Draft version for stakeholder interaction and discussion - 1+MG Consent Recommendations

1. Introduction 1.1. Purpose

The 1+MG initiative aims to promote responsible cross-border access and secondary use of genomic and related-health data across Europe for research, healthcare, and policy-making purposes. This document provides consent recommendations for prospective data collections intending on secondary use of data for research purposes (without a specific project in mind), including making data available cross-border.1 The guidance focuses primary on consent content elements, as consent models and processes2 may vary across countries and contexts. These content elements can also be used to design information for re-consenting or notifying individuals of secondary use (research purposes) including cross-border access.3

1.2. Nature of the Recommendations

Recommendations are made that 1+MG adopt 1) minimum requirements (MUST); 2) best practices (SHOULD); and 3) points-to-consider (non-directive). If a minimum requirement is missing, this may mean that a Data Holder cannot legally or ethically make data available through 1+MG, or can only do so subject to special data and access and use conditions. Best practices may also reflect in some cases national legal requirements.

The recommendations are informed by the requirements of the European General Data Protection Regulation (GDPR)4, the interpretive guidance of the European Data Protection

Board (EDPB), research ethics principles5 and guidelines, as well as ethical and legal data governance principles, such as those outlined in the draft Data Governance Act, and implemented in the 1+MG Data Inclusion Policy. Justifications and explanations are provided. Legal consent requirements depend on the legal basis selected under the GDPR art. 6 and art. 9. The guidance provided is largely independent of the legal basis, with caveats provided where a consent legal basis may require less flexibility in information, interpretation of what counts as “freely given” as well as in consequences of withdrawal.6 Legal consent requirements may also depend on national laws7. Some illustrative examples are provided. National advisory bodies (e.g., ethics committees) are expected to provide additional, nationally-tailored consent guidance. Some 1+MG best practices may in fact be minimum requirements in certain national settings. It is the ultimate responsibility of the organizations involved in collecting data to identify and comply with all norms applicable to their activities.

This guidance is agnostic to different collection and sequencing contexts across Europe8, including: population databases, genomic research projects, precision medicine clinical trials, genomic medicine initiatives, as well as clinical care (such as predictive, diagnostic or confirmatory genome sequencing). Some practical implementation examples are provided to facilitate application of the guidelines in specific contexts. The guidance is designed generally for any organization who plans to collect and/or generate genomic and related-health data, with the intention9 to process the data for further research purposes (and/or secondary healthcare use) covering cross-border access. The guidelines are not specific to use of the 1+MG infrastructure per se. The guidance does not distinguish between further research purposes led by the collecting organizations and further research purposes of external researchers accessing data (except to ensure the consent covers the possibility of the latter). This is both to simplify communication, and because the publicly-funded 1+MG infrastructure is designed to support non-discriminatory access to data.

1.3. Background

The collection/generation of genomic and related-health data and widespread use for research and healthcare raises a number of ethical issues around informed consent. This includes the risk of privacy breaches; psychological distress due to the type and amount of personal data being processed and shared; risks of harm if data are misused or misinterpreted; the handling of results and incidental findings that have implications for the health of participants and/or their families, including capacity limits of health care systems to provide adequate follow-up care; and issues of vulnerability (e.g., to discrimination) related to factors including cultural, 

linguistic, and socio-economic considerations.10 Ethical issues in genetic/genomic research include the risk of therapeutic misconception; the risk of misunderstanding the purpose and design of this type of research as compared to clinical trials testing medical interventions; and misunderstanding of the risk–benefit ratio.

Additional legal and ethical issues arise where genomic and health-related data are made available to broad communities of users and organizations for secondary use. Sharing sensitive and potentially identifiable genomic and related-health data raises concerns about increased risk of privacy breaches, affecting the rights and interests of data subjects and their families. Countries outside the EEA may not provide equivalent legal protections or ethics oversight mechanisms. Moreover, the specific purposes, recipients of data, and associated risks cannot be fully specified at the time of an initial consent, raising issues about the informedness and specificity of consent. Even where the scope of consent is made clear and understood, there are concerns about the effectiveness of oversight and enforcement mechanisms to ensure data are only used for consented purposes. In short, transparent information is needed to enable individuals to make informed decisions about cross-border access and secondary use of genomic and related health data, combined with robust governance frameworks to ensure data are processed responsibly.