United States

Given the lack of comprehensive data privacy legislation in the United States, scientific research and the flow of genetic information are governed by a patchwork of federal and state laws.^{Reference Clayton55} There are currently over 200 statutes in effect in 49 states and the District of Columbia that implicate genetics and genomics in a variety of contexts, including ownership of genetic data, employment and insurance discrimination, health insurance coverage, privacy, research, and the use of residual newborn screening specimens.⁵⁶ For example, some states have deemed genetic information to be the property of the individual being tested⁵⁷ and/or impose informed consent requirements for genetic testing and analysis.⁵⁸ States may also regulate the retention of biospecimens and the resulting data in healthcare and research,⁵⁹ impose security requirements for genetic data or other health records,⁶⁰ or convey additional protections to research participants (e.g., applying Common Rule protections to all human subjects research).⁶¹

The diversity of state laws poses challenges for researchers seeking to recruit participants from jurisdictions across the country. These challenges may be heightened in the context of research that relies on the DTP model, as such efforts have the potential to implicate laws in multiple jurisdictions (e.g., laws in place in the state where either the researcher or participants reside, or both). Such laws might vary considerably with respect to the protections afforded participants or the restrictions placed on researchers (and in some cases they may be in direct conflict). Although state laws that conflict with federal law may be preempted in certain circumstances, many existing federal statutes (e.g., Health Insurance Portability and Accountability Act (HIPAA), Genetic Information Nondiscrimination Act (GINA), and Clinical Laboratory Improvement Amendments (CLIA), permit states to adopt more protective laws.⁶²

In the absence of congressional action, more comprehensive data privacy laws are being enacted and implemented at the state level. For example, the California Consumer Privacy Act of 2018 (CCPA),⁶³ effective on January 1, 2020, is leading the way, with other states likely to enact similar legislation.^{Reference Rothstein and Tovino64} This legislation and pending bills vary in their scope and whether they explicitly address research or genetic information, but, like the European Union's General Data Protection Regulation (GDPR), commonly grant access and correction rights to individuals and impose restrictions on the use and sharing of personal information without explicit consent. It remains to be seen whether the United States will adopt comprehensive data privacy legislation, and if it does, whether Congress will preempt state laws in favor of a more uniform law.

Europe

Legal uncertainty is not confined to jurisdictions like the United Sates that lack comprehensive privacy legislation, a fact illustrated by the GDPR.⁶⁵ Implemented in May 2018, the GDPR is a sweeping law imposing restrictions on the processing of personal information of individuals residing in the European Economic Area (EEA) and grants numerous rights to data subjects. Because the GDPR applies to any entity that targets EEA residents, regardless of whether the entity has a presence in Europe, the effects of the GDPR are being felt worldwide and will likely affect researchers engaged in DTP genomic research. In addition, the GDPR has served as a model for similar legislation in other, non-EU jurisdictions.⁶⁶

The GDPR designates genetic data as a “special category of personal data,”⁶⁷ processing of which is generally prohibited unless “the data subject has given explicit consent to the processing of those personal data for one or more specified purposes.”⁶⁸ However, the GDPR contains several provisions designed to facilitate scientific research. For example, although the GDPR typically prohibits further processing of data in a manner that is incompatible with the “specific, explicit, and legitimate purposes” for which it was initially collected (i.e., “purpose limitation”), this requirement is relaxed if carried out “for purposes in the public interest, scientific or historical research purposes or statistical purposes.”⁶⁹ Similarly, the GDPR permits storage of data for research purposes for longer periods than would otherwise be permitted under the regulations in most circumstances (“storage limitation”).⁷⁰

The GDPR defers to the law of the EU or Member States in several key areas that could have a dramatic impact on scientific research.^{Reference Pormeister71} For example, under Article 9(4) of the GDPR, “Member States may maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health.”⁷² Member State law may also specify conditions under which a researcher may use genetic data for research purposes without consent,⁷³ and Member States may adopt derogations that eliminate, in the context of research, rights generally afforded by the GDPR (e.g., access and correction rights, the right to object, and restrictions on processing), “in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.”⁷⁴

Broad consent (i.e., a single consent for future, unspecific uses of data for scientific research)^{Reference Rothstein75} is another important area where the GDPR defers heavily to EU or Member State law. Recital 33 allows Member Nations to permit broader, less specific consent than would generally be allowed by Article 9. Recognizing that “[i]t is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection,” the recital states that “data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognized ethical standards for scientific research.”⁷⁶ It remains to be seen how Member States will interpret these provisions. For example, Germany's Conference of German Data Protection Authorities recently issued a resolution on its interpretation of Recital 33 in which it interpreted “certain areas of scientific research” relatively narrowly, requiring specific consent for the vast majority of research projects.^{Reference Senger and Schonhofen77} In situations where broad consent is indispensable to the research, German regulators specified several additional safeguards for researchers to consider, such as REC approval for additional research purposes and enhanced transparency and security measures, including restrictions on transfers of personal data to other countries with less stringent data protection laws.⁷⁸

The result of the GDPR's deference to the law of Member States results in considerable uncertainty surrounding the cross-border use of personal data, including genetic information. Not all Member states have applicable laws governing research and/or genetic data, and those that do can vary considerably or even directly conflict with one another.⁷⁹ Despite the GDPR's deference to Member State laws in the several key areas discussed above, the GDPR lacks clarity surrounding the appropriate resolution of these potential intra-EU conflicts of law.⁸⁰ However, there are indications that Member states are willing to work cooperatively to address such issues as they arise. For example, 13 European countries recently signed a declaration of cooperation⁸¹ designed to facilitate the sharing of genetic information across borders for medical research.⁸²

South Africa

South Africa is in the process of implementing data privacy regulations inspired by an early draft of the GDPR.^{Reference Nordling83} However, the Protection of Personal Information Act (POPIA),⁸⁴ passed in 2013 and slated to go into effect in 2020, lacks some of the research provisions added in subsequent drafts of the GDPR. As a result, many scholars and researchers fear the law has the potential to negatively affect scientific research in the country.^{Reference Staunton85} For example, there is considerable uncertainty surrounding the law's restrictions on broad consent,^{Reference Pepper86} which is currently permitted in South Africa under existing guidelines and endorsed by the Academy of Science of South Africa.⁸⁷ Although there is ongoing disagreement about the extent to which the POPIA will preclude broad consent, there are concerns that the law not only creates uncertainty for future research, but that the POPIA's restrictions could require the destruction of previously collected biospecimens unless individuals were re-consented, a development that would have dire consequences for biobanks and the researchers who rely on reanalysis of such biospecimens.⁸⁸ Others have expressed concerns that the law's restrictions on sharing certain types of sensitive information (e.g., HIV status) will hinder important infectious disease research.⁸⁹

Developments in South Africa are being closely followed as the law has the potential to influence data protection legislation across the continent. Few African nations have adopted data privacy legislation (although several are considering it) and may look to South Africa as they contemplate data privacy legislation or research regulations of their own.^{Reference de Vries and Rich90}

India

Recent developments in India serve as a useful case study of how well-intentioned regulatory reform can create uncertainty that stifles scientific research. In the decades preceding 2013, India had become home to a robust clinical trials industry. However, widespread media reports began to emerge alleging that thousands of clinical trial participants within the country had died in just the last several years.^{Reference Mahapatra91} In response, India's Supreme Court issued a sweeping ruling in 2013 that placed restrictions on clinical trials conducted within the country.^{Reference Kay92} The decision halted over 150 clinical trials, impacting local researchers, large multinational pharmaceutical companies, and dozens of NIH-funded clinical trials.^{Reference Reardon93}

The Indian government subsequently convened an “Expert Committee” tasked with issuing recommendations for improving regulation of clinical trials.⁹⁴ Among the Committee's numerous recommendations were accreditation requirements for institutions carrying out clinical trials,^{Reference Barnes95} mandatory audio-video recording of each trial participant providing informed consent,⁹⁶ requirements that researchers provide compensation for research-related injuries,⁹⁷ and the provision of ancillary medical care for study participants for medical issues that arose during the course of a trial, even those unrelated to the research.⁹⁸ In response to the recommendations, the government began to consider, and in some cases implement, a number of regulatory changes^{Reference Chaudhury and Mehta99} that quickly resulted in considerable uncertainty amongst researchers, who worried about their potential liability for future compensation and medical care and expressed concerns about the unintended consequences of requirements such as mandatory video recording of study participants.^{Reference Mallath and Chawla100} Indian investigators lamented that they were “suddenly looked upon as partners in the crime committed by a few of their kind” and that prior to the fallout created by the ruling, “[their] poor patients who could not afford even the basic standard of care were getting the best care on these global trials.”¹⁰¹

As the regulatory landscape in India continues to evolve, it remains to be seen whether the country will strike a balance that protects participants without unduly inhibiting scientific research. India has since issued clarifications regarding the scope of some of the regulations discussed above and has retreated entirely from certain requirements.¹⁰² Despite some lingering uncertainty, there is evidence that clinical trials have begun to return to the country.^{Reference Shelar and Ilancheran103} Regardless of the ultimate outcome, India's experience illustrates the dramatic effects that regulatory uncertainty can have on scientific research.

China

Other jurisdictions may adopt restrictions that specifically target international researchers, such as those that recently took effect in China.^{Reference Normile104} In May 2019, the Chinese State Council released a new regulation governing scientific research within the country (“Regulation of Human Genetic Resources”).^{Reference Lovells105} The regulation, which went into effect on July 1, 2019, broadly defines Human Genetic Resources (RGRs) to include biospecimens as well as the resulting data, and has the potential to dramatically affect international scientific research, including DTP research within the country.¹⁰⁶

The regulations place a number of restrictions on international researchers, including a prohibition on accessing biospecimens or data from within the country without a Chinese collaborator.¹⁰⁷ These collaborations must be pre-approved by the Chinese Ministry of Science and Technology and are subject to, among other things, “a security review if it might affect public health, national security or public interest.”¹⁰⁸ In addition, all scientific data resulting from such a collaboration must be made available to the Chinese government,¹⁰⁹ and any export of genetic information also requires a permit that is subject to security review if it affects public health, national security, or the public interest.¹¹⁰ Export of biospecimens is even more difficult, as it is permitted only if it is “truly necessary” to the collaboration.¹¹¹ The regulations impose steep penalties for engaging in research without approval or for obtaining biospecimens without informed consent; researchers who run afoul of the regulations could face steep monetary penalties of up to 10 million yuan (nearly $1.4 million U.S. dollars).¹¹²

Taken together, these restrictions are likely to serve as a barrier to foreign scientific research within the country, including DTP research. However, it is worth noting that China, unlike other countries that have implemented or may be contemplating research restrictions, has a relatively robust scientific infrastructure.^{Reference Guarino, Rauhala and Wan113} Chinese researchers may be able to fill the gap left by international researchers in a way that may not be possible in countries that lack such infrastructure (e.g., developing countries that are of intense interest to researchers, such as African nations).¹¹⁴

Regulatory Challenges

Effective regulation must balance the interests of various stakeholders, including research participants, researchers, and the public more broadly, and will require cross-border coordination and cooperation. Restrictive regulations may often be a legitimate response to ongoing or historical abuses, including concerns about exploitative research by international researchers. Yet, as the above examples indicate, well-intentioned regulations can have unintended consequences that can reduce participant autonomy, stifle scientific progress, and may ultimately be detrimental to public health.

A. History of Local Ethics Review

Extending back to its earliest applications in the 1950s,^{Reference McCarthy and Emanuel134} ethics review of human research protocols has been primarily a local activity. Throughout the world, ethics reviewers typically live in the same community or even work in the same institution as the researcher proposing the research. When the NIH introduced peer review for intramural research conducted with healthy volunteers in 1953, the review panel was composed of peer researchers also working in the NIH Clinical Center.¹³⁵ Over twenty years later, when the first regulations applicable to extramural researchers were promulgated in the U.S., they called for institutions to develop their own review boards composed of both local experts and community members.¹³⁶ This is precisely the reason why ethics review committees in the U.S. are referred to as Institutional Review Boards; they largely operate within a single institution. Despite the difference in terminology, RECs throughout the world still operate primarily on a local scale.

Several interrelated factors have contributed to the adoption of local review, as opposed to regional or national review. Most research with human participants conducted in the twentieth century was conducted at a single site, typically under the direction of a single lead investigator. Because most research was designed and carried out locally, local review allowed review committees to discuss research protocols with the lead investigator, to maintain oversight and accountability to ensure that research is conducted according to the protocol, and perhaps even to learn which investigators can be trusted to conduct research responsibly.^{Reference Klitzman137}

Critically, however, the tradition of local ethics review has not been driven exclusively by practical considerations. At least two related normative concerns have also driven this practice. The first normative concern is that members of local communities might have values or needs that are not identical with those of other communities, and that needed to be addressed during the ethics review process. To take a recent example, members of African-American communities in Baltimore might have grown more skeptical of biomedical research as a result of the disclosure that Johns Hopkins Hospital collected cervical cancer cells from Henrietta Lacks and developed a cell line without her or her family's permission.^{Reference Skloot138} For this reason, it might be important for a local IRB at this institution to consider the implications of this story in the approval of new research protocols that would include members of local African-American communities.¹³⁹

The second normative concern that has been offered to support local research ethics review is that it is important for local institutions and communities that research ethics committees retain some degree of autonomy and independence. As discussed above, local committees might require autonomy so that they can represent the values and needs of local communities in their review of research protocols. Potential research participants may also be reassured that the local institution, which they know and trust, has reviewed and approved a study. The independence of local RECs has also been emphasized as an approach that can reduce conflicts of interest. For example, in countries with national healthcare systems, such as the United Kingdom (U.K.), a local REC that operates independently from the national healthcare system is seen as a way to ensure that research studies are approved on the basis of their ethical and scientific merits, and not on financial or political considerations.^{Reference Redshaw, Harris and Baum140}

B. Single-Site Domestic Review

Even though most research ethics review has remained local, researchers, patient advocates, and other stake-holders have long expressed interest in more centralized approaches. A great deal of this interest has been driven by concerns that local ethics review can significantly increase the effort required to carry out multi-site research. Although research conducted in large networks has grown increasingly popular in the past decade,^{Reference Brothers141} multi-site designs for clinical trials have been used for decades. Beginning in the early 1990s, for example, investigators in the U.K. began to explore regional or national review for multi-site clinical trials on the grounds that applying for ethics approval at each individual site took significant effort and tended to delay the start of trials.¹⁴² This critique has been supported by reports demonstrating significant variability in the amount of time required by local RECs to review protocols for multi-site studies, with some sites requiring weeks to months to complete this review.^{Reference Ahmed and Nicholson143}

In addition to these practical concerns, support for centralized approaches to ethics review has been bolstered by growing evidence that local variability in research ethics review often does not seem attributable to local differences in values or the specific needs of communities. In a 2003 report, for example, investigators categorized proposed revisions to the language of consent forms from two trials that were reviewed locally at 25 sites.^{Reference Burman144} They found that revisions proposed by local IRBs tended to make consent forms longer and score lower on readability scales. IRBs sometimes proposed wording changes that did not alter meaning, and even introduced errors. These changes were made at the cost of a median review time of over 100 days, with some sites requiring nearly a year to complete their review. Reports demonstrating similar issues with variation in local research ethics review come from the U.K.,^{Reference Berry, Ades, Peckham, Garfield, Gilbert, Fulford, Parker, Hotopf, Wessely and Noah145} the U.S.,^{Reference Dziak, Mansbach, McWilliams, Hoover-Fong, Hamosh, Ravina, Silverman, Hull, Sugarman, Stair, Stark, Tyson, Hibberd and Vick146} and Canada.¹⁴⁷

Taken as a whole, the experience with local ethics review over the past decades shows that this approach creates significant practical challenges for multi-site research, and often does not address the normative concerns that originally motivated the adoption of this approach around the world. As a result, many countries have adopted alternative approaches that can be utilized in some circumstances. In 1997, the U.K. created 13 multicenter research ethics committees to review research studies that would take place at five or more sites.^{Reference Al-Shahi148} In 1981, the Food and Drug Administration in the U.S. issued regulations that allowed study sponsors to create their own IRBs for multi-site studies, and in 1998 for sites to delegate research ethics review to another site.^{Reference Levine and Lasagna149} However, many IRBs remained reticent to delegate their authority to central IRBs. As a result, a regulatory change was introduced in January 2019 that made central IRB review obligatory for multi-site studies.¹⁵⁰

C. Single-Site International Review

Given that individual countries have successfully adopted single-site review within their borders, it is perhaps inevitable that researchers and other stake-holders would begin to consider whether such an approach could be adopted across international borders. As we have noted, this approach is particularly attractive in contexts like international DTP genomic research where the incremental burden of seeking review in additional countries is large while the benefit in recruiting additional participants is likely to be small. Although we believe that international single-site review could prove successful from both a practical and an ethical perspective, we recognize that international single-site review raises issues that are not necessarily identical with those raised by in-country central review. Before recommending a strategy to adopt international single-site review, then, it is important to first consider the unique issues raised in the international context.

Perhaps the most obvious challenge raised by single-site review for international research is that the policies adopted in each country differ, and sometimes in significant ways. When multi-site studies undergo central review within a country, that central review typically utilizes the same process and applies the same criteria that would have been used had the study been reviewed locally. The same consistency would not be expected in an international context. Even countries with deep historical and cultural ties like Canada and the U.K. utilize review criteria and processes that are different from one another. For example, research policies in many countries allow for an expedited review process when a study poses only minimal risk to participants. However, as shown in one study that underwent ethics review in five countries (Canada, Israel, New Zealand, U.K., and the U.S.), both the criteria for determining when a study poses minimal risk and the interpretation of those criteria in practice can vary significantly.^{Reference Goodyear-Smith151} Our examination of the legal frameworks of 31 countries presented above also clearly demonstrates this type of variation.

Although this type of variation in process and review criteria clearly takes place, it remains unclear whether that variation should be considered a “feature” or a “bug” of country-by-country review of international research. On the one hand, some of that variation seems irrelevant to the goal of ensuring that research is conducted in an ethically appropriate way. The fact that one country requires one set of forms and another country requires a different set of forms has little impact on the goal of ensuring that research participation is voluntary and its risks are minimized. However, it is dangerous to disregard all variation as undesirable. For example, in the minimal risk study conducted in five countries, the differences in the classification of risk might legitimately reflect differing perspectives on the risk of research participation that correspond with cultural values that differ across the five countries. This example is important because in contrast to the examples of in-country variation cited earlier, the differences in review observed in this study did seem to reflect differences in perspective on an ethically important issue: the interpretation of risks posed by research.

In our proposal for adopting international single-site review for DTP genomic research, therefore, we do not intend to disregard the variation in perspectives on the conduct of research around the world. Instead, we argue that important differences in culture and values among countries can be addressed — and perhaps are even better addressed — through strategies other than additional REC review. As discussed above, researchers working to develop an international DTP genomic research protocol can engage with appropriate stakeholders through a variety of methods. The community of patients and family members most interested in a particular rare disease typically engage through online platforms like Facebook, although this is not an option in some countries. This is by necessity, since they are usually scattered around the world. These types of communities are key stakeholders in DTP genomic research and are generally enthusiastic about the opportunity to engage with researchers through online platforms.

Depending on the focus of a study, the relevant stakeholders may not be accessible through a single online community, but researchers can seek the input of stakeholders in other ways. Expatriates in the researcher's own country may be able to serve as cultural liaisons to the populations that live in their country of origin. Leaders from government, medicine, and public health in target countries, reached by phone or videoconference, may also be able to help researchers and RECs address local cultural needs and design research to respect these differences. This type of engagement can be carried out, and used to inform study design, without the need for country-by-country ethics review.

REC review is designed to ensure that proposed research is designed in ways that respects the autonomy of participants, maximizes benefits and minimizes risks, and approaches recruitment and other procedures in a just way, among other ethical concerns. The priorities reflected in this ethical framework — the same framework explicated in the Declaration of Helsinki and applied across the globe — are consistent enough to provide a basis for mutual recognition of ethics approval among most countries. To the extent that variation in cultural values need to be considered in the design and operation of a study, a single REC should evaluate whether the investigators have undertaken appropriate consultation and are proposing sufficient strategies to continue that engagement throughout the course of a study. For example, the REC itself could retain consultants to assist it in considering the implications of a research study in different cultural contexts. All of these measures could be utilized without REC review in each country, and does not prevent studies from adopting slightly different procedures in different countries in order to accommodate values or legal requirements that are relevant in certain communities or jurisdictions.^{Reference Dove152}

D. Low Risk International DTP Genomic Research

Although it is perhaps possible to make a strong ethical case for international single-site ethics review for all research with humans, we are focused in this work on a single type of research: international DTP genomic research on rare disorders. Our conclusion is that single-site ethics review would work well with international DTP genomic research because participants are literally few and far between and genetic diversity carries special scientific value. Moreover, DTP genomic research does not raise many of the issues that benefit most from close REC oversight.

First, DTP genomic research is typically minimal risk¹⁵³ and non-interventional. The collection of DNA in this type of research requires participants to spit into a vial or swab the inside of their cheeks. This does not carry the types of risks conferred by research involving the invasive collection of a biospecimen or the administration of an investigational drug. Researchers conducting DTP genomic research eventually may use their findings to develop new pharmaceuticals, but studies testing those pharmaceuticals would require their own approvals in the future, often including regulatory considerations that fall outside the scope of this analysis, such as Investigational New Drug approvals by the Food and Drug Administration. The fact that future research might carry higher risks (and require its own approvals) should not affect the approval of DTP genomic research.

One dimension of DTP genomic research that carries an element of intervention is the return of genomic results to participants. As discussed above, this is often viewed by participants as a positive because many are interested in learning more about their genetic makeup. It could carry risks, however, such as if a participant receives information about their risk for developing a condition and then responds to the information by pursuing invasive medical tests. These possibilities need to be considered when an REC is reviewing a DTP genomic research protocol involving the return of genomic results, especially when those results are so-called secondary findings because they do not relate to the original study. Nevertheless, there is no reason to believe that country-by-country review would be superior to single-site review in this context, and appropriate guidelines are available for minimizing the risks of returning results. ^{Reference Thorogood, Dalpe, Knoppers and Zawati154}

The second feature of international DTP genomic research that makes it amenable to single-site review is the low risk it is likely to carry for creating a therapeutic misconception. In many forms of conventional health research, participants may misunderstand their research participation as a form of medical care. This misconception is reinforced by the fact that much of this research takes place in academic medical centers, sometimes with a patient's own healthcare provider as an investigator in the study. This misconception is ethically problematic because it increases the chances that individuals will overlook the potential risks of research or even fail to recognize that they are participating in research. In our view, individuals choosing to submit their biospecimens for DTP genomic research are unlikely to make such a mistake.

A far greater risk is that they will participate due to a diagnostic misconception; in other words that they are participating in research in order to obtain a diagnosis for themselves or their child with an undiagnosed rare disease. It is not clear, however, that this would be a misconception of the goals of this type of research.^{Reference Childerhose155} Genomic research on rare diseases is often designed with a dual research and clinical purpose. This research typically involves individuals who are known to have a clinical condition (such as a neuro-developmental disorder or an immune deficiency), but for whom the genetic cause of this condition is not known. Researchers analyze participants' genomic data to identify genetic variants that may be causing this condition. The research finding, if it meets appropriate standards for validity, will then often be disclosed to parents as the genetic cause of their child's condition.

Although the ethical implications of this dual-purpose research needs to be explored further,¹⁵⁶ it is sufficient in this context to observe that there are two potential risks created by this “diagnostic misconception”: (1) the risk that parents would allow their child to participate in research that creates undue risks in order to obtain a diagnosis for the child; and (2) the risk that parents will pursue ill-advised medical interventions on the basis of unverified research results. The former risk is significantly mitigated in the context of DTP research, since this research is typically minimal risk and non-interventional. The latter risk can be mitigated in part through clear communication that any diagnostic information generated in the research context would need to be confirmed in a clinical context. The protocol for this communication can be appropriately reviewed by a single-site review, especially if high standards are followed for translation of information into other languages, such as the confirmation of translation through back-translation.

E. Participant Autonomy

We have previously discussed the importance of autonomy to potential research participants. In this section we consider autonomy in the enrollment process as a practical limitation on regulation.

DTP genomic research does not only involve researchers soliciting potential participants, but in an indeterminate number of cases an individual will learn of the research, contact the researchers, and ask to enroll. The individual may be informed of the research by an already-enrolled participant, read about the research on a disease-specific website, or learn about the research through some other means. The 31 country reports appearing in this symposium clearly indicate that, regardless of the laws in their country, no individual would be legally sanctioned for participating in a DTP genomic research project conducted abroad where the research was not approved in the individual's country.¹⁵⁷

If no attempt is made to bring civil or criminal legal proceedings against a participant, then any legal action would have to be brought against a DTP researcher.¹⁵⁸ We think it is also highly impractical and therefore unlikely that a legal action would be brought against a foreign researcher who does not have domestic ethics approval, except in the case of a researcher with ongoing operations in the participant's country, such as a pharmaceutical company or a university with multiple research protocols.¹⁵⁹ Based on the reluctance to proceed against individuals, it is reasonable to assume that enrollment initiated by the participant will not result in a legal action. Indeed, it is likely that virtually all international DTP genomic research will be free from legal actions. As the author of the country report on Germany has observed: “It is difficult to envisage a regulatory regime capable of effectively governing cross-border activity that involves private individuals, exempt specimens that can be sent by ordinary post, and the processing of data in the context of globalized networks.”^{Reference Hoppe160}

Furthermore, it will be extremely difficult to neatly divide the wide range of enrollment circumstances into researcher-solicited (assumedly unlawful) versus participant-initiated (assumedly lawful) enrollment. To illustrate this point, we describe two of the many possible scenarios.

Example 1: A researcher mentions at an international medical conference that he or she is conducting genomic research on a certain rare disorder and asks international colleagues to help identify affected individuals. If a conference attendee mentions the study to a patient and the patient contacts the researcher, is this researcher-solicited or participant-initiated enrollment? Would this be different from having the physician mention the study to the patient and, with the patient's consent, sending the patient's contact information to the researcher?

Example 2: An individual reads about an international DTP genomic study online and contacts the researcher. After discussing enrollment criteria, the researcher says that the individual does not qualify for the current phase of the study, but the individual would qualify for a new phase beginning the following year. At the individual's request, the researcher contacts the individual when the new phase of the study is beginning. Is this researcher-solicited or participant-initiated enrollment? If the patient, with or without authorization, supplies the researcher with contact information of other patients, would subsequent contact by the researcher be researcher-solicited or patient-initiated?

The difficulty and undesirability of drawing distinctions among various types of recruitment and enrollment to enforce research laws that were not enacted to regulate DTP research supports our recommendation that ethics approval by an adequate ethics review body in the researcher's country should permit international DTP genomic research in the participant's country of residence.

F. Data Protection Precedent

The concept of deferring to another country's legal protections following a determination of adequacy is becoming an accepted principle in international law. Perhaps the best example is in the area of data protection. Although European concerns about the transfer of data to other countries dates to the 1970s,^{Reference Wagner161} the first major development was the enactment of the European Data Protection Directive of 1995.¹⁶² Its aim was to harmonize rules on data processing by members of the European Union (E.U.) and to restrict the transfer of personal data to non-member countries that did not ensure “an adequate level of protection.” Without obtaining a formal determination of adequacy, the E.U. and the U.S. entered into the Safe Harbor Framework Agreement in 2000, which provided that certain U.S. entities may be considered as offering essentially equivalent data protection as in the E.U. Directive. To merit such a status, U.S. companies had to file an annual self-certification, pledging that they were in compliance with the principles of the Directive as set forth on the website of the U.S. Department of Commerce. The companies also were required to publicize that they were following these principles and, if they failed to do so, it would constitute a deceptive trade practice in violation of section 5 of the Federal Trade Commission Act.¹⁶³

The Safe Harbor Framework Agreement was in effect until 2015, when it was struck down by the European Court of Justice. The case of Schrems v. Data Protection Commissioner ^{Reference Roth-stein164} was brought after Edward Snowden revealed that Facebook and other technology companies disclosed personal data of E.U. citizens to the U.S. National Security Agency. Because such disclosures were not prevented by the Safe Harbor Agreement, the court invalidated the entire agreement. In 2016, the Privacy Shield was established to replace the Safe Harbor Agreement.¹⁶⁵ Its structure, self-certification and publication of an assurance of compliance, were the same as before, but there were two key differences. First, Privacy Shield strengthened the enforcement provisions to require that organizations respond expeditiously to complaints by E.U. state authorities through an independent mechanism, establish damages for harms flowing from improper disclosures, and increase the ability of individuals to access their personal data.^{Reference Schwartz166} Second, the U.S. government provided assurances that its national security agencies would not engage in mass surveillance of data transferred pursuant to the Privacy Shield.

In 2018, the E.U.'s General Data Protection Regulation (GDPR)¹⁶⁷ replaced the 1995 Directive, but the same approach to transfer of personal data to third countries applies. Under Article 45 of the GDPR, personal data may be exported to a country outside of the E.U. only if the European Commission has acknowledged the adequacy of data protection in the recipient country.

So far, the European Commission has recognized Andorra, Argentina, Canada (application limited to private entities falling under the scope of Canadian Personal Information Protection and Electronic Documents Act), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Switzerland, Uruguay and the United States (limited to the Privacy Shield framework) as providing adequate protection.¹⁶⁸ With the exception of Japan, the other governmental policies were assessed under the previous Data Protection Directive framework. Article 45(9) of the GDPR provides that these earlier decisions will be amended, replaced or repealed by a Commission decision during a periodic review, which must take place at least every four years. Changes in the legal framework of a third country or international organization may warrant sooner review.¹⁶⁹

Substantively, adequacy requires compliance with 10 principles, the first six of which were previously part of the Data Protection Directive:

1. 1. purpose limitation principle;

2. 2. data quality and proportionality principle;

3. 3. transparency principle;

4. 4. security principle;

5. 5. right of access, rectification and opposition;

6. 6. restrictions on onward transfers;

7. 7. the foreign country's legislation should include basic data protection concepts and remain consistent with the principles enshrined in the GDPR;

8. 8. data must be processed in a lawful, fair, and legitimate manner while being set out in a sufficiently clear manner;

9. 9. the data retention principle ensures that data are kept no longer than necessary for the purposes for which personal data is processed;

10. 10. the confidentiality principle complements the security principle by stipulating that data must be protected against unauthorized or unlawful processing as well as accidental loss, destruction or damage.¹⁷⁰

The E.U.-U.S. data protection agreement, as well as a similar Switzerland-U.S. agreement,¹⁷¹ clearly suggests that without adopting identical laws and procedures it is still possible for countries to use adequacy determinations as a way of deferring to the laws of other nations. Comparable measures could enable the use of adequacy determinations to permit single-site ethics review for international DTP genomic research.

Because of the centrality of equivalence and adequacy to the recommendations in this article, it is important to distinguish these two concepts. “Equivalence” is based on a comparison of research ethics provisions in more than one country. By contrast, “adequacy” is based on a comparison of the research ethics review process and outcomes in more than one country. Therefore, a country with equivalent research ethics provisions that failed to apply or enforce them would not be adequate, and a country without equivalent provisions could achieve adequacy through other means, such as ad hoc administrative determinations or explicit international agreements. In our analytical framework, both concepts are important, and equivalence supports the finding of adequacy.

G. Equivalency Provision in the Common Rule

Single-site ethics review with deferral to the ethics determination in the researcher's country is consistent with the following provision that has been a part of the Common Rule since 1991:

Strictly construed, this provision permits U.S.-supported researchers to comply with foreign ethics procedures if there is a determination by the U.S. agency or department sponsoring the research that the foreign procedures are equivalent to the Common Rule.¹⁷³ Without an equivalency determination, foreign researchers participating in a multinational study funded by an American agency would have to comply with the Common Rule, despite a greater familiarity with their own comparable research provisions.¹⁷⁴

This provision has not been used, however, and the Office for Human Research Protections (OHRP) of the Department of Health and Human Services (HHS) has never deemed any country to have equivalent protections. Not only should this provision be used to permit researchers to comply with comparable ethics review requirements in the countries of participants, but the spirit of this provision supports a wider application of equivalency. We believe that reports in this symposium from 31 diverse countries, our review showing adequacy and equivalency of laws regulating research with human participants around the world, and the low risk and high potential benefit of international DTP genomic research present a compelling case for recognizing the determinations of single-site ethics review conducted in the researcher's home country.^{Reference Dove, Knoppers, Zawati, Lavery, McDonald, Meslin and Sugarman175}

A. Legal Requirements

Our primary recommendation is to have single-site ethics review in the researcher's country. The most direct way to accomplish this would be to have a multinational treaty or a series of bilateral agreements establishing reciprocal recognition of research ethics determinations. Although this may be simple in theory, it would be exceedingly difficult to achieve because international agreements often require time-consuming, contentious negotiations and significant political support.¹⁷⁷

Another way in which our primary recommendation could become legally binding is through unilateral action. A country could declare that the research ethics review procedures of certain named countries are equivalent to their own and therefore adequate to satisfy the laws of the research participant's country. For example, the U.S. OHRP could make a determination that ethics review in Canada is equivalent to review in the U.S. and therefore it is adequate to satisfy the Common Rule.¹⁷⁸ The effect would be to permit Canadian researchers to conduct DTP genomic research in the U.S. without local IRB approval.¹⁷⁹

For this approach of unilateral recognition of adequacy to be effective a substantial number of countries would need to declare the research ethics review of a considerable number of other countries as equivalent. There could be reciprocal, unilateral agreements or multinational agreements. For example, the E.U. could determine that the H3Africa countries have equivalent ethics review and vice versa.

As noted earlier, focusing on the participant's country seems to burden the participant's country rather than the researcher's country and, consequently, raises the question of why the participant's country would agree to accept the determinations of the researcher's ethics review body. The answer, to reiterate, is that DTP genomic research is consensual, non-interventional, data based, and low risk. Potential participants excluded from genomic studies would be adversely affected if the individuals enrolled do not sufficiently represent the global population. We believe that any minor variation or deviation in established research review procedures for this type of research is more than offset by the public policy supporting potentially valuable genomic studies.

As a matter of strategy, it might be better for the countries performing significant amounts of genomic research, such as the U.S., to take the lead in recognizing the equivalence of other countries. Then, other countries may be more likely to reciprocate.

B. Ethical Guidelines and Best Practices

Besides legally binding provisions there are other international documents and principles that currently do or could be revised to expressly support single-site review in the researcher's country for international DTP genomic research. These include the Council for International Organizations of Medical Sciences (CIOMS) and World Health Organization (WHO) International Ethical Guidelines for Biomedical Research Involving Human Subjects (2016);¹⁸⁰ United Nations Educational, Scientific and Cultural Organization (UNESCO) Universal Declaration of Bioethics and Human Rights (2005)¹⁸¹ and Task Force on Privacy and Protection of Health-Related Data (2019);¹⁸² Council of Europe, Recommendation on the Protection of Health-Related Data (2019);¹⁸³ Human Heredity and Health in Africa (H3Africa) Guidelines on Informed Consent;¹⁸⁴ and the World Medical Association's Declaration of Helsinki (2013).¹⁸⁵

Indeed, a review of international ethics norms from these recognized bodies over the last 25 years reveals remarkable symmetry and complementarity as concerns both the principles for genomic research and for ethics review. Even “classical” biomedical principles of respect for persons, beneficence, and justice have been translated into more genetic-specific guidance. They now also include familial or community interests in genetic information, the need to examine possible group stigmatization or discrimination (insurance/employment) concerns, and more recently, consideration of the impact on future generations and ensuring equitable access. This move from strictly individualistic ethics protection to including the welfare of others affected by genetic conditions or the need for health care to include the sharing of genetic data are common to the guidance provided in the norms of these international bodies. These shared principles and guidance for ethics review in genomic research bode well for the recognition of single site ethics review.

In addition to international declarations and ethical guidelines, funders of international research, such as the Wellcome Trust¹⁸⁶ and the Gates Foundation,¹⁸⁷ could condition funding on single-site ethics review in the researcher's country for international DTP genomic research. Organizations of genomic researchers, such as the Global Alliance for Genomics and Health (GA4GH)¹⁸⁸ could also adopt best practices calling for this procedure for ethics review. This “soft” regulation could generate momentum for acceptance of this review process. The most persuasive evidence of the appropriateness of this approach, however, would be the successful use of these procedures in international DTP genomic research without significant difficulty or complaints from participants, researchers, or governments.