applications will be made public in the data access portal, which means that by default there exists no collective means to learn from rejected applications and the reasoning provided by DSCs. Our DSA40 Data Access Tracker is supposed to close this gap by allowing you to share as much information as you want with us, so that we can feed it back into the community. 

Also, on a more general note, and to not make this list look like The Ten Commandments:

11. We are all pioneers. This data access framework is new to everyone – including DSCs, researchers, and platforms. So if you engage in the process at this point in time, know that there will be frustrations and confusions on all sides. But don’t let this discourage you – after all, this is what comes with charting an untrodden path. Also, try and empathise with the other people involved in this process, and maybe don’t submit your access application during the summer break.

If you want to understand what kinds of data platforms hold, you should definitely also have a look at the EDMO report on Platform Datasets, authored by the wonderful people at the Integrity Institute. To get even deeper into the weeds, we recommend Matt Motyl’s comprehensive documentation of platform APIs, different data types, and existing datasets over at show-me-the-data.com.

In case you are more interested in data protection, AWO, a law firm and strategy consultancy specializing in data protection, has got you covered: their summary paper on “Data Protection and DSA Data Access for Platform Research” is a great primer on the core concepts of EU data protection law and how they relate to the requirements for data access based on Art. 40(4) DSA. The Online Tool for Data Protection concepts by Gesellschaft für Freiheitsrechte (GFF) will help you translate the data protection theory into practice: it is custom made to support researchers with creating risk assessments and documentation of the technical and organisational measures they have in place to safeguard the accessed data.

Finally, we’d like to draw your attention to some resources on creating a data management plan – another essential document for applications to access non-public data, like the Data Management Expert Guide by the Consortium of European Social Science Data Archives (CESSDA), DMPonline, and the Research Data Management Organiser (RDMO)  – which are a great starting points for any researcher independent of experience level.

What about access to public data?

With all that buzz around non-public data access, one may feel like access to publicly accessible data set out in Art. 40(12) is a thing of the past. But don’t worry – we have not forgotten about public data access! In fact, during the last months we have kept pushing to also improve the state of this access pathway (see below) and are actively working on tools to further facilitate the submission of access requests directly to the platforms. We hope to be able to tell you more soon!