Purpose definition as a crucial step for determining the legal basis under the GDPR: implications for scientific research.

The General Data Protection Regulation (GDPR) of the European Union, which became applicable in 2018, contains a new accountability principle. Under this principle, controllers (ie parties determining the purposes and the means of the processing of personal data) are responsible for ensuring and demonstrating the overall compliance with the GDPR. However, interpretive uncertainties of the GDPR mean that controllers must exercise considerable judgement in designing and implementing an appropriate compliance strategy, making GDPR compliance both complex and resource-intensive. In this article, we provide conceptual clarity around GDPR compliance with respect to one core aspect of the law: the determination and relevance of the purpose of personal data processing. We derive from the GDPR's text concrete requirements for purpose specification, which we subsequently apply to the area of secondary use of personal data for scientific research. We offer guidance for correctly specifying purposes of data processing under different research scenarios. To illustrate the practical necessity of purpose specification for GDPR compliance, we then show how our proposed approach can enable controllers to meet their compliance obligations, using the example of the overarching GDPR principle of lawfulness to highlight the relevance of purpose specification for the identification of a suitable legal basis.

Confidentiality, public interest, and the human right to science: when can confidential information be used for the benefit of the wider community?

This article explores whether the human right to science can support the public interest as a legal basis to use and disclose confidential information. The contextual focus is scientific research; the jurisdictional focus is England. The human right to science, as reflected in the Universal Declaration of Human Rights (Article 27) and the International Covenant on Economic, Social and Cultural Rights (Article 15), hitherto has not been invoked in support of a public interest basis for lawful disclosure, but the argument is made herein that there may be scope to develop this jurisprudentially. On grounds of both law and policy, and in line with the underlying rationale of recent UK Government deployment of 'COPI Notices' for lawful use of confidential patient information in the course of the COVID-19 pandemic, I contend that the human right to science may well serve as a valuable juridical buttress to an overriding public interest justification to lawfully share confidential information. However, this could occur only in restricted circumstances where the public interest is clearly manifest, namely studies researching serious, imminent health threats to the general population that rely on confidential information accessed outside of existing statutory gateways, and not more routine scientific endeavors.

Achieving Procedural Parity in Managing Access to Genomic and Related Health Data: A Global Survey of Data Access Committee Members.

Data access committees (DACs) are critical players in the data sharing ecosystem. DACs review requests for access to data held in one or more repositories and where specific constraints determine how the data may be used and by whom. Our team surveyed DAC members affiliated with genomic data repositories worldwide to understand standard processes and procedures, operational metrics, bottlenecks, and efficiencies, as well as their perspectives on possible improvements to quality review. We found that DAC operations and systemic issues were common across repositories globally. In general, DAC members endeavored to achieve an appropriate balance of review efficiency, quality, and compliance. Our results suggest a similarly proportionate path forward that helps DACs pursue mutual improvements to efficiency and compliance without sacrificing review quality.

"Data makes the story come to life:" understanding the ethical and legal implications of Big Data research involving ethnic minority healthcare workers in the United Kingdom-a qualitative study.

The aim of UK-REACH ("The United Kingdom Research study into Ethnicity And COVID-19 outcomes in Healthcare workers") is to understand if, how, and why healthcare workers (HCWs) in the United Kingdom (UK) from ethnic minority groups are at increased risk of poor outcomes from COVID-19. In this article, we present findings from the ethical and legal stream of the study, which undertook qualitative research seeking to understand and address legal, ethical, and social acceptability issues around data protection, privacy, and information governance associated with the linkage of HCWs' registration data and healthcare data. We interviewed 22 key opinion leaders in healthcare and health research from across the UK in two-to-one semi-structured interviews. Transcripts were coded using qualitative thematic analysis. Participants told us that a significant aspect of Big Data research in public health is varying drivers of mistrust-of the research itself, research staff and funders, and broader concerns of mistrust within participant communities, particularly in the context of COVID-19 and those situated in more marginalised community settings. However, despite the challenges, participants also identified ways in which legally compliant and ethically informed approaches to research can be crafted to mitigate or overcome mistrust and establish greater confidence in Big Data public health research. Overall, our research indicates that a "Big Data Ethics by Design" approach to research in this area can help assure (1) that meaningful community and participant engagement is taking place and that extant challenges are addressed, and (2) that any new challenges or hitherto unknown unknowns can be rapidly and properly considered to ensure potential (but material) harms are identified and minimised where necessary. Our findings indicate such an approach, in turn, will help drive better scientific breakthroughs that translate into medical innovations and effective public health interventions, which benefit the publics studied, including those who are often marginalised in research.

Leveraging Algorithms to Improve Decision-Making Workflows for Genomic Data Access and Management.

Studies on the ethics of automating clinical or research decision making using artificial intelligence and other algorithmic tools abound. Less attention has been paid, however, to the scope for, and ethics of, automating decision making within regulatory apparatuses governing the access, use, and exchange of data involving humans for research. In this article, we map how the binary logic flows and real-time capabilities of automated decision support (ADS) systems may be leveraged to accelerate one rate-limiting step in scientific discovery: data access management. We contend that improved auditability, consistency, and efficiency of the data access request process using ADS systems have the potential to yield fairer outcomes in requests for data largely sourced from biospecimens and biobanked samples. This procedural justice rationale reinforces a broader set of participant and data subject rights that data access committees (DACs) indirectly protect. DACs protect the rights of citizens to benefit from science by bringing researchers closer to the data they need to advance that science. DACs also protect the informational dignities of individuals and communities by ensuring the data being accessed are used in ways consistent with participant values. We discuss the development of the Global Alliance for Genomics and Health Data Use Ontology standard as a test case of ADS for genomic data access management specifically, and we synthesize relevant ethical, legal, and social challenges to its implementation in practice. We conclude with an agenda of future research needed to thoughtfully advance strategies for computational governance that endeavor to instill public trust in, and maximize the scientific value of, health-related human data across data types, environments, and user communities.

The Ethical Implications of Big Data Research in Public Health: "Big Data Ethics by Design" in the UK-REACH Study.

In this article, we analyze legal and ethical issues raised in Big Data health research projects in the Covid-19 era and consider how these issues might be addressed in ways that advance positive values (e.g., furtherance of respect for persons and accordance with relevant legal frameworks) while mitigating or eliminating any negative aspects (e.g., exacerbation of social inequality and injustice). We apply this analysis specifically to UK-REACH (The United Kingdom Research Study into Ethnicity and Covid-19 Outcomes in Healthcare Workers), a project with which we are involved. We argue that Big Data projects like UK-REACH can be conducted in an ethically robust manner and that funders and sponsors ought to encourage similar projects to drive better evidence-based public policy in public health. As part of this, we advocate that a Big Data ethics-by-design approach be undertaken when such projects are constructed. This principle extends the work of those who advocate ethics by design by addressing prominent issues in Big Data health research projects; it holds that ethical values and principles in Big Data health research projects are best adhered to when they are already integrated into the project aims and methods at the design stage. In advocating this principle, we present a unique perspective regarding pressing ethical problems around large-scale, data-driven Covid-19 research, as well as legal issues associated with processing ostensibly anonymized health data.

The Genetic Discrimination Observatory: confronting novel issues in genetic discrimination.

Genetic discrimination (GD) is the differential or unfair profiling of an individual on the basis of genetic data. This article summarizes the actions of the Genetic Discrimination Observatory (GDO) in addressing GD and recent developments in GD since late 2020. It shows how GD can take many forms in today's rapidly evolving society.

Signalling Standards for Progress: Bridging the Divide Between a Valid Consent to Use Patient Data Under Data Protection Law and the Common Law Duty of Confidentiality.

In this article, we analyse the legal components of disclosing confidential patient information under the UK's common law duty of confidentiality (CLDoC) and processing personal (health) data under the UK's General Data Protection Regulation (GDPR) and Data Protection Act 2018. We describe the ostensible divide between the CLDoC and data protection law when it comes to the requirements of a valid signal of consent by a patient to use and disclose patient information, obtained by a health professional in the context of direct care, for health care and health research purposes. Ultimately, our analysis suggests that we are saddled, at least in the medium term, with two regimes operating with different standards of a valid consent-while putatively protecting similar interests. There is, however, opportunity for progress. It is possible to improve professional guidance on the interaction between the regimes and to achieve significant normative alignment without aligning the signalling standard for consent; this would promote consistent protection of reasonable expectations of patients across both regimes. Further coherence would require aligning not only the standard, but also the role played by consent under each regime. Here we argue that, in relation to direct care, any such shift should be away from consent as the normal justification. In relation to health research, on the contrary, it should be toward consent as the normal justification for use and disclosure of patient information under both the CLDoC and data protection law.

Ethics review of big data research: What should stay and what should be reformed?

BACKGROUND: Ethics review is the process of assessing the ethics of research involving humans. The Ethics Review Committee (ERC) is the key oversight mechanism designated to ensure ethics review. Whether or not this governance mechanism is still fit for purpose in the data-driven research context remains a debated issue among research ethics experts. MAIN TEXT: In this article, we seek to address this issue in a twofold manner. First, we review the strengths and weaknesses of ERCs in ensuring ethical oversight. Second, we map these strengths and weaknesses onto specific challenges raised by big data research. We distinguish two categories of potential weakness. The first category concerns persistent weaknesses, i.e., those which are not specific to big data research, but may be exacerbated by it. The second category concerns novel weaknesses, i.e., those which are created by and inherent to big data projects. Within this second category, we further distinguish between purview weaknesses related to the ERC's scope (e.g., how big data projects may evade ERC review) and functional weaknesses, related to the ERC's way of operating. Based on this analysis, we propose reforms aimed at improving the oversight capacity of ERCs in the era of big data science. CONCLUSIONS: We believe the oversight mechanism could benefit from these reforms because they will help to overcome data-intensive research challenges and consequently benefit research at large.

Engaged genomic science produces better and fairer outcomes: an engagement framework for engaging and involving participants, patients and publics in genomics research and healthcare implementation.

Genomic science is increasingly central to the provision of health care. Producing and applying robust genomics knowledge is a complex endeavour in which no single individual, profession, discipline or community holds all the answers.  Engagement and involvement of diverse stakeholders can support alignment of societal and scientific interests, understandings and perspectives and promises better science and fairer outcomes. In this context we argue for F.A.I.R.E.R. data and data use that is Findable, Accessible, Interoperable, Reproducible, Equitable and Responsible. Yet there is a paucity of international guidance on how to engage publics, patients and participants in genomics. To support meaningful and effective engagement and involvement we developed an Engagement Framework for involving and engaging participants, patients and publics in genomics research and health implementation. The Engagement Framework is intended to support all those working in genomics research, medicine, and healthcare to deliberatively consider approaches to participant, patient and public engagement and involvement in their work. Through a series of questions, the Engagement Framework prompts new ways of thinking about the aims and purposes of engagement, and support reflection on the strengths, limitations, likely outcomes and impacts of choosing different approaches to engagement. To guide genomics activities, we describe four themes and associated questions for deliberative reflection: (i) fairness; (ii) context; (iii) heterogeneity, and (iv) recognising tensions and conflict. The four key components in the Engagement provide a framework to assist those involved in genomics to reflect on decisions they make for their initiatives, including the strategies selected, the participant, patient and public stakeholders engaged, and the anticipated goals. The Engagement Framework is one step in an actively evolving process of building genomics research and implementation cultures which foster responsible leadership and are attentive to objectives which increase equality, diversity and inclusion in participation and outcomes.

International federation of genomic medicine databases using GA4GH standards.

We promote a shared vision and guide for how and when to federate genomic and health-related data sharing, enabling connections and insights across independent, secure databases. The GA4GH encourages a federated approach wherein data providers have the mandate and resources to share, but where data cannot move for legal or technical reasons. We recommend a federated approach to connect national genomics initiatives into a global network and precision medicine resource.

GA4GH: International policies and standards for data sharing across genomic research and healthcare.

The Global Alliance for Genomics and Health (GA4GH) aims to accelerate biomedical advances by enabling the responsible sharing of clinical and genomic data through both harmonized data aggregation and federated approaches. The decreasing cost of genomic sequencing (along with other genome-wide molecular assays) and increasing evidence of its clinical utility will soon drive the generation of sequence data from tens of millions of humans, with increasing levels of diversity. In this perspective, we present the GA4GH strategies for addressing the major challenges of this data revolution. We describe the GA4GH organization, which is fueled by the development efforts of eight Work Streams and informed by the needs of 24 Driver Projects and other key stakeholders. We present the GA4GH suite of secure, interoperable technical standards and policy frameworks and review the current status of standards, their relevance to key domains of research and clinical care, and future plans of GA4GH. Broad international participation in building, adopting, and deploying GA4GH standards and frameworks will catalyze an unprecedented effort in data sharing that will be critical to advancing genomic medicine and ensuring that all populations can access its benefits.

Fail to Prepare and you Prepare to Fail: the Human Rights Consequences of the UK Government's Inaction during the COVID-19 Pandemic.

As the sustained and devastating extent of the coronavirus disease 2019 (COVID-19) pandemic becomes apparent, a key focus of public scrutiny in the UK has centred on the novel legal and regulatory measures introduced in response to the virus. When those measures were first implemented in March 2020 by the UK Government, it was thought that human rights obligations would limit excesses of governmental action and that the public had more to fear from unwarranted intrusion into civil liberties. However, within the first year of the pandemic's devastation in the UK, a different picture has emerged: rather than through action, it is governmental inaction that has given rise to greater human rights concerns. The UK Government has been roundly criticized for its inadequate response, including missteps in decision-making, delayed implementation and poor enforcement of lockdown measures, abandonment of testing, shortages of critical resources and inadequate test and trace methods. In this article, we analyse the UK Government's missteps and compare them with published international guidance; we also contrast the UK's decisions with those taken by several other countries (including the devolved administrations within the UK) to understand how its actions and inactions have contributed to unfavourable outcomes. Using an analytical perspective that demonstrates how human rights are both a protection from the power of the state and a requirement that governmental powers are used to protect the lives, health and wellbeing of citizens, we argue that the UK Government's failure to exercise their powers competently allowed the virus to spread without ensuring the country had the means to manage a high case load. This abject failure has led to one of the highest rates of deaths per capita worldwide. We offer several lessons that can be learnt from this unfortunate, but preventable, situation.

To What Extent Does the EU General Data Protection Regulation (GDPR) Apply to Citizen Scientist-Led Health Research with Mobile Devices?

In this article, we consider the possible application of the European General Data Protection Regulation (GDPR) to "citizen scientist"-led health research with mobile devices. We argue that the GDPR likely does cover this activity, depending on the specific context and the territorial scope. Remaining open questions that result from our analysis lead us to call for lex specialis that would provide greater clarity and certainty regarding the processing of health data by for research purposes, including these non-traditional researchers.

Co-production and Managing Uncertainty in Health Research Regulation: A Delphi Study.

European and international regulation of human health research is typified by a morass of interconnecting laws, diverse and divergent ethical frameworks, and national and transnational standards. There is also a tendency for legislators to regulate in silos-that is, in discrete fields of scientific activity without due regard to the need to make new knowledge as generalisable as possible. There are myriad challenges for the stakeholders-researchers and regulators alike-who attempt to navigate these landscapes. This Delphi study was undertaken in order to provide the first interdisciplinary and crosscutting analysis of health research regulation, as it is experienced by such stakeholders in the UK context. As well as reinforcing existing understandings of the regulatory environment, Delphi participants called for greater collaboration, and even co-production, of processes involved in health research regulation. On the basis of this research, we offer insights about how health research regulation can become a matter with which a wider range of stakeholders-including researchers, regulators, publics and research sponsors-can engage. The evidence supports the normative claim that health research regulation should continue to move away from strict, prescriptive rules-based approaches, and towards flexible principle-based regimes that allow researchers, regulators and publics to co-produce regulatory systems serving core principles. By unpacking thorny concepts and practices at the heart of health research regulation-including the public interest and public engagement-our results have the potential to situate and breathe life into them. The results also demonstrate that while proportionality is well-recognised as a crucial element of flexible regulatory systems, more must be done to operationalise this as an ethical assessment of the values and risks at stake at multiple junctures in the research trajectory. This is required if we are to move beyond proportionality as a mere risk-management tool. Compliance culture no longer accurately reflects the needs and expectations of researchers or regulators, nor does it necessarily produce the best research. Embracing uncertainty-both as a human practice and a regulatory objective-may represent the brighter future for health research.

Requiring a Single IRB for Cooperative Research in the Revised Common Rule: What Lessons Can Be Learned from the UK and Elsewhere?

This article argues in general support of the sIRB rule, but also draws on recent empirical research to highlight several residual weaknesses in the US regulatory structure for research ethics review, and suggests ways in which these weaknesses might be addressed in future regulatory reforms to improve upon the sIRB rule.