NIH’s DRAFT Data Management and Sharing Policy: We Need to Hear From You!

Around this time last year, I wrote about a request for information (RFI) on potential key elements that could comprise a future NIH data management and sharing policy.  Not surprisingly, we received a lot of helpful feedback. Most commenters supported data sharing and the importance of prospectively planning for where, when, and how scientific data should be managed and shared.  There were, however, concerns about how one policy could fit all sizes and types of data across the biomedical research universe as well as potential burden on the research community.

Over the course of the last year, NIH has been incorporating many of these suggestions into our thinking and continuing to engage the community on their thoughts about data management and sharing. We’ve also been working with sovereign Tribal Nations through consultation sessions held across the U.S which have been vital in shaping NIH’s perspective on the potentially unique data sharing needs of those communities.

Today, NIH has released for public comment in the Federal Register a Draft NIH Policy for Data Management and Sharing along with supplement draft guidance. The draft policy furthers NIH longstanding commitment to making available the results and products of the research we fund and conduct.

To facilitate public comments, NIH has established a web-portal where folks can easily and securely provide their feedback.  The portal can be accessed by clicking here. To ensure that your comments are considered, responses must be submitted no later than January 10, 2020.

I recognize that there is a perception that a Draft policy represents a finished product, that NIH has already made up our mind. I want to assure you that this is not the case.  It is very important that we hear from the stakeholder community about what you think works and doesn’t work with respect to what we have proposed. We are also eager to hear your thoughts on the utility of the supplemental draft guidance or recommendations for any other guidance materials that would be helpful. I previously wrote a blog on best practices for public comments that you might find useful.

Finally, to further engage stakeholders, NIH will be hosting a webinar on the draft policy in the near future. Please stay tuned for the details. We look forward to hearing what you think about the draft policy and supplemental draft guidance and encourage you to broadly share its availability and our request for comments.  With your help, we can ensure that the draft policy maximizes the myriad benefits of data management and sharing while minimizing the burden to the research community.

Posted by Dr. Carrie D. Wolinetz, November 6, 2019

GDPR: Crossing the Data Sharing Bridge, One Regulation at a Time

Like most of you, my personal email last summer was filled with fun invitations, the latest news….and tens to hundreds of emails from companies highlighting new privacy policies, notices, and updates. Behind the immense number of notifications that “we’ve updated our privacy policy” was a new regulation and one of the defining science policy issues of the last decade: the tension between participant privacy and open data sharing.

When it comes to data sharing and biomedical research, most of us have a horse in both races. We want to know and have some control over how our personal data is accessed and shared, and we understand that open science—where researchers share data as freely as possible with other researchers—can skyrocket our ability to find better treatments and cures for patients, which helps us all. Balancing and respecting these different values is complicated. NIH has spent a lot of time and resources staying attuned to participant interests in privacy and autonomy while charting a path that allows for responsible open science and data sharing.

The European General Data Protection Regulation (GDPR) enacted in May last year is the latest regulation on the privacy and data policy block, As Europe’s answer to navigating today’s data-filled, breach-full and not-always-regulated online and business world, GDPR mandates a high level of personal data protection and autonomy for people in the European Economic Area (EEA). GDPR defines personal data broadly—from name and email address to special categories such as health and genetic data—and provides people in the EEA with control over when and how their personal data is collected, retained, passed along, and used. So, given that GDPR was written to protect people in the EEA from data and privacy breaches, and not intended to target biomedical research—where significant protections for individual privacy and the concept of explicit consent already exist—why has the onset of GDPR created barriers for critical research collaborations between NIH grantees and their European research partners?

Not surprisingly, the answer has to do with both GDPR itself and with individual reactions to GDPR. GDPR is not directed at biomedical research, but it does regulate the use, processing, and transfer of personal data collected in the EEA for clinical and observational research. There are legal pathways under GDPR for data collected in the EEA to be transferred to, used and processed in other countries. Unfortunately, understanding how to translate the legalese of these pathways into practice has been confusing, and the costs for non-compliance are high—most recently €50 million for Google in France. As a result, risk-adverse interpretations of GDPR have dominated collaboration discussions between EEA and U.S. research partners and led to delays in EEA-U.S. collaboration. In the absence of an official recognition that U.S. laws ensure an adequate level of protection (an “adequacy decision”), and with the NIH unable to use standard, GDPR-approved data protection clauses (as they conflict with U.S. law for federal agencies), the NIH is exploring GDPR’s other legal options for data sharing. These include relying on explicit consent from participants, defining data transfer as being in the “public interest,” and adherence to an approved, sector-specific code of conduct (to date unwritten). A code of conduct is particularly compelling, as it should serve as an implementation manual, providing clear, concise guidance to EEA and non-EEA researchers and research institutions on how to ensure GDPR protections for personal data when collaborating.

Given the current uncertainty, and the likelihood that any “solutions” to GDPR for biomedical research will take time, what does all this mean for NIH-funded researchers now? Fundamentally, it means that it is never too early to begin the time-consuming but necessary data privacy and data sharing discussion with potential collaborators in the EEA. While such discussions are leading to glimmers of light at the end of tunnels for currently halted collaborations, it sure would be preferable to resolve issues before research is scheduled to begin. We are interested in hearing from you about any GDPR-related problems or resolved issues and will certainly keep you updated on our experiences. In the midst of all this work, I am reminded that GDPR presents us with great opportunities as well as challenges. If we can harmonize consent and data sharing between U.S. and EEA researchers, we will be able to pool analysis of genomic and other health data and tissue samples, powering new and innovative trials and advancing the science of the future.

A Data Sharing Renaissance: Music to My Ears!

When world famous cellist, Yo-Yo Ma, visited the NIH campus, he shared a story from the history of music, in which the peak of stringed instrument quality occurred in the late 17th century at a time of great collaboration and sharing of knowledge. When instrument makers began to compete, all of that changed: secrets of craftsmanship were held close and the quality of instruments plummeted. This decline lasted, according to Ma, until the 20th century, when again the free-flow of knowledge resumed. NIH Director Francis Collins noted, “There’s a lesson here about science.”

Data sharing is important. It is critical to continued progress in science, to maximize our investment in research, and to ensure the highest levels of transparency and rigor in science. But data sharing is a means to an end, not itself an end goal and, as such, needs to be done thoughtfully, in a way that fulfills the vision and mission of NIH and continues the advancement of treatments for disease and improvement of human health. NIH has long been on the forefront of making access to the results of our research accessible and has described our vision for expanding access to publications and data both in the 2015 NIH Plan for Increasing Access to Scientific Publications and Digital Scientific and in the 2018 Strategic Plan for Data Science.

The generation, analysis, and publication of data relates to the core function of NIH’s role as a biomedical research agency. Therefore, policies related to the management and sharing of data can have great impact across the agency and the research community. As such, it is critically important that we engage stakeholders on this complex topic. We began the conversation with the 2016 request for information on Strategies for NIH Data Management, Sharing, and Citation, and a 2017 joint workshop with the National Science Foundation that focused on the value of data sharing. Now we want to share with the community our current thinking about potential next steps in data management and sharing policy and seek your feedback on the best path forward.

Today, NIH released a notice in its Guide to Grants and Contracts that seeks public input on the key policy provisions that NIH is considering for inclusion in a future draft policy aimed at replacing NIH’s existing Data Sharing Policy. By obtaining robust stakeholder feedback we can help ensure that the future NIH policy will promote opportunities for data management and sharing while allowing flexibility for various data types, sharing platforms, and strategies.  The information stakeholders provide can also assist us in developing streamlined approaches that could potentially reduce unnecessary administrative burdens.

While we appreciate and will consider any and all feedback our stakeholders provide, we are specifically interested in your thoughts on these key items:

  • The definition of scientific data to be covered within these plans,
  • The elements of required data management and sharing plans, and
  • The optimal timing, including possible phased adoption, for NIH to consider in implementing various parts of a new data management and sharing policy, as well as how possible phasing could relate to needed improvements in data infrastructure, resources, and standards.

You can view our request for information, the key provisions and provide your comments by visiting Previously Compiled Public Comments. Comments will be accepted until December 10, 2018.  In addition, NIH will also be hosting a webinar on the proposed provisions on November 7, 2018.  Interested participants can find more details and register for the webinar here.

I often hear that policies seem to emerge from NIH fully formed, with little opportunity for the expertise and thoughts of the research community to come to come to bear. This RFI represents an opportunity to join the conversation before policy decisions are made. In the spirit of collaboration, embodied by 17th century Italian instrument makers, let’s work together to get this right.

The Insider’s Guide to Effective Commenting on NIH Policies

Before I came to NIH, I spent my career working with advocacy groups in the biomedical research community. A big part of my job was writing comment letters in response to proposed policies and rules developed by federal agencies. Now that I’m in a position where I read and consider feedback from stakeholder communities when developing NIH policies, I find myself looking back on my own comment letters and cringe just a little.

Why? Because although those comments may have been beautifully composed (if I do say so myself!) and accurately represented the views of the organizations or constituents that I was representing, I recognize now that they may not have been as effective for NIH or other federal agencies in developing their final policies and rules. So, with that knowledge in hand, what does make feedback on a proposed policy useful? How can you all learn from my experiences to be more effective in shaping biomedical research policy?

Be specific: If you read a lot of comment letters, a common thread is enthusiastic endorsement or opposition to whatever is being proposed. Knowing whether affected stakeholders like or don’t like what you are trying to do is critically important information, but it falls into the category of necessary but not sufficient. Many times such statements tend to be general and sometimes hyperbolic. As a policymaker, what I want to know is: why do you like or not like it? How will it specifically impact you, your organization, or your ability to engage in the mission of the agency? When thinking about where to go next, I want to know if your concerns can be addressed through alterations of the policy (and if so, specific language suggestions about how to alter the policy) or through further guidance or additional resources or, in contrast, whether they represent a deal-breaking obstacle that will send us back to the drawing board. Is this a policy going to have inadvertent negative effects that are important for NIH to be aware of or does dislike represent resistance to change?  Similarly, if you are supportive of a policy provision or proposal, tell us why. Those comments can be helpful to us in navigating the pathway to moving policy forward.

Provide data: There is seldom complete consensus on a proposed policy. It is more common to see some stakeholders strongly in favor, some strongly opposed, and a range of views in between. When considering how to weigh opposing viewpoints or when thinking about how to be responsive to the comments, it is immensely helpful when commenters provide examples and/or data to support their point. For example, a commenter might say a policy will have a great financial impact, either positive or negative, on their organization. What does that mean? Are we talking tens of thousands of dollars, hundreds of thousands of dollars, or millions? What is your evidence, even if there are many built in assumptions, for that estimate? Commenters might say they will have to hire more staff to implement a new policy or that they don’t have the expertise. How many staff are we talking about here?? What kinds of expertise, and how hard is it to find?  When input is unspecific or lacking data, it puts policymakers in the position of having to “read between the lines”, which is not ideal for evidence-based decision making or finding appropriate solutions to make the policy more palatable.

Answer the questions: When agencies are seeking feedback, whether via part of a Request for Information (RFI) or via the formal rulemaking or policymaking process, it is because there is genuine need of input from the community before a decision is reached. In true Robert Frost fashion, multiple policy options might be possible, and we need guidance from those who know the topic best or have a true on the ground perspective before choosing a way forward. When comments are non-responsive to the question being asked, a decision might be made based on our best judgement and/or input from those stakeholders who did take the time to answer. If you have a reason for not responding – doesn’t apply to me, don’t care about it, don’t have enough data to answer – that can be helpful to know, too.

Include new ideas: Have you and your organization found a creative solution to a problem that we are trying to solve via this policy? Is there something that we haven’t thought of or asked that we should have? One of the reasons I love venturing away from the NIH campus – or welcoming visitors to it! – is because interacting with the biomedical research community, from scientists to research participants to universities to advocates, is where many of the best ideas emerge. Yes, I know I just told you to answer the questions but going beyond the information we are seeking and helping us think outside the box with specific or alternative ideas can also spark innovative and creative approaches to policy.

Emphasize what matters to you most: When reading through a long, complex set of comments, it can be difficult to determine order of magnitude. You might have strong feelings about one policy provision but have a more neutral sense of another. Because you have followed all of the advice above, you may have provided very detailed comments on every piece of the policy being proposed or questions posed. This makes it very difficult to discern the priorities of the commenter. Providing that context will help the agency prioritize the areas that most need to be addressed or retained versus those that may present less of an issue.

At the end of the day, NIH science policy is all about creating the framework that facilitates the mission of the agency: supporting science and improving human health. Understanding the strengths and gaps of that framework, the push and pull tension by which policies incentivize or present barriers to achieving the highest quality, publicly funded research: this is the foundation of sound policy. Nobody understands that framework better than those who live on it and in it, day to day. So keep those comments coming in… and I will look forward to reading them!