GA4GH 2020 Gap Analysis

DURI Team

Useful Links

• Full Gap Analysis Document
• DURI 2020 Roadmap

Overall Themes

• Alignment with external standards
• Increased GA4GH-wide interoperability
• Practical implementations
• Reduce barriers to participation

DURI Specific Points

• Fragmentation of data access committees and data governance policies^[a] may continue to lock data within small data sets that are hard to integrate.

• Jonathan: REWS is evaluating different data access agreements. Yan Joly is working on this.  [https://www.nature.com/articles/s41597-019-0310-4] DURI to coordinate with REWS
• Jaime: Could we put forth guidance on what your governance process should or shouldn’t cover?
• Kristina REWS consent task force may have overlap with DURI: https://docs.google.com/presentation/d/1ojqVL_q-37xiL0CIVL_CY5m6khzF9iHoS_HdkesFt2U/edit#slide=id.g75c251d40c_0_35 

• The community needs protocols for data access committees to create reciprocity and authorization agreements.^[b][c]

• Adrian: Access governance includes policies, processes, and agreements. We can also try and identify best practices and harmonize - and then eventually (hopefully) coordinate.
• Craig: Need DPs for this.  It would help us determine how to go about supporting this
• Jaime: Each group operating within their own governance. If you could come up with a way to code similar processes, it may help with adoption and then agree on certain aspects.  May not give reciprocal approval, but may show alignment
• Kurt: The visa concept within a passport would be able to encapsulate a DAC decision, signed by the DAC. Another DAC could choose to honor that after validating signatures.
• Sarion: Maybe have partial reciprocity by adopting identification mechanisms (for example) but this doesn’t grant them access, just have a step expedited.
• Laura R: consider if the focus should be up at the level of data repositories. This would also encompass issues around reciprocal identity authentication and potential for broader authorization than one DAC at a time.

• Need to determine which of the many types of consent (e.g., machine readable, familial, recontact) is most urgent.

• Adrian: All being worked on anyway.  We can prioritize at the implementation stage.^[d]

• The Cloud Work Stream is not fully aware of how TRS would apply the GA4GH Passports and standard OIDC protocols. It is unclear where responsibilities for integration and interoperability lie.

• This point was also discussed on the Data Security gap analysis.  See that document for details
• Craig: probably applies to all APIs related to FASP as well
• Mikael: ELIXIR has made an analysis on WES, TES and DRS using AAI.

• DAC workflows are looking to DURI for potential solutions:

• Identifying the legitimacy of Signing Officials and Researchers with assurance
• Requestor orgs signing Data Access Agreements
• Optimized human DAC workflows, still facing growing/unsustainable # of requests
• Dylan: Applying permissions to a repository from a DAC, e.g EGA from REMS or eDAM

• Improving assurance levels of users, such as identity proofing and multi-factor authentication, would need to be exposed through Passports for some integrations

• Work with the AAI security workstream for underlying infrastructure in OIDC/Oauth layers
• Additional integrations with identity proofing systems are emergent and needs more analysis