Joint controllers in large research consortia: a funnel model to distinguish controllers in the sense of the GDPR from other partners in the consortium.

Large European research consortia in the health sciences face challenges regarding the governance of personal data collected, generated and/or shared during their collective research. A controller in the sense of the GDPR is the entity which decides about purposes and means of the data processing. Case law of the Court of Justice of the European Union (CJEU) and Guidelines of the European Data Protection Board (EDPB) indicate that all partners in the consortium would be joint controllers. This paper summarises the case law, the Guidelines and literature on joint controllership, gives a brief account of a webinar organised on the issue by Lygature and the MLC Foundation. Participants at the webinar agreed in large majority that it would be extreme if all partners in the consortium would become joint controllers. There was less agreement how to disentangle partners who are controllers of a study from those who are not. In order to disentangle responsibilities, we propose a funnel model with consecutive steps acting as sieves in the funnel. It differentiates between two types of partners: all partners who are involved in shaping the project as a whole versus those specific partners who are more closely involved in a sub-study following from the DoA or the use of the data Platform. If the role of the partner would be comparable to that of an outside advisor, that partner would not be a data controller even though the partner is part of the consortium. We propose further nuances for the disentanglement which takes place in various steps. Uncertainty about formal controllership under the GDPR can stifle collaboration in consortia due to concerns over (shared) responsibility and liability. Data subjects' ability to exercise their right can also be affected by this. The funnel model proposes a way out of this conundrum.

Human exposome assessment platform.

The Human Exposome Assessment Platform (HEAP) is a research resource for the integrated and efficient management and analysis of human exposome data. The project will provide the complete workflow for obtaining exposome actionable knowledge from population-based cohorts. HEAP is a state-of-the-science service composed of computational resources from partner institutions, accessed through a software framework that provides the world's fastest Hadoop platform for data warehousing and applied artificial intelligence (AI). The software, will provide a decision support system for researchers and policymakers. All the data managed and processed by HEAP, together with the analysis pipelines, will be available for future research. In addition, the platform enables adding new data and analysis pipelines. HEAP's final product can be deployed in multiple instances to create a network of shareable and reusable knowledge on the impact of exposures on public health.

Will the Eu Data Protection Regulation 2016/679 Inhibit Critical Care Research?

There is an inherent tension between critical care research and data protection. Because of their condition it is not possible to ask for the patients' informed consent to be enrolled in observational research at the point of admission to the hospital. Often this is not possible at a later moment either. Yet informed consent is the baseline to be enrolled in research with personal data and exceptions must be allowed for by national legislation. This was the case under Directive 95/96/EC and will be the case under the General Data Protection Regulation (GDPR, Regulation 2016/679 EU) which will replace the Directive from 25 May 2018 onwards. Though being a Regulation and therefore directly applicable in the Member States, the long debate about the research exceptions in the GDPR left many aspects of observational research including the exception to the informed consent principle, mainly to the Member States. It may be assumed that most Member States will leave their present state of the law intact in this respect as that was part of the political compromise. We compared existing national privacy legislation from the perspective of critical care research and found great variation. Although this may not impede the collection of emergency and critical care research with data without prior informed consent in countries which are more responsive to such research, it might be a challenge to exchange such data from the national nodes in European wide research collaboration. We make a case that countries which are not responsive to such research should adapt their legislation in the interests of future critical care patients.

The legal framework for European cervical cancer screening programmes.

BACKGROUND: A comprehensive legal framework needs to be developed to run the health services and to regulate the information systems required to manage and to ensure the quality of cancer screening programmes. The aim of our study was to document and to compare the status of legal basis for cervical screening registration in European countries. METHODS: An electronic questionnaire including questions on governance, decision-making structures and legal framework was developed. The primary responses were collected by September 2016. RESULTS: We sent the questionnaire to representatives of 35 European countries (28 countries of the EU, with the United Kingdom included as 4 countries; 4 EFTA member countries: Iceland, Liechtenstein, Norway, and Switzerland); responses were collected from 33 countries. The legal framework makes it possible to personally invite individuals in 29 countries (88%). Systematic screening registration in an electronic registry is legally enshrined in 23 countries (70%). Individual linkage of records between screening and cancer registries is allowed in 19 of those countries. Linkage studies involving cancer and screening registries have been conducted in 15 countries. CONCLUSION: Although the majority of EU/EFTA countries have implemented population-based screening, only half of them have successfully performed record linkage studies, which are nevertheless a key recommendation for quality assurance of the entire screening process. The European legislation is open to the possibility of using health data for these purposes; however, member states themselves must recognize the public interest to create a legal basis, which would enable all the necessary functions for high-quality cancer screening programmes.

Observational health research in Europe: understanding the General Data Protection Regulation and underlying debate.

Insights into the incidence and survival of cancer, the influence of lifestyle and environmental factors and the interaction of treatment regimens with outcomes are hugely dependent on observational research, patient data derived from the healthcare system and from volunteers participating in cohort studies, often non-selective. Since 25th May 2018, the European General Data Protection Regulation (GDPR) applies to such data. The GDPR focusses on more individual control for data subjects of 'their' data. Yet, the GDPR was preceded by a long debate. The research community participated actively in that debate, and as a result, the GDPR has research exemptions as well. Some of those apply directly; other exemptions need to be implemented into national law. Those exemptions will be discussed together with a general outline of the GDPR. I propose a substantive definition of research-absent in the GDPR-which can warrant its special status in the GDPR. The debate is not over yet. Most legal texts exhibit ambiguity and are interpreted against a background of values. In this case, those could be subsumed under informational self-determination versus solidarity and the deeper meaning of autonomy. Values will also guide national implementation and their interpretation. The value of individual control or informational self-determination should be balanced by nuanced visions about our mutual dependency in healthcare, as an ever-learning system, especially in the European solidarity-based healthcare systems. Good research governance might be a way forward to escape the consent or anonymise dichotomy.

Sharing and reuse of individual participant data from clinical trials: principles and recommendations.

OBJECTIVES: We examined major issues associated with sharing of individual clinical trial data and developed a consensus document on providing access to individual participant data from clinical trials, using a broad interdisciplinary approach. DESIGN AND METHODS: This was a consensus-building process among the members of a multistakeholder task force, involving a wide range of experts (researchers, patient representatives, methodologists, information technology experts, and representatives from funders, infrastructures and standards development organisations). An independent facilitator supported the process using the nominal group technique. The consensus was reached in a series of three workshops held over 1 year, supported by exchange of documents and teleconferences within focused subgroups when needed. This work was set within the Horizon 2020-funded project CORBEL (Coordinated Research Infrastructures Building Enduring Life-science Services) and coordinated by the European Clinical Research Infrastructure Network. Thus, the focus was on non-commercial trials and the perspective mainly European. OUTCOME: We developed principles and practical recommendations on how to share data from clinical trials. RESULTS: The task force reached consensus on 10 principles and 50 recommendations, representing the fundamental requirements of any framework used for the sharing of clinical trials data. The document covers the following main areas: making data sharing a reality (eg, cultural change, academic incentives, funding), consent for data sharing, protection of trial participants (eg, de-identification), data standards, rights, types and management of access (eg, data request and access models), data management and repositories, discoverability, and metadata. CONCLUSIONS: The adoption of the recommendations in this document would help to promote and support data sharing and reuse among researchers, adequately inform trial participants and protect their rights, and provide effective and efficient systems for preparing, storing and accessing data. The recommendations now need to be implemented and tested in practice. Further work needs to be done to integrate these proposals with those from other geographical areas and other academic domains.

The Newborn Screening Paradox: Sensitivity vs. Overdiagnosis in VLCAD Deficiency.

OBJECTIVE: To improve the efficacy of newborn screening (NBS) for very long chain acyl-CoA dehydrogenase deficiency (VLCADD). PATIENTS AND METHODS: Data on all dried blood spots collected by the Dutch NBS from October 2007 to 2010 (742.728) were included. Based solely on the C14:1 levels (cutoff ≥0.8 µmol/L), six newborns with VLCADD had been identified through NBS during this period. The ratio of C14:1 over C2 was calculated. DNA of all blood spots with a C14:1/C2 ratio of ≥0.020 was isolated and sequenced. Children homozygous or compound heterozygous for mutations in the ACADVL gene were traced back and invited for detailed clinical, biochemical, and genetic evaluation. RESULTS: Retrospective analysis based on the C14:1/C2 ratio with a cutoff of ≥0.020 identified an additional five children with known ACADVL mutations and low enzymatic activity. All were still asymptomatic at the time of diagnosis (age 2-5 years). Increasing the cutoff to ≥0.023 resulted in a sensitivity of 93% and a positive predictive value of 37%. The sensitivity of the previously used screening approach (C14:1 ≥0.8) was 50%. CONCLUSION: This study shows that the ratio C14:1/C2 is a more sensitive marker than C14:1 for identifying VLCADD patients in NBS. However, as these patients were all asymptomatic at the time of diagnosis, this suggests that a more sensitive screening approach may also identify individuals who may never develop clinical disease. Long-term follow-up studies are needed to establish the risk of these VLCADD-deficient individuals for developing clinical signs and symptoms.

EUROCOURSE recipe for cancer surveillance by visible population-based cancer RegisTrees in Europe: From roots to fruits.

Currently about 160 population-based cancer registries (CRs) in Europe have extensive experience in generating valid information on variation in cancer risk and survival with time and place. Most CRs cover all cancers, but some are confined to specific cancers or to children. They cover 15-55% of the populations in all of the larger member states of the European Union (EU), except the United Kingdom (UK), and 100% coverage in 80% of those with populations below 20 million. The EU FP 7 EUROCOURSE project, which operated in 2009-2013, explored the essential role of CRs in cancer research and public health, and also focused attention on their programme owners (POs) and stakeholders (e.g. cancer societies, oncological professionals, cancer patient groups, and planners, providers and evaluators of cancer care and mass screening). Generally, all CRs depended on their regional and/or national oncological context and were increasingly involved in population-based studies of quality of cancer care, long-term prognosis and quality of life, one third being very active. Within the public health domain, CRs, in addition to describing the variety of environmental and lifestyle-related cancer epidemics, have also contributed actively to aetiologic research by a European databases that showed wide discrepancies in cancer risk and survival across the EU, and in more depth by follow-up of cohorts and recruitment for case-control studies. CRs were also actively contributing to independent evaluation of mass screening as an intervention which affects quality of care and cancer mortality. The potential of CRs for clinical evaluation has grown substantially through interaction with clinical stakeholders and more incidentally biobanks, also with greater involvement of patient groups - with a special focus on elderly patients who generally do not take part in clinical trials. Whereas 25-35% of CRs are active in a range of cancer research areas, the rest have a low profile and usually provide only incidence and survival data. If they are unable to do so because POs and stakeholders do not demand it, they might also be inhibited by data protection restrictions, especially in German and French speaking countries. The value of population-based studies of quality of oncologic care and mass screening and the flawless reputation with regard to data protection of intensively used CRs in the northwest of Europe offered a sharp contrast, although they also follow the 1995 EU guideline on data protection. CRs thus offer a perfect example of what can be done with sensitive and minimal data, also when enriched by linkages to other databases. Intensive use of the data has allowed CR research departments to take on a visible expertise-based profile but a neutral in many public controversies in preventive oncology. Their management and fundability also appeared to benefit from externally classifying the wide array of tumour- or tract-specific intelligence and research activities for the various users in oncology and public health and also patients - who are the source of the data - are better informed. Transparency on what CRs enable may also improve through programmes of research have been deemed essential to our funding POs (ministries, cancer charities, cancer centres or public health institutes) who might benefit from some guidance to - often suboptimal -governance. Therefore, a metaphoric RegisTree has been developed for self-assessment and to clarify CR working methods and domain-specific performance to stakeholders and funding agencies, showing much room for development in many CRs. All in all, CRs are likely to remain unique sources of independent expert information on the burden of cancer, indispensable for cancer surveillance, with increased attention to cancer survivors, up to 4% of the population. Investments in the expanding CR network across Europe offer an excellent way forward for comparative future cancer surveillance with so many epidemiologic and clinical changes ahead.

A standardised graphic method for describing data privacy frameworks in primary care research using a flexible zone model.

PURPOSE: To develop a model describing core concepts and principles of data flow, data privacy and confidentiality, in a simple and flexible way, using concise process descriptions and a diagrammatic notation applied to research workflow processes. The model should help to generate robust data privacy frameworks for research done with patient data. METHODS: Based on an exploration of EU legal requirements for data protection and privacy, data access policies, and existing privacy frameworks of research projects, basic concepts and common processes were extracted, described and incorporated into a model with a formal graphical representation and a standardised notation. The Unified Modelling Language (UML) notation was enriched by workflow and own symbols to enable the representation of extended data flow requirements, data privacy and data security requirements, privacy enhancing techniques (PET) and to allow privacy threat analysis for research scenarios. RESULTS: Our model is built upon the concept of three privacy zones (Care Zone, Non-care Zone and Research Zone) containing databases, data transformation operators, such as data linkers and privacy filters. Using these model components, a risk gradient for moving data from a zone of high risk for patient identification to a zone of low risk can be described. The model was applied to the analysis of data flows in several general clinical research use cases and two research scenarios from the TRANSFoRm project (e.g., finding patients for clinical research and linkage of databases). The model was validated by representing research done with the NIVEL Primary Care Database in the Netherlands. CONCLUSIONS: The model allows analysis of data privacy and confidentiality issues for research with patient data in a structured way and provides a framework to specify a privacy compliant data flow, to communicate privacy requirements and to identify weak points for an adequate implementation of data privacy.

Biobanking residual tissues.

Health-care research relies largely on human materials stored in highly specialised biorepositories. Medical translational research on tissues can be performed using a variety of resources in distinct situations. The best known is the secondary use of pathology archives where paraffin-embedded tissues are stored for diagnostic reasons. Another is collecting and storing frozen material obtained from leftover surgical diagnosis. Such residual tissues can either be used directly in research projects or used in the context of a clinical trial with new interventional medicinal products. The latter can make the regulations governing the use of these materials for medical research much more complicated. The use of residual materials is very distinct from biobanking projects for which tissue is specifically collected. This article describes the consequences of using residual human material from different sources in distinct situations and why signed informed consent is not always the preferred choice of individual countries regarding the use of residual material. In addition, signed informed consent is overdone when using residual tissues in medical research. We maintain that the opt-out system is a balanced choice if certain requirements are met, relating to sufficient transparency about using residual tissue for research, the purpose of such research and to the confidentiality of the data used in that research. Finally, the international exchange of samples can be based on the laws and regulations of the countries of origin. Respecting these form the basis of what can and cannot be done in the country where the research on the samples is being performed.

Cervical cytology biobanking in Europe.

A cervical cytology biobank (CCB) is an extension of current cytopathology laboratory practice consisting in the systematic storage of Pap smears or liquid-based cytology samples from women participating in cervical cancer screening with the explicit purpose to facilitate future scientific research and quality audit of preventive services. A CCB should use an internationally agreed uniform cytology terminology, be integrated in a national or regional screening registry, and be linked to other registries (histology, cancer, vaccination). Legal and ethical principles concerning personal integrity and data safety must be respected strictly. Biobank-based studies require approval of ethical review boards. A CCB is an almost inexhaustible resource for fundamental and applied biological research. In particular, it can contribute to answering questions on the natural history of HPV infection and HPV-induced lesions and cancers, screening effectiveness, exploration of new biomarkers, and surveillance of the short- and long-term effects of the introduction of HPV vaccination. To understand the limitations of CCB, more studies are needed on the quality of samples in relation to sample type, storage procedures, and duration of storage.

First report on the patient database for the identification of the genetic pathways involved in patients over-reacting to radiotherapy: GENEPI-II.

BACKGROUND: Identifying the most radiosensitive patient group would have huge clinical implications. METHODS: A tissue bank containing skin fibroblasts, whole blood, lymphocytes, plasma and lymphoblastoid cell lines from clinically radiation hypersensitive patients was established from patients in Europe and Canada. Over-reacting individuals had CTCAE3.0 severe acute side effects grade 2 or more occurring at very low radiation doses where these side effects are unexpected or grade 3-4 lasting more than 4 weeks after the end of radiotherapy and/or requiring surgical intervention at any time or severe late side effects grade 3-4. RESULTS: Eleven patients have been identified with a mean age of 61.6±8.5 years (range 49-74). Two patients were male, 9 female. One patient had non-small cell lung cancer, 6 breast cancer, 2 head and neck cancer, one lymphoma and one meningioma. The mean follow-up time after radiotherapy was 1658±1048 days (range 84-3752). CONCLUSIONS: The establishment of an international tissue bank of the rare group of patients with extreme hypersensitivity to radiotherapy was proven to be feasible and should enable in-depth molecular studies.

Obstacles to European research projects with data and tissue: solutions and further challenges.

Most European biomedical research projects are about data. Research with tissue is about data as well; data will accompany the tissue, and data will be derived from analysing the tissue. Data can be merged with data from various sources, copied and re-analysed in the context of European projects. Privacy enhancing technologies (PET) should be used for transferring data from participating centres to the level where data are being merged. PET provide coding techniques which allow donors to be anonymous and still uniquely discernable. It is defended that under certain conditions two-way coded data can be considered as anonymous data in the sense of the European Data Protection Directive. Divergent interpretations of this Directive and most of all about the concept of coded-anonymous data is one of the main obstacles to observational research in Europe. The Data Protection Authorities will have to relax the extremely high threshold before data cannot be considered personal data anymore. Arguments are given for such relaxation. Besides the logic and logistics of data transfer in European projects, it is also about trust and a realistic risk assessment. In spite of the massive dataflow in European research projects no breach of confidentiality has ever been reported. The ethical rationale of such projects can be based on the principles of citizenship and solidarity provided that certain safeguards are met by which that research will remain observational. However, if the project does not preclude individual feed-back on the outcomes of research, as in theory would be possible with two-way coded tissue, that tissue cannot be considered anonymous. It is argued that in most tissuebanking projects individual feed-back should be excluded. Tissuebanking for research should not turn into medical screening without applying the established criteria for screening to it. If individual feed-back is not foreseen, two-way tissue should be considered anonymous, under the same conditions as two-way coded data. Good research governance is proposed as the way forward in the longer run. Good research governance is about a fair balance between the interests of all stakeholders. It should make the basic principles transparent on which observational research projects are based in line with European solidarity-based healthcare systems. It should encompass principles on how the general results of research will be disseminated, 'conflict of interests' policies, how the issues of intellectual property rights are dealt with, how the confidentiality of personal data of donors is maintained, etc. This should not become an extra bureaucratic layer. A good research governance framework should not establish rules but principles which provide enough flexibility for the specifics of a project, according to the 'comply or explain' principle. Such research governance should be developed bottom-up, by researchers together with the most interested stakeholders, patient organisations. Patients as 'biosocial citizens' are the natural allies of researchers against the 'paternalistic attitudes' of some ethicists and regulators.

Tumour banks: well-guarded treasures in the interest of patients.

In order for the genomics revolution to change how we diagnose, categorize and treat cancer, scientists and clinicians must have access to tumour samples. There has therefore never been a better time to create banks of tumour tissue. Collecting and storing tumour samples and their associated data, however, creates numerous methodological, ethical, legal and technical problems. How can we leap these hurdles in a responsible manner and still make full use of the wealth of information that can be obtained from them?