1 of 15

Options

to do the work that�must be done

GDPR Art 25: “...appropriate technical and organisational measures…”

myDRE Contracts © 2024 by anDREa BV is licensed under CC BY-NC-SA 4.0

2 of 15

Taking care of data = Trusted Processing Environments

Research Institute

myDRE

Study 2

Gather Data

Study 1

  • No Data Transfer Agreement needed
  • Possibly needed:
    • Data Processing Agreement

Institute 1

Institutes

myDRE

Study 1

Gather Data

Study 2

  • Data Transfer Agreement needed
    • Unless Accountable & Privileged Members are employees of the data issuer
  • Processing costs directly incurred by the other party

Version: 20240330

3 of 15

Remember …

In case your organization is Consortium Lead:

Choose smartly who is:

This may make collaboration way easier for:

  • Cohort studies
  • Federated Learning
  • Federated Processing / Analysis
  • And it might be possible that a Data Transfer Agreement is not needed

Version: 20240125

4 of 15

Cohort Study Blueprint

Research Institute

myDRE

Study 2

Study 1

Gather Data

Prep & Issue Data

Study 3

  • No Data Transfer Agreement needed
  • Possibly needed:
    • Data Processing Agreement

Research Institute

Institutes

myDRE

Study 2

Study 1

Gather Data

Prep & Issue Data

Study 3

  • Data Transfer Agreement needed
    • Unless Accountable & Privileged Members are employees of the data issuer
  • Processing costs directly incurred by the other party

Version: 20240330

5 of 15

Federated Learning / Processing Blueprint - I

Institute 1

Institute 2

myDRE

Institute 1

myDRE

Institute 2

Gather Data

Workspace

Gather Data

Workspace

  • Data Transfer Agreement needed
    • Unless Accountable & Privileged Members are employees of Institute 2
  • Possibly needed:
    • Technology Transfer Agreement
    • Data Processing Agreement

Version: 20240330

Workspace

Gather Data

Workspace

  • No Data Transfer Agreement needed
  • Possibly needed:
    • Technology Transfer Agreement
    • Data Processing Agreement

Outcome

Gather Data

Workspace

Outcome

6 of 15

Federated Learning / Processing Blueprint - II

Research Institute

Institute 1

myDRE

Create Model

Train Model

Gather Data

Prep Data

Trained Model

  • No Data Transfer Agreement needed
  • Possibly needed:
    • Technology Transfer Agreement
    • Data Processing Agreement

Research Institute

Institute 1

myDRE

Create Model

Train Model

Gather Data

Prep Data

Trained Model

  • Data Transfer Agreement needed
    • Unless Accountable & Privileged Members are employees of the data issuer
  • Possibly needed:
    • Technology Transfer Agreement
    • Data Processing Agreement

Version: 20240330

7 of 15

Taking care of data = Trusted Processing Environments

Organisation X

Organisation B

Organisation A

myDRE

Version: 20240330

  • Trusted
  • Setup time infra�< 30 minutes
  • Collaboration
  • Trusted
  • Setup time infra�> 10 days
  • Collaboration

Data Sources

Data Sources

8 of 15

Cohort Studies - Data Gathering

Organisation X

Organisation B

Organisation A

myDRE

Version: 20240330

  • Trusted
  • Setup time infra�< 30 minutes
  • Collaboration
  • Trusted
  • Setup time infra�> 10 days
  • Collaboration

Data Sources

Data Sources

Data Sources

9 of 15

Cohort Studies - Data Issuing

Organisation X

Organisation B

Organisation A

myDRE

Version: 20240330

  • Trusted
  • Setup time infra�< 30 minutes
  • Collaboration
  • Trusted
  • Setup time infra�> 10 days
  • Collaboration

10 of 15

Federated Learning / Processing

Organisation X

Organisation B

Organisation A

myDRE

Version: 20240330

  • Trusted
  • Setup time infra�< 30 minutes
  • Collaboration
  • Trusted
  • Setup time infra�> 10 days
  • Collaboration

Data Sources

Data Sources

Data Sources

11 of 15

Pandemic Readiness

Organisation X

Organisation B

Organisation A

myDRE

CDC

Version: 20240330

  • Trusted
  • Setup time infra�< 30 minutes
  • Collaboration
  • Trusted
  • Setup time infra�> 10 days
  • Collaboration

Data Sources

Data Sources

Data Sources

12 of 15

DTA or no DTA? - always consult your privacy lawyer

Organisation B

Organisation A

myDRE

Version: 20240330

Data Sources

Data Transfer Agreement Needed?

YES: most likely

NO: most likely - how to proof

YES: if Accountable = Org. B*

MAYBE: if Accountable = Org. A*

NO: if Accountable = Org. A*

MAYBE: if Accountable = Org. B*

* Who is Privileged Member might also impact

13 of 15

Federated Learning with Multiple Workspaces in myDRE

Overview:

  • Federated Learning is a machine learning approach where multiple edge devices or servers collaborate to train a model without sharing their local data.
  • In this setup, each customer has an Azure Subscription which hosts research Workspaces containing private data.
  • An additional Shared Subscription hosts a Federation host and an SMB Share.
  • The Federation host is the central node where all the model deltas from different Workspaces are aggregated and evaluated.
  • The evolved models are then put in a Private Endpoint linked SMB Share.

Steps:

  • Each Workspace uses the latest iteration of the global model to train against its private data.
  • The Workspace submits the updated model fragment (delta) to be evaluated together with other participating workspaces' trained model deltas.
  • The Federation host aggregates and evaluates the model deltas.
  • The evolved model is then put in the Private Endpoint linked SMB Share.
  • The Workspaces can then download the evolved model and use it for inference.

Benefits:

  • This setup allows multiple Workspaces to collaboratively learn a shared prediction model while keeping all the training data on their original servers, preserving data privacy.
  • It also allows customers to leverage the power of Federated Learning without having to manage the underlying infrastructure.

Example:

  • A group of hospitals are collaborating to train a model to predict patient outcomes. Each hospital has its own private dataset of patient data, and they do not want to share this data with each other.
  • Using Federated Learning, the hospitals can train a shared model without sharing their data. The model is trained in a central location, but the training data never leaves the hospitals.
  • This setup allows the hospitals to benefit from the power of machine learning without compromising their patients' privacy.

Version: 20230516

14 of 15

Options to organize - Federated Learning / Processing

issue

Study A

Data Capture

Prep Data for Studies

Study B

Outcome analysis

Outcome analysis

Data Extraction

I

II

III

IV

Overall Agreement

Data Capture Agreement

Per Study Agreements

Per Outcome Agreements

Per Data Processing

Version: 20230516

15 of 15

Institute Y

Institute X

Study A

Data Capture

Prep Data for Studies

Study B

Outcome analysis

Outcome analysis

Data Extraction

I

II

III

IV

Data Capture

Prep Data for Studies

Data Extraction

I

II

Version: 20230516