Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Donna Gitter, "Informed Consent and Privacy of De-Identified and Estimated Data: Lessons from Iceland and the United States in an Era of Computational Genomics"


Published on

Part of the "2016 Annual Conference: Big Data, Health Law, and Bioethics" held at Harvard Law School on May 6, 2016.

This conference aimed to: (1) identify the various ways in which law and ethics intersect with the use of big data in health care and health research, particularly in the United States; (2) understand the way U.S. law (and potentially other legal systems) currently promotes or stands as an obstacle to these potential uses; (3) determine what might be learned from the legal and ethical treatment of uses of big data in other sectors and countries; and (4) examine potential solutions (industry best practices, common law, legislative, executive, domestic and international) for better use of big data in health care and health research in the U.S.

The Petrie-Flom Center for Health Law Policy, Biotechnology, and Bioethics at Harvard Law School 2016 annual conference was organized in collaboration with the Berkman Center for Internet & Society at Harvard University and the Health Ethics and Policy Lab, University of Zurich.

Learn more at

Published in: Healthcare
  • Be the first to comment

Donna Gitter, "Informed Consent and Privacy of De-Identified and Estimated Data: Lessons from Iceland and the United States in an Era of Computational Genomics"

  1. 1. ìInformed  Consent  and  Privacy  of  De-­‐ Identified  Information  and  Estimated  Data Lessons  from  Iceland  and  the  United  States  in  an  Era  of   Computational  Genomics Conference  on  Big  Data,  Health  Law  and  Bioethics Petrie-­‐Flom Center  for  Health  Law  Policy,  Biotechnology,  and  Bioethics Harvard  Law  School     May  6,  2016 Donna  M.  Gitter Professor  of  Law Baruch  College,  City  University  of  New  York New  York,  NY  
  2. 2. Hypothetical/Thought  Experiment ì Your  mother  has  been  in  the  hospital  for  a  stroke  and   agreed  to  participate  in  a  clinical  study ì Her  brother  volunteered  his  DNA  for  a  research  study   ì Researchers  can  now  predict  your likelihood  of  a   genetic  disposition  for  stroke (estimated  data) ì You  are  then  informed  of  these  results  without  being   asked  if  you  would  like  them 2
  3. 3. Temperature  in  the  Room Invasion  of  privacy? versus Advancement  of  public  health? Do  you  have  a  right  of  informed  consent? 3
  4. 4. Assertion  #1 ì Informed  consent  should  be  required  for  individuals   from  whom  estimated  data  gleaned 4
  5. 5. Assertion  #2 ì Should  be  robust  recognition  of  the  right  not  to   know  one’s  genetic  risk  factors 5
  6. 6. 6
  7. 7. What  Is  Estimated  Data? ì deCODE  Genetics  searches  for  associations   between  genetic  variants  and  human  disease ì deCODE  calculates  the  probability  that  individuals,   whose  DNA  was  not  sequenced,  carry  particular   genetic  variants,  using  genetic  and  genealogical   data  from  research  participants 7
  8. 8. How  Is  Estimated  Data  Used  in  Iceland? ì deCODE  uses  genotypes  from  120,000  research   participants  and  genealogical  data ì Estimates  “in  silico”  genotypes  of  close  relatives  of   volunteers   ì Can  deduce  genotypes  for  entire  Icelandic  population   of  320,000 ì Able  to  identify  2,000  Icelanders  with  the  BRCA2  gene,   even  if  they  have  not  participated  in  genetic  research 8
  9. 9. Does  This  Matter  for  Nation  of  Roughly   320,000,000?   ì Research  scalable  if  enough  data  collected ì U.S.  lacks  a  national  db  similar  to  Iceland’s,  BUT ì Private  companies  such  as  23andme  and   -­‐ rough  gene  maps  of  several  million  people ì U.S.  NIH  -­‐ spend  millions  of  dollars  in  coming  years  on   sequencing  full  genome  data  on  tens  of  thousands  of   people 9
  10. 10. Big  Data  and  Privacy 10 “I’m  Big  Data,  and  this  is  my  friend  No  Privacy.” I’m  Big  Data,  and  this  is  my  friend  No  Privacy.
  11. 11. THESIS  I:  Informed  Consent  (IC)  Should   Apply  to  Estimated  Data ì U.S.  Common  Rule  governs  human  subjects  research ì IC  required  for  reasonably  foreseeable   risks  (risk  that  information   about  participant  will  extend  to  family) ì NO  IC  required  if  data  or  biospecimens non-­‐identified ì BUT,  proposed  U.S.  rule  change  by  U.S.  HHS  suggests  IC  even  for   non-­‐identifiable  biospecimens or  private  information  (not   estimated  data) ì Recently  revised  National  Institutes  of  Health  Genomic  Data-­‐ Sharing  Policy  (GDS)  already  requires  IC  for  genomic  or  other  data,   even  if  non-­‐identified 11
  12. 12. THESIS  II:  Maintenance  of  the  Right  Not  to   Know  (RNTK)  One’s  Genetic  Risks ì Some  erosion  of  the  RNTK  genetic  risks  (professional   societies  and  IRBs  question) ì Leads  to  possibility  of  being  conscripted  into  genetic   research,  through  estimated  data,  and  then  having   findings  returned  to  you,  all  without  informed  consent   12
  13. 13. Why  Is  Informed  Consent  Necessary  for   Estimated  Data? ì deCODE’s 2012  proposal  to  use  hospital  records  to  link   individuals  for  whom  data  had  been  estimated  to  private   information  such  as  surgery  codes  and  prescriptions ì Icelandic  Data  Protection  Authority  (DPA)  first  denied  the   request ì DPA  then  relented  when  deCODE  assured  that  any  genetic   imputation  “would  be  generated  in  a  split  second  in  the   processing  memory  of  a  computer”  and  “then  cease  to   exist  and  would  never  be  accessible  to  anyone  in  any  form” 13
  14. 14. De-­‐Identification/Re-­‐Identification  Risk ì deCODE  states  estimated  data  is  accurate  on  a  group,   not  individual,  level ì Risk  depends  on  the  likelihood  of  re-­‐identification ì Achieved  through  use  of  more  powerful  computers;   datasets  produced  by  local,  state,  and  federal   governments;  and  other  publicly  available  sources   14
  15. 15. Risks  of  Big  Data 15
  16. 16. Autonomy ì Even  if  re-­‐identification  unlikely,  right  of  autonomy ì Individuals  have  the  right  to  decline  to  participate   altogether,  or  to  limit  their  participation,  on  moral,   ethical,  religious,  cultural,  or  other  grounds 16
  17. 17. Public  Opinion  on  Informed  Consent ì If  information  identifiable,  all  protections  apply,  but  if  not   identifiable,  none  apply  (bimodal) ì Survey  data  indicates  that  public  does  not  recognize  this   distinction ì Survey  of  patients  indicated  want  IC  when  research   performed:  72%  when  data  non-­‐identified  v.  81%  when   identifiable ì The  majority  of  individuals  want  to  be  asked  for  informed   consent,  whether  information  identifiable  or  not 17
  18. 18. Proposed  Changes  to  the  Law  of  Informed   Consent ì Presently  use  biospecimens and  private  information  without   consent  by  stripping  them  of  identifiers ì Proposed  HHS  change  would  require  informed  consent   (prospectively)  for  secondary  research  with  a  biospecimen (part  of  a  blood  sample  that  is  left  over  after  being  drawn  for   clinical  purposes),  even  if  non-­‐identified ì Would  treat  biospecimens as  “intrinsically  identifiable”   because  of  the  genetic  information  imbedded  in  them ì Research  community  opposes,  while  most  individual   members  of  society  who  commented  were  in  favor 18
  19. 19. U.S.  National  Institutes  of  Health  (NIH)   Policy ì In  2014,  NIH  revised  its  Genomic  Data  Sharing  Policy  (GDS) ì Researchers  are  “expected”  to  obtain  participants’  consent   for  the  use  of  not  only  their  biospecimens and  identifiable   private  information,  but  also  use  of  genomic data ì True  even  if  the  cell  lines  or  clinical  specimens  used  to   generate  the  data  are  de-­‐identified ì NIH  GDS  goes  even  further  than  proposed  federal  rule   change  by  requiring  informed  consent  for  de-­‐identified   genomic  data,  not  just  biospecimens or  personal   information  (name,  address,  diagnosis) 19
  20. 20. Trends  Point  Toward  Requirement  of   Informed  Consent ì Proposed  federal  rule  change  and  NIH  GDS  indicate   trend  toward  requiring  informed  consent  for  use  of  de-­‐ identified  specimens  and  genetic  information ì Law  does  not  discuss  estimated  data 20
  21. 21. Any  Meaningful  Difference  Between  De-­‐identified   Specimens  and  Information  and  Estimated  Data? ì Neither  requires  direct  interaction  with  the  individual ì Both  potentially  subject  the  research  subject  to  re-­‐ identification  risk   ì Estimated  data  even  more  tied  to  identifiers  than  non-­‐ identified  data ì Even  without  re-­‐identification  (if  estimated  data  are   not  accurate  at  the  individual  level),  issue  of  autonomy   remains  (right  to  object  to  research  participation) 21
  22. 22. Should  Informed  Consent  Be  Required  for   Estimated  Data? ì Law  of  informed  consent,  codified  before  the   development  of  current  technologies,  does  not  address   issues  of  informed  consent  arising  from  use  of   estimated  data ì Arguments  in  favor  of  IC:  ethical,  religious  or  other   personal  objections  to  research  participation;  objection   to  commercial  exploitation  (no  chance  for  disclaimer);   would  promote  public  support  for  research ì Arguments  against  IC:  administrative  burden  and  cost   of  contacting  each  participant;  impedes  research   22
  23. 23. Conclusion ì Informed  consent  should  be  required  for  estimated   data,  given  the  ease  of  re-­‐identification  and  the  right  of   autonomy  (the  right  to  object  to  research  participation) ì Nuremberg  Code  was  created  in  order  to  prevent  a   class  of  people,  perhaps  the  sickest  among  us  who   interact  with  the  medical  system,  from  unwilling  or   unwitting  research  participation 23
  24. 24. The  Right  Not  to  Know  One’s  Genetic   Risks ì Previously  widely  accepted,  but  increasingly  in  doubt ì American  College  of  Medical  Genetics  now  suggests   that  when  clinically  recommended  genome  sequencing   occurs,  a  minimum  list  of  conditions  should  be   evaluated  and  reported  to  the  ordering  clinician ì Incidental  findings  should  be  communicated  to  the   family  even  without  seeking  preferences ì Imposes  on  clinicians  duty  to  hunt  and  to  know 24
  25. 25. Survey  Evidence  of  Erosion  of  the  RNTK ì Survey  of  IRB  members  published  in  2015:  96%   endorse  the  right  of  research  participants  not  to  know   genetic  findings ì But  when  presented  with  a  specific  case  where  an   individual  patient  chose  not  to  know:  35%  indicated   that  RNTK  should  absolutely  be  respected  and  28%   would  “probably  honor”  it ì RNTK  seems  sacrosanct,  but  loses  support  when   people  forced  to  confront  tradeoffs  in  real  cases   25
  26. 26. In  Iceland,  the  RNTK  Confronts  Estimated   Data ì deCODE  can  identify  every  Icelander  with  the  BRCA2   mutation  (raises  risk  of  breast  and  ovarian  cancer),   even  if  the  individuals  have  not  submitted  to  genetic   testing ì deCODE  asked  permission  to  inform  Icelanders  of  risks   revealed  when  studying  their  estimated  data,  and  a   government  commission  is  evaluating  the  process ì Shows  the  complexity  with  regard  to  estimated  data,  as   individuals  did  not  plan  to  participate  in  research 26
  27. 27. Paradox  of  Computational  Genomics ì Trend  in  U.S.  law  toward  informed  consent  even  for   non-­‐identified  data ì However,  emerging  view  that  genetic  findings  ought  to   be  gathered  and  returned  to  individuals,  even  absent   their  informed  consent ì Raises  troubling  specter  of  individuals  who  have   consented  neither  to  use  of  their  estimated  data  nor  to   the  return  of  incidental  findings,  being  involved  in   research  without  their  informed  consent  and  then   contacted  with  the  results 27
  28. 28. Thank  you Donna  M.  Gitter Professor  of  Law Baruch  College,  City  University  of  New  York New  York,  NY   USA 28