29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL DATA PROTECTION AND PRIVACY COMMISSIONERS CONFERENCE 29e Confrence internationale des commissaires à la protection de la vie prive

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL DATA PROTECTION AND PRIVACY COMMISSIONERS CONFERENCE 29e Confrence internationale des commissaires à la protection de la vie prive Biobanking and genomic research: Some special needs William W. Lowrance, PhD September 27, 2007

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL DATA PROTECTION AND PRIVACY COMMISSIONERS CONFERENCE 29e Confrence internationale des commissaires à la protection de la vie prive Need to make clearer distinctions among the kinds of data Biobanks, major platforms of data and biospecimens curated as broad resources banks for research Genetic/genomic project data and biospecimen collections, cordoned-off by research protections Clinical genetic test data, held under medical confidentiality

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL DATA PROTECTION AND PRIVACY COMMISSIONERS CONFERENCE 29e Confrence internationale des commissaires à la protection de la vie prive Distinctions, cont. Genetic-related public-health data, protected by public-health laws Other sets of biological materials and derived data, such as forensic collections, held under various regimes. Failure to make firm distinctions is causing serious confusion in dialogue and regulation!

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL DATA PROTECTION AND PRIVACY COMMISSIONERS CONFERENCE 29e Confrence internationale des commissaires à la protection de la vie prive Genetic/ genomic/ biobank exceptualism? My view is that Clinical genetic-test and related data should be treated like other sensitive medical data But until a number of issues get sorted- out and reliable protections are in place, most genomic and research biobank data deserve special attention.

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL DATA PROTECTION AND PRIVACY COMMISSIONERS CONFERENCE 29e Confrence internationale des commissaires à la protection de la vie prive Need to refine aspects of the whole suite of research protections Informed consent De-identification Research-ethics oversight Safeguards Data-release policies and practices Barriers against access for non-research purposes Sanctions against misuse.

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL DATA PROTECTION AND PRIVACY COMMISSIONERS CONFERENCE 29e Confrence internationale des commissaires à la protection de la vie prive Need to rethink the construal of consent Traditionally, consent has been meant to be "fully informed" But biobanking and genomic data, and their risks, are very difficult for most people to comprehend So, in consenting: informed of what?

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL DATA PROTECTION AND PRIVACY COMMISSIONERS CONFERENCE 29e Confrence internationale des commissaires à la protection de la vie prive In my view, consent negotiations should inform of the purposes the overall plan and any data- or specimen-collecting that may involve them directly the disclosure risks generally the auspices and protections that make "the deal" trust-worthy anything else asked about.

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL DATA PROTECTION AND PRIVACY COMMISSIONERS CONFERENCE 29e Confrence internationale des commissaires à la protection de la vie prive Need to cope with identifiability The challenge is that genomic data: are extensive are very fine-grained influence many personal attributes hold implications about family are intrinsic to the body don't change during the lifetime are unique to the individual.

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL DATA PROTECTION AND PRIVACY COMMISSIONERS CONFERENCE 29e Confrence internationale des commissaires à la protection de la vie prive Identifiability, cont. Whether and how to de-identify depends on the character of the data, the intended uses, consent, disclosure risks, and safeguards. As an alternative or complement to de-identification, controlled data- release should be seriously considered.

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL DATA PROTECTION AND PRIVACY COMMISSIONERS CONFERENCE 29e Confrence internationale des commissaires à la protection de la vie prive Need to improve data-release For open release, must become clearer as to "how much" genome can be exposed without undue disclosure risk For controlled release, must attend to the terms of release agreements, stewardship, security, and enforcement. Ref: Lowrance and Collins, "Identifiability in genomic research," Science 317, (August 3, 2007).

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL DATA PROTECTION AND PRIVACY COMMISSIONERS CONFERENCE 29e Confrence internationale des commissaires à la protection de la vie prive In all of this We must facilitate health research for the collective public good and at the same time protect the individuals with whom the data and biospecimens were, or are, associated!