ìInformed  Consent  and  Privacy  of  De-­‐Identified  Information  and  Estimated  Data

Lessons  from  Iceland  and  the  United  States  in  an  Era  of  Computational  Genomics

Conference  on  Big  Data,  Health  Law  and  BioethicsPetrie-­‐Flom Center  for  Health  Law  Policy,  Biotechnology,  and  Bioethics

Harvard  Law  School    May  6,  2016

Donna  M.  GitterProfessor  of  Law

Baruch  College,  City  University  of  New  YorkNew  York,  NY  

Hypothetical/Thought  Experiment

ì Your  mother  has  been   in  the  hospital  for  a  stroke  and  agreed  to  participate  in  a  clinical  study

ì Her  brother  volunteered   his  DNA  for  a  research  study  

ì Researchers  can  now  predict  your likelihood  of  a  genetic  disposition  for  stroke (estimated  data)

ì You  are  then  informed  of  these  results  without  being  asked  if  you  would  like  them

2

Temperature  in  the  Room

Invasion  of  privacy?

versus

Advancement  of  public  health?

Do  you  have  a  right  of  informed  consent?

3

Assertion  #1

ì Informed  consent  should  be  required  for  individuals  from  whom  estimated  data  gleaned

4

Assertion  #2

ì Should  be  robust  recognition  of  the  right  not  to  know  one’s  genetic  risk  factors

5

6

What  Is  Estimated  Data?

ì deCODE  Genetics  searches  for  associations  between   genetic  variants  and  human  disease

ì deCODE  calculates  the  probability  that  individuals,  whose  DNA  was  not  sequenced,   carry  particular  genetic  variants,  using  genetic  and  genealogical  data  from  research  participants

7

How  Is  Estimated  Data  Used  in  Iceland?

ì deCODE  uses  genotypes   from  120,000  research  participants  and  genealogical  data

ì Estimates  “in  silico”  genotypes  of  close  relatives  of  volunteers  

ì Can  deduce  genotypes   for  entire  Icelandic  population  of  320,000

ì Able  to  identify  2,000  Icelanders  with  the  BRCA2  gene,  even  if  they  have  not  participated  in  genetic  research

8

Does  This  Matter  for  Nation  of  Roughly  320,000,000?  

ì Research  scalable  if  enough  data  collected

ì U.S.  lacks  a  national  db  similar  to  Iceland’s,  BUT

ì Private  companies  such  as  23andme  and  Ancestry.com  -­‐ rough  gene  maps  of  several  million  people

ì U.S.  NIH  -­‐ spend  millions  of  dollars  in  coming  years  on  sequencing  full  genome  data  on  tens  of  thousands  of  people

9

Big  Data  and  Privacy

10“I’m  Big  Data,  and  this  is  my  friend  No  Privacy.”

I’m  Big  Data,  and  this   is  my  friend  No  Privacy.

THESIS  I:  Informed  Consent  (IC)  Should  Apply  to  Estimated  Data

ì U.S.  Common  Rule  governs  human  subjects  research

ì IC  required  for  reasonably  foreseeable   risks  (risk  that  information  about  participant  will  extend  to  family)

ì NO  IC  required  if  data  or  biospecimens non-­‐identified

ì BUT,  proposed  U.S.  rule  change  by  U.S.  HHS  suggests  IC  even  for  non-­‐identifiable  biospecimens or  private  information  (not  estimated  data)

ì Recently  revised  National  Institutes  of  Health  Genomic  Data-­‐Sharing  Policy  (GDS)  already  requires  IC  for  genomic  or  other  data,  even  if  non-­‐identified

11

THESIS  II:  Maintenance  of  the  Right  Not  to  Know  (RNTK)  One’s  Genetic  Risks

ì Some  erosion  of  the  RNTK  genetic  risks  (professional  societies  and  IRBs  question)

ì Leads  to  possibility  of  being  conscripted  into  genetic  research,  through  estimated  data,  and  then  having  findings  returned  to  you,  all  without  informed  consent  

12

Why  Is  Informed  Consent  Necessary  for  Estimated  Data?

ì deCODE’s 2012  proposal  to  use  hospital  records  to  link  individuals   for  whom  data  had  been  estimated  to  private  information  such  as  surgery  codes  and  prescriptions

ì Icelandic  Data  Protection  Authority  (DPA)  first  denied  the  request

ì DPA  then  relented  when  deCODE  assured  that  any  genetic  imputation  “would  be  generated  in  a  split  second  in  the  processing  memory  of  a  computer”  and  “then  cease  to  exist  and  would  never  be  accessible  to  anyone  in  any  form”

13

De-­‐Identification/Re-­‐Identification  Risk

ì deCODE  states  estimated  data  is  accurate  on  a  group,  not  individual,  level

ì Risk  depends  on  the  likelihood  of  re-­‐identification

ì Achieved  through  use  of  more  powerful  computers;  datasets  produced  by  local,  state,  and  federal  governments;  and  other  publicly  available  sources  

14

Risks  of  Big  Data

15

Autonomy

ì Even   if  re-­‐identification  unlikely,   right  of  autonomy

ì Individuals  have  the  right  to  decline  to  participate  altogether,  or  to  limit  their  participation,  on  moral,  ethical,  religious,  cultural,  or  other  grounds

16

Public  Opinion  on  Informed  Consent

ì If  information  identifiable,  all  protections  apply,  but  if  not  identifiable,   none  apply  (bimodal)

ì Survey  data  indicates  that  public  does  not  recognize  this  distinction

ì Survey  of  patients  indicated  want  IC  when  research  performed:  72%  when  data  non-­‐identified   v.  81%  when  identifiable

ì The  majority  of  individuals  want  to  be  asked  for  informed  consent,  whether   information  identifiable  or  not

17

Proposed  Changes  to  the  Law  of  Informed  Consent

ì Presently  use  biospecimens and  private  information  without  consent  by  stripping  them  of  identifiers

ì Proposed  HHS  change  would  require  informed  consent  (prospectively)   for  secondary  research  with  a  biospecimen(part  of  a  blood  sample  that  is  left  over  after  being  drawn  for  clinical  purposes),  even  if  non-­‐identified

ì Would  treat  biospecimens as  “intrinsically  identifiable”  because  of  the  genetic  information  imbedded   in  them

ì Research  community  opposes,  while  most  individual  members  of  society  who  commented  were  in  favor

18

U.S.  National  Institutes  of  Health  (NIH)  Policy

ì In  2014,  NIH  revised  its  Genomic  Data  Sharing  Policy  (GDS)

ì Researchers  are  “expected”  to  obtain  participants’  consent  for  the  use  of  not  only  their  biospecimens and  identifiable  private  information,  but  also  use  of  genomic data

ì True  even  if  the  cell  lines  or  clinical  specimens  used  to  generate  the  data  are  de-­‐identified

ì NIH  GDS  goes  even  further  than  proposed  federal  rule  change  by  requiring  informed  consent  for  de-­‐identified  genomic  data,  not  just  biospecimens or  personal  information  (name,  address,  diagnosis)

19

Trends  Point  Toward  Requirement  of  Informed  Consent

ì Proposed  federal  rule  change  and  NIH  GDS  indicate  trend  toward  requiring  informed  consent  for  use  of  de-­‐identified  specimens  and  genetic  information

ì Law  does  not  discuss  estimated  data

20

Any  Meaningful  Difference  Between  De-­‐identified  Specimens  and  Information  and  Estimated  Data?

ì Neither  requires  direct  interaction  with  the  individual

ì Both  potentially  subject  the  research  subject  to  re-­‐identification  risk  

ì Estimated  data  even  more  tied  to  identifiers  than  non-­‐identified  data

ì Even  without  re-­‐identification  (if  estimated  data  are  not  accurate  at  the   individual  level),  issue  of  autonomy  remains  (right  to  object  to  research  participation)

21

Should  Informed  Consent  Be  Required  for  Estimated  Data?

ì Law  of  informed  consent,  codified  before  the  development   of  current  technologies,  does  not  address  issues  of  informed  consent  arising  from  use  of  estimated  data

ì Arguments  in  favor  of  IC:  ethical,  religious  or  other  personal  objections  to  research  participation;  objection  to  commercial  exploitation  (no  chance  for  disclaimer);  would  promote  public  support   for  research

ì Arguments  against  IC:  administrative  burden  and  cost  of  contacting  each  participant;  impedes  research  

22

Conclusion

ì Informed  consent  should  be  required  for  estimated  data,  given  the  ease  of  re-­‐identification  and  the  right  of  autonomy  (the  right  to  object  to  research  participation)

ì Nuremberg  Code  was  created  in  order  to  prevent  a  class  of  people,  perhaps  the  sickest  among  us  who  interact  with  the  medical  system,  from  unwilling  or  unwitting  research  participation

23

The  Right  Not  to  Know  One’s  Genetic  Risks

ì Previously  widely  accepted,  but  increasingly  in  doubt

ì American  College  of  Medical  Genetics  now  suggests  that  when  clinically  recommended  genome  sequencing  occurs,  a  minimum  list  of  conditions  should  be  evaluated  and  reported  to  the  ordering  clinician

ì Incidental  findings  should  be  communicated  to  the  family  even  without  seeking  preferences

ì Imposes  on  clinicians  duty  to  hunt  and  to  know

24

Survey  Evidence  of  Erosion  of  the  RNTK

ì Survey  of  IRB  members  published   in  2015:  96%  endorse  the  right  of  research  participants  not  to  know  genetic  findings

ì But  when  presented  with  a  specific  case  where  an  individual  patient  chose  not  to  know:  35%  indicated  that  RNTK  should  absolutely  be  respected  and  28%  would  “probably  honor”  it

ì RNTK  seems  sacrosanct,  but  loses  support  when  people  forced  to  confront  tradeoffs  in  real  cases  

25

In  Iceland,  the  RNTK  Confronts  Estimated  Data

ì deCODE  can  identify  every   Icelander  with  the  BRCA2  mutation  (raises  risk  of  breast  and  ovarian  cancer),  even  if  the  individuals  have  not  submitted  to  genetic  testing

ì deCODE  asked  permission  to  inform  Icelanders  of  risks  revealed  when  studying  their  estimated  data,  and  a  government  commission  is  evaluating  the  process

ì Shows  the  complexity  with  regard  to  estimated  data,  as  individuals  did  not  plan  to  participate  in  research

26

Paradox  of  Computational  Genomics

ì Trend  in  U.S.  law  toward  informed  consent  even  for  non-­‐identified  data

ì However,  emerging  view  that  genetic  findings  ought  to  be  gathered  and  returned  to  individuals,  even  absent  their  informed  consent

ì Raises  troubling  specter  of  individuals  who  have  consented  neither  to  use  of  their  estimated  data  nor  to  the  return  of  incidental  findings,  being  involved  in  research  without  their  informed  consent  and  then  contacted  with  the  results

27

Thank  you

Donna  M.  GitterProfessor  of  Law

Baruch  College,  City  University  of  New  YorkNew  York,  NY  

USA

28