Tag: Science Policy Coordination

GDPR: Crossing the Data Sharing Bridge, One Regulation at a Time

Posted on

Like most of you, my personal email last summer was filled with fun invitations, the latest news….and tens to hundreds of emails from companies highlighting new privacy policies, notices, and updates. Behind the immense number of notifications that “we’ve updated our privacy policy” was a new regulation and one of the defining science policy issues of the last decade: the tension between participant privacy and open data sharing.

When it comes to data sharing and biomedical research, most of us have a horse in both races. We want to know and have some control over how our personal data is accessed and shared, and we understand that open science—where researchers share data as freely as possible with other researchers—can skyrocket our ability to find better treatments and cures for patients, which helps us all. Balancing and respecting these different values is complicated. NIH has spent a lot of time and resources staying attuned to participant interests in privacy and autonomy while charting a path that allows for responsible open science and data sharing.

The European General Data Protection Regulation (GDPR) enacted in May last year is the latest regulation on the privacy and data policy block, As Europe’s answer to navigating today’s data-filled, breach-full and not-always-regulated online and business world, GDPR mandates a high level of personal data protection and autonomy for people in the European Economic Area (EEA). GDPR defines personal data broadly—from name and email address to special categories such as health and genetic data—and provides people in the EEA with control over when and how their personal data is collected, retained, passed along, and used. So, given that GDPR was written to protect people in the EEA from data and privacy breaches, and not intended to target biomedical research—where significant protections for individual privacy and the concept of explicit consent already exist—why has the onset of GDPR created barriers for critical research collaborations between NIH grantees and their European research partners?

Not surprisingly, the answer has to do with both GDPR itself and with individual reactions to GDPR. GDPR is not directed at biomedical research, but it does regulate the use, processing, and transfer of personal data collected in the EEA for clinical and observational research. There are legal pathways under GDPR for data collected in the EEA to be transferred to, used and processed in other countries. Unfortunately, understanding how to translate the legalese of these pathways into practice has been confusing, and the costs for non-compliance are high—most recently €50 million for Google in France. As a result, risk-adverse interpretations of GDPR have dominated collaboration discussions between EEA and U.S. research partners and led to delays in EEA-U.S. collaboration. In the absence of an official recognition that U.S. laws ensure an adequate level of protection (an “adequacy decision”), and with the NIH unable to use standard, GDPR-approved data protection clauses (as they conflict with U.S. law for federal agencies), the NIH is exploring GDPR’s other legal options for data sharing. These include relying on explicit consent from participants, defining data transfer as being in the “public interest,” and adherence to an approved, sector-specific code of conduct (to date unwritten). A code of conduct is particularly compelling, as it should serve as an implementation manual, providing clear, concise guidance to EEA and non-EEA researchers and research institutions on how to ensure GDPR protections for personal data when collaborating.

Given the current uncertainty, and the likelihood that any “solutions” to GDPR for biomedical research will take time, what does all this mean for NIH-funded researchers now? Fundamentally, it means that it is never too early to begin the time-consuming but necessary data privacy and data sharing discussion with potential collaborators in the EEA. While such discussions are leading to glimmers of light at the end of tunnels for currently halted collaborations, it sure would be preferable to resolve issues before research is scheduled to begin. We are interested in hearing from you about any GDPR-related problems or resolved issues and will certainly keep you updated on our experiences. In the midst of all this work, I am reminded that GDPR presents us with great opportunities as well as challenges. If we can harmonize consent and data sharing between U.S. and EEA researchers, we will be able to pool analysis of genomic and other health data and tissue samples, powering new and innovative trials and advancing the science of the future.

Blog Roll

Investing in Bioethics Research to Inform Science Policy

Posted on

I am a big believer in policies based on evidence. I am also a big fan of ensuring that all of the research that NIH funds upholds the highest ethical standards. Where those two interests collide is in the funding of bioethics research. To that end, NIH has published advanced notice of an upcoming funding opportunity announcement that will give NIH-funded researchers the opportunity to apply for administrative supplements that would advance our knowledge of bioethical issues, which could then be used to inform policy endeavors.

The scope of the funding opportunity announcement will be broad and would support expanding grants that already include bioethics research efforts. It would also allow for the addition of a bioethics component to a grant in which bioethics was not the primary focus. Potential research topics that may be funded through this opportunity include, but are not limited to, new and emerging technology development and use, clinical and non-clinical data sharing, and research privacy and security. Through this program, NIH intends to fund at least 10 awards.

While applications for this funding opportunity announcement are not currently being accepted, we wanted to provide the research community with plenty of notice of our plans so that they could begin thinking of ways and places where bioethics could substantially impact research and policy. We anticipate that NIH will publish the funding opportunity announcement in early 2019.

Supporting development of an evidence base to ensure that our ethical responsibilities are not outpaced by our science isn’t a novel idea. NIH has proudly supported bioethics-related projects and programs over the last two decades.  For example, NIH funded a robust literature survey on participant preferences for using deidentified biospecimens for future studies, and a large survey of prospective research participants views on broad consent. This research was cited in comments on the 2015 Notice of Proposed Rule Making (NPRM) to revise the Common Rule.

What are your ideas for research questions that can help deepen our understanding about bioethics and build the foundation for future policy considerations or discussions on ethical issues related to biomedical research? We are excited to see your innovative proposals.

Blog Roll

‘TwasThe Night Before…..

Posted on

‘Twas the night before Christmas,
When policy wonks take,
For 48 hours, a much needed break.
Although even at rest, thoughts still run deep.
Because NIH science policy never really sleeps.
And come Wednesday morn, OSPeeps and I,
Will be reading responses to each RFI.
For from the community we heard lots of chatter,
How you share data really does matter!
But that barely compares with the receiving of flack,
From those who worry we might do away with the RAC.
But worry not, friends, you’ve nothing to fear.
The next iteration of RAC soon enough will appear.
To help us work through biotech that’s emerging,
Which meetings in Hong Kong make feel slightly more urgent…
While return of results is still under discussion,
Genomic summaries now available, with not too much fussin’
No longer will gene therapy have oversight times two

And sIRB resources are available now, too!

Certificates of confidentiality now required by law,

More Common Rule delay, as you probably saw.

On, rigor! On, CRISPR! On, dual use, too!
On, research protections! On, fetal tissue review!

To a scientific culture where harassment is ended,

Where female researchers are protected and defended.

To a data sharing policy, beloved by all!

(Although perhaps that’s an order just a bit too tall…)

As GDPR and Plan S across the pond fly,

And clinical trial policies raise great hue, and great cry,

OSP never forgets, as we read every letter,

Our enterprise is great, but it can always be better…

Together we stand, as the NIH thrives,

Fulfilling the mission to improve people’s lives.

In the New Year, we look forward to working with you,

To make biomedical research the best we can do.

And as we shape policies, to get this thing right…

Happy holidays to all, and to all, a good night!

Posted by Dr. Carrie D. Wolinetz, December 21, 2018

Blog Roll

Protecting Participants, Empowering Researchers: Providing Access to Genomic Summary Results

Posted on

This blog was co-authored by Dr. Eric Green, Director of the Human Genome Research Institute.  More information about NHGRI can be found at https://www.genome.gov/.

Today, we are updating the way we manage data related to the NIH Genomic Data Sharing Policy to again allow unrestricted access to genomic summary results for most of the studies we support in order to advance health or further research purposes.  These summary results are importantly distinct from other genomic research data, most notably in that they do not include individual-level information. Instead, these results come from analyzing pooled genomic data from multiple individuals together to generate a statistical result for the entire dataset. Such information can be a powerful tool for helping researchers determine which genomic variants potentially contribute to a disease or disorder.

In 2008, researchers raised concerns that statistical methods using genomic summary results could be used to determine if an individual participated in a specific research study (if the researcher had access to the individual’s genomic data).  In response, we decided that while we assess the state of the science and any potential risks to research participants, NIH officially would move genomic summary results from unrestricted access (i.e., open and public) to controlled-access.  While we were employing this controlled-access model, genomic summary results continued to be published within the scientific literature as an intrinsic piece of evidence to support a study’s conclusions.  Additionally, others in the research community developed several highly used and valuable public data resources to share genomic summary results to inform the interpretation of genomic variation.  Despite the increasing availability of genomic summary results from a variety of sources, we are not aware of any reported examples of individuals being matched to participation in a research study using genomic summary results beyond the research designed to demonstrate the hypothetical possibility that it could happen.

Over the past several years, we have continued to engage stakeholders with respect to genomic summary results and potential participant risks, including bringing together leaders in the field to consider potential risks and benefits of genomic summary results access.  We also solicited feedback from the public through a spring 2017 Request for Information, and in a Request for Comment issued last fall. What we have gleaned from these analyses and conversations is that unrestricted access to genomic summary results holds a great deal of potential benefits for research and clinical care, with low risk to participants’ privacy.  However, because there could be a small risk of learning information about individual participants in certain types of research, most stakeholders agree that additional protections should be available for studies where there might be additional privacy concerns, such as those that include populations from isolated geographic areas or with rare or stigmatizing traits.

With today’s update, we are taking an important step in continuing to share data and information from federally funded research in a way that carefully balances risks and benefits. This update will help to maximize the benefit of our investment in genomics research while ensuring that studies with particular sensitivities have appropriate protection.

Blog Roll