Hi. I think for these questions:
#5: we tend to discuss using the CDM and standardised analytical tools within EHDEN as ‘privacy by design’ under GDPR. In a federated approach, it is ultimately driven by the local privacy, security and confidentiality requirements at a local level, meanwhile only aggregated, population level results are shared with researchers, also ensuring we have the usual rules, such as small cell number avoidance, etc. This is even more stringent than HIPAA and US requirements.
#7: the Data Partner remains the final arbiter of running any scripts or queries on their own data, meaning also that local requirements, inclusive of approval, ethics boards, et al are still respected. It is even more beneficial to Data Partners than a centralised approach where your data is shared into e.g. a data lake, and there needs to be all sorts of technical and governance requirements. With the use of the CDM, no data is moved, only queries and derived information.
Hope that helps?
