Genetics and bioethics in the age of big data

With rapid advances in genomics and information technology, both governments and industry have recently invested in organised collections of population-based health data and biological samples (Swede, Stone, & Norwood, 2007) for the purpose of innovation and discovery in biomedical research and improvements in human health (Dove, Laurie, & Knoppers, 2017; Gulcher. Kong, & Stefansson, 2001; Wang et al., 2017). Tire most comprehensive type of population-based biobank is designed to link biological tissue (e.g., DNA, or other molecular markers derived from blood, saliva, urine, or diseased tissue) with medical history and lifestyle information, such as routinely collected information in an individual’s medical records or other government (administrative) databases. Highly publicised examples include the UK Biobank (Sudlow et al., 2015), the US Precision Medicine Initiative (NIH, 2016), and Human Genome Projects (Lander, Linton, Birren, & Consortium, 2001), while at least 10 other countries have established national biobanks, including in Canada (Awadalla et al., 2013), Norway (Skolbek-ken,Ursin, Solberg, Chr istensen, & Ytterhus, 2005), the Netherlands (Boeckhorrt & Douglas, 2015), Germany (Hirschberg, Knüppel, & Strech, 2013), South Africa (Rheeder, 2017), Singapore (Waldby, 2009), Iceland, Estonia, Latvia, Japan, Sweden, and the Kingdom of Tonga (Austin, Harding, & McElroy, 2003; Swede et al., 2007). Interestingly, public opposition saw the closing of the biobank in the Kingdom of Tonga, and privacy protection surrounding the Icelandic (deCODE) initiative (Gulcher et al., 2001) was ruled unconstitutional in 2003. Despite being the world’s first population-wide genomic biobank, the Icelandic biobank has since been decommissioned, highlighting the profound ethical and legal challenges that such large scale biobanking poses to governments and participating individuals. While the vast majority of these popirlation-based biobanks were established with the informed consent of the individuals whose biological material is containedin them, ethical and legal issues concerning consent and protection of privacy, and ownership and control over the use of biobank data continue to be debated (Caulfield & Murdoch, 2017; Dhai, Mahomed, & Sarnie, 2015; Dove et al., 2017; Miller & Tucker, 2017; Vayena, Salathe, Madoff, & Brownstem, 2015). These bioethical issues are increasingly important given growing interest in the use of ‘residual’ specimens (i.e., leftover tissue) acquired in the context of a specific research investigation or after clinical procedures in hospitals, for which informed consent may not have been obtained at the time of their collection for clinical or specific research purposes (Cunningham, O'Doherty, Senecal, Secko, & Avard, 2015). Of particular concern in both instances is the reporting of incidental clinically actionable findings to participants who may have opted to remain anonymous during consent processes (Wallace & Kent, 2011; Wolf et al., 2012).

Pertinent to these ongoing bioethical debates, is the need for government, industry, and multiple researchers to be involved in the administration and use of biobanked data, given the long-term nature of biobanking initiatives and the impracticality of obtaining informed consent for each and every use of a participating individual’s tissue or health data. For example, it is impossible to predict all future research questions that an end-user (academic or industry partner) might ask of biobanked data to enable a participant to feasibly consent to all potential uses of their specimens (Caulfield et al., 2008). As such, broad or ‘open consent’ strategies that deviate from traditional legal nonns have been adopted by the majority of population-wide biobanking initiatives, with questions remaining about their legal and ethical appropriateness (Caulfield, 2015; Edwards, Cadi-gan, Evans, & Henderson, 2014; Eriksson & Helgesson, 2005). Other options for ‘dynamic consent’ have been put forward (Kaye et al., 2015), especially in relation to the use of personal data by third parties. Ongoing efforts to resolve these issues include new data protection legislation developed by the European Union (EU, 2016; Hallman & Friedewald, 2015; Hallinan, Friedewald, & De Heit 2013) that was applied from May 2018; at this time, the General Data Protection Regulation (GDPR) came into effect, providing a regulatory framework in response to privacy concerns that relate to biobanks, but also broader concerns arising from an ever-expanding market of digitised consumer and mobile technologies (Rumbold & Pierscionek. 2017). The new regulation serves to protect individuals’ rights to privacy and other freedoms, while simultaneously facilitating the exchange of data as required for the common good; the policy has specific clauses relating to the processing of genetic and health data, and personal data relating to criminal convictions and offences. In particular, ‘broad consent’ for scientific research will be permissible according to recognised ethical standards. However, this does not equate to ‘blanket’ or ‘open’ consent in the case of biobanking research for which the perceived risks are minimal when weighed against the potential benefits (Sheehan, 2011). While the GDPR makes some effort to address issues for biomedical research when consent has not been explicitly obtained from the individual (e.g., use of residual data) - noting that this may be possible when such research conforms to the public’s best interest - key issues remain unresolved, such as the definition of ‘public interest’ or ‘pressing social need’ (Rumbold &

Pierscionek, 2017). One significant issue for cunent practices is that, according to the new GDPR legislation, pseudonyinised data will be treated as personal data (where personal data is defined as that which can identify an individual). Pseudonyinised data - for example, where identifiers are removed and replaced with a unique code that can be traced back to the (re-identified) individual - was previously regarded as sufficient to protect privacy. However, truly anonymised data would not be able to be traced back to the person’s identity. Pseudonyinised data is thus recognised as allowing incidental findings to be traced back to the (re-identified) individual, and/or their contributed biological or health data to be verified, and the new change in legislation has resulted from acknowledgement of vulnerability (potential identification of individuals) when pseudonyinised data are used, compared to the protection afforded by true anonymisation (Rumbold & Pierscionek, 2017).