I. The Evolving Health Data Ecosystem

We propose to conceptualize health data as an evolving ecosystem consisting of three interconnected parts broadly clustered under three rubrics: data sources, data capabilities, and data stakeholders.⁷ Although each part gives rise to specific ethical challenges, their interdependence augments the complexity of each challenge.

II. The Fate of Consent

Access to data for research purposes, and to human data in particular, should meet certain conditions. Of paramount importance among those conditions is informed consent to the collection, storage, use, and sharing of health-related data. This cornerstone of research ethics enacts respect for research participants and promotes their fundamental ethical interests by disclosing information about a study's purpose, risks, procedures (including procedures for handling personal samples and data) as well as measures to cope with harms resulting from participation. Yet, many scholars have questioned the function and the efficacy of informed consent in today's medical and scientific practices. In particular, the role of consent has been challenged in the online environment where data flow from and toward many directions.^{Reference Vayena, Mastroianni and Kahn18}

In the field of biomedical research, complex regulatory requirements linked to the development and review of informed consent forms are often perceived as unnecessary bureaucratic burdens.^{Reference Hayden19} Informed consent in clinical research has been considered “culturally biased, legalistic, ritualistic and unevenly enforced.”^{Reference Henderson20} A recent New York Times op-ed tellingly referred to it as a “farce.”^{Reference Sekeres and Gilligan21} In this context, some see consent as an empty “ceremony of individual control and choice,” for which we had better find new alternatives.^{Reference Koenig22}

Doubts can be raised as to whether individuals can have meaningful control over escalating volumes of research data collected, for instance, in large-scale genomic datasets used by multiple researchers over long periods of time. Moreover, when consenting to have biological samples or data collected in biobanks, individuals often implicitly agree to future uses of their material under rather unspecific terms. Both in the United States and in Europe, for example, stored data and samples can generally be shared and reused without seeking additional consent provided they are deidentified. The U.S. Common Rule “incentivize[s] the use of specimens and information by allowing their use without the knowledge or consent of the individual once they have been stripped of identifiers.”²³ These practices are commonplace in the European Union as well,^{Reference Elger and Caplan24} undermining individual control over both the type of studies that will be undertaken and the entities with which samples will be shared.

To address this issue, the National Institutes of Health (NIH) Genomic Data Sharing Policy expects grantees to seek broad consent for reuse and sharing of participants' data and samples, and looks favorably at the possibility of using dynamic or tiered consent.²⁵ The recently promulgated revisions to the Common Rule also promote the use of broad consent^{Reference Blasimme, Moret, Hurst and Vayena26} as an efficient way of ensuring that data and samples are made as widely available as possible for research.^{Reference Grady, Eckstein, Berkman, Brock, Cook-Deegan, Fullerton, Greely, Hansson, Hull, Lo, Pentz, Rodriguez, Weil, Wilfond and Wendler27} In recent years, however, some have cited the theory and practice of informed consent to warrant for other — more radical — possibilities. For example, some have argued that, when risks are minimal, consent to the further use of samples originally donated for research can simply be presumed.^{Reference Wendler and Emanuel28} Others, instead, have proposed “blanket consent,” that is, consent to any future research on one's donated samples, with no further information on future uses, and with no further oversight.^{Reference Wendler29} “Open consent,” adopted by the Personal Genome Project, takes a transparency-based approach and asks donors to have their genetic and genomic data included in an open-access database, with no privacy guarantees.^{Reference Lunshof, Chadwick, Vorhaus and Church30} Similarly, the so-called “Portable Legal Consent” allows individuals to share sensitive data — such as genome sequences — with a selected pool of research institutions.³¹

What these models have in common is that they maximize the availability of samples and data, impose little or no restriction on their use, and offer limited information or control to the individual. It is fair to ask whether unspecific consent is truly informed consent, a question that has already generated a variety of responses. Among the most popular of them are that unspecific consent promotes the development of science at the cost of “diluting” the ethical interests of donors and research participants;^{Reference Árnason32} that the ethical soundness of unspecific consent is anchored on the role that well-functioning review boards play in research oversight;^{Reference Helgesson33} or that the better solution to this challenge should be found in interactive types of consent that promise to allow participants to express and update their preference regarding the reuse and the sharing of their data and samples.³⁴

These issues are already thorny in the case of research employing what we called standard sources of health data. Further complications arise, however, when standard sources are combined with expanded sources of data produced outside of conventional clinical or academic settings, and collected through commercial devices — such as smartphones and wearable devices — or even over the Internet. In this case, most of the time, informed consent of the sort we are used to seeing in health research is simply not offered. Moreover, Internet users notoriously pay little or no attention at all to online privacy notices, which detail the conditions that people accept to release their data.

This disconnect is only getting worse with the advent of big data.^{Reference Cate and Mayer-Schönberger35} Informed consent was not originally conceived for research relying on this type of data, and there are still no established ethical benchmarks to assess the use of data of this sort in the context of research.³⁶ Moreover, the collection and analysis of such data types can take place without the intermediation of institutional review boards, as in the case of citizen science projects or self-tracking activities.³⁷ Questions also arise about the efficacy of research consent when organizations possess large amounts of data that can be used for research — Facebook's experiment on emotional contagion is a prominent example.^{Reference Kahn, Vayena and Mastroianni38} Nonetheless, a number of ethically relevant elements need to be taken into account. For instance, such data are not initially collected for the purpose of medical research, and data subjects cannot opt out from specific types of data processing (including research); nor are they given information regarding potential risks and benefits of research with their data. Moreover, some of the most distinctive forms of analysis in the era of big biomedical data, such as the use of machine learning algorithms, give rise to accountability issues that can hardly be managed through individual consent alone. Under these circumstances, it is hard to imagine how informed consent for medical research — as it is currently practiced — could be relevant to such novel types of research.

As the health data ecosystem expands and evolves, informed consent may leave important ethical interests of research participants unattended. In particular, unspecific informed consent seems to err on the side of providing limited information about the possible uses of personal information. This undermines participants' capacity to exert control on donated data.^{Reference Vayena and Blasimme39} Insisting on consent while knowing that it does not satisfy informational requirements can create an illusion of control, which may compromise data subjects' rights as well as public trust. What is more, emphasis on maximizing the reuse of samples and data while at the same time reducing the bureaucratic load on science can turn out to be a disincentive to the communication of clinically beneficial information to research participants.^{Reference Blassime, Soulier, Julia, Leonard and Cambon-Thomsen40}

One way of counteracting the tendency to provide less information concerning future uses of biological samples and personal data is to use informed consent models that make room for more individual choice. These solutions have emerged especially in the field of biobanking and genetic research.^{Reference Anastasova, Blasimme, Julia and Cambon-Thomsen41} Authorization-based models and tiered consent, for instance, allow donors to decide upfront which type of studies they approve of,^{Reference Caulfield, Upshur and Daar42} or even which kind of clinical information they want to receive and how they prefer to be recontacted.^{Reference Bunnik, Cecile, Janssens and Schermer43} Others have proposed a partnership-based approach in the field of genetic biobanks that, after initial broad consent, relies on continued communication between researchers and participants in order to keep the latter informed about ongoing research, collect more data, and inform them of clinically relevant results.^{Reference McGuire and Beskow44} “Dynamic consent,” another variant, combines choice and ongoing communication, offering a user-friendly web-based interface that allows participants to receive information and update their preferences over time.^{Reference Kaye, Whitley, Lund, Morrison, Teare and Melham45}

Increased granularity allows data subjects to exert more control over the conditions of exposure of their data. This is to be welcomed, as empirical evidence shows research participants are indeed concerned about not having sufficient control on their data.⁴⁶ Nonetheless, it also loads research participants with more direct responsibilities for the management of their data. Such control may lead to excessively self-protective behaviors — preventing data from becoming accessible for research^{Reference Jones, Laurie, Stevens, Dobbs, Ford and Lea47} — or to over-exposure of personal data – which may harm data subjects by increasing the likelihood of discriminatory practices by insurers and employers. These risks notwithstanding, the value of more granular control over the exposure of self-regarding data cannot be ignored. Yet, as we explain elsewhere, enhanced granularity is more likely to arise from the synergistic effect of new forms of data governance than from innovative consent models alone.⁴⁸

The prospect of linking dispersed data sets raises two important issues: first, authorizations given for the primary data uses (whether the data are from the standard or expanded sources) are unlikely to cover all potential combinations of future uses; second, given the variety of entities involved in big data health research, in terms of both data sources and data capabilities, it is unlikely that the current oversight models will suffice. The combination of weakened consent and insufficient research oversight is potentially detrimental to health research in an evolving health data ecosystem. This state of affairs can result in direct harms to individuals and groups, and also risks damaging public trust in scientific research.

III. The Case for Systemic Oversight

Despite the interest in more granular consent models, there appears to be a tendency toward the widespread adoption of broad consent as the default model for data-driven health research. This is especially true of large-scale initiatives in precision medicine (for instance in the United States, United Kingdom, and Switzerland). The revised Common Rule, promulgated in January 2017, also introduces, for the first time, specific requirements for broad consent forms.^{Reference Sugarman49} To alleviate the tensions built into current data practices in health research, we argue, oversight mechanisms should adapt to the ecosystemic features of health data.

We consider oversight activities as constitutive elements of health research governance. We use “governance” as a broad term encompassing a variety of approaches aimed at orienting and monitoring the activities of a group of stakeholders without relying exclusively on binding legal norms or pure market mechanisms.^{Reference King and Schneider50} Governance refers to activities such as self-regulation; soft law; codes of conduct; review bodies; auditing mechanisms; expert advice; coordination initiatives among public authorities, researchers, and private actors; deliberation; citizens' forums; and public engagement initiatives. Some governance mechanisms aim at channeling the activity of stake-holders in ways that correspond to public expectations or to previously declared principles (including ethical principles). These are what we consider the oversight components of health research governance. In different ways and at different levels, oversight mechanisms contribute substantially to the creation and maintenance of public trust in research initiatives. For the sake of brevity, we term the entirety of such components “the oversight pipeline” of health research.

We propose that the oversight pipeline of data-driven health research should be able to shape practices and activities toward socially desirable outcomes. Given the interconnectedness and mutual dependencies of the health data ecosystem, we propose a systemic model of oversight for data-driven health research. The health data ecosystem that we have described in this paper is the result of a complex network of convergent technologies whose boundaries are not easy to set. Yet, converging technologies represent an opportunity for the development of innovative governance approaches.^{Reference Macnaghten, Kearnes and Wynne51} Such an approach should track critical points across the spectrum of data-processing activities and actors and remain attentive to the direction that technological development can take, in order to minimize risks for stakeholders while optimizing the delivery of public benefits.

Before we present the substantive features of a systemic orientation to health research oversight, a few preliminary considerations are in order. Systemic oversight is not limited to any particular phase of the data-processing lifecycle, nor is it undertaken by a specific body charged with oversight responsibilities in health research. Rather, systemic oversight spells out the substantive features that oversight activities should have for health research in an evolving data ecosystem. Such features are intended to create alignment throughout the oversight pipeline — for existing bodies and mechanism, as well as for new ones that may have to be created in the future. Data-driven medical progress could be hindered by differences in regulatory cultures playing out across the wide spectrum of practices and stakeholders that characterize the ecosystem. Given the difficulty and the potential inefficiency of implementing a unique regulatory framework spanning multiple layers of interdependent data-related activities, common ground is needed for the governance of health research. This is more likely to happen at a higher level of abstraction, namely, with the adoption of a substantive point of reference by all the actors involved in research oversight activities. It is our contention that such common ground could foster coordination, increase trust, and prevent systemic crises for the field due to the mis-alignment of stakeholders' motives and expectations.

The key substantive features of systemic oversight are: 1) the capacity to cope with the uncertainty that surrounds data collection and data uses through adaptive and flexible mechanisms; 2) the capacity to address the expanded temporality of data-related activities (from storing to re-analysis) through dynamic monitoring and responsiveness; and finally, 3) the ability to cope with the relational nature of big biomedical data by means of reflexivity and inclusiveness.

To account for the uncertainty that is typical of data-intensive health research, oversight mechanisms should not be seen as procedures for prospective risk assessment, but rather as adaptive instruments that respond to change. Recognizing the limits of anticipatory efforts in a fast-moving data ecosystem and the insufficiency of one-size-fits-all solutions to data governance, adaptivity refers to the capacity to devise specific oversight mechanisms for new data types and uses. The flexibility requirement, by contrast, demands that, for oversight purposes, data are treated under different rubrics depending on their actual use rather than their source. Adaptive and flexible oversight will enhance effective containment of harmful effects in case of security failures (such as data breaches, forced re-identification, and the like).

Large-scale data collection allows virtually infinite possibilities and combinations of data analysis methods that can be used to search for medically relevant correlations in datasets. The power of such analytical capabilities lies in the fact that they can be invented on the go. While certain parameters are set, it is hard to predict what future analytical developments will look like. This undermines the possibility of explicitly defining in advance the purpose of data collection and the commitment to limit data use to that purpose,^{Reference Laurie52} thus endangering the creation of public trust around data-driven health research. It is also difficult to specify in advance whether data protection measures taken to ensure the privacy of data subjects can indeed achieve this goal. The effectiveness of privacy impact assessments (PIA), a well-established practice to ascertain privacy risks in data projects, has been challenged for this very reason.^{Reference Polonetsky, Tene and Jerome53} Moreover, the opacity of algorithmic approaches, black-box medicine and the like, indicates lurking risks and the need for better accountability mechanisms.^{Reference Pasquale54} Technological transformations are faster paced than in the previous world of standard data sources and analytics. At the same time, it is necessary, especially in the scenario we are depicting, to acknowledge the limits of anticipatory practices.^{Reference Macnaghten, Kearnes and Wynne55} Since important technological players are bound to have sufficient resources to shape the field to their advantage, regulators may have a hard time trying to fix the downstream effects of such activities. Greater coordination is thus required between public authorities, academic players, and private actors in order to set up converging oversight practices able to adapt rapidly to evolving technological conditions.

Ethical oversight of data collection and use should be a continuous monitoring process aimed at detecting signals of novel vulnerabilities for research participants, such as potential harms of discrimination and new privacy risks. Ethical challenges exist throughout the whole data-processing lifecycle. Moreover, each instance of data analysis gives birth to more data with renewed life expectancy. These developments can instigate ethical transgressions that cannot be anticipated at the moment of authorized collection. Responsive measures should aim at preventing vulnerabilities from resulting in harm to individual participants or their community, as well as at containing and compensating harms should they occur. Such measures, however, cannot be entirely established during the evaluation phase of a given research project. Rather they need to be revised regularly to align with the expanded temporality of multiple data reuse.

A fundamental tenet of big data research is the identification of patterns and correlations within large collections of structured and unstructured data. In essence, such patterns will disclose not only how phenomena relate to one another but also how individuals relate to others, or groups of individuals to other groups of individuals. A typical biomedical big data project explores correlations among phenotypic, biological, and behavioral data to ascertain disease patterns. Revealing such relations can quickly implicate individuals and groups of people who were never aware of underlying correlations linking them to one another. This may have especially sensitive implications for both individuals and groups in biographical, cultural, ethnic, and racial terms. Nevertheless, it is impossible for the current one-stop shop model of ethical assessment to anticipate those outcomes and include all these features in the assessment of foreseeable risks.

Oversight activites should be reflexive enough to consider the effects of classificatory practices as they emerge from scientific activities (including their historical load and cultural consequences). It is crucial to cultivate awareness of how and why previous governance models have failed in this respect or have ended up reinforcing dominant interests and power structures over individual entitlements, communities' interests, and the common good.^{Reference Voß and Bornemann56} Reflexive oversight should thus foster the critical appraisal of the assumptions underlying previous regulatory arrangements.^{Reference Hendriks and Grin57} Reflexivity can be fostered by engaging relevant stake-holders upstream and by including lay or traditionally under-represented voices (such as the voice of patients or that of socially marginalized communities) to promote mutual learning before technological path dependencies^{Reference Collingridge58} become established.

IV. Points to Consider

Our systemic oversight model is not an isolated example of an approach providing a common ground for a variety of governance actors and activities. To begin with, the contribution of governance to social coordination, accountability, and public trust has long been established in political science and public policy studies. The so-called “new governance” (introduced in the United Kingdom in the 1990s) relies on public engagement of civil society actors, integration across government levels and between government and private actors, decentralization, deliberation, use of soft law instruments, experimentation, and mutual learning.^{Reference Rhodes59}

Many of these features are of relevance to systemic oversight as well. Interestingly, new approaches to governance have enjoyed widespread consideration in the field of science policy, in particular with respect to the public management of environmental issues. Approaches such as public deliberation^{Reference Macnaghten, Kearnes and Wynne60} and dynamic oversight^{Reference Ramachandran, Wolf, Paradise, Kuzma, Hall, Kokkoli and Fatehi61} in nanobiotechnology, reflexive governance for ecological problems,⁶² and constructive technology assessment^{Reference Rip, Schot, Misa, Rip, Schot and Misa63} all stress the “limits of prognostic knowledge”⁶⁴ and the importance of continued learning to redress power asymmetries among stakeholders. Moreover, some substantive features of systemic oversight like reflexivity, inclusivity, and responsiveness, are also characteristic of the Responsible Research and Innovation framework,^{Reference Stilgoe, Owen and Macnaghten65} which aimed at promoting the democratic governance of science and innovation.

Innovative forms of governance have also been discussed in the domain of health research. “Adaptive governance,” for instance, conceptualizes research participants as a collective body to be consulted and included in the definition of genomic biobank policies.^{Reference O'Doherty, Burgess, Edwards, Gallagher, Hawkins, Kaye, McCaffrey and Winckoff66} One frequently proposed way to keep research governance structures in line with technological, social, and regulatory change is to adopt deliberative democracy practices. In biobank research, it has been proposed that consent should not be seen as a mechanism for individual choice, but rather as “consent to a governance scheme.”⁶⁷ Deliberative democracy techniques — like citizens' forums — are tools that allow lay publics to provide input. Such forums can also become institutionalized and take the form of “citizen-led Community Advisory Boards” endowed with the right to propose policies on topics such as secondary findings, communication with participants, and the like.^{Reference Garrett, Dohan and Koenig68} The collective engagement of research participants in decisions about data governance (including the creation of guiding ethical and privacy principles) seems particularly well suited to the assemblage of large-scale repositories – such as those envisaged in flagship programs like the “All of Us” Precision Medicine Initiative.^{Reference Evans69}

In addition, in the field of health research governance, data access review has been proposed as a mechanism to assess precisely the risks connected with the re-use of personal data. Review processes can be focused on assessing coding and security measures^{Reference Hansson, Dillner, Bartram, Carlson and Helgesson70} or can instead embrace a more comprehensive evaluation as in the case of Data Access Committees (DACs) in genetic and genomic biobanking. DACs typically evaluate the fit between data access requests and the original purpose of collection, make sure that those seeking access are technically qualified, stipulate data access agreements, and monitor possible violations.^{Reference Shabani, Knoppers and Borry71} Along similar lines, Grady and colleagues endorse broad consent upon condition that future uses are overseen before approval (ongoing oversight) and that, whenever possible, communication with participants, and enforcement and monitoring activities take place.^{Reference Grady, Eckstein, Berkman, Brock, Cook-Deegan, Fullerton and Greely72}

These models of expanded and more effective governance in health research are laudable. Many of them possess some of the substantive features of systemic oversight. Yet, they have been proposed for standard sources of data, and they focus either on policy-setting mechanisms for large-scale research initiatives or on review procedures for the use of research resources. Systemic oversight instead is intended for issues arising when data sources are mixed or when big data research is conducted by organizations that are not conventional players in the field of health research. Moreover, systemic oversight cuts across policy-making and operative decisions at the level of local research initiatives. Finally, this approach considers all data types as potentially sensitive data — irrespective of the context from which they were sourced.

Implementing the principles of systemic oversight across the spectrum of regulatory activities taking place in data-driven health research will certainly have numerous procedural implications, which we do not discuss here. Suffice it to say that oversight bodies adopting a systemic orientation will need to apply the principles of systemic oversight to their composition, their mandate, their operational mechanisms, and their enforcement and monitoring powers. Undoubtedly, this process of adaptation and substantive convergence toward systemic oversight will be complex. Nevertheless, the required transformations are no greater than the scientific, medical and societal revolutions that big data are causing globally. The scale of the digital revolution in medicine and medical research is such that remodeling regulatory standards with the aim of steering innovation is not only desirable but rather imperative.

The legal landscape around the use of personal data — including for research purposes — is evolving and will continue to evolve in the years to come, as evidenced by the European General Data Protection Regulation (GDPR)⁷³ — adopted in 2016 and to become operative in 2018 — or by the planned revision of the Swiss law on data protection.⁷⁴ New legislation may also introduce new elements to the existing oversight pipeline, as is the case with the GDPR demanding the presence of data protection officers (DPOs) at each research institution.⁷⁵ While those developments are necessary, legal solutions alone cannot address the full complexity of the heterogeneous ecosystem of data-driven research. As noted by Laurie, legal frameworks for specific kinds of health practices (e.g., biobanking) have often proved ineffective and burdensome.⁷⁶ Moreover, nation-specific legal approaches to health data management may hinder cross-border collaboration and exchange. New legally required oversight components — like DPOs — will need to be aligned with the other pieces of the pipeline.

Efficient governance will require a common orientation between the various components of the oversight pipeline.^{Reference Vayena, Gasser, Wood, O'Brien and Altman77} Systemic oversight endorses the idea of distributed responsibility for the processing of health data. This may lead to difficulty in tracing responsibility for decisions that affect different stakeholders in different ways. To avoid the dilution of accountability, we argued that the systemic oversight processes should remain modifiable through the input of concerned stakeholders (inclusivity).

The complexity of the health data ecosystem will require concerted effort to address emerging ethical issues. Enhancing the granularity of consent should definitely continue to be pursued. In addition, innovative research governance models need to be given appropriate consideration and tested in practice. However, the new reality of big data research within the evolving data ecosystem demands ethical controls that are spread throughout the continuum of regulatory activities and can respond to unexpected events across the life cycle of data use. We have argued that this can be achieved through the implementation of a systemic oversight approach tailored to the features of the health data ecosystem. Systemic oversight, we have argued, can become a catalyst for ethical health research in the big data era and holds the key to public trust in research. We have sketched the substantive cornerstones of such an approach without discussing the necessary procedural adaptations. Our aim is to generate discussion around the conceptual shift toward the systemic oversight approach, to make progress toward its operationalization.