Data-driven health research, specifically the development of AI models, is hampered by poor data availability and associated administrative burdens, caused complex and fragmented data protection regulation. To reap the benefits of using high quality health data, while safeguarding data protection of patients, the synthetic data generation is seen as a promising privacy-enhancing technology to avoid the need for personal data sharing. Although synthetic data is widely discussed, research primarily focuses on a technical development and evaluation of data protection, leaving substantive matters on the use of synthetic data within its institutional context open. By combining legal and technical knowledge, this thesis aimed to bridge this gap, by analysing how synthetic data generation could enable health data sharing for research in a privacy-enhancing manner. Specifically, a design science research approach is followed to combine the requirements from the institutional environment, focusing on a use case with a Dutch healthcare provider and research institute, with scientific knowledge on synthetic data generation and data protection evaluations. The research objective was to design a framework that structures the data protection-related factors that influence the extent to which synthetic health data enables secondary use of health data for research. The identified barriers and drivers of synthetic data generation focus on the health data sharing process, the interplay between the legal definition of anonymisation and technical data protection evaluations, as well as data protection principles. Synthetic data can enable secondary use of health data for research, but, measures should be implemented in the various phases of synthetic data sharing to safeguard patients’ data protection. As policy opportunity, this thesis argues for narrower definition of personal data to support privacy-enhancing technologies such as synthetic data generation.

Technology advancements and growing demands from citizens brought about a digital transformation of the Dutch public sector. As the digital standard rises higher and higher, the Dutch public sector is faced with the task to offer a strong digital environment and can choose to do so by either maintaining current IT infrastructures or by investing in alternatives.

At the moment the most promising alternative seems to be cloud technology. Cloud technology, or more specifically public cloud technology, provides the option to ’rent’ computing resources remotely from an external party. It is already widely in use within the private sector, as well as in some European governments. However, to introduce public cloud technology some hurdles must be overcome, such as concerns related to data security or the dependence on soft- and hardware that has been superseded but is difficult to replace. To gain more insight into the issue of the public cloud being a viable option to accommodate future digital transformation, it is first and foremost important to know what variables play a role in the decision-making process: what are the incentives to answer this question with either a ’yes’ or a ’no’? The objective of this study will therefore be to investigate this landscape of variables that influence the decision to adopt public cloud technology. It starts with the identification of variables from current research and reports, and then explores possible interrelationships. The identification and classification of these relationships could eventually help to bring about a well-considered decision about public cloud adoption in the Dutch public sector.

Reviewing current research related to variables that influence cloud adoption, three research gaps emerged. Firstly, current research was delineated to the Netherlands and therefore failed to capture geographically specific variables, such as legal or cultural characteristics. Secondly, authors that analysed the decision-making process of adopting cloud technology neglected any interrelations between different variables. Thirdly, existing theories fell short in capturing the full scope of could computing adoption decisions, being either too generic or not specific enough.

To address the knowledge gaps and simultaneously fulfil the objective of this study, Interpretive Structural Modeling (ISM) and Fuzzy Matrice d’Impacts Croisés Multiplication Appliquée à un Classement (MICMAC) methods are used. ISM aims to simplify complex relationships between a system of variables by providing a graphical representation of the hierarchical structure of that system. Fuzzy MICMAC is used to assess the strength of the relationship between the variables. In total, 22 interviews with experts in the field were held as input for the analysis. The experts worked in the Dutch public sector and were familiar with the decision-making process related to cloud computing adoption.

In the first step of ISM, relevant current literature and official Dutch documents and reports were used to create a list of eight variables that would have a negative effect on the decision to adopt cloud computing within the Dutch public sector. These were classified as the ’barriers’. Additionally, a list of eight positive variables was created and classified as the ’drivers’. Then, the ISM Fuzzy MICMAC steps were followed for both lists.

Key findings for ISM can be described as ’how many’ other variables are influenced by a certain variable, or by ’how many’ other variables this certain variable influences (including indirect effects). For Fuzzy MICMAC, results can be described by using the terms driving power, i.e. how ’strong’ does a variable influence other variables in the system, and dependence power, i.e. how ’strong’ is a variable influenced by other variables.

For the barriers, Regulations and government policy was the variable that had the most influence on other variables within the barrier system. The barrier that influenced other variables the strongest however (i.e. had the highest driving power), was Lack of knowledge and capabilities. Both Internal resistance to change and Negative business case were influenced by the highest number of other variables and did not affect any new variables. The variables with the highest dependence power were Internal resistance to change and Data security concerns.

For the drivers, Bigger knowledge market, Ease of use and Improved hard- and software were the variables that had the most influence on other variables within the drivers’ system. The driver with the highest driving power was Improved hard- and software. Governmental strategy was influenced by the highest number of other variables and did not affect any new variables. The variables with the highest dependence power were Lower and flexible cost and Governmental strategy.

The findings of this research have practical and theoretical implications. Practical, because they can support decisions about cloud within the Dutch public sector. Theoretical, since the findings suggest new variables, interrelations and theories related to public cloud computing. Furthermore, it uses ISM Fuzzy MICMAC, which is often used in the context of novel technologies, but never before for cloud computing adoption decisions.

Future research could address the limitations of this study, such as the exclusion of a feedback loop from the experts during the identification of the variables. Alternatively, research could use the Total Interpretive Structural Modelling (TISM) method to investigate the relationships further.