Part of the "2016 Annual Conference: Big Data, Health Law, and Bioethics" held at Harvard Law School on May 6, 2016. This conference aimed to: (1) identify the various ways in which law and ethics intersect with the use of big data in health care and health research, particularly in the United States; (2) understand the way U.S. law (and potentially other legal systems) currently promotes or stands as an obstacle to these potential uses; (3) determine what might be learned from the legal and ethical treatment of uses of big data in other sectors and countries; and (4) examine potential solutions (industry best practices, common law, legislative, executive, domestic and international) for better use of big data in health care and health research in the U.S. The Petrie-Flom Center for Health Law Policy, Biotechnology, and Bioethics at Harvard Law School 2016 annual conference was organized in collaboration with the Berkman Center for Internet & Society at Harvard University and the Health Ethics and Policy Lab, University of Zurich. Learn more at http://petrieflom.law.harvard.edu/events/details/2016-annual-conference.

1. ìInformed Consent and Privacy of De-­‐
Identified Information and Estimated Data
Lessons
from
Iceland
and
the
United
States
in
an
Era
of
Computational
Genomics
Conference
on
Big
Data,
Health
Law
and
Bioethics
Petrie-­‐Flom Center
for
Health
Law
Policy,
Biotechnology,
and
Bioethics
Harvard
Law
School
May
6,
2016
Donna
M.
Gitter
Professor
of
Law
Baruch
College,
City
University
of
New
York
New
York,
NY

2. Hypothetical/Thought Experiment
ì Your
mother
has
been
in
the
hospital
for
a
stroke
and
agreed
to
participate
in
a
clinical
study
ì Her
brother
volunteered
his
DNA
for
a
research
study
ì Researchers
can
now
predict
your likelihood
of
a
genetic
disposition
for
stroke (estimated
data)
ì You
are
then
informed
of
these
results
without
being
asked
if
you
would
like
them
2

3. Temperature in the Room
Invasion
of
privacy?
versus
Advancement
of
public
health?
Do
you
have
a
right
of
informed
consent?
3

4. Assertion #1
ì Informed
consent
should
be
required
for
individuals
from
whom
estimated
data
gleaned
4

5. Assertion #2
ì Should
be
robust
recognition
of
the
right
not
to
know
one’s
genetic
risk
factors
5

6. 6

7. What Is Estimated Data?
ì deCODE
Genetics
searches
for
associations
between
genetic
variants
and
human
disease
ì deCODE
calculates
the
probability
that
individuals,
whose
DNA
was
not
sequenced,
carry
particular
genetic
variants,
using
genetic
and
genealogical
data
from
research
participants
7

8. How Is Estimated Data Used in Iceland?
ì deCODE
uses
genotypes
from
120,000
research
participants
and
genealogical
data
ì Estimates
“in
silico”
genotypes
of
close
relatives
of
volunteers
ì Can
deduce
genotypes
for
entire
Icelandic
population
of
320,000
ì Able
to
identify
2,000
Icelanders
with
the
BRCA2
gene,
even
if
they
have
not
participated
in
genetic
research
8

9. Does This Matter for Nation of Roughly
320,000,000?
ì Research
scalable
if
enough
data
collected
ì U.S.
lacks
a
national
db
similar
to
Iceland’s,
BUT
ì Private
companies
such
as
23andme
and
Ancestry.com
-­‐ rough
gene
maps
of
several
million
people
ì U.S.
NIH
-­‐ spend
millions
of
dollars
in
coming
years
on
sequencing
full
genome
data
on
tens
of
thousands
of
people
9

10. Big Data and Privacy
10
“I’m
Big
Data,
and
this
is
my
friend
No
Privacy.”
I’m
Big
Data,
and
this
is
my
friend
No
Privacy.

11. THESIS I: Informed Consent (IC) Should
Apply to Estimated Data
ì U.S.
Common
Rule
governs
human
subjects
research
ì IC
required
for
reasonably
foreseeable
risks
(risk
that
information
about
participant
will
extend
to
family)
ì NO
IC
required
if
data
or
biospecimens non-­‐identified
ì BUT,
proposed
U.S.
rule
change
by
U.S.
HHS
suggests
IC
even
for
non-­‐identifiable
biospecimens or
private
information
(not
estimated
data)
ì Recently
revised
National
Institutes
of
Health
Genomic
Data-­‐
Sharing
Policy
(GDS)
already
requires
IC
for
genomic
or
other
data,
even
if
non-­‐identified
11

12. THESIS II: Maintenance of the Right Not to
Know (RNTK) One’s Genetic Risks
ì Some
erosion
of
the
RNTK
genetic
risks
(professional
societies
and
IRBs
question)
ì Leads
to
possibility
of
being
conscripted
into
genetic
research,
through
estimated
data,
and
then
having
findings
returned
to
you,
all
without
informed
consent
12

13. Why Is Informed Consent Necessary for
Estimated Data?
ì deCODE’s 2012
proposal
to
use
hospital
records
to
link
individuals
for
whom
data
had
been
estimated
to
private
information
such
as
surgery
codes
and
prescriptions
ì Icelandic
Data
Protection
Authority
(DPA)
first
denied
the
request
ì DPA
then
relented
when
deCODE
assured
that
any
genetic
imputation
“would
be
generated
in
a
split
second
in
the
processing
memory
of
a
computer”
and
“then
cease
to
exist
and
would
never
be
accessible
to
anyone
in
any
form”
13

14. De-­‐Identification/Re-­‐Identification Risk
ì deCODE
states
estimated
data
is
accurate
on
a
group,
not
individual,
level
ì Risk
depends
on
the
likelihood
of
re-­‐identification
ì Achieved
through
use
of
more
powerful
computers;
datasets
produced
by
local,
state,
and
federal
governments;
and
other
publicly
available
sources
14

15. Risks of Big Data
15

16. Autonomy
ì Even
if
re-­‐identification
unlikely,
right
of
autonomy
ì Individuals
have
the
right
to
decline
to
participate
altogether,
or
to
limit
their
participation,
on
moral,
ethical,
religious,
cultural,
or
other
grounds
16

17. Public Opinion on Informed Consent
ì If
information
identifiable,
all
protections
apply,
but
if
not
identifiable,
none
apply
(bimodal)
ì Survey
data
indicates
that
public
does
not
recognize
this
distinction
ì Survey
of
patients
indicated
want
IC
when
research
performed:
72%
when
data
non-­‐identified
v.
81%
when
identifiable
ì The
majority
of
individuals
want
to
be
asked
for
informed
consent,
whether
information
identifiable
or
not
17

18. Proposed Changes to the Law of Informed
Consent
ì Presently
use
biospecimens and
private
information
without
consent
by
stripping
them
of
identifiers
ì Proposed
HHS
change
would
require
informed
consent
(prospectively)
for
secondary
research
with
a
biospecimen
(part
of
a
blood
sample
that
is
left
over
after
being
drawn
for
clinical
purposes),
even
if
non-­‐identified
ì Would
treat
biospecimens as
“intrinsically
identifiable”
because
of
the
genetic
information
imbedded
in
them
ì Research
community
opposes,
while
most
individual
members
of
society
who
commented
were
in
favor
18

19. U.S. National Institutes of Health (NIH)
Policy
ì In
2014,
NIH
revised
its
Genomic
Data
Sharing
Policy
(GDS)
ì Researchers
are
“expected”
to
obtain
participants’
consent
for
the
use
of
not
only
their
biospecimens and
identifiable
private
information,
but
also
use
of
genomic data
ì True
even
if
the
cell
lines
or
clinical
specimens
used
to
generate
the
data
are
de-­‐identified
ì NIH
GDS
goes
even
further
than
proposed
federal
rule
change
by
requiring
informed
consent
for
de-­‐identified
genomic
data,
not
just
biospecimens or
personal
information
(name,
address,
diagnosis)
19

20. Trends Point Toward Requirement of
Informed Consent
ì Proposed
federal
rule
change
and
NIH
GDS
indicate
trend
toward
requiring
informed
consent
for
use
of
de-­‐
identified
specimens
and
genetic
information
ì Law
does
not
discuss
estimated
data
20

21. Any Meaningful Difference Between De-­‐identified
Specimens and Information and Estimated Data?
ì Neither
requires
direct
interaction
with
the
individual
ì Both
potentially
subject
the
research
subject
to
re-­‐
identification
risk
ì Estimated
data
even
more
tied
to
identifiers
than
non-­‐
identified
data
ì Even
without
re-­‐identification
(if
estimated
data
are
not
accurate
at
the
individual
level),
issue
of
autonomy
remains
(right
to
object
to
research
participation)
21

22. Should Informed Consent Be Required for
Estimated Data?
ì Law
of
informed
consent,
codified
before
the
development
of
current
technologies,
does
not
address
issues
of
informed
consent
arising
from
use
of
estimated
data
ì Arguments
in
favor
of
IC:
ethical,
religious
or
other
personal
objections
to
research
participation;
objection
to
commercial
exploitation
(no
chance
for
disclaimer);
would
promote
public
support
for
research
ì Arguments
against
IC:
administrative
burden
and
cost
of
contacting
each
participant;
impedes
research
22

23. Conclusion
ì Informed
consent
should
be
required
for
estimated
data,
given
the
ease
of
re-­‐identification
and
the
right
of
autonomy
(the
right
to
object
to
research
participation)
ì Nuremberg
Code
was
created
in
order
to
prevent
a
class
of
people,
perhaps
the
sickest
among
us
who
interact
with
the
medical
system,
from
unwilling
or
unwitting
research
participation
23

24. The Right Not to Know One’s Genetic
Risks
ì Previously
widely
accepted,
but
increasingly
in
doubt
ì American
College
of
Medical
Genetics
now
suggests
that
when
clinically
recommended
genome
sequencing
occurs,
a
minimum
list
of
conditions
should
be
evaluated
and
reported
to
the
ordering
clinician
ì Incidental
findings
should
be
communicated
to
the
family
even
without
seeking
preferences
ì Imposes
on
clinicians
duty
to
hunt
and
to
know
24

25. Survey Evidence of Erosion of the RNTK
ì Survey
of
IRB
members
published
in
2015:
96%
endorse
the
right
of
research
participants
not
to
know
genetic
findings
ì But
when
presented
with
a
specific
case
where
an
individual
patient
chose
not
to
know:
35%
indicated
that
RNTK
should
absolutely
be
respected
and
28%
would
“probably
honor”
it
ì RNTK
seems
sacrosanct,
but
loses
support
when
people
forced
to
confront
tradeoffs
in
real
cases
25

26. In Iceland, the RNTK Confronts Estimated
Data
ì deCODE
can
identify
every
Icelander
with
the
BRCA2
mutation
(raises
risk
of
breast
and
ovarian
cancer),
even
if
the
individuals
have
not
submitted
to
genetic
testing
ì deCODE
asked
permission
to
inform
Icelanders
of
risks
revealed
when
studying
their
estimated
data,
and
a
government
commission
is
evaluating
the
process
ì Shows
the
complexity
with
regard
to
estimated
data,
as
individuals
did
not
plan
to
participate
in
research
26

27. Paradox of Computational Genomics
ì Trend
in
U.S.
law
toward
informed
consent
even
for
non-­‐identified
data
ì However,
emerging
view
that
genetic
findings
ought
to
be
gathered
and
returned
to
individuals,
even
absent
their
informed
consent
ì Raises
troubling
specter
of
individuals
who
have
consented
neither
to
use
of
their
estimated
data
nor
to
the
return
of
incidental
findings,
being
involved
in
research
without
their
informed
consent
and
then
contacted
with
the
results
27

28. Thank you
Donna
M.
Gitter
Professor
of
Law
Baruch
College,
City
University
of
New
York
New
York,
NY
USA
28