Guthrie Cards in Scotland: Ethical, Legal and Social Issues

CHAPTER 5: CONSENT AND ANONYMISATION

Key questions addressed by this chapter are:

• Should specific consent be sought from all persons whose samples and information are held as part of the Guthrie collection?
• What are the arguments for and against this approach?
• What does the law and good practice require?
• What are the alternatives?

• Can the collection be kept and used if the cards are anonymised?
• Is it possible or practical to do so?
• What are the pros and cons of anonymisation?

Key messages from this chapter are:

• The law does not require that specific consent be sought from all persons whose samples or data are held in the Guthrie collection; it is for consideration none the less, whether such consent should be sought as a matter of good practice.
• If specific consent is not sought, there must be a robust system of opt-out to respect persons whose samples/data are contained in the collection.
• Because people consent to inclusion in the collection on the basis of broad consent, attention should be given to how they will be kept up-to-date with uses of the resource as and when these occur.
• It is for consideration whether a system of 'consent for consent' should be considered to facilitate access to the Guthrie collection for research purposes; caution should be exercised, however, about adopting a presumed consent approach.
• Specific consent should be sought from individuals if access is contemplated for non-standard purposes, e.g. non-health-related research.
• It is for consideration whether mature minors should be allowed to opt-out of the collection.
• Transparent procedures should be developed for circumstances where access will be given without consent but subject to suitable authorisation.
• Transparent procedures should be developed to decide whether and how access will be granted if neither consent nor anonymisation is possible.
• Consideration should be given to scrutiny mechanisms authorising access even when anonymisation is contemplated.
• A policy should be developed on whether and how feedback of individual results will be given.
• A decision should be taken on Open Access to the resource or results from the resource.
• A Privacy Impact Assessment should be carried out on the Guthrie collection.

DISCUSSION

Consent: the issues

5.1 This section discusses the function of consent, ethically and legally, and raises some issues for the collection. The next section addresses the most viable alternative, namely, anonymisation.

5.2 The purposes for which the Guthrie collection is maintained, the role of consent and the requirements of the relevant legal regimes are inextricably linked. The introduction of an informed consent system addresses many of the ethical, legal and social issues surrounding the collection but it is not a panacea nor should it be considered as such. Even for those who have given consent there are questions about the degree to which this was sufficiently informed (for example in relation to current procedures for police requests for access, and as yet untested applications by commercial interests such as pharmaceutical companies - see Chapter 6). These matters could clearly be addressed for the future. More difficult issues relate to the elements of the collection relating to persons for whom specific consent was not given, either those who are now adults or those who are still children. If consent were thought to be the 'best practice' option this would raise a plethora of social and economic issues and would bring with its own set of ethical concerns.

The function of consent

5.3 Consent is merely a device to show respect to persons, it is not an ethical value in its own right. Moreover, there are many different models of consent which are in use.

5.4 The lingua franca of modern medicine is informed consent, and this works best in the context of treatment or clinical trials when individuals can be fully informed before committing to a course of action about what will happen, the consequences, risks and alternatives. This model does not work for collections like the Guthrie collection. Equally, while presumed consent can be inferred from individuals' actions, this only has a very narrow sphere of legitimate operation - for example when a patient offers his or her arm for blood to be taken. In particular, it is not at all clear that consent can be inferred from non-action. This raises questions about the information material given to parents. The section on research states: "If you do not want the stored blood spot card to be used for research, please ask the midwife to write 'no research' in the comments box on the blood spot card."⁸⁴ Can it be inferred from a blank box that consent has been given? Matters would be clearer if a positive assent to research was recorded.

5.5 The approach with the Guthrie collection is one of broad consent whereby individuals are presented with a broad proposition and asked to agree to participate. Clearly all future uses, research or otherwise, cannot be explained before consent is given. None the less, arguably the ethical (and legal) obligation is to keep people informed of uses as and when they occur. If this does not happen people might lose trust in the system if they discover uses of which they would not have approved. The experience of Texas, para 2.18 above, is a clear example of this.

5.6 Existing projects that rely on broad consent, such as UK Biobank,⁸⁵ always provide an opt-out or withdrawal mechanism. Keeping people informed about the uses of a collection, e.g. via regular updates on a website, can help to ensure transparency and give meaning to a right to withdraw. Moreover, human rights would suggest that the onus is on those responsible for the collection to demonstrate and justify the continued need for, and value of, its retention. It will be recalled from para 4.12 that arbitrary retention of records with the abstract hope that they might have a future research value is not acceptable. A clear commitment to a research purpose and demonstrate utility is required.

5.7 The ethical imperative in all dealings with patients is to respect them. There may be many ways to respect individuals, their rights and their interests which do not require consent. It is essential, therefore, to identify which interests or rights are at stake for people with respect to the Guthrie collection. Two stand out as having paramount importance: privacy and autonomy (freedom of choice).

5.8 Assuming the lawfulness of the existing collection in terms of continued storage, the next question is whether specific consent for on-going use should be sought. We make no comment here about the resource implications of such a policy or the procedures that this would involve. Consent could operate in a variety of ways with respect to future use of the resource. We can consider the following questions.

5.9 Should "consent for consent" be sought in the context of research use? There is on-going contemporary discussion about the need for, and utility of, seeking "consent for consent" with respect to use of health data for research purposes. It is argued in some quarters that individuals should be actively approached, or at least informed, about the prospect of their medical data being used for research and given the opportunity to consent to being contacted for specific consent at some future date, or alternatively, to refuse any such approach. There are serious practical and economic consequences of adopting this approach, but its application to the Guthrie collection raises no novel issues not already being discussed in the wider community.

5.10 Should specific consent be sought only for specific purposes, e.g., a specific research project? The logistics of this would be considerable if it were to occur for every research use. It might, however, be used for research uses which reasonable persons would not consider to be within the original purposes of a collection such as Guthrie cards. An example of such a use might be non-health-related research.⁸⁶

5.11 What is the role of opt-out/on-going obligations of keeping the public informed about issues of use and access? We suggest that given the nature of consent that has been obtained since 2003 (broad consent) and the absence of consent before 2003, there is an imperative to keep people informed about the collection and the uses to which it is put and, ideally, to involve them in processes for deciding future policy. This does not necessarily mean that every individual should be contacted individually.⁸⁷ Furthermore, given the interest in freedom of choice, this supports a robust opt-out mechanism.

5.12 What is the position with respect to the mature minor/minor assent? The law recognises that children can be sufficiently mature to take health-related decisions about their own care before they are 16.⁸⁸ In keeping with the spirit of this law, there is a strong case for arguing that mature children should be able to opt-out of the collection should they choose to do so. A counter argument to this is that their continued inclusion in the collection might be a necessary part of their own medical record. In the event of any dispute about whether to retain or destroy a mature minor's sample and data, the guiding legal principle would be best interests to be resolved by a court in the ultimate resort.

5.13 Is consent required at all if, all things considered, risks are minimal or non-existent? In the absence of any expression of choice by a person or their representative to opt-out, the remaining serious risk is to privacy. We suggest, in keeping with other ethical models of biomedical governance, that if privacy risks can be shown to be minimal and ethical approval for access has been granted by a relevant and authorised body or person (such as a Caldicott Guardian), then access can be granted without prior consent. The mechanics of this are best dealt with under Governance, below. The most likely privacy protection mechanism in such cases is anonymisation, and it is to a consideration of that issue that we now turn.

Anonymisation: the issues

5.14 It should be clear from the previous section that while consent has a role to play in legitimating actions which might otherwise be illegal, it is not the only means to do so. Information can be processed without consent to promote recognised public interests, such as the prevention or detection of crime, and/or because other safety mechanisms can be used to protect individuals' interests and which do not require specific consent. Anonymisation is the paradigm example of this and is frequently used in research ethics to protect participants' privacy. Both data protection laws and human tissue legislation envisage a role for anonymisation.⁸⁹ Thus, anonymisation can serve in protecting privacy interests while seeking to maximise the use of the resource.⁹⁰ As with consent, however, anonymisation is not a solution to all challenges thrown up by all uses of the resource. Specific issues to consider include:

I: Anonymisation is not always possible from the privacy perspective

There is considerable debate about what 'anonymisation' actually means.⁹¹ For example, is it absolute anonymity that is required such that no person can ever be identified from information/material?, or is it relative anonymity such that it is not reasonably likely that the person will be identified? It has been increasingly demonstrated that that the former is not possible in the context of genetic material and other personal data,⁹² while the latter is probably all that is required by law.⁹³ More recent contributions to the Scottish Guthrie collection are reversibly anonymised, but this is not true for the majority of the collection where personal information and the sample are held together on the same card. This has implications for what people are told about the risk to their privacy.

Expectations couched in terms of guarantees of privacy protection should be avoided; expectations must be realistic and the reality is the any use of personal data, even anonymised data, increases privacy risks. To appropriately assess the range of privacy risks, we recommend a regular Privacy Impact Assessment of the Guthrie collection in Scotland. Details are available from the Information Commissioner's Office⁹⁴ and the Information Services Division in NHS Scotland has already conducted such exercises.

II. Anonymisation is not always possible from the research perspective

Some kinds of research are not possible using anonymised data, i.e., identifiable or potentially identifiable data are required in order for the research to be carried out.⁹⁵ While the possibility of seeking specific consent remains, in many cases it is not reasonable or practicable to pursue this route. In other countries, legislation has been introduced which allows a designation body to authorise uses of information without consent when use would otherwise be unlawful, e.g., a breach of confidence. The Ethics and Confidentiality Committee performs this role for England & Wales under the auspices of the Health Research Authority⁹⁶ and operates on a statutory footing.⁹⁷ A similar, although not identical function is performed in Scotland by the Privacy Advisory Committee (PAC) but this body does not have a statutory basis. PAC exists to advise the institutions that set it up, being the NHS National Services Scotland (NSS) and National Records of Scotland (NRS). It considers applications for linkages of identifiable data from any datasets held under the auspices of these bodies. The Guthrie collection is not such a collection as such - it is held under the auspices of the Greater Glasgow and Clyde Health Board. PAC would only have a role with respect to any requests to link data from the collection to other datasets held by NSS or NRS. Therefore, PAC has no direct remit over the Guthrie collection per se. This means that requests merely to access the Guthrie collection without other linkage to other datasets must be governed by other means. The operation of the Caldicott Guardians system is integral to these mechanisms in the United Kingdom. As stated previously, these Guardians are responsible for protecting patient confidentiality and exist in each of the Scottish Health Boards. Thus, the Greater Glasgow and Clyde Guardian will have a responsibility for the Guthrie collection and can play a vital role in decisions about access and use. The point to note here is that the traditional approach of 'consent or anonymise' is not always possible for all kinds of research. Authorisation is another valid route. We return to consider this in the section on Governance, below.

III: Anonymisation can lead to potential harm to other individual interests

What are the obligations that exist between researchers and research participants and how are these affected by anonymisation? For example, is there a duty to feedback results if health-relevant information is generated as a result of research? How would this be possible if anonymity is to be preserved? This is a difficult issue in the research community on which opinion is currently divided.⁹⁸ It is important to compare and contrast, however, two situations in the context of the Guthrie collection: (i) monitoring infection rates in women/children, which is the confirmation of a specific diagnosis and therefore of direct significance to someone's health,⁹⁹ and (ii) the creation of generalisable knowledge on a population level which is only statistically significant at that level, that is, the chances of saying something about an individual's health status is very slim. Either way, what, if any, feedback policies are in place with respect to the uses of the Guthrie spot collection? Has this issue been considered? How would it be managed and what are the implications of any given policy? We are not aware of any consideration of these issues and therefore recommend that attention be given to the subject.

IV: Anonymisation and the specifics of genetic information

It is trite to confirm that every individual's genetic data are unique to them (absent the case of homozygous twins); in terms of anonymisation and identifiability, therefore, it suggests that genetic data/samples always point to a particular individual (or pair of individuals). This reality can impact significantly on the deliberate balance between access policies and privacy protection.¹⁰⁰ A recent experience illustrates the point well. The U.S. National Institutes of Health and the Wellcome Trust hurriedly revised their policy of open access to genome-wide association materials after it was shown statistically how individuals could be identified from aggregated data available on the public site.¹⁰¹ There is serious doubt about attempts to make genetic or genomic data available on an open access basis, even if it is thought that anonymity has been achieved; once again, it has implications for access policies as we discuss below.

V. Anonymisation and authorisation

Given the comments above, and in keeping with conclusions about consent, we suggest that consideration should be given to whether appropriate authorisation of access should be given even if a proposal for access is for anonymised use of samples/data. This is not only to address concerns about individual's privacy but also because there might be wider, social impacts of (research) access depending on the purposes for which access is sought. This is particularly the case for the Guthrie collection due to the coverage of the collection and the potential for the collection to be misrepresented as a de facto "DNA database" for the Scottish population born since 1965.¹⁰²

POINTS TO CONSIDER AND RECOMMENDATIONS FROM CHAPTER 5:

• The law does not require that specific consent be sought from all persons whose samples or data are held in the Guthrie collection; it is for consideration none the less, whether such consent should be sought as a matter of good practice.
• If specific consent is not sought, there must be a robust system of opt-out to respect persons whose samples/data are contained in the collection. Robust in this context means that clear and detailed information be publicly available both about the existence of the collection and any uses to which it is put. Citizens must be able to access procedures for opt-out easily and have their wishes respected in a timely fashion.
• Because people consent to inclusion in the collection on the basis of broad consent, attention should be given to how they will be keep up-to-date with uses of the resource as and when these occur.
• It is for consideration whether a system of 'consent for consent' should be considered to facilitate access to the Guthrie collection for research purposes; caution should be exercised, however, about adopting a presumed consent approach. The parent information and consent leaflet should be revised to make consent for research an explicit option.
• Specific consent should be sought from individuals if access is contemplated for non-standard purposes, e.g. non-health-related research.
• It is for consideration whether mature minors should be allowed to opt-out of the collection.
• Transparent procedures should explain in accessible format the circumstances in which access will be given without consent but subject to suitable authorisation.
• Transparent procedures should explain whether and how access will be granted if neither consent nor anonymisation is possible.
• A policy should be developed on whether and how feedback of individual results will be given.
• A decision should be taken on Open Access to the resource or results from the resource.
• A regular Privacy Impact Assessment should be carried out on the collection.