TRANSCRIPT, Meeting 8 Session 3


February 2, 2012


San Francisco, Cal.


Jane Kaye, D.Phil., L.L.B.

Director of the Centre for Law, Health and Emerging Technologies (HeLEX), Oxford University                                                                                   

John Wilbanks

Founder, Consent to Research, Senior Fellow, Kauffman Foundation, Research Fellow, Lybba


Download the Transcript



            DR. WAGNER:  Well, good afternoon.  Welcome back, to our guests.  This Session 3 is also on the privacy issues, control, access and human genome sequence data.

            I remind the folks joining us, that if you develop questions during these presentations, or as we are asking questions, the staff can help you locate a card to get that question up to the front, and we're very happy to interject your thoughts and comments.  This is a learning period for the Commission.

            So, picking up where we left off before lunch -- I'm sorry, did you have something else you wanted to announce?

            DR. GUTMANN:  No, no, not at all.

            DR. WAGNER:  We're going to focus this session on the issue of privacy, how it relates to access and control of genetic information, after sequencing a genome.

            The speakers we have, Jane Kaye and John Wilbanks, welcome to you both.  We'll begin with Dr. Kaye.

            Jane Kaye is Director of the Center for Law, Health, and Emerging Technologies at Oxford, also known as HeLEX, which is based in the Department of Public Health at the University of Oxford.

            She is a member of the Ethics and Confidentiality Committee of the UK National Information Governance Board, the Sample and Ethics Committee of the 1,000 Genomes Project, the UK 10K Ethics Advisory Board and Chair of Canada's Cartogene International Scientific Advisory Board, among other bodies.

            Her research involves investigating the relationships between law, ethics and practice in the area of emerging technologies and health.  You can see why she is perfect for this session.

            Her main focus in on genomics, with an emphasis on bio-banks, privacy, data sharing framework.

            We are delighted that you braved the long flight over here, and I'm not certain what time it is for you, but I'm sure -- we hope we make it worth your while. It certainly will be worth our while to hear from you.  Welcome.

            DR. KAYE:  Thank you very much.  It's very kind of you to invite me, and --

            DR. WAGNER:  Make sure that microphone is on, please, Jane.

            DR. KAYE:  And it's definitely worth the trouble.

            So, what I wanted to do really, was to actually suggest that -- to bring in some of the perspectives from bio-banking and to suggest that what we need to do is make a conceptual shift in thinking, away from simply thinking about privacy as something that has to be protected, but rather to think of it as something that needs to be enacted through partnerships.

            So, that’s my starting point.  So, what I'm going to do is talk about what is privacy, to talk about some of the new developments in science, and how this challenges protections for privacy that we've traditionally used, such as informed consent, withdrawal and anonymization, and third -- fourthly, to talk about ways forward.

            So, this is a quote from Justice Laws in our Court of Appeal in Britain, and he said about privacy that, "Subject to certain qualifications, an individual’s personal autonomy makes him -- should make him master of all those facts about his own identity, such as his name, health, sexuality, ethnicity, his own image and also, of the zone of interaction between himself and others. 

            "He is the presumed owner of these aspects of his own self.  His control of them can only be loosened, abrogated if the state shows an objective justification for doing so."

            So, I want to just bring to your attention, it should make him master of all those facts about his own identity.  So, just -- and also, just note -- and also that he has control over this, and in Britain, when our justices talk about 'him' or 'he' or 'his', they actually also include women.

            So, what -- how is science changing and what are the current trends in science?

            So, if we look at this picture, it's an artist's impression of the internet, and the interactions on the internet, and I think this is a very good representation of global science interactions.

            So, if we think of the white nodes as actually being bio-banks, where information and samples are collected, organized and then sent out again, across global networks, and so, we actually have a series of research networks, which actually  are networks within networks, and through this increasingly, we're going to have whole genome sequencing, and I think this is a real change and it's been brought about because of technology.

            But also, a vision for the future is actually this, which is the fact -- this is taken from C.S. Lewis book, 'The Lion, the Witch and the Wardrobe', and it's actually opening up onto a whole new world, and I foresee that in the future, what we will have are networks within networks of information, so that a researcher will actually be able to go to one portal and actually access a number of data sets, without actually knowing that they are actually accessing different data sets, so that it will be a seamless whole to them, and I can see that this is the way that science is going, and actually something what we want to encourage.

            But underpinning all of this change are fundamental principles that come from our research governance, and I think that there is real challenges to some of the things that have been implicit in our research governance frameworks for research, and underpinning our research governance frameworks is this idea of a social contract, and this has been based on a respect for persons, but also, altruism and appeal to solidarity.

            So, people participate in research, knowing that it will actually do good for others, but also they will be respected, and so, in return for this -- entering into this social contract, participants have been promised confidentiality, but not necessarily control over their personal information, as outlined by Justice Laws, and in some cases, they been promised anonymity, and so, procedures and practices have been developed on the basis of this implicit agreement.

            But with this new way of doing science, one of the big challenges is to this concept of informed consent.  So, these requirements are outlined in the Declaration of Helsinki, which is an international instrument, and that basically requires that people should be informed prior to enrolling in research, that they should know who is doing the research and the nature of the research, and of course, this must be obtained at the beginning of the research processes.

            Now, these requirements, as people will be well aware, are based on the Nuremberg Code, and they're actually requirements that were designed for physical harm and really, for one project research, and as we move to networks within networks, this requirement becomes increasingly challenged.

            So, when we're talking about bio-banks, it's very difficult to inform research participants at the time of collection, of all the research uses and who will use data or samples.

            This focus on informed consent also focuses on individuals, rather than the concerns of families, groups and populations.

            So, what has been suggested and what is used within bio-banking is a broad consent, and consent for a broad range of purposes, and this is often described as actually letting people know the rules of the game.  So, basically, that that is going to happen when you enrolled in a bio-bank.

            However, this is contentious and the reason it's contentious is that it's asking individuals to give a one-off consent for the use of their medical information, which will be used for many years, and that you have to build up profiles on individuals, so that you could link the different data sets, but also, you get the richness of data that is needed to understand the etiology of complex diseases.

            So, effectively, a broad consent is what I am calling a consent for governance, as hard decisions will be delegated to research ethics committees or advisory boards attached to the bio-bank, and so, really to kind of mitigate some of these issues and this risk, bio-banking has really developed a number of public engagement initiatives and ways of incorporating people into the governance structures of bio-banks.

            So, the problem is with the consent for governance, is really the heavy lifting for our research governance and oversight, is done by research ethics committees and oversight bodies, and these committees are being asked to stand in the shoes of participants and actually make decisions on their behalf, and that is well and good, but I think there are sometimes limitations when we think about the complexities involved in research, but also the privacy issues, which as other people have said, is very individual specific and context specific.

            So, oversight is done by institutional research boards, but their enforcement powers are variable. 

            So, they have few enforcement powers once research has commenced, and authority is generally nationally based, so that's problematic for global networks, and decision making is committee specific, so that also makes it very difficult, when you're wanting to share samples and data across borders, because you may have different decisions by different committees.

            The second plank of medical research ethics, which is actually challenged by global data sharing is that participants should be able to withdraw from research at any time, and withdrawal cannot be promised when data and samples are shared widely.

            Computer data sets containing personal information must be continually archived, and it's difficult to claw back minute segments of sequence spread over a global network, and data used in multiple research projects.

            So, as my colleague Eric Meslin said, it's a bit like Hotel California, you can check out you any time you like, but you can never leave.

            So, in terms of safeguarding privacy, we can no longer promise that individuals remain anonymous, as we have been able to do so previously, when it comes to data sharing.

            DNA is a unique identifier.  Data can be replicated indefinitely.  Data is shared globally and can be linked to other data sets.  Genome sequence is becoming more accessible to people, other than researchers, through companies, and yet, we're still actually asking participants to be altruistic and to hold to their side of the bargain.  Can I continue?

            DR. WAGNER:  Yes.

            DR. KAYE:  So, the issue is, are we actually placing too much emphasis on anonymization techniques, so much so that they are ineffectual, and it is a bit like putting a gate in a field.

            So, I think there is limitations on how far we can anonymize effectively, particularly when we get very rich data and we get whole genome sequence data, and I think this can be detrimental to science, really, because in actual fact, it's the richness of the data which is so important.

            Also, the issue is, I'm not sure that people are concerned so much with anonymization, but they're concerned with being asked about data.

            So, if data is taken and anonymized and used for secondary purposes, I think people want to know about that, and I think that is an issue that we really need to consider and more research needs to be done on that.

            So, this is my second to last slide.  I think that in actual fact, some of the initiatives that we've seen developed within Europe are a move towards e-governance, and this very much in development, but I think that as a way of going forward with this kind of portal and being able to open the wardrobe, something that we need to do is supplementing our current governance mechanisms with forms of e-governance.

            So, if you imagine a researcher going through a maze, there are ways using technology that you can actually prohibit them from doing various things.

            So, IT becomes a system of governance.  We develop pathways approach, not just for researchers, but also, for research participants, and we move to a situation where we have ELSI by design, ethical, legal and social implications built in to control and direct what people do and the flow of data.

            I also think very important here is patient-centric interfaces and a concept that we're -- that we've developed a sort of dynamic consent, which is through a patient-centric interface.

            But also, within bio-bank, there is acknowledgments being developed for contributions.  So, IDs for bio-banks, which have been developed by Anne Cambon-Thomsen's team in Toulouse and also, for researchers through the ORCHID model.

            So, this also could have the potential to enable the tracking of the use of data, to cut down on expert committee oversight, as well.

            So, I've got a slide here which actually puts this into context, but I can talk about that later. 

            This is my final slide.  So, in conclusion, we need to bring research governance into the 21st century.  I think there is a great potential to implement 2.0 technologies to enable the greater involvement for people in research, and through that, developing accountable and transparent governance mechanisms, which actually could help us with having better frameworks for translational research.

            So, thank you.

            DR. WAGNER:  Thank you, Jane.  I'm going to introduce to the Commission now, John Wilbanks, who is a Fellow at the Kauffman Foundation, was previously Vice President of Science, following a fellowship with the Worldwide Consortium for Life Sciences.

            Also, founded -- he also founded and led Incellico, a bio-informatics company that built semantic graph networks for use in pharmaceutical research and development and served as the Assistant Director for the Berkman Center for Internet and Society at Harvard Law School.

            He's a research affiliate with Computer Science and Artificial Intelligence Lab, with a concentration on mathematics and computation and serves on the Advisory Board of the U.S. National Library of Medicine and also, Open Knowledge Foundation, and Open Knowledge Definition.

            Welcome, we're pleased to have you.

            MR. WILBANKS:  Thank you.  Thank you to the Commission for having me here today, and I couldn't ask for a better set up than Jane has delivered.

            So, I am going to probably talk about different things than I've heard this morning, and when I talk about privacy, I tend to think about it from a web perspective, and so, this is the working definition I tend to go from, and if you've never read Dana Boyd's work on privacy, I would highly encourage it.  She studies in many ways the way that people use the web and what they think about privacy.

            And this idea that it's about context, social situations and control is at the heart of her work, and what I'm going to talk about really emerges from that idea of privacy.

            So, the first point I wanted to make is that we, people like me, not researchers, I have less degrees than anyone here, I think, are going to get our genetic and health data one way or another, and just as an example, when we get that data, we don't have the right to decide what’s done with that data about us.

            So, if you think about the movements in European privacy, they’re attempts to give the individual more agency over what happens with their data, but Facebook's S-1 filing is proof of what happens when a company controls lots of data about people.

            The current projection is somewhere around 100-billion U.S. for the IPO, and when you sign up with Facebook, which is a nice way to share, as they say, they own all the data you put there, and so, we don't have agency.

            And so, in many ways, I think the privacy debate that I run into is more a debate about agency, which is the right to decide what is done with my data and the right to see a copy of what people know about me.  If I would like to see everything Facebook knew about me, I wouldn't be able to.

            Now, if you think about our capacity to generate data about ourselves, whether it's through downloading a health record on Blue Button or installing an app on our phone, getting our gene sequenced or wearing a Fitbit, which is a personal heart rate monitor and other sorts of devices, like you track your lifestyle, we have a growing capacity to generate data that used to only be researcher-generated.

            We can get our genome sequence.  This is an individual's health profile.  It's obviously a male, because he has a high incidence risk for prostate cancer, 32 percent versus the average risk of 17 percent.  We don't know what to do with it, but we have the data.

            We have the right to access our medical records, but they come often as scans or faxes, as opposed to digital information that you can re-upload in a useful manner, and you can put apps onto your phone,is one from Massive Health, which is a start-up here in San Francisco.  They've come out with a very popular chart this week on why carbs are killing you, and it's a beautiful application that tracks the relationship of what you eat to how you think you feel. 

            This is all tremendously valuable data, but it's disconnected from the medical record and disconnected from the genotype.

            The other thing that's weird about this is, we're also going to talk about all of this information, whether or not it has to do with privacy.

            So, if you've seen PatientsLikeMe, this is a self-reported community of about 100,000 people.  Quite a few of the ALS community are gathered there.  They have done a self-study on whether lithium impacts ALS positively or not.

            This looks like research data.  It's not a research project.  It was nowhere ever near an IRB.  And these people have voluntarily shared all of this information with each other, as well as with the company that is running the study, and if you try to get your own medical records and you can't get them, you're also going to talk about it, right.

            So, look at all the privacy violations in the first paragraph.  He is worried about the names.  I've changed the names of the hospital and physicians, to protect them, right.  Different world.

            Genomera, another start-up here in San Francisco.  For disclosure sake, I serve as an advisor.  The goal here is to let any group of people of more than two, come together and run a medical study, whether it's on what you eat or a medicine you take or a lifestyle you have, to actually rigorously observe the outcomes.

            And so, all of the stuff is emerging outside the system that we live in, because the system we live in is not functioning for the needs.

            Another company, the idea is, if you're ill and you get genotyped, you might want to take that into your doctor, but your doctor is going to have a deer in the headlights look.  So, this is a company that provides services to doctors, to understand genotypes in real-time, by getting reports that are automated.

            Genomes Unzipped is a place you can upload your genome, if you'd like to have other people do research on it.  I think it's a one-page privacy policy and you just click, and then you see, do you think this is going to get better or worse, as the cost of genome sequencing drops?

            And so, my like sad realization is that whether it's your genome or your health information, anyone who really wants to screw you will probably be able to get a copy of the data they need to do so, and the people who are least likely to get a copy are the people who can do something amazing with it, like researchers.

            So, that is my depressing start.  The more hopeful part is that data is the first step on a pretty long chain towards actually making a wise decision about something, and so, I think we should be focusing more on the transformations of data into information and knowledge, and how we can enable that, while also trying to create agency for people, than trying to stall information flow.

            This is one gene sequence.  It's the CAS-10 gene.  I think this is what you would get -- the privacy law theoretically regulates.  Here is a structure of that through NCBI, into a little more information, doing some sequence alignments.

            Now, we can see that it's apoptosis-related.  Now, we see it in the context of the apoptosis pathway, all right.  It's on its way from data, to something approaching knowledge.

            But when I actually download my own genotype from 23andMe, and this is mine, I get something that looks a lot more like the first element.

            So, I would really like to be able to upload my data, so that researchers can add it into this system, but if I have to try to enroll in a study somewhere to do that, it's often too complicated, if someone has to find me to enroll me, it's too complicated.

            The web is a wonderful way to make these sort of connections happen, at a very low transaction cost. 

            So, Open-Snip was a reaction to this.  This was some people in Germany who got pissed off and just wrote a website, that would let anyone upload their 23andMe file and let people start attaching papers and annotations to the Snips.  It has zero connection to bio-ethics in the professional sense.

            And so, if you want to try to think about how to turn the data into knowledge, models are one of the best ways we have to do this computationally.  Weather models convert raw weather data into snow predictions, so you know whether or not to go skiing in Tahoe, and we're beginning to see biological models emerge, as one of the best ways to transform this data into something actionable. 

            All right, should I take drug one or drug two, based on my genotype, and we've thought about previously, in the context of diagnostics and biomarkers, but we really would like to be able to make decisions that say, "Based on my genotype, I have a very low chance of this cancer drug working, and maybe I should take a different drug."

            All right, and the best studies on this indicate that three out of four cancer drugs fail in vivo.  All right, the average efficacy of a cancer drug is 25 percent.  That is probably at least somewhat genetically determined, and we can at least begin to dig into that, if we can start to get into this sort of modeling culture.

            The big problem is that the infrastructure for that modeling is just emerging, compared to weather modeling, compared to social media, we have very little infrastructure to make that transition from data to information, to knowledge to wisdom.

            This was published yesterday, in Healthcare Finance News.  Four reasons patients aren't managing their care, one of them is patient engagement hasn't been proven, but there is a great quote buried in it, which is that technology doesn't support this.

            So, all these different pieces, whether it's your iPhone app or your genotype or whatever, you don't have the technical infrastructure to bring them together, and neither does a researcher who might like to do something with them.

            So, Sage Bionetworks, which is a non-profit in Seattle that spun out of Merck, when Merck realized they couldn't do enough of the modeling in-house and they needed to have a much broader engagement.  So, Merck basically gave the whole thing away.

            I sit on the Board.  Jane has been helping us, as well.  The goal of Sage is to actually provide that technical infrastructure.  So, they have spent millions of dollars and several years creating an open compute environment, into which my genotype and my health record can be loaded, and out of which a researcher can come and begin to build models.

            And unfortunately, we ran into the problem, which is that there is no consent structure for this.  So, I had to quit my job and start a new project to try to build a consent structure that actually works for people to upload their data and have researchers legally access it.

            This is what it's going to look like, when it's finally IRB approved.  There is a real consent form underneath it.  It's 24 pages long, at current, but you go through a wizard that takes about seven to eight minutes, and teaches you the key pieces of what you're going to do.

            The goal is to create a cohort that is at least as large as Framingham, if not an order of magnitude larger, that is consented, contactable and open, in the sense that you can unanticipated research, as long as you drop me note every now and then, and let me know what you're doing.

            We don't want this to be all of the world, but there are quite a few motivated patients who would like to get their data into this sort of framework.

            The big question is, what happens, even if we get IRB approval, and even if we get informed consent, what happens five years down the road, and that is probably the biggest barrier we face.

            So, my wish list, and this is my last slide, is I'd like to see some of the uncertainty around e-governance and experimentation removed. 

            So, I'm not asking for blanket approval for everything, but it would be nice to see some safe harbors carved out, for IRB approved experimentation with new models for consent.

            Because consent is typically created through a conversation between a clinician and a patient, doing the entire thing digitally in a way that actually allows greater sharing is something people are legitimately worried about, and we'd also like to see some conversations that harm is not the act -- is not the act of distributing data.  Harm comes from actions that are taken once the data has been distributed.

            It comes from identification, discrimination and other types of activity, not with the distribution of the data, because trying to control movement of content in the internet age is a failing strategy, and last is that it would be nice to see matching grants for infrastructure.

            Most of the stuff that I've talked about has been privately funded, and it would be really nice to see specific line items carved out for the construction of highways, if you will, in this phase.  Thank you.

            DR. WAGNER:  John, thank you very much.  You're right, this is a different tack and a different view than we have seen through the day.

            Commissioners, comments or questions for these two?  Raju?

            DR. KUCHERLAPATI:  Both of you, thank you very much for coming, and it's really remarkable.

            So, John, the picture that you painted is really tremendously interesting.  As Jim is pointing out, you know, in the past, when you think about health information, it is just between the doctor and the patient, and the electronic medical records, and how you keep the information together.

            But now, it's a completely different world.  The picture that you have painted about all the social networks and individuals trying to get their information through going through 23andMe or Navi-genetics or some other place, and voluntarily putting that information, you know, onto the net, you know, for people to utilize the way that they want to utilize it, or exchange information for other individuals, such as themselves.

            So, in a -- the question is, given this tremendous amount of explosion in the social networks and the way that the people behave and exchange information, is the whole issue of privacy, is it exaggerated or -- because it looks like that most people are willing and wanting to share the information with everybody, and our notions about patient and doctor issues are moot.

            MR. WILBANKS:  I don't know if most would.  I think most people aren't even really aware of it.

            You know, I go shopping for something for -- I have a 10-month old at home.  I go shopping for something for him and for the next week, ads for that are at the top of every webpage I see.

            You know, anyone that wants to snoop on my phone behavior, just has to install an app that has a function I like, and I'll sort of sign off on it.

            So, I'm not sure most people are aware of it.  I think it sort of pervades the culture we're in, and where you don't have HIPAA involved, there is not a lot of barriers to companies exploiting you.

            I do think that there are some people who are motivated, either because they're the sort of people who think of themselves as on the edge, or because they have ill family or they are themselves ill, who would place accelerating our ability to tie genetic traits to health outcomes above privacy.

            And so, that is the group that I am focused on trying to work with, is people who are willing to endure 10 minutes of education on consent and openness, in order to enroll and then upload the data they have gathered about themselves, because I think that we cannot accidentally get people sharing information about their health, the way that people accidentally share information about what webpages they go to, because while we figure this out, I think that there is a real danger of sort of applying the web model too closely to the health information space.

            So, when I show what I'm doing to the people at Apple and other places, it is like I did something very rude at dinner, because it takes so long for you to go through the process, and they say, "Well, no one is going to do that.  It takes three minutes," and I'm like, "Yes, that is the point."

            DR. WAGNER:  Jane, let me ask, is there a place in the world that John is describing for us, for this -- what did you call it?  The exercise of consent for governance, to take place, or must it be distributed, as well?

            DR. KAYE:  I think I'd like to just pick up on your point again, and to just say that actually, I think what people consent to is context specific.

            And so, there is a certain -- it's whether people actually trust the person that they're actually giving information to, so that if I share information with a friend, there are certain expectations about what that friend will do with that information, as opposed to me sharing that information with a journalist.

            And so, I think we need to be very clear that there are different contexts and people have different expectations, but also into that mix is the fact that individuals may decide -- may have very different expectations about the context, as well.

            Sorry, could you just repeat your question?

            DR. WAGNER:  Actually, thank you for addressing that.  I am wondering, you talked about this --

            DR. KAYE:  Consent?

            DR. WAGNER:  Yes, this consent for governance, and when we have this rather distributed picture that John Wilbanks is painting for us, is there really an opportunity and -- to do what you're talking about, and is there a locus to doing that?

            DR. KAYE:  Well, I think that the problem with our research governance frameworks at the moment is that we have too many expert committees actually making decisions on behalf of individuals, and what I would like to see is a more balanced situation, where that we actually enable individuals to be involved more, in how their personal information is used, or simply just to know more about how their information is used.

            So, I think consent for governance does work, and I think -- but I think people have to actually know that that is what they're doing, and I don't think that people do, all the time.

            So, I think we do need a number of different governance mechanisms from people actually consenting in real-time, in terms of a dynamic consent, but also, giving that responsibility or authority to other people, to act on their behalf.

            MR. WILBANKS:  And one example of this is that you might allow a chunk of your health record up to be fully opened, but to say, if you'd like access to my genotype, you need to contact me, and then I can decide on a one-off basis, who I decide to give it to.

            If you have a large enough group of people, that's not an undue burden on the researcher because you just find the people who are willing to play by the specific protocol you want out.

            But right now, recruiting 500 people is so hard, right, and you think about how small that number is, in the context of the web, and if you can blow those numbers out, then it becomes a lot easier to begin to do the sort of flexible governance that Jane is talking about.

            DR. GUTMANN:  So, John, I think what you're trying to do is enormously consonant with what not only technology enables, but what we've seen a lot of people have resonated to, which is the power of numbers on the web, of getting information that is really useful.        I think what is -- I'm particularly impressed by -- is that you want the kind of consent that would actually inform people about what they're opting into, and you recognize that some people won't want to do that, just as some people, myself included, don't have a Facebook page, and may -- I may die, never having a Facebook page and not regretting it, right.

            But the -- so, the question is, how do you think -- what do you think the next steps are that would facilitate, enabling people who want to share information the way you've described, to be able to do it, knowing what they're getting themselves into, the upside, as well as what, you know -- the unintended effects are, which there are, and at the same time, protecting people who -- like I don't want to be on Facebook, may not want their genetic information shared --

            MR. WILBANKS:  So, I mean, we've --

            DR. GUTMANN:  -- in the way that would be on the web, that is made public?

            MR. WILBANKS:  And so, I mean, we're sort of bulls in the china shop, with this project.

            And so, we've been trying to get advice, so, I'm not going to imply endorsement from Jane, but she has listened to me patiently on the phone, quite a few times.

            The biggest thing is making it -- for us, has been making it voluntary and saying, if it's data you've already got about yourself, and then you choose to press the buttons to upload it, that is the biggest difference in this, from the personal genome project, which I heard referenced, and we're working with them.  We're actually basing off of their consent protocol.

            And it's this corner that says, if you've already got data about yourself, all right, you've gotten a copy of it from somebody else, unless you did your own sequencing at home, and so, it's simply a way to make sure that data gets accessed by researchers.

            So, it's very difficult to accidentally get through the system that we're designing.  What I want to make sure is that these sorts of projects and pilots are allowed, they don't wind up sort of -- I don't want 60 Minutes showing up later, saying, "You know, you tried to convince people to sign up and give their data away," because I think this is really only for people who really want in, right now.

            I think there is going to be a multitude of gradients between that and people who don't ever want to be part of a genetic study, and my hope is that this sort of systems Jane talked about are that gradient, but someone has to go ahead and get out on the leading edge of things and do some fully open stuff, I think to make the argument for the gradient between.

            DR. GUTMANN:  Jane, what is your view on this?

            DR. KAYE:  Well, I think you're absolutely right, that we need to do more pilot studies.

            But what I'd like to see is that things become mainstream.  So, we're developing a dynamic consent interface for participants in a bio-bank in Oxford, and we've got the prototype developed.

            And so, I think what would be good is if we could then actually take the prototype, try it out in other countries where there may be other cultural -- different cultural expectations of how information is used.

            But I think that we need to think about e-governance for research in total.  So, while it's very good to focus on research participants, and I strongly agree to that, but I think also, we need to think about these other mechanisms for researchers.

            So, we're actually building a research governance platform that is based on e-governance.  So, you know, because if you just look at participants, that is one aspect, but there is a whole range of ways, and I know that John and Sage Informatics are doing that.

            DR. WAGNER:  Actually, a question and a comment we have from the audience, I believe dove-tails right into this.

            So, if you don't mind, Dan, I'll insert this one here.

            It says, the genome -- inasmuch as the genome represents a digital human being and could provide the foundation for some sort of digital human rights in the future, two questions.

            Should the U.S. lead the way in recognizing that a person has a right to privacy and owns those raw data, and secondly, would it make sense to require that entities storing personal genetic data should be subject to audits, to prove authorized consent?

            DR. KAYE:  So, a right to privacy and raw data, I mean, the closest that we have is the Marper Case in Europe, and basically, the Court said that there was a right to privacy in genetic information.

            So, I think that establishes a good precedent.

            If we're then talking about whether entities are accountable for the use of personal information and genomic information, well, I think, you know, that is absolutely right, and our researchers now, in publically funded institutions, are accountable.

            I mean, they receive funding.  They have to go through research ethics committees. There is that structure in place, but it could be more rigorous and involve the individual whose information it involves.

            DR. WAGNER:  John, I think the issue sounds a little more complicated, if I have signed on to upload my private data, what assurances -- is it appropriate to have assurances in place, that those data are used?

            MR. WILBANKS:  So, this is -- the question of whether you're -- whether data equals property is probably outside the scope of the conversation, but it's one to at least bookmark, because it's clearly not, in the United States, at least, intellectual property, all right.  It's not a creative work.  It's not an invention, and so, to the extent that it is IP, it's a trade secret and that's, I think, where you would sort of categorize it.

            So, trade secrets lose their trade secrecy when you make them voluntarily public, all right, like recipes or other sorts of things.

            DR. WAGNER:  And material, as well.

            MR. WILBANKS:  Yes, yes.  But to the extent that you have a digital version of it.

            So, I'm not sure that thinking of these things as property that can be owned in the sense of the way that you own a beer or whether you own your copyrights, is the right way to go.  I think it's really more of, it's secret, and you decide whether to keep the secret or not.

            In terms of audits, I know that's at least part of the European privacy directive is that you have to -- if you're going to hold that sort of secret, you need to be auditable, and the balance comes back to what I heard earlier today, which is, we have to balance -- as individuals, we have to balance that against the benefits to society of being able to actually understand genetic variation and how it impacts health.

            So, I just think in the end, it comes down to individual agencies.  It's not something I want to make Amy do, but I would like to have the right to do it myself, if I wanted to.

            DR. WAGNER:  Dan?

            DR. SULMASY:  I wanted to ask a little bit more about sort of concretely, how e-governance would actually work?

            I mean, it sounds like a nice idea, but I don't really have a lot concrete about it, and I thought maybe a way to get into it would be to sort of propose a research study, and you could walk through me, you know, how we could do this.

            Say, we've got a big, you know, database which links patient electronic health records to their whole genome sequence.  Is this already there, right, and it's -- and I've got a patient that I've just diagnosed with a mild form of cystic fibrosis, right, and they haven't been diagnosed before as cystic fibrosis.  They've just got sinus problems, bronchitis, diarrhea and azoospermia, they're infertile, they don't produce any sperm, all right.

            So, I'm interested then in saying, does anybody else have this disease?  How prevalent is it?  What is the natural history of it?  How penetrant is it, and one of the ways I might think of finding that is sort of see, you know, who else has this gene and who else has azoospermia or maybe, who has sought out IVF treatment in the past?

            This could be sort of sensitive information, and this is the study I want to do, to sort of look at this variant.

            How do you protect that that is all I do?  Should I be allowed to do that?  What if I want to also try to find out who they are, so I can interview them, because they might not even be diagnosed?

            Should I -- what protects me from also selling this data, if I find it, to people who want to market adoption services or IVF to those people?

            So, how does e-governance work in a sort of concrete case like that?

            DR. KAYE:  Okay, e-governance is very much a concept that I'm still developing.  So, you'll have to bear with me.

            But I think it's a concern with the fact that in genomics, if you're going to access sequence data from DB-Gap, for instance, what is being developed is a series of data access committees, and so, each project has data access committees.

            So, you have to actually apply for access, which is just sort of another tier of research ethics governance.

            So, if you wanted to basically do that inquiry, I think we need to have systems in place, which are sort of like a cocoon of a research community, very much like being -- which is developed through sign up, so that you actually have a system where there are clear rules and obligations and clarity about who has access to data and that can be tracked through just seeing how people use data.

            But I think one of the key things here is actually understanding disclosure risks and also, making sure that individuals are aware of those risks. 

            So, it is very much going back to what John says.  But I think walking through that, instead of you having to necessarily go to a research ethics committee for approval, you would then be part of a research community.  You could then say, do certain kinds of linkages or certain kinds of research, as long as it was within the bounds of what was proposed and the consent, and all those other things.

            So, I'm not saying that we take those other -- the governance mechanisms we have in place, but in fact, we expedite them and make them far more efficient.

            MR. WILBANKS:  One way to think about it is, think about the way that you're tracked with your cell phone and imagine imposing that requirement on researchers when they did research inside complex genetic data sets, and you wouldn't necessarily publish that graph of the researchers' activity, but at that -- the transparency of the actions themselves is a form of governance.

            Right now, if I access a bunch of human sensitive data under an IRB group, you have no idea what I'm doing with it, until I tell you through a paper, what I did.

            And so, in the computer environment, that can become quite transparent, and so, you could even imagine not having to go to the IRB every time you wanted to exploratory data driven research, but knowing that if it came down to it, your records could be pulled and they would see how your normalize the data, what linkages you did and so forth.

            I think that sort of information doesn't need to be published.  It's competitive information from a scientific perspective, versus another scientist.

            But knowing that it's out there and it's accessible to your review committee is a very powerful form of governance to do the things that you said that you would do, and then as a scientist demonstrates that they're trustable, they can get more and more latitude to do exploratory digital research, all right, inside the database, and you could have a gradient between one organization might say, "You've got to come every time you want to run a query," and another organization say, "I'm going to give you monthly log-in and tokens that don't run out."

            So, that flexibility is what I think of, when I hear e-governance.

            DR. SULMASY:  And just to follow on it.  So, you're suggesting then, that this might replace IRB's as -- for this data set, and the secondly, what I heard described in the end was more an e-tracking than really e-governance.

            It's not as if there are blocks being imposed within the data set, from what I heard. 

            DR. KAYE:  No, we're definitely not saying that you get rid of IRB's.

            DR. SULMASY:  So, that's an extra layer.

            DR. KAYE:  But it's an extra -- no, I don't think it's an extra layer.  I think it's actually methods that enable research to happen far more efficiently, because the concern is now, that we're actually -- what we're doing is, we're just building legacy -- we're taking the legacy systems, and imposing them on science and the use of data and networks, and in actual fact, they are based on very -- concepts which are quite different.

            So, the IRB is very useful, but it's based on one researcher, one jurisdiction, one project type model.  In an actual fact, that doesn't work for networks or across jurisdictions, and so, the models that are being developed, actually enable that other kind of research to be going on, network, but in actual -- allow it to be governed in a way that is an oversight mechanisms, to put in place, which aren't burdensome for scientists, but actually still transparent and accountable.

            MR. WILBANKS:  Yes, I certainly don't think we're going to get rid of IRB's.  I think that there are -- think about it transactionally.

            It used to be that every transaction that was a research transaction needed an IRB approval, because they were non-digital transactions.  You needed to recruit people and talk to them.

            But as you have digital representations of individuals, right, or of individual cases, there are answers to hundreds of thousands of questions in those data files that were not part of the original data collection protocol.

            And so, the idea is that e-governance is a way to allow at least some exploratory querying of those data sets without having to burden the IRB, every time with repetitive transactions.

            So, and it's really up to the IRB of an institution to decide how progressive or conservative they'd like that institution to be, because you can say, "We think we're going out-compete for computational biology faculty by saying that these kinds of queries are going to be prospectively allowed," and only when you're going to actually go into the clinic and touch a patient, do you have to come and get permission.

            Other organizations might be much more conservative and say, "We want to run a traditional IRB system."

            I think this is simply a way to bring some of the governance capacity to the IRB that's missing, because it's not designed for the computer environment.

            But I definitely don't want to get rid of that aspect of this.

            DR. WAGNER:  So, your answer to the e-tracking comment was that this is another tool for --

            MR. WILBANKS:  In much the same way that, you know, filing a research report at the end of the year is simply tracking, right, but it plays deeply into the way that you're governed, right, because if you know that you're going to be reviewed, then you govern yourself a lot better than if you think no one is watching.

            DR. FARAHANY:  This is tremendously interesting conversation, and I want to pick up a couple of threads that we've been talking about, and also, to just have a little bit better precision about the similarities and differences between your views.

            So, we've been talking about privacy generally, and I want to be a little bit more precise about the nature of privacy that we're talking about.

            So, I'm going to throw out two different forms of privacy that we could talk about.  One is a seclusion interest in privacy, all right, stay away from my body. You cannot come and take a swab out of my mouth.  You cannot take blood from my body, a right to hide from public, go into my home, stay away from other people.

            The second is a secrecy interest, which is keeping information secret, akin to what you were talking about with trade secrets, and it seems to me like there are two different things that we're talking about here, when we're talking about things like information becoming transparent and what we -- what point at which we intervene.

            So, there is the personal autonomy aspect, which is, I have some zone of privacy, of secrecy.  Right, so, the secrecy of my movements, secrecy of my web-based searches, secrecy of my information, and then there is the kind of libertarian principle of, no forceable participation in research, no forceable -- you know, you can't force me to sign up for your website, things like that.

            And it seemed like that, Jane, you were really talking about the first aspect, when you put up the slide about the personal autonomy and from the case, you know, talking about the kind of zone and sphere of privacy, which would encompass far more than my genetic information.  It would encompass my email tracking, my Google searches, everything else that I do.

            And what you're talking about, John, seems to be about the kind of libertarian principle of, don't force me to participate, but does that really work for genetic information?

            So, I see how that works for don't forcibly take swabs from me, don't force me to sign up for a website, don't force me to disclose information.

            But what if I just took everybody's cups from the room and got the genetic information and put it into the DNA database, right, or if I just went through the trash and got lots of different genetic samples?  I wouldn't be violating that libertarian principle, and so, then the question is, is there any secrecy interest, aside from the seclusion interest, aside from a trade secret?

            I've abandoned my trade secret when I've left the glass behind.  So, you know, given that I hear you talking about two different things, the seclusion versus secrecy interest, is that right, are you really talking about a zone of personal autonomy and are you really talking about kind of forceable participation and that there isn't a secrecy interest, or do you both think that there should be some secrecy interest for genetic information, distinct from my Google searches, my email tracking, the data that is derived from email?

            MR. WILBANKS:  I'm not quite arguing the libertarian argument.  I'm more arguing a voluntary argument, which is that it should only work if I decide to do it, and that is different than don't -- like, don't tread on me, right?

            So, you going and getting a swab from my cup and uploading it is not me choosing to upload it.  So, I see a difference there, because it's about my agency and my choice.  That is the --

            DR. FARAHANY:  That is not overriding your agency or your choice, unless there is some property interest or other interest that you have the secrecy of information, right.

            You don't even know, you leave your cup behind, I take it and I put the genetic information into the database.  So, there is no agency involved, at all, right, and in fact --

            MR. WILBANKS:  To my mind, there is, if you put my information online, whether it's -- you know, because at a minimum, if I've signed up for Google tracking, if I've signed up for Google, right, when I logged into Google today, they made me click 'yes' on the privacy policy.

            All right, there is at least a theoretical agency in all of these things, that is different than, you went through my garbage and uploaded my credit records.

            So, to me, there is a -- it's a small difference, but it's an important one, which is that it's not simply, don't -- I have a right to not be touched, but it's, I have a right to choose what I am engaged in.

            But I view what I'm doing as a tiny piece of what Jane does, which is a more holistic view of governance, right, and I have this very specific task, which is to work on sort of consent of the participants.

            But I think that may be just a little bit --

            DR. FARAHANY:  I'm sorry to interrupt you, but I just want to make sure I understand, precisely.

            So, is it that your genetic information is part of your extended personality, and so, when you say agency, genetic information is still you, whether it is shed on the ground in, you know, a health sample on my cup or in my body, it's all the same.  It's just I have kind of an extended personality, wherever it is, and that's part of who I am?

            MR. WILBANKS:  I had not thought of it that way before, to be blunt.  So, it's hard for me to say yes or no.

            I tend to say -- my instinct is to say, yes, that is sort of what I'm trying to get at, is that I do think our health information is a little different than what websites we visit. 

            Was this a philosophy debate?  Representationally, it is? 

            DR. KAYE:  So, I'm not sure if I'm going to answer your question, but I'll try.

            I think that privacy really, when you go back to philosophical discussions of privacy, I mean, there is different elements of privacy, aren't there?  There is decisional.  There is physical.  There is informational privacy.

            I think that it would be wrong to try and restrict those dimensions when we're talking about the use of personal information, such as medical information, and I think it can be used in some -- those elements come into play in different contexts, and so we have to be alive to that.

            You're talking about the cup. In the UK, we actually have legislation that prohibits non-consensual testing of DNA, and that sort of goes back to access.

            So, I mean, privacy is not an absolute right, and there will always be reasonable -- there is a reasonable expectation of privacy, but there will always be ways in which privacy can be breached, for good reasons, in the public interest.

            And so, I think that we -- there are different legal mechanisms that we can use, as you're well aware, to actually protect privacy, and so one of them might be non-consensual testing of DNA, but it doesn't -- I would be reluctant to actually define privacy too strictly or too rigidly in this context, because I think that we'll find there will be lots of different circumstances which will bring in different aspects of privacy.

            DR. WAGNER:  Well, you two have done it again, as with our earlier panelists, you have both educated us and left us asking some pretty important questions.

            So, we thank you so much for being part of this session, and I believe we move directly into Session 4, don't we?






This is a work of the U.S. Government and is not subject to copyright protection in the United States. Foreign copyrights may apply.