Research using genetic data raises various concerns relating to privacy protection. Many of these concerns can also apply to research that uses other personal data, but not with the same implications for failure. The norms of exclusivity associated with a private life go beyond the current legal concept of personal data to include genetic data that relates to multiple identifiable individuals simultaneously and anonymous data that could be associated with any number of individuals in different, but reasonably foreseeable, contexts. It is the possibilities and implications of association that are significant, and these possibilities can only be assessed if one considers the interpretive potential of data. They are missed if one fixates upon its interpretive pedigree or misunderstands the meaning and significance of identification. This book demonstrates how the public interest in research using genetic data might be reconciled with the public interest in proper privacy protection.

England and Wales are moving toward a model of ‘opt out’ for use of personal confidential data in health research. Existing research does not make clear how acceptable this move is to the public. While people are typically supportive of health research, when asked to describe the ideal level of control there is a marked lack of consensus over the preferred model of consent (e.g. explicit consent, opt out etc.). This study sought to investigate a relatively unexplored difference between the consent model that people prefer and that which they are willing to accept. It also sought to explore any reasons for such acceptance. A mixed methods approach was used to gather data, incorporating a structured questionnaire and in-depth focus group discussions led by an external facilitator. The sampling strategy was designed to recruit people with different involvement in the NHS but typically with experience of NHS services. Three separate focus groups were carried out over three consecutive days. The central finding is that people are typically willing to accept models of consent other than that which they would prefer. Such acceptance is typically conditional upon a number of factors, including: security and confidentiality, no inappropriate commercialisation or detrimental use, transparency, independent overview, the ability to object to any processing considered to be inappropriate or particularly sensitive. This study suggests that most people would find research use without the possibility of objection to be unacceptable. However, the study also suggests that people who would prefer to be asked explicitly before data were used for purposes beyond direct care may be willing to accept an opt out model of consent if the reasons for not seeking explicit consent are accessible to them and they trust that data is only going to be used under conditions, and with safeguards, that they would consider to be acceptable even if not preferable.

This paper explores key issues in the development of open access to research data. The use of digital means for developing, storing and manipulating data is creating a focus on ‘data-driven science’. One aspect of this focus is the development of ‘open access’ to research data. Open access to research data refers to the way in which various types of data are openly available to public and private stakeholders, user communities and citizens. Open access to research data, however, involves more than simply providing easier and wider access to data for potential user groups. The development of open access requires attention to the ways data are considered in different areas of research. We identify how open access is being unevenly developed across the research environment and the consequences this has in terms of generating data gaps. Data gaps refer to the way data becomes detached from published conclusions. To address these issues, we examine four main areas in developing open access to research data: stakeholder roles and values; technological requirements for managing and sharing data; legal and ethical regulations and procedures; institutional roles and policy frameworks. We conclude that problems of variability and consistency across the open access ecosystem need to be addressed within and between these areas to ensure that risks surrounding a data gap are managed in open access.

The United Kingdom’s Data Protection Act 2018 introduces a new public interest test applicable to the research processing of personal health data. The need for interpretation and application of this new safeguard creates a further opportunity to craft a health data governance landscape deserving of public trust and confidence. At the minimum, to constitute a positive contribution, the new test must be capable of distinguishing between instances of health research that are in the public interest, from those that are not, in a meaningful, predictable and reproducible manner. In this article, we derive from the literature on theories of public interest a concept of public interest capable of supporting such a test. Its application can defend the position under data protection law that allows a legal route through to processing personal health data for research purposes that does not require individual consent. However, its adoption would also entail that the public interest test in the 2018 Act could only be met if all practicable steps are taken to maximise preservation of individual control over the use of personal health data for research purposes. This would require that consent is sought where practicable and objection respected in almost all circumstances. Importantly, we suggest that an advantage of relying upon this concept of the public interest, to ground the test introduced by the 2018 Act, is that it may work to promote the social legitimacy of data protection legislation and the research processing that it authorises without individual consent (and occasionally in the face of explicit objection).

The disclosure of confidential patient data without an individual's explicit consent should be for purposes that persons have reason to both expect and accept. We do not currently have the required level of clarity or consistency in understanding regarding the disclosure of confidential patient information for public health purposes to support effective public dialogue. The Health Service (Control of Patient Information) Regulations 2002 establish a legal basis in England and Wales for data to be disclosed for public health purposes without patient consent. Under the Regulations, there is more than one potential route towards lawful processing: Data may be processed for public health purposes under both Regulations 3 and 5. The alternatives have different safeguards and conditions attached, and their respective applicability to processing for purposes of public health improvement is currently unclear and subject to review. Beyond the need for clarity regarding the safeguards applicable to processing for particular public health purposes, there are reasons to prefer recognition that Regulation 5 is the most appropriate legal basis for disclosure when the purpose is public health improvement rather than public health protection. Where health improvement, rather than protection, is the aim, there is no justification for discarding the additional safeguards associated with processing under Regulation 5.

Draft regulatory guidance suggests that if the processing of a child’s personal data begins with the consent of a parent, then there is a need to find and defend an enduring consent through the child’s growing capacity and on to their maturity. We consider the implications for health research of the UK Information Commissioner’s Office’s (ICO) suggestion that the relevant test for maturity is the Gillick test, originally developed in the context of medical treatment. Noting the significance of the welfare principle to this test, we examine the implications for the responsibilities of a parent to act as proxy for their child. We argue, contrary to draft ICO guidance, that a data controller might legitimately continue to rely upon parental consent as a legal basis for processing after a child is old enough to provide her own consent. Nevertheless, we conclude that data controllers should develop strategies to seek fresh consent from children as soon as practicable after the data controller has reason to believe they are mature enough to consent independently. Techniques for effective communication, recommended to address challenges associated with Big Data analytics, might have a role here in addressing the dynamic relationship between data subject and processing. Ultimately, we suggest that fair and lawful processing of a child’s data will be dependent upon data controllers taking seriously the truism that consent is ongoing, rather than a one-time event: the core associated responsibility is to continue to communicate with a data subject regarding the processing of personal data.