Health research, data protection, and the public interest in notification

Medical Law Review

Volumn 19, Issue 2, 2011, Pages 267-303

  Taylor, Mark J ^a  

^a UNIVERSITY OF SHEFFIELD   (United Kingdom)

Author keywords

[No Author keywords available]

Indexed keywords

ACCESS TO INFORMATION; ARTICLE; COMPUTER SECURITY; CONFIDENTIALITY; EUROPEAN UNION; HUMAN; INFORMATION DISSEMINATION; LEGAL ASPECT; MEDICAL RECORD; MEDICAL RESEARCH; NATIONAL HEALTH SERVICE; PERSONNEL; POLICY; PUBLIC OPINION; UNITED KINGDOM;

ACCESS TO INFORMATION; BIOMEDICAL RESEARCH; COMPUTER SECURITY; CONFIDENTIALITY; EUROPEAN UNION; GREAT BRITAIN; HUMANS; INFORMATION DISSEMINATION; MEDICAL RECORDS; PUBLIC OPINION; PUBLIC POLICY; RESEARCH PERSONNEL; STATE MEDICINE;

EID: 79957803224     PISSN: 09670742     EISSN: 14643790     Source Type: Journal    
DOI: 10.1093/medlaw/fwr006     Document Type: Article

References (113)

1. The Academy of Medical Sciences, 'A New Pathway for the Regulation and Governance of Health Research' (January 2011) accessed January 2011.
2. accessed January 2011.
3. A perspective first expressed, in rather strong terms, in Academy of Medical Sciences, 'Personal Data for Public Good: Using Health Information in Medical Research' (January 2006) accessed January 2011.
4. J Peto, O Fletcher and C Gilham, 'Data Protection, Informed Consent, and Research' (2004) BMJ 328 1029-30 (1 May).
5. T Kielmann and others, 'The Department of Health's Research Governance Framework Remains an Impediment to Multi-centre Studies: Findings from a National Descriptive Study' (2007) J R Soc Med 100(5) 234-8 (May 1).
6. C Metcalfe and others, 'Low Risk Research Using Routinely Collected Identifiable Health Information Without Informed Consent: Encounters with the Patient Information Advisory Group' (2008) 34 J Med Ethics 37-40.
7. AS Gershon and JV Tu 'The Effect of Privacy Legislation on Observational Research' (2008) 178 CMAJ 871-3.
8. J Fletcher, J Marriott and D Phillips 'Data Protection, Informed Consent, and Research: Interpretation of Legislation Should Reflect Patients' Views' (2004) 328 BMJ (7453) 1437.
9. N Hallowell and others, 'An Investigation of Patients' Motivations for Their Participation in Genetics-Related Research' (2010) 36 J Med Ethics 37-45.
10. For an alternative perspective, where participants are not patients, see H Busby, 'Blood Donation for Genetic Research: What Can We Learn from Donor's Narratives?' in R Tutton and O Corrigan (eds), Genetic Databases: Socio-ethical Issues in the Collection and Use of DNA (Routledge, London and New York 2004).
11. Wellcome Trust, 'Towards Consensus for Best Practice (June 2009), 2 accessed January 2011.
12. J Tozer, Personal Details of Thousands of Patients Stolen from Hospital in New Security Blunder The Daily Mail (18 June 2008) accessed January 2011.
13. A data stick containing information relating to 6,360 prisoners was lost by a Heath Trust, BBC News website (Friday, 17 April 2009) accessed January 2011.
14. The organ donation preferences of 444,031 people were recorded inaccurately on the Organ Donation Register (ODR) due to a software error, ICO press release (21 January 2011) accessed January 2011.
15. These errors take place within a broader context of electronic data security breaches by government and others that are regularly reported in the media, e.g. BBC News 'Discs worth £1.5bn' to Criminals' accessed January 2011.
16. Harrison, Government's Record Year of Data Loss The Guardian accessed January 2011.
17. M Evans, List of Porn Pirates Leaked onto Internet Telegraph.co.uk accessed January 2011.
18. Also, and perhaps somewhat ironically, it might reduce the utility of the records for researchers.
19. BMA (2010) Health Informatics Strategy 4 accessed January 2011.
20. There is a debate about what 'reasonable expectations' patients might have in this area. However, there is evidence that patients do not currently expect their personal health information to be shared for research purposes without consultation.
21. See, for example, The Bolton Research Group, 'Patients' Knowledge and Expectations of Confidentiality in Primary Health Care: A Quantitative Study (2000) 50 Br J Gen Pract 901-2
22. See also Department of Health, Summary of Responses to the Consultation on the Additional Uses of Patient Data, 40 accessed January 2011.
23. That patients expect to know what is done with their patient data seems to be implicitly accepted by the Rawlins' Review recommendation that there 'is a need to better communicate to the public and patients what is meant by the use of patient data in research, and to improve public engagement in discussions relating to policy decisions in this area [...] Participants at the PPI workshop felt that there is a need to inform not only patients, but the public more widely of the value of conducting research using patient data [...]' AMS 'A new pathway' (n 2) 67.
24. See, for example, Article 25 of theWorld Medical Association, Declaration of Helsinki-Ethical Principles for Medical Research Involving Human Subjects accessed January 2011.
25. Article 25 recognises that it might be ethical to use identifiable data for research purposes in circumstances where 'consent would be impossible or impractical to obtain for such research or would pose a threat to the validity of the research'. In such situations, the Declaration provides that such research may be done but 'only after consideration and approval of a research ethics committee'. Section 251 of the National Health Service Act 2006 allows the English common law duty of confidentiality to be set aside with similar safeguards.
26. (See for more information about Section 251 NHS Act 2006 and its operation.).
27. L Brown, M Parker and M Dixon-Woods, 'Whose Interest? British Newspaper Reporting of Use of Medical Records for Research' (2008) J Health Serv Res Policy 3(3) 140-5 (July 1).
28. J Sheather, 'Confidentiality and Sharing Health Information' (2009) 338 BMJ b2160 (see ).
29. 'Asked at his maiden news conference for his definition of "the public interest" [FCC Chairman Michael] Powell joked, "I have no idea." The term can mean whatever people want it to mean, he said. 'It's an empty vessel in which people pour in whatever their preconceived views or biases are'. A similar point is made by Frank Sorauf when he notes that a 'concept as nebulous as the public interest invites not definition but absorption. The scholar can make of it what he will by projecting into it whatever content or meaning he finds congenial'.
30. FJ Sorauf, 'The Public Interest Reconsidered' (1957) 19 J Polit 616-39, 618.
31. That there is a lack of transparency in the current regulatory arrangements is a point strongly made by I Brown, L Brown and D Korff, 'Using Patient Data for Research without Consent' (2010) 2 Law Innovation Technol 219-58.
32. 'In some circumstances seeking consent is not possible or required (see Chapter 6) and in such circumstances there is a need to communicate to patients and the public the safeguards that are in place'. AMS 'A new pathway' (n 2) [2.3.1]. See also [2.3.4].
33. As might arguably be implied by exhortations such as represented by Article 2 of the Council of Europe, Convention for the Protection of Human Rights and Dignity of the Human Being with regard to the Application of Biology and Medicine (Convention on Human Rights and Biomedicine) (ETS no.164, 1997): 'The interests and welfare of the human being shall prevail over the sole interest of society or science'.
34. 'There are certain "public goods" which "benefit us all (in one way or another) as members of a territorially circumscribed society. Such public goods may equate to what Alan Gewirth referred to as basic wellbeing, which comprises the natural rights to essential conditions such as life, physical integrity and mental equilibrium, without which it would be difficult or impossible to achieve, or have a reasonable chance of achieving, any purposes; and basic freedoms, such as distributive and aggregative levels of "justice" , "equality", "crime control" and programmes of health care. This may include tangible goods like food and housing; intangible goods, such as political security; and goods on demand, such as health care and legal representation.'
35. B Capps, A Campbell and R ter Meulen (report for UK Biobank, 22 April 2008), 13 accessed January 2011.
36. To give some indication of the potential commercial value of the patient data held within NHS records, it is worth noting that IMS Health, which is currently the world's leading provider of health care data to the pharmaceutical and health care industries, announced fourth-quarter revenue in 2009 of $599.2 million.
37. Source accessed January 2011.
38. Marc Rodwin describes the rise of these databases in the USA from relatively humble beginnings in the 1950s to the rise of medical information organisations (MIOs) which provide anonymised patient data to a range of users for diverse purposes
39. MA Rodwin 'Patient Data: Property Privacy and the Public Interest' (2010) Legal Studies Research Paper Series 10-24 (May 2) accessed January 2011.
40. MIOs are now a global phenomenon (see, for example, the rise of Cegedim Dendrite with a presence in at least eighty countries).
41. AMS 'A New Pathway' (n 2) 2.
42. AMS 'Personal Data for Public Good' (n 4) 6.
43. Wellcome Trust (n 8) 2
44. T Groves 'Whose Research Is It Anyway' (2006) BMJ 333(7560) (22 July).
45. 'What I may see or hear in the course of the treatment or even outside of the treatment in regard to the life of men, which on no account one must spread abroad, I will keep to myself, holding such things shameful to be spoken about'. accessed January 2011.
46. 74/1996/693/885, 27 August 1997, [41].
47. Wellcome Trust, Public Perspectives on the Governance of Biomedical Research: A Qualitative Study in a Deliberative Context (Wellcome Trust 2007), 87. accessed January 2011.
48. This supported a conclusion of earlier work by Ipsos MORI which indicated 'that a majority of the general public feels that consent should always be sought': Ipsos MORI, Consultation on Public Attitudes Toward the Secondary Use of Personal Health Information for Medical Research (Report for MRC, June 2007), 9 accessed January 2011.
49. Ipsos MORI (n 28) 22.
50. Department of Health, 'Summary of Responses to the Consultation on the Additional Uses of Patient Data', 6 accessed January 2011.
51. Note also that according to the 'ideal information sharing system described' by the Ipsos MORI research patients would 'opt in' to the sharing of anonymised data. Ipsos MORI (n 28) 21.
52. Department of Health (n 30) 6.
53. [1988] 2 All ER 648, 653.
54. J Peto, O Fletcher and C Gilham, 'Data Protection, Informed Consent, and Research' (2004) 328 BMJ 1029-30 (1 May).
55. Sheather, n 13.
56. Sorauf, n 14.
57. M Meyerson and EC Banfield, Politics, Planning and the Public Interest (Glencoe, 1955), 322 cited in Sorauf, n 14, 619.
58. B Capps, A Campbell & R ter Meulen (n 19).
59. See for a discussion of communitarianism as an idea.
60. See for a discussion of libertarianism as an idea.
61. J Narveson, The Libertarian Idea (Temple University Press, Philadelphia 1988).
62. Such as might inform a normative preference for a particular kind or society or be associated with the idea of public interest as moral imperative.
63. It is accepted that a complete 'answer' to the question 'When is research access to patient information without consent in the public interest?' might only be described in the light of a substantive, fully worked out, 'thick' concept of the public interest. Such a concept would have to be supported by a particular normative framework and it would, almost inevitably, be disputed. This is one of the difficulties those seeking to address this question face. Not only might we dispute the likely practical consequences of allowing increased research access to patient data but we may each rely upon rather different assumptions about our responsibilities within a society (that benefits from the products of health research).
64. For a particular, and controversial, view, one might refer for example to J Harris, 'Scientific Research Is a Moral Duty' (2005) 31 J Med Ethics 242-8.
65. These are important questions but they also involve extremely thorny and contentious issues. There is a danger that a pre-occupation with them might distract from the possibility that some arguments might build upon commonalities between positions rather than fixate upon differences.
66. D Curtin and AJ Meijer, 'Does Transparency Strengthen Legitimacy?' Inform Polity II (2006) 109-22, 112.
67. I am here focussing on 'social legitimacy' because it is the perception of legitimacy by those affected by decision-making processes that I am particularly concerned with and people might perceive their interests to be appropriately taken into account even if they are not able to directly influence the decision-making process itself.
68. LB Solum, 'Public Legal Reason' (2006) 92 Virginia LR 1449, 1472.
69. Why else should they support it? An answer to this question might appear to be 'Because it's the right thing to do'. However, I am not aware of an attempt to answer the Authoritative Question within Moral Philosophy that does not take account of the interests of the addressees (even though those interests may not motivate a moral act).
70. This appears consistent with the Rawlin's Review recommendation that 'it is essential patients and the public.... [i]nform the priorities, design, and implementation of research and the regulation pathway'. AMS 'A new pathway' (n 2) [3.2.2].
71. The complexities of the relationship between legitimacy and transparency have frequently been considered in the context of debate over the legitimacy of EU law and legal institutions.
72. See generally G de Bú rca, 'The Quest for Legitimacy in the European Union' (1996) 59 MLR 349-76.
73. Curtin and Meijer (n 44).
74. See also J Lodge, 'Transparency and Democratic Legitimacy' (1994) 32 J Common Market Stud 343-68.
75. Sorauf (n 35) 633.
76. Solum (n 46) 1468.
77. Support for public reason does not support transparency within all decisionmaking. For example, there may be certain decisions concerning defence or security that there is good public reason to keep secret. However, even here the justification for non-transparency should be transparently made out.
78. While 'expectations' are not synonymous with 'interests', positive expectations (i.e. things that we both expect and positively value) may provide evidence of perceived interests.
79. Lodge, (n 50) 343-68, 365.
80. January 2011, Version 5 accessed January 2011.
81. There are in fact no circumstances in which those holding confidential information are required by law to disclose identifiable information for research purposes. The exception 'we have to do this by law' does not then apply (currently at least) to health research.
82. For discussion of the problems of bias that consent can introduce, see AMS, 'A new pathway' (n 2) 57.
83. AMS, 'Personal Data for Public Good' (n 4) 46ff.
84. Data Protection Act 1998, Schedule 1, Part I, Paragraph 2.
85. The relevant conditions are, '(a) that the data are not processed to support measures or decisions with respect to particular individuals, and (b) that the data are not processed in such a way that substantial damage or substantial distress is, or is likely to be, caused to any data subject' Data Protection Act 1998, Section 33(1).'
86. In particular, 'fair' processing of any personal data must satisfy at least one of the conditions set out in Schedule 2 of the DPA. If the data are 'sensitive', then fair processing also requires that one of the conditions set out in Schedule 3 be satisfied. The DPA defines 'sensitive personal data' as including information about an individual's 'racial or ethnic origin', 'religious beliefs or other beliefs of a similar nature', 'physical or mental health or condition', or 'sexual life'. Research involving identifiable patient information will, therefore, invariably, involve the processing of sensitive personal data and it will be necessary to satisfy one of the conditions listed within Schedule 3 as well as Schedule 2.
87. Data Protection Act 1998, Schedule I, Part II, s 1(1).
88. Data Protection Act 1998, Schedule I, Part II, s 2.
89. See sub-paragraph (b) in both Articles 10 and 11.
90. Although it may be possible to process for research purposes even if such purposes have not been notified, it would be a breach of the responsibility to notify.
91. Data Protection Act 1998, Schedule 1, Part II, Paragraph 3.
92. For example, research into abuse or neglect where notification might be counter-productive to protection of vulnerable persons.
93. One might, however, be able to imagine certain circumstances. In addition to those described immediately above consider for example, if a patient is being informed of a terminal illness during a consultation. One might understand a clinician reasonably objecting to introducing anything into that conversation that was irrelevant to the patient's immediate care and treatment. This may be the case even if information is gathered during the course of the consultation that they recognise may be of research interest. In these circumstances, however, there may well be practicable alternatives to notification at that particular time as particularly sensitive and difficult consultations are likely to be followed up.
94. For reasons already given, to do otherwise would be arbitrary given that disproportionate effort is recognised to be a lawful excuse for non-notification in cases where data have been obtained via a third party.
95. That is, if there is an intention to anonymise data and use it for a research purpose, then a failure to notify of this may deceive or mislead persons of the purposes for which their data will be used (contrary to the first data protection principle).
96. [2001] QB 424 [44].
97. D Townend and others, 'Privacy Interests in Biobanking: A Preliminary View on a European Perspective' in J Kaye and M Stranger, Principles and Practice in Biobank Governance (Ashgate, Aldershot 2009).
98. See also, JL McGregor, 'Population Genomics and Research Ethics with Socially Identifiable Groups' (2007) 35 J Law Med Ethics 356-70.
99. For a discussion of the difference between 'private data' and 'personal data', see D Beyleveld and E Histed, 'Betrayal of Confidence in the Court of Appeal' (2000) 4 Med Law Intl 277-311.
100. M Barbaro and T Zeller Jr., A Face Is Exposed for AOL Searcher No. 4417749 New York Times (9 August 2006) accessed January 2011.
101. Groves (n 25); see also D Kalra and others in the same volume of the BMJ, 196.
102. G Eysenbach, 'Medicine'2.0: Social Networking, Collaboration, Participation, Apomediation, and Openness' (2008) 10 J Med Internet Res e22.
103. [2008] UKHL 47 [26].
104. P Ohm, 'Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization' (13 August 2009).
105. University of Colorado Law Legal Studies Research Paper No. 09-12. See also Brown and others (n 16).
106. Beyleveld and Histed (n 75).
107. See, for example, Wellcome Trust (n 8).
108. Consistent with the current UK position but not necessarily the EU position. See text to n 67. That is not to suggest that notification would be a substitute for consent. Consent would continue to be required in the same circumstances that it is now, but, where requirements for consent are currently lifted for good reason, then notification might still be practicable, serve some useful 'public-interest' function, and yet, not be required by the current regulatory framework.
109. It might seem counter-intuitive to suggest notifying patients before the use of anonymous data, after all, how are they to be identified for the purposes of notification? Such systems work effectively however within GP practices currently.
110. For example, QResearch last accessed 2011.
111. If notification were sufficient to affect what might described as the reasonable expectations of patients, and patients did not take the opportunity to object to such use, then research would not breach the common law duty of confidence. In Murray v Express Newspapers plc and another [2008] EWCA Civ 446, [2009] Ch. 481, 502-3, Sir Anthony Clarke MR said: 'As we see it, the question whether there is a reasonable expectation of privacy is a broad one, which takes account of all the circumstances of the case. They include the attributes of the claimant, the nature of the activity in which the claimant was engaged, the place at which it was happening, the nature and purpose of the intrusion, the absence of consent and whether it was known or could be inferred, the effect on the claimant and the circumstances in which and the purposes for which the information came into the hands of the [party alleged to owe the duty of confidence]' [36]. In Coco v A N Clark (Engineers) Ltd [1969] RPC 41, Megarry J said: 'It seems to me that if the circumstances are such that any reasonable man standing in the shoes of the recipient of the information would have realised that upon reasonable grounds the information was being given to him in confidence, then this should suffice to impose upon him the equitable obligation of confidence.', 48. If, having taken all the circumstances into account, it is clear to a person providing personal information that it will be used for research purposes unless they object, and they are given the opportunity to object at no cost to themselves, then it is hard to imagine a court finding the use of that information for research purposes would involve a breach of any confidence.
112. An example might be a system giving patients the opportunity to allow identifiable data to be used to determine their suitability for particular research studies and to then enable researchers to contact them for project specific consent and/or for use of their data in anonymised form. See AMS, 'A New Pathway' (n 2) [6.4.4]. Such consent would inevitably be broad in the first instance, but if accompanied with an ongoing opportunity to receive/access relevant information-and the opportunity to withdraw consent when appropriate-then it might nevertheless go a long way toward both meeting expressed patient expectations and better enabling research access.
113. AMS 'A new pathway' (n 2) Ch 9.