Remote Access to Official German Microdata - Challenges, Solutions and Brick Walls

One of the core tasks of Research Data Centres (RDC) is to make sensitive micro data availa-ble for researchers in a user-friendly way while at the same time ensuring a high level of data protection. The established access routes have well-known weaknesses: For (i) on-site data use in traditional safe centres, on the one hand, there are both high monetary costs and time expenditures for data users to travel to a safe room, as well as a limited number of work-stations; (ii) controlled remote execution, on the other hand, is often very labour-intensive for both data users and RDC staff, prone to inefficiencies and requiring very high levels of self-organization. In light of these limitations, direct Remote Desktop access to research data, which allows interactive data work from outside a safe room (e.g. regular or home office), is considered the future of data access and heavily advertised and demanded by researchers and their interest groups (e.g. RatSWD [1]). Remote Desktop solutions offer flexible and location-independent data access, but they pose a number of institutional and legal challenges for the data privacy frameworks of most countries. Using three German RDCs as case studies, the presentation outlines the hurdles such as data protection requirements, legal frameworks and institutional cautiousness that need to be over-come when setting up a Remote Desktop system. While the RDCs of the German Statistical Office (RDC-StBA) and the Institute for Employment Research (RDC-IAB) have successfully launched their respective Remote Desktops recently, their solutions are different in many ways and not easily reconciled. The RDC of the Federal Office for Migration and Refugees (RDC-BAMF), however, is still gridlocked in a set of rules and requirements that effectively rule out a Remote Desktop in the foreseeable future. This demonstrates that existing systems cannot be transferred 1:1 to other RDCs despite supposedly identical frameworks, and that despite the GDPR, Germany is still a long way from a unifying idea of how data protection and data access can be reconciled in practice.