Dynamic consent is increasingly recommended for longitudinal and biobanking research; however, the value of investing in such systems is unclear. We undertook a rapid review of the benefits and challenges of implementing dynamic consent by searching five databases (Ovid Medline, Ovid Embase, Scopus, Web of Science, Cumulative Index to Nursing and Allied Health Literature – CINAHL) for articles published up to May 2023 that report on participants’ or researchers’ experience of dynamic consent. From 1611 papers screened, 12 met inclusion criteria. (...) Guided by thematic analysis with an inductive approach, we synthesised 31 benefits and 8 challenges. Benefits included: enhanced participant experience through improved consent management and tailoring; greater participant engagement and retention through increased autonomy, trust and communication; reduced costs and burden and increased accessibility and inclusivity. Participants and researchers also valued additional features that dynamic consent platforms facilitate such as two-way communication and return of research updates. The main challenges included the digital divide and consent fatigue. The papers gave recommendations to mitigate these challenges, for example by supplementing with other communication tools and allowing a broad consent approach, respectively. Overall, dynamic consent was described as a valuable consent approach with many benefits and some surmountable challenges. Most included literature was qualitative, so further research is needed to quantify the impact of dynamic consent on recruitment, retention, and participant experience. Further long-term investigations are necessary to explore whether participants want to and do change their consent over time, as well as the impact of dynamic consent on participant privacy. (shrink)

In this article, we consider the possible application of the European General Data Protection Regulation to “citizen scientist”-led health research with mobile devices. We argue that the GDPR likely does cover this activity, depending on the specific context and the territorial scope. Remaining open questions that result from our analysis lead us to call for lex specialis that would provide greater clarity and certainty regarding the processing of health data by for research purposes, including these non-traditional researchers.

The aim of UK-REACH (“The United Kingdom Research study into Ethnicity And COVID-19 outcomes in Healthcare workers”) is to understand if, how, and why healthcare workers (HCWs) in the United Kingdom (UK) from ethnic minority groups are at increased risk of poor outcomes from COVID-19. In this article, we present findings from the ethical and legal stream of the study, which undertook qualitative research seeking to understand and address legal, ethical, and social acceptability issues around data protection, privacy, and information (...) governance associated with the linkage of HCWs’ registration data and healthcare data. We interviewed 22 key opinion leaders in healthcare and health research from across the UK in two-to-one semi-structured interviews. Transcripts were coded using qualitative thematic analysis. Participants told us that a significant aspect of Big Data research in public health is varying drivers of mistrust—of the research itself, research staff and funders, and broader concerns of mistrust within participant communities, particularly in the context of COVID-19 and those situated in more marginalised community settings. However, despite the challenges, participants also identified ways in which legally compliant and ethically informed approaches to research can be crafted to mitigate or overcome mistrust and establish greater confidence in Big Data public health research. Overall, our research indicates that a “Big Data Ethics by Design” approach to research in this area can help assure (1) that meaningful community and participant engagement is taking place and that extant challenges are addressed, and (2) that any new challenges or hitherto unknown unknowns can be rapidly and properly considered to ensure potential (but material) harms are identified and minimised where necessary. Our findings indicate such an approach, in turn, will help drive better scientific breakthroughs that translate into medical innovations and effective public health interventions, which benefit the publics studied, including those who are often marginalised in research. (shrink)

Open science has recently gained traction as establishment institutions have come on-side and thrown their weight behind the movement and initiatives aimed at creation of information commons. At the same time, the movement's traditional insistence on unrestricted dissemination and reuse of all information of scientific value has been challenged by the movement to strengthen protection of personal data. This article assesses tensions between open science and data protection, with a focus on the GDPR.

In the early 1970s, Congress considered enacting comprehensive privacy legislation, but it was unable to do so. In 1974, it passed the Privacy Act, applicable only to information in the possession of the federal government. In the intervening years, other information privacy laws enacted by Congress, such as the Health Insurance Portability and Accountability Act, have been weak and sector specific. With the explosion of information technology and the growing concerns about an absence of effective federal privacy laws, the legal (...) focus has shifted to the states. Signaling a new direction in state data privacy and consumer protection law, the California Consumer Privacy Act establishes important rights and protections for California residents with regard to the collection, use, disclosure, and sale of their personal information. The CCPA is certain to spur similar legislation and to affect national and international businesses that collect data from California's residents. Understanding the new law is important for all data‐driven industries, including health care. (shrink)

Responsible Research and Innovation (‘RRI’) is a cross-cutting priority for scientific research in the European Union and beyond. This paper considers whether the way such research is organised and delivered lends itself to the aims of RRI. We focus particularly on international consortia, which have emerged as a common model to organise large-scale, multi-disciplinary research in contemporary biomedical science. Typically, these consortia operate through fixed-term contracts, and employ governance frameworks consisting of reasonably standard, modular components such as management committees, advisory (...) boards, and data access committees, to co-ordinate the activities of partner institutions and align them with funding agency priorities. These have advantages for organisation and management of the research, but can actively inhibit researchers seeking to implement RRI activities. Conventional consortia governance structures pose specific problems for meaningful public and participant involvement, data sharing, transparency, and ‘legacy’ planning to deal with societal commitments that persist beyond the duration of the original project. In particular, the ‘upstream’ negotiation of contractual terms between funders and the institutions employing researchers can undermine the ability for those researchers to subsequently make decisions about data, or participant remuneration, or indeed what happens to consortia outputs after the project is finished, and can inhibit attempts to make project activities and goals responsive to input from ongoing dialogue with various stakeholders. Having explored these challenges, we make some recommendations for alternative consortia governance structures to better support RRI in future. (shrink)

BackgroundIncreasingly, hospitals and research institutes are developing technical solutions for sharing patient data in a privacy preserving manner. Two of these technical solutions are homomorphic encryption and distributed ledger technology. Homomorphic encryption allows computations to be performed on data without this data ever being decrypted. Therefore, homomorphic encryption represents a potential solution for conducting feasibility studies on cohorts of sensitive patient data stored in distributed locations. Distributed ledger technology provides a permanent record on all transfers and processing of patient data, (...) allowing data custodians to audit access. A significant portion of the current literature has examined how these technologies might comply with data protection and research ethics frameworks. In the Swiss context, these instruments include the Federal Act on Data Protection and the Human Research Act. There are also institutional frameworks that govern the processing of health related and genetic data at different universities and hospitals. Given Switzerland’s geographical proximity to European Union (EU) member states, the General Data Protection Regulation (GDPR) may impose additional obligations.MethodsTo conduct this assessment, we carried out a series of qualitative interviews with key stakeholders at Swiss hospitals and research institutions. These included legal and clinical data management staff, as well as clinical and research ethics experts. These interviews were carried out with two series of vignettes that focused on data discovery using homomorphic encryption and data erasure from a distributed ledger platform.ResultsFor our first set of vignettes, interviewees were prepared to allow data discovery requests if patients had provided general consent or ethics committee approval, depending on the types of data made available. Our interviewees highlighted the importance of protecting against the risk of reidentification given different types of data. For our second set, there was disagreement amongst interviewees on whether they would delete patient data locally, or delete data linked to a ledger with cryptographic hashes. Our interviewees were also willing to delete data locally or on the ledger, subject to local legislation.ConclusionOur findings can help guide the deployment of these technologies, as well as determine ethics and legal requirements for such technologies. (shrink)

Private companies are data-rich. But market pressures to collect more, store more, and analyze more consumer data can often make them ethically bankrupt in the way of proactively protecting consume...