Consent, data sharing and GDPR

1. Consent, data sharing and GDPR Margaret Rees Reader Emeritus in Reproductive Medicine, University of Oxford Visiting Professor, University of Glasgow, Karolinska Institute and University of Turku Adjunct Associate ProfessorRobert Wood Johnson Medical School, at Rutgers University. Editor in Chief Maturitas Editor in Chief Case Reports in Women’s Health Conflict of interest: none declared

2. Guide for authors • The author should ensure that the work described has been carried out in accordance with The Code of Ethics of the World Medical Association (Declaration of Helsinki) for experiments involving humans; Uniform Requirements for manuscripts submitted to Biomedical journals. Authors should include a statement in the manuscript that informed consent was obtained for experimentation with human subjects. The privacy rights of human subjects must always be observed.

3. Informed consent and patient details • Case reports and case series require informed consent, which should be documented in the paper • Appropriate consents, permissions and releases must be obtained where an author wishes to include case details or other personal information or images of patients and any other individuals in an Elsevier publication. • Written consents must be retained by the author but copies should not be provided to the journal. Only if specifically requested by the journal in exceptional circumstances (for example if a legal issue arises) the author must provide copies of the consents or evidence that such consents have been obtained • Unless you have written permission from the patient (or, where applicable, the next of kin), the personal details of any patient included in any part of the article and in any supplementary materials (including all illustrations and videos) must be removed before submission.

4. Research in human beings • The Nuremberg Doctors’ Trial 1946 • Tuskegee Study of Untreated Syphilis in the Negro Male started in 1932-1972 • Public Health Service Sexually Transmitted Diseases (STD) Inoculation Study in Guatemala 1946-8 • Alder Hey Affair 1999 ( storage of human tissue)

5. Medical experiments were undertaken upon concentration camp inmates and other living human subjects, without their consent, in the course of which experiments the defendants committed the murders, brutalities, cruelties, tortures, atrocities, and other inhuman acts 23 physicians and scientists Crimes against humanity A) High-Altitude Experiments B) Freezing Experiments C) Malaria Experiments D) Lost (Mustard) Gas Experiments E) Sulfanilamide Experiments F) Bone, Muscle, and Nerve Regeneration and Bone Transplantation Experiments G) Sea-Water Experiments H) Epidemic Jaundice Experiments I) Sterilization Experiments J) Spotted Fever (Fleckfieber) Experiments K) Experiments with Poison L) Incendiary Bomb Experiments Nuremberg Doctors’ trial

6. Nuremberg trial • During the Doctors Trial, American medical expert Dr. Leo Alexander points to scars on the leg of Ravensbrückconcentration camp survivor Jadwiga Dzido. • The experiments, including injections of highly potent bacteria • December 20, 1946.

7. Nuremberg code 1947 • Required is the voluntary, well-informed, understanding consent of the human subject in a full legal capacity. • The experiment should aim at positive results for society that cannot be procured in some other way. • It should be based on previous knowledge (e.g., an expectation derived from animal experiments) that justifies the experiment. • The experiment should be set up in a way that avoids unnecessary physical and mental suffering and injuries. • It should not be conducted when there is any reason to believe that it implies a risk of death or disabling injury. • The risks of the experiment should be in proportion to (that is, not exceed) the expected humanitarian benefits. • Preparations and facilities must be provided that adequately protect the subjects against the experiment’s risks. • The staff who conduct or take part in the experiment must be fully trained and scientifically qualified. • The human subjects must be free to immediately quit the experiment at any point when they feel physically or mentally unable to go on. • Likewise, the medical staff must stop the experiment at any point when they observe that continuation would be dangerous.

8. World Medical Association • Formed in 1945 • Represents physicians world wide • Non political • Non governmental • Addresses non clinical medical issues such as ethics and education

9. Declaration of Helsinki • First written in 1964 it is • ‘ a statement of ethical principles to provide guidance to physicians and other participants in medical research involving human subjects’ • Both clinical trials and non-therapeutic research • Most recently updated version 7 in 2013

10. Declaration of Helsinki: key elements • Protection of patient rights • Informed consent • Independent approval • Scientific/medical basis • Appropriate risk benefit • Subject well being takes precedence over other considerations

11. Declaration of Helsinki: version 7 http://www.wma.net/en/30publications/10policies/b3/ ( 37 paragraphs) • Paragraph 26 (applicable to studies outside medical research)In medical research involving human subjects capable of giving informed consent, each potential subject must be adequately informed of the aims, methods, sources of funding, any possible conflicts of interest, institutional affiliations of the researcher, the anticipated benefits and potential risks of the study and the discomfort it may entail, post-study provisions and any other relevant aspects of the study. The potential subject must be informed of the right to refuse to participate in the study or to withdraw consent to participate at any time without reprisal. Special attention should be given to the specific information needs of individual potential subjects as well as to the methods used to deliver the information. •            After ensuring that the potential subject has understood the information, the physician or another appropriately qualified individual must then seek the potential subject’s freely-given informed consent, preferably in writing. If the consent cannot be expressed in writing, the non-written consent must be formally documented and witnessed.       •            All medical research subjects should be given the option of being informed about the general outcome and results of the study.

12. Safe guarding participants: Tuskegee Syphilis experiments • 1932, the Public Health Service, working with the Tuskegee Institute, began a study to record the natural history of syphilis in hopes of justifying treatment programs for blacks. It was called the "Tuskegee Study of Untreated Syphilis in the Negro Male." • The study initially involved 600 black men – 399 with syphilis, 201 who did not have the disease. The study was conducted without the benefit of patients' informed consent. Researchers told the men they were being treated for "bad blood,“ • The study lasted 40 years. Even when penicillin became the drug of choice for syphilis in 1947, researchers did not offer it to the subjects. • 1972  First news articles condemn studies. Compensation fund set up after out of court settlement • 1997 President Clinton apologizes on behalf of the Nation. • http://www.cdc.gov/tuskegee/timeline.htm

13. Safe guarding participants: the 1946-1948 U.S. Public Health Service Sexually Transmitted Diseases (STD) Inoculation Study in Guatemala • The study was funded by a grant from the U.S. National Institutes of Health to the Pan American Sanitary Bureau (which became the Pan American Health Organization) to several Guatemalan government ministries.  Dr Cutler involved. The study had never been published. • The initial intent of the study was to look for new ways to prevent STDs, including gonorrhea, chancroid, and syphilis. The first experiments involved infecting female commercial sex workers with gonorrhea or syphilis, and then allowing them to have unprotected sex with soldiers or prison inmates. When few of these men became infected, the research approach changed to direct inoculation of soldiers, prisoners, and mental hospital patients. Gonorrhea was transmitted by inoculations into the urethra; chancroid by skin injection; and syphilis by a variety of means including skin injection and exposing the foreskin of the penis to infectious material. About 1,500 study subjects were involved.  • Participants were not informed of the purpose of the study and did not provide consent. The researchers indicated that they treated the vast majority of persons who contracted gonorrhea and chancroid, and most who contracted syphilis. However, the research suggests that some of the persons infected with syphilis were prescribed only partial treatment or not treated at all. At least one patient died during the experiments, although it is not clear whether the death was from the experiments or from an underlying medical problem. There are inadequate records to determine if the commercial sex workers were treated. • 2010, the U.S. formally apologized to Guatemala for conducting these experiments. • http://www.hhs.gov/1946inoculationstudy/factsheet.html

14. Data sharing: why and how • Why: best use of research findings, supported by funders, government and publishers/ editors • How: consent (GDPR), data storage, type of data, assessment of sharers, publication • When inappropriate: lack of consent ( old studies cannot necessarily reconsent all), personal data, case reports

15. Why data sharing • To maximise the research opportunities that such a diversity, richness and quantity of data provides. • To encourage informed use beyond the originating research teams. • Enabling new research questions to be answered in existing data • Promoting collaboration between different research teams and diverse disciplines • Sharing of knowledge about best methods for data collection, linkage and analysis • Independently verifying established research findings • Reducing data fabrication and falsification? • Development and testing of new research methods • Using to best effect the gift of data made by study participants

16. Sharing Clinical Trial Data: A Requirement of the International Committee of Medical Journal Editors http://icmje.org/news-and-editorials/data_sharing_june_2017.pdf • ICMJE will require the following as conditions of consideration for publication of a clinical trial report in our member journals: • 1. As of 1 July 2018 manuscripts submitted to ICMJE journals that report the results of clinical trials must contain a data sharing statement as described below. • 2. Clinical trials that begin enrolling participants on or after 1 January 2019 must include a data sharing plan in the trial's registration • Data sharing statements must indicate the following: whether individual deidentified participant data (including data dictionaries) will be shared; what data in particular will be shared; whether additional, related documents will be available (e.g., study protocol, statistical analysis plan, etc.); when the data will become available and for how long; by what access criteria data will be shared (including with whom, for what types of analyses, and by what mechanism).

18. General Data Protection Regulation (GDPR) • Came into force 25 May 2018 and is enforceable in the UK, Data Protection Act 2018 • Has been effective since 24 May 2016 • GDPR is concerned with working practices in the way that personal data is handled and used, including how it is shared. Most of the Articles concern corporations and organisations and the way in which they handle personal data. • https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/whats-new/ • Cornock M Editorial General Data Protection Regulation (GDPR) and implications for research Maturitas 2018 • https://www.hra.nhs.uk/planning-and-improving-research/policies-standards-legislation/data-protection-and-information-governance/gdpr-guidance/

19. GDPR and research • Changes to consent • New rights for individuals • Data sharing • Protection of children • Data breaches and reporting • The penalties are very severe and any breach has to be reported in a very strict timeframe. However, it needs to be remembered that these are aimed primarily at organisations and not individuals.

20. GDPR and consentCornock M Editorial General Data Protection Regulation (GDPR) and implications for research Maturitas 2018 • With regard to consent there is a requirement that it be demonstrated that the person has consented to the use of their data, that consent is obtained in a way that is understandable and accessible to the subject, and that there is an opportunity for the person to withdraw from the study at any time: ‘It shall be as easy to withdraw as to give consent’ (Article 7). • Some of the rights that individuals will have include ‘the right to be forgotten’. This means to be able to request, in certain conditions, the compete erasure of their data. • This might be taken to mean that data already coded or being reported on will have to be removed. However, this is not necessarily so if the data was lawfully obtained and is still necessary for the purpose for which it was obtained (Article 17): which underlies the need to ensure that consent is adequate for the purpose of the research.

21. GDPR and consent • There are specific rules with regard to transferring data outside of the European Union (EU) (Chapter V). These rules exist to ensure that an individual’s rights are not reduced by the laws in the country receiving the data. It does not mean that data cannot be shared outside the EU, only that certain procedures have to be out in place. • There is also a requirement (Article 20) that data is portable, meaning that the individual has a right to receive it in a way that can be read by them. This may mean that researchers have to reconsider how they store subject data. • With regard to children, the provisions (Article 8) relate to ensuring that they understand any information provided to them.

22. Data storage • Anonymisation/ de-identification/ re-identification • Data formatting ie useable in future years • Who owns the data/ data holder • Data controller/ data processor • Repositories by whom and where: institution, national, publishers • Access/ safeguarding • Duration of data storage Consistent with the law, regulation and recognised good practice and data protection legislation Consistent with GDPR

24. ClinicalStudyDataRequest.com (CSDR) • A data-sharing initiative involving academic research funders and pharmaceutical companies • Researchers seeking data can search the website to view the metadata of the listed trials.  • To request data, a researcher completes a data access application form. • An independent review panel considers data access requests to ensure that the research plan is viable and the team requesting the data are able to handle the data in a responsible manner. The panel then decides whether access should be granted to the dataset(s) requested. • A coordinator supports both the data generator and the requestor to share and gain access to the data.

25. Data sharing and publicationElsevier core guidance This journal encourages and enables you to share data that supports your research publication where appropriate, and enables you to interlink the data with your published articles. Research data refers to the results of observations or experimentation that validate research findings. To facilitate reproducibility and data reuse, this journal also encourages you to share your software, code, models, algorithms, protocols, methods and other useful materials related to the project.Below are a number of ways in which you can associate data with your article or make a statement about the availability of your data when submitting your manuscript. If you are sharing data in one of these ways, you are encouraged to cite the data in your manuscript and reference list. 

26. Data statement • To foster transparency, we encourage you to state the availability of your data in your submission. This may be a requirement of your funding body or institution. If your data is unavailable to access or unsuitable to post, you will have the opportunity to indicate why during the submission process, for example by stating that the research data is confidential. The statement will appear with your published article on ScienceDirect.  • Allows for studies where participants did not consent to data sharing • Allows for data access after assessment of suitability of the researchers to access

27. Data sharing: additional information • Upon publication, I agree to share appropriately anonymized data files from this research with other qualified professionals on request in order to confirm the substantive conclusions of the research, in fulfilment of APA Ethics Code Standard 8.14a. • Yes • No • If NO, please explain which of the above you cannot agree to and why (e.g. proprietary data, impossible to anonymize) • FREE TEXT BOX HERE

28. American Psychological Association • 8.14 Sharing Research Data for Verification(a) After research results are published, psychologists do not withhold the data on which their conclusions are based from other competent professionals who seek to verify the substantive claims through reanalysis and who intend to use such data only for that purpose, provided that the confidentiality of the participants can be protected and unless legal rights concerning proprietary data preclude their release. This does not preclude psychologists from requiring that such individuals or groups be responsible for costs associated with the provision of such information.

29. Comparison of adaptive pacing therapy, cognitive behaviour therapy, graded exercise therapy, and specialist medical care for chronic fatigue syndrome (PACE): a randomised trial. Lancet. 2011doi: 10.1016/S0140-6736(11)60096-2. • Freedom of information: can researchers still promise control of participants’ data? • A UK Tribunal has concluded by a 2:1 majority that certain PACE trial data into chronic fatigue syndrome should be disclosed to a member of the public under the Freedom of Information Act. • But participants in the trial never consented to this (recruited 2005-8). BMJ 2016; 354 doi: http://dx.doi.org/10.1136/bmj.i5053 (Published 21 September 2016) http://www.qmul.ac.uk/media/news/items/smd/181216.html • Pressure grows on Lancet to review “flawed” PACE trial • Over a hundred academics, patient groups, lawyers, and politicians have now signed an open letter to the Lancet calling on the journal to commission an independent reanalysis of the data from the PACE trial…….. BMJ 2018; 362 doi: https://doi.org/10.1136/bmj.k3621 (Published 22 August 2018)

30. PACE trial: 2016 • Queen Mary University of London said this month that it has released the data from the PACE trial (a randomised evaluation of pacing, graded activity, cognitive behaviour therapy, and specialised medical care for chronic fatigue syndrome) to a patient who had requested it under the Freedom of Information Act. The university had long battled against the request, citing concern that the participants could be identified if the data were released. • Frances Rawle, head of corporate governance and policy at the Medical Research Council, says that it will now be necessary to rethink how consent forms for future trials are drafted if it is no longer possible to assure participants that data will not be shared. • “People who run trials have to say what will happen to the data they collect, so we’ll have to look very carefully at the wording of consent forms,” she says. “As things stand they are no longer consistent with the Freedom of Information Act.” • If people have to be told that data may be shared, even if only after anonymisation, it could affect recruitment for trials.

31. Expression of Concern The PLOS ONE EditorsPublished: May 2, 2017https://doi.org/10.1371/journal.pone.0177037 • Statement from the authors • We disagree with the Expression of Concern about our health economic paper that PLOS ONE has issued and do not accept that it is justified. We believe that data should be made available and have shared data from the PACE trial with other researchers previously, in line with our data sharing policy. This is consistent with the data sharing policies of Queen Mary University of London, and the Medical Research Council, which funded the trial. The policy allows for the sharing of data with other researchers, so long as safeguards are agreed regarding confidentiality of the data and consent as specified by the Research Ethics Committee (REC). • The PACE trial REC advised that public release, even of anonymised data, is not appropriate. • PLoS One. 2012;7(8):e40808. doi: 10.1371/journal.pone.0040808. Epub 2012 Aug 1.

32. Publishing Medical Case Reports and data sharing • Data sharing problematic as would give access to source data with information from people who may not have consented eg healthcare professionals • Risk of identifiable data being made publicly available • Removal of identifiers in text, images • http://publicationethics.org/files/Best_Practices_for_Ensuring_Consent_for_ Publishing_Medical_Case_Reports_guidance_from_COPE.pdf

33. Recommendations: identifiers • Names •  Geographic regions •  Elements of dates including birth date, date of death, and admission/discharge date •  Listing ages older than 89 years require additional consent unless providing a single category of age >90 years •  Telephone numbers, fax numbers, and e-mail addresses •  Personal identifying numbers (e.g., social security numbers, medical record numbers) •  Web Universal Resource Locators (URLs) and Internet Protocol (IP) addresses •  Biometric identifiers, photographs and images (without specific additional permission, •  Other unique, identifying characteristics or codes • CARE guidelines for case reports: explanation and elaboration document. J Clin Epidemiol. 2017 doi: 10.1016/j.jclinepi.2017.04.026 • Royal College of Radiologists. Guidance on the use of patient images obtained as part of standard care for teaching, training and research. Dec 2017. https://www.rcr.ac.uk/publication/guidance-use-patient-images-obtained-part-standard-care-teaching-training-and-research

34. Remove meta data connected to images • GPS coordinates • Camera settings/ make and model of camera • Date and time photo taken • Name and build of all programmes used to view or edit photo • Cropping/ removal of identifiers (medical images) can be uncropped • Data eg patient data may be embedded into images and need to be removed at source Royal College of Radiologists. Guidance on the use of patient images obtained as part of standard care for teaching, training and research. Dec 2017. https://www.rcr.ac.uk/publication/guidance-use-patient-images-obtained-part-standard-care-teaching-training-and-research

35. Conclusion • The bottom line is consent • Consent must be compliant with current legislation • Practicalities of reconsent • Legislation may vary between countries • Legislation varies over time