Citizens' Jury on QCovid: Report on the jury's conclusions and key findings

7. Population-level tool: using anonymised data

Summary and principles

The population-level tool could be utilised in an anonymised way. This would involve running the QCovid® model, or a similar risk prediction model, through anonymised health records at a national or regional level. The tool would not identify individuals at risk (as is the case with the non-anonymised population tool) but would allow governments and health boards to see how many people in a certain area were at risk for research and planning purposes.

In sessions three and four of the Citizens' Jury, members were introduced to the population-level tool (both the anonymised and non-anonymised forms) and heard from expert speakers explaining how both tools would work and the key considerations for their use. An overview of the speakers and topics is provided in the previous chapter. Participants reflected on the presentations and had the opportunity to ask questions about the population-level tool using anonymised data. In sessions five and six, participants deliberated on the population-level tool and discussed the key risks, benefits and ethical considerations in relation to its use with anonymised data, before drawing conclusions.

The jury were generally favourable towards the population-level tool utilising anonymised data and there was consensus that the public benefits outweighed concerns over data privacy. Nevertheless, there were a number of principles that would still apply to the use of this tool in Scotland.

Use of the anonymised population-level tool in Scotland, as part of the QCovid® model or a similar risk model, is acceptable if:

• Information about the tool, and reasons for using it, is available and clearly communicated to the general public i.e. without jargon. Note that some felt the information should be available where others felt it should be presented i.e. during a public briefing by a medical professional. Some also felt medical professionals should be kept up to date in order to keep their patients up to date.
• The tool is kept up to date in case of people moving from low risk to high risk (and vice versa) based on new evidence or changing circumstances (including in relation to the virus e.g. new variant).
• The data is agile and able to adapt as new situations arise (including change in profile of the population).
• The data is to be used by Scottish Government and NHS Scotland only for the purpose of resource planning, research and informing the public.
• There are data security protocols in place to ensure the tool is developed and used appropriately (e.g. resource planning or valid/justifiable research by verified third parties e.g. non-profit research institutes).

Use of the tool becomes unacceptable if:

• Data is shared with third parties for purposes that do not align with healthcare-related public benefits (e.g. in the case of QCovid®, relating to the pandemic response).
• Data is not protected from commercial companies accessing it.
• There is any collaboration with data farm companies.
• It is used to discriminate against certain groups (e.g. being denied access to certain services based on age or ethnicity).

Risks and benefits

As part of their deliberation on the anonymised population-level tool, participants considered the risks and benefits of it, as well as any key ethical concerns.

The key risks identified were that:

• There are limitations with using large datasets (e.g. the data is not complete, such as missing data on those outwith the 19-100 age range or information on ethnicity, and the data may not always be up-to-date).
• If the accuracy of the data is not high it would undermine resource planning.
• The anonymised data might not be enough and could result in people being at risk but not being aware of it as they would not be identified.
• It is not targeted enough to the individuals at risk. Decisions made at a regional level (such as a local lockdown) could therefore restrict and impact negatively on peoples' lives who are not at risk, rather than focusing on those who are at risk.
• Consent is not possible to obtain, leaving people with limited control over how their data is used.

The key benefits of the were that:

• It would allow Scottish Government and NHS Scotland to allocate resources effectively.

"You need the right care and equipment at the right time. You need to be strategic about this and use high level statistical data, which is what the tool is."

(Participant in session 5)

• It could be used to support research, which provides significant wider benefits.
• It could be used to help the Scottish Government prepare for, and respond to, future pandemics more effectively.

On balance, the jury considered the anonymised population-level tool to be fairly uncontroversial, concluding that it would present a relatively low risk, as no personally identifiable information is used, while having broad public health benefits.

"I see no drawback in using the anonymised version of the population tool. It can only be a good thing if it helps with planning and prioritisation."

(Participant in session 5)

Where views were more nuanced, this was driven by concerns over data being used for purposes unrelated to public health planning and some uncertainty over the usefulness of this tool when not targeting individuals at risk. This is depicted in figure 6 overleaf, where participants each placed a digital post-it according to their own assessment of the risk-benefit of the anonymised population-level tool.

Key ethical considerations

As with the non-anonymised population-level tool, views on the anonymised version of the tool developed as participants learned more about it. Having raised some initial concerns about the population-level tool overall (such as on the accuracy and security of the tool), the jury came to view the anonymised population tool as a sensible option for Scottish Government and NHS Scotland to plan resources at on a regional and national basis, with the benefits generally outweighing the risks. However, there were some key ethical considerations which participants highlighted, which formed the key principles underpinning the possible use of the anonymised population-level tool in Scotland.

Data accuracy and agility

It was generally agreed that these large, anonymised health datasets lend themselves well to making decisions, citing the example of the JCVI using the QCovid® model on anonymised data to recommend which groups should be prioritised for vaccination against Covid-19. However, participants noted that some data can be missing, for example from medical records, which led to some concern that data inaccuracies could lead to poor decision-making. One participant, reflecting on their experience of living under regional restrictions while pregnant, found the blanket restrictions difficult.

"Even though I was in the early stages of pregnancy, I didn't have a vulnerability. I wanted to do some things, but I couldn't do them, and it was frustrating [..] I feel it should be more nuanced."

(Participant in session 4)

In this sense, the non-anonymised population tool was considered to strike a better balance between protecting individuals without restricting the wider population.

"It seems like a smart way of reacting and people being able to allocate resources. And I suppose it's only as good as the process and sciences keeping on top of it. It needs to be agile and respond to new developments, for instance the new variants."

(Participant in session 4)

It was acknowledged by the jury that the underlying model would need to be kept up-to-date and be constantly evolving as pandemic events occur (such as the emergence of the Omicron variant and booster vaccine rollout).

Data privacy

Although consent was an issue raised by participants early in the deliberative process, after further learning it was recognised that consent is not possible to obtain when working with such large datasets. It evolved into an issue around data privacy and 'unforeseen consequences' in terms of how the data is used in future (an ethical concern which cuts across all of the tools). Participants felt strongly that the data should not be passed onto third parties, and agreed that the population-level tool would be acceptable only if there were clear parameters set around its use by Scottish Government and NHS Scotland for the purposes of resource planning, research and informing the public, and not for profit.

"What are the boundaries of use in each version of the tool? and then how can we really know they won't be transgressed?"

(Participant in session 3)

Transparency and trust

To allay any potential concerns around data privacy, the jury agreed that there needs to be a robust and clear rationale for using anonymised health data at the population level using this tool. This was borne out of participants themselves not being clear early in the process as to how the tool would be used:

"You can't say how you will support something without knowing how it's going to be used."

(Participant in session 3)

Over the course of the deliberation, and as the jury cultivated greater understanding of risk prediction models and the different tools, they concluded that the benefits of the anonymised population tool outweigh the risks, but that it would be important for Scottish Government to build public trust in the tool by clearly explaining its purpose and use.

Communication

Clear communication about the use of QCovid® or a similar risk model was deemed 'essential' by the jury. In the case of the population-level tool, which the jury felt would be broadly acceptable to most people, it was felt that information on the NHS Scotland and Scottish Government websites - with alternative versions for those who are not online - would suffice for those wishing to learn about it. It was important to some participants that the information should come from the medical officers and not politicians.

Circumstances for using the anonymised population-level tool

In session four, as they did for the non-anonymised version, participants considered a range of scenarios in which the population-level tool might be deployed using anonymised data, and discussed the extent to which its use would be acceptable or not.

The scenarios were the same as those discussed for the non-anonymised version and included:

• If a new variant emerges which appeared to be resistant to the vaccine.
• If the effectiveness of the vaccine was waning against the existing variants.
• If there was a low prevalence of Covid-19 in society.

The anonymised population-level tool was acceptable to the jury across all scenarios and it was agreed that the key principles of transparency, communication, accuracy, and protection against misuse still applied in any of these situations. For one group, considering the different scenarios reinforced the importance of ensuring the tool can adapt to such changing circumstances.

Although the use of the tool was considered acceptable in a low prevalence scenario, views did diverge in terms of the usefulness of having the tool in this situation. One view was that it would be important to keep the tool operational so that it could adapt to and take account of events in case of any changing circumstances. Furthermore, it was felt that an up-to-date risk prediction model could be repurposed in future. An alternative (and more exceptional) view was that there would be less of a clear rationale for running and resourcing the tool if the prevalence of Covid-19 was low.