The GDPR and the research exemption: considerations on the necessary safeguards for research biobanks

The General Data Protection Regulation (GDPR) came into force in May 2018. The aspiration of providing for a high level of protection to individuals’ personal data risked placing considerable constraints on scientific research, that was contrary to various research traditions across the EU. Therefore, along with the set of carefully outlined data subjects’ rights, the GDPR provides for a two-level framework to enable derogations from these rights when scientific research is concerned. First, by directly invoking provisions of the GDPR on a condition that safeguards that must include ‘technical and organisational measures’ are in place and second, through the Member State law. Although these derogations are allowed in the name of scientific research, they can simultaneously be challenging in light of the ethical requirements and well-established standards in biobanking that have been set forth in various research-related soft legal tools, international treaties and other legal instruments. In this paper we review such soft legal tools, international treaties and other legal instruments that regulate the use of health research data. We report on the results of this review, and analyse the rights contained within the GDPR and Article 89 of the GDPR vis-à-vis these instruments. These instruments were also reviewed to provide guidance on possible safeguards that should be followed when implementing any derogations. To conclude, we will offer some commentary on limits of the derogations under the GDPR and appropriate safeguards to ensure compliance with standard ethical requirements

Appropriate safeguards and Article 89 of the GDPR: considerations for biobank, databank and genetic research

The collection and use of biological samples and data for genetic research, or for storage in a biobank or databank for future research, impacts upon many fundamental rights, including the right to dignity, the right to private and family life, the right to protection of personal data, the right to freedom of arts and sciences, and the right to non-discrimination. The use of genetic data and other health-related data in this context must be used in a manner that is rooted in human rights. Owing in part to the General Data Protection Regulation (GDPR) coming into force, the right to the protection of personal data in the context of scientific research has been afforded increasing attention. The GDPR gives effect to the right to data protection, but states that this right must be balanced against other rights and interests. The GDPR applies to all personal data, with specific attention to special categories of data, that includes health and genetic data. The collection, access to, and sharing of such data must comply with the GDPR, and therefore directly impacts the use of such data in research. The GDPR does provide for several derogations and exemptions for research from many of the strict processing requirements. Such derogations are permitted only if there are appropriate safeguards in place. Article 89 states that to be appropriate, safeguards must be “in accordance” with the GDPR “for the rights and freedoms of the data subject”. In particular, those safeguards must ensure “respect for the principle of data minimisation”. Despite the importance of safeguards, the GDPR is silent as to the specific measures that may be adopted to meet these requirements. This paper considers Article 89 and explores safeguards that may be deemed appropriate in the context of biobanks, databanks, and genetic research

Return of research results (RoRR) to the healthy CHRIS cohort: designing a policy with the participants

Legal, financial and organizational challenges and the absence of coherent international guidelines and legal frameworks still discourage many genetic studies to share individual research results with their participants. Studies and institutions deciding to return genetic results will need to design their own study-specific return policy after due consideration of the ethical responsibilities. The Cooperative Health Research in South Tyrol (CHRIS) study, a healthy cohort study, did not foresee the return of individual genomic results during its baseline phase. However, as it was expected that the follow-up phase would generate an increasing amount of reliable genetic results, an update of the return of research results (RoRR) policy became necessary. To inform this revision, an empirical study using mixed methods was developed to investigate the views of CHRIS research participants (20), local general practitioners (3) and the local genetic counselling service (1). During the interviews, three different examples of potential genetic results with a very diverse potential impact on participants were presented: breast cancer, Parkinson disease and Huntington disease. The CHRIS participants also completed a short questionnaire, collecting personal information and asking for a self-evaluation of their knowledge about genetics. This study made it clear that research participants want to make autonomous decisions on the disclosure or non-disclosure of their results. While the motivations for participants' decisions were very diverse, we were able to identify several common criteria that had a strong influence on their choices. Providing information on these factors is crucial to enable participants to make truly informed decisions. [Abstract copyright: © 2021. The Author(s).

Precision cancer medicine and the doctor-patient relationship:a systematic review and narrative synthesis

Background: The implementation of precision medicine is likely to have a huge impact on clinical cancer care, while the doctor-patient relationship is a crucial aspect of cancer care that needs to be preserved. This systematic review aimed to map out perceptions and concerns regarding how the implementation of precision medicine will impact the doctor-patient relationship in cancer care so that threats against the doctor-patient relationship can be addressed. Methods: Electronic databases (Pubmed, Scopus, Web of Science, Social Science Premium Collection) were searched for articles published from January 2010 to December 2021, including qualitative, quantitative, and theoretical methods. Two reviewers completed title and abstract screening, full-text screening, and data extraction. Findings were summarized and explained using narrative synthesis. Results: Four themes were generated from the included articles (n = 35). Providing information addresses issues of information transmission and needs, and of complex concepts such as genetics and uncertainty. Making decisions in a trustful relationship addresses opacity issues, the role of trust, and and physicians’ attitude towards the role of precision medicine tools in decision-making. Managing negative reactions of non-eligible patients addresses patients’ unmet expectations of precision medicine. Conflicting roles in the blurry line between clinic and research addresses issues stemming from physicians’ double role as doctors and researchers. Conclusions: Many findings have previously been addressed in doctor-patient communication and clinical genetics. However, precision medicine adds complexity to these fields and further emphasizes the importance of clear communication on specific themes like the distinction between genomic and gene expression and patients’ expectations about access, eligibility, effectiveness, and side effects of targeted therapies.</p

Balancing scientific interests and the rights of participants in designing a recall by genotype study

Recall by genotype (RbG) studies aim to better understand the phenotypes that correspond to genetic variants of interest, by recruiting carriers of such variants for further phenotyping. RbG approaches pose major ethical and legal challenges related to the disclosure of possibly unwanted genetic information. The Cooperative Health Research in South Tyrol (CHRIS) study is a longitudinal cohort study based in South Tyrol, Italy. Demand has grown for CHRIS study participants to be enrolled in RbG studies, thus making the design of a suitable ethical framework a pressing need. We here report upon the design of a pilot RbG study conducted with CHRIS study participants. By reviewing the literature and by consulting relevant stakeholders (CHRIS participants, clinical geneticists, ethics board, GPs), we identified key ethical issues in RbG approaches (e.g. complexity of the context, communication of genetic results, measures to further protect participants). The design of the pilot was based on a feasibility assessment, the selection of a suitable test case within the ProtectMove Research Unit on reduced penetrance of hereditary movement disorders, and the development of appropriate recruitment and communication strategies. An empirical study was embedded in the pilot study with the aim of understanding participants’ views on RbG. Our experience with the pilot study in CHRIS allowed us to contribute to the development of best practices and policies for RbG studies by drawing recommendations: addressing the possibility of RbG in the original consent, implementing tailored communication strategies, engaging stakeholders, designing embedded empirical studies, and sharing research experiences and methodology

The challenges of the expanded availability of genomic information: an agenda-setting paper

Rapid advances in microarray and sequencing technologies are making genotyping and genome sequencing more affordable and readily available. There is an expectation that genomic sequencing technologies improve personalized diagnosis and personalized drug therapy. Concurrently, provision of direct-to-consumer genetic testing by commercial providers has enabled individuals’ direct access to their genomic data. The expanded availability of genomic data is perceived as influencing the relationship between the various parties involved including healthcare professionals, researchers, patients, individuals, families, industry, and government. This results in a need to revisit their roles and responsibilities. In a 1-day agenda-setting meeting organized by the COST Action IS1303 “Citizen’s Health through public-private Initiatives: Public health, Market and Ethical perspectives,” participants discussed the main challenges associated with the expanded availability of genomic information, with a specific focus on public-private partnerships, and provided an outline from which to discuss in detail the identified challenges. This paper summarizes the points raised at this meeting in five main parts and highlights the key cross-cutting themes. In light of the increasing availability of genomic information, it is expected that this paper will provide timely direction for future research and policy making in this area.Funding Deborah Mascalzoni is supported under Grant Agreement number 305444. Álvaro Mendes is supported by the FCT—The Portuguese Foundation for Science and Technology under postdoctoral grant SFRH/BPD/88647/2012. Isabelle Budin-Ljøsne receives support from the National Research and Innovation Platform for Personalized Cancer Medicine funded by The Research Council of Norway (NFR BIOTEK2021/ES495029) and Biobank Norway funded by The Research Council of Norway—grant number 245464. Heidi Carmen Howard is partly supported by supported by the Swedish Foundation for Humanities and Social Science under grant M13-0260:1), the Biobanking and Molecular Resource Infrastructure of Sweden (BBMRI.se) and the BBMRI-ERIC. Brígida Riso is supported by the Portuguese Foundation for Science and Technology (FCT) under the PhD grant SFRH/BD/100779/2014. Heidi Beate Bentzen receives support from the project Legal Regulation of Information Processing relating to Personalized Cancer Medicine funded by The Research Council of Norway BIOTEK2021/238999

Patient/family views on data sharing in rare diseases: study in the European LeukoTreat project.: Survey assessing data sharing in leukodystrophies

International audienceThe purpose of this study was to explore patient and family views on the sharing of their medical data in the context of compiling a European leukodystrophies database. A survey questionnaire was delivered with help from referral centers and the European Leukodystrophies Association, and the questionnaires returned were both quantitatively and qualitatively analyzed. This study found that patients/families were strongly in favor of participating. Patients/families hold great hope and trust in the development of this type of research. They have a strong need for information and transparency on database governance, the conditions framing access to data, all research conducted, partnerships with the pharmaceutical industry, and they also need access to results. Our findings bring ethics-driven arguments for a process combining initial broad consent with ongoing information. On both, we propose key item-deliverables to database participants

Caught you: threats to confidentiality due to the public release of large-scale genetic data sets

<p>Abstract</p> <p>Background</p> <p>Large-scale genetic data sets are frequently shared with other research groups and even released on the Internet to allow for secondary analysis. Study participants are usually not informed about such data sharing because data sets are assumed to be anonymous after stripping off personal identifiers.</p> <p>Discussion</p> <p>The assumption of anonymity of genetic data sets, however, is tenuous because genetic data are intrinsically self-identifying. Two types of re-identification are possible: the "Netflix" type and the "profiling" type. The "Netflix" type needs another small genetic data set, usually with less than 100 SNPs but including a personal identifier. This second data set might originate from another clinical examination, a study of leftover samples or forensic testing. When merged to the primary, unidentified set it will re-identify all samples of that individual.</p> <p>Even with no second data set at hand, a "profiling" strategy can be developed to extract as much information as possible from a sample collection. Starting with the identification of ethnic subgroups along with predictions of body characteristics and diseases, the asthma kids case as a real-life example is used to illustrate that approach.</p> <p>Summary</p> <p>Depending on the degree of supplemental information, there is a good chance that at least a few individuals can be identified from an anonymized data set. Any re-identification, however, may potentially harm study participants because it will release individual genetic disease risks to the public.</p

Public preferences for digital health data sharing: Discrete choice experiment study in 12 european countries

Background: With new technologies, health data can be collected in a variety of different clinical, research, and public health contexts, and then can be used for a range of new purposes. Establishing the public s views about digital health data sharing is essential for policy makers to develop effective harmonization initiatives for digital health data governance at the European level. Objective: This study investigated public preferences for digital health data sharing. Methods: A discrete choice experiment survey was administered to a sample of European residents in 12 European countries (Austria, Denmark, France, Germany, Iceland, Ireland, Italy, the Netherlands, Norway, Spain, Sweden, and the United Kingdom) from August 2020 to August 2021. Respondents answered whether hypothetical situations of data sharing were acceptable for them. Each hypothetical scenario was defined by 5 attributes ("data collector," "data user," "reason for data use," "information on data sharing and consent," and "availability of review process"), which had 3 to 4 attribute levels each. A latent class model was run across the whole data set and separately for different European regions (Northern, Central, and Southern Europe). Attribute relative importance was calculated for each latent class s pooled and regional data sets. Results: A total of 5015 completed surveys were analyzed. In general, the most important attribute for respondents was the availability of information and consent during health data sharing. In the latent class model, 4 classes of preference patterns were identified. While respondents in 2 classes strongly expressed their preferences for data sharing with opposing positions, respondents in the other 2 classes preferred not to share their data, but attribute levels of the situation could have had an impact on their preferences. Respondents generally found the following to be the most acceptable: A national authority or academic research project as the data user; being informed and asked to consent; and a review process for data transfer and use, or transfer only. On the other hand, collection of their data by a technological company and data use for commercial communication were the least acceptable. There was preference heterogeneity across Europe and within European regions. Conclusions: This study showed the importance of transparency in data use and oversight of health-related data sharing for European respondents. Regional and intraregional preference heterogeneity for "data collector," "data user," "reason," "type of consent," and "review" calls for governance solutions that would grant data subjects the ability to control their digital health data being shared within different contexts. These results suggest that the use of data without consent will demand weighty and exceptional reasons. An interactive and dynamic informed consent model combined with oversight mechanisms may be a solution for policy initiatives aiming to harmonize health data use across Europe

Sharing health-related data:A privacy test?

Greater sharing of potentially sensitive data raises important ethical, legal and social issues (ELSI), which risk hindering and even preventing useful data sharing if not properly addressed. One such important issue is respecting the privacy-related interests of individuals whose data are used in genomic research and clinical care. As part of the Global Alliance for Genomics and Health (GA4GH), we examined the ELSI status of health-related data that are typically considered ‘sensitive’ in international policy and data protection laws. We propose that ‘tiered protection’ of such data could be implemented in contexts such as that of the GA4GH Beacon Project to facilitate responsible data sharing. To this end, we discuss a Data Sharing Privacy Test developed to distinguish degrees of sensitivity within categories of data recognised as ‘sensitive’. Based on this, we propose guidance for determining the level of protection when sharing genomic and health-related data for the Beacon Project and in other international data sharing initiatives