Collecting and storing research data: biobanks and data archives

Biobanks are growing in popularity as a source of research data. Participants in a biobank voluntarily undergo a battery of tests as part of an observational study and allow the resultant data to be stored by the biobank for use in future research. Data curators process raw participant data on behalf of the biobank, including identifying incorrect or incomplete data, and harmonising data from different sources, to ensure they are useable for research. In some cases, this research will be conducted by researchers who are a part of the biobank, and in other cases, the biobank will grant access to this data to outside researchers. At the time the data are collected, participants are not specifically told what their data will be used for. In most cases, researchers who will eventually use these data do not have any contact with the participants who contributed their data and may only receive data stripped of any possible identifiers (ie, ‘deidentified’). The Northern European Returning Results Network is a group of bioethicists, social scientists, epidemiologists, and clinical researchers who are associated with a number of these types of studies (box 1).

Researchers might also access research data through a data archive. Unlike a biobank, a data archive does not collect data from participants directly; it acts as a repository for research data already collected through primary research or clinical practice. For example, the UK’s National Consortium of Intelligent Medical Imaging (NCIMI) and PathLAKE are repositories for annotated data of medical images and digitised pathology slides, respectively, collected from National Health Service patients. Similarly, the Mount Sinai Health System in New York collects clinical images from over 1 million patients, and integrates them with electronic health records, in its Imaging Research Warehouse. Researchers accessing data from a data archive do not typically have any contact with the original participants from whom the data were collected, and only receive deidentified datasets. Moreover, because regulations such as the General Data Protection Regulations (GDPR) in the European Union (EU) permit the processing of patient health records for research purposes without consent, patients may be unaware of the specific nature of the research for which their data are being used, or even that their data are being used at all.

Regulations governing the processing of personal data, including health data, may vary significantly by jurisdiction. In the UK and EU, identifiable data produced in the course of clinical care may be used for research purposes without the informed consent of the patient, provided it meets one of several legal bases for processing, including being necessary for the performance of a public task, a legal obligation, or legitimate interests. Even when informed consent is not the legal basis for data use, patients have the right to be informed about the collection and use of their personal data.1 Additionally, in the UK, all health and social care organisations which make use of patient health and care information must have a Caldicott Guardian, a senior person responsible for ensuring that personal data is used legally and ethically.2 The national data opt-out allows individuals to opt-out of the use of their personal data.

Conversely, in the USA, the processing of personal health information is governed by the Health Insurance Portability and Accountability Act, but only applies to data created or held by ‘covered entities’, including health plans, provider organisations and clearinghouses, and their subcontractors.3 Thus, health information collected by commercial companies (eg, from fitness trackers or other ‘health apps’)—which may be used for secondary research—are not subject to this regulation.

In this paper, we refer to data which have been collected by or on behalf of someone other than the user as ‘secondary data.’ Participants who contribute their data to a biobank, or whose data are accumulated in a data archive, contribute secondary data and are referred to as ‘data contributors’. A participant in primary research becomes a ‘data contributor’ once their data are made accessible to researchers outside the study for which they were originally collected. Likewise, we refer to any research using secondary data from data contributors as ‘secondary research’, and the researchers making use of such data as ‘secondary researchers.’ For example, a researcher using saliva samples collected from the Trøndelag Health Study, or clinical data from the FINRISK study, is a secondary researcher. A researcher employed by UK Biobank who is conducting research on genomic markers of Alzheimer’s disease, using blood samples collected by the biobank, is also a secondary researcher, because the data they are using were not collected specifically for this purpose. (Thus, there is no primary researcher in this case). Conversely, a researcher who collects genomic data from participants to study the genetics of learning disorders is a primary researcher, but if these data are subsequently deposited in a data archive, a researcher who accesses the deposited data is a secondary researcher. For example, researchers in the SCARFE (Secondary Cardiac Findings Evaluation) study are exploring the pathogenicity of genomic variants associated with cardiac disease in individuals whose genomic data are contained in the NIHR BioResource for Rare Disease.4 Finally, a radiographer at a biobank who acquires an MRI scan from a data contributor and analyses the scan for image quality is not a researcher at all, because she is curating data and not conducting research. (Were the researcher acquiring the scans in the context of a specific research study, this would be primary research). We will consider these cases—and the responsibilities of biobanks as data curators—separately.

There are several important differences between primary and secondary research, which may influence the obligations of secondary researchers regarding the provision of individual findings. Centrally, the different relationship between the secondary researcher and data contributor (compared with primary researcher and participant) suggests that the standard justifications for disclosing potentially clinically significant findings in primary research (ie, the duty of easy rescue or beneficence, respect for persons, ancillary care obligations) may not apply in the same way to secondary research. In what follows, we examine the potential moral obligations of secondary researchers to data contributors, specifically as they relate to feeding back individual research findings. We also consider the role of intermediaries such as biobanks, from whom secondary researchers acquire data.

What are individual research findings?

Biomedical research can generate several different types of findings. Aggregate research results offer a summary of the study’s overall findings, such as the percentage of a study population that carries a certain genetic marker associated with heart disease. In the context of primary research, offering aggregate results to participants once they have undergone peer review is generally accepted as good research practice.5 6 Making such results available can demonstrate gratitude for the participant’s contribution and build trust in the research enterprise. We suggest that similar considerations apply to the context of secondary research. For example, a biobank might make aggregate results of research conducted using biobank data available on its website. Because the feedback of aggregate results is not our main concern in this paper, we will not discuss these kinds of results further.

Individual research results may be termed ‘primary findings’ when they relate to the outcome measure of the research, such as whether participant A has specific changes in their heart in a cardiac imaging study. Conversely, ‘secondary findings’ are individual findings that are not the primary target of a test or procedure but may be considered appropriate for return because they may have clinical relevance for the participant. In some cases, secondary findings are actively sought: the UK 100 000 Genomes Project offers participants, regardless of the health condition for which they enrolled, feedback of pathogenic genomic variants associated with health conditions that have a long asymptomatic or presymptomatic phase and for which treatments or enhanced screening have clinical utility. This includes some genes associated with predisposition to cancer, and familial hypercholesterolaemia.7

Secondary findings may also be unsought, and in such cases are referred to as ‘incidental findings.’ Incidental findings are sometimes further divided into ‘anticipatable’ or ‘unanticipatable’, where the former refers to findings which are known to be associated with a certain test or procedure (while not being deliberately sought), and the latter refers to findings which are not. The salient difference here is that a participant can be informed of the possibility of anticipatable incidental findings prior to participating in the study. For example, an asymptomatic brain infarct would be an anticipatable finding on a brain MRI (as these are present in 7.2% of healthy volunteers).8

Secondary findings and incidental findings are not uncommon. For example, research suggests that secondary genomic findings in a curated gene list are detected in approximately 3% of individual genomic sequences across a variety of settings (eg, primary care, biobanks),9 while incidental findings occur in 15%–89% of study contributors receiving CT colonography, and between 13% and 84% of brain scans.10–13

The feedback of individual research findings—primary research results, secondary findings or incidental findings—in secondary research presents many of the same ethical questions as in primary research, which have been discussed extensively: is there an obligation to return individual findings to data contributors, and if so, whose responsibility is it?14–16 But secondary research presents an added layer of complexity.

First, the introduction of additional parties changes the nature of the relationship between the data contributor and the researchers using their data, and complicates the assignment of responsibility for disclosure. If a secondary researcher detects a potential anomaly in a sample or sequence they receive from a biobank or a data archive, for example, it is unclear if it should be disclosed, and if so, who bears responsibility for disclosing this finding. Indeed, multiple secondary researchers may independently detect the same finding. Understanding their clinical significance may require further clinical evaluation,4 17 and in the case of some genetic findings, individual results might imply a risk to relatives.18 It may be unclear whether such clinical follow-up and, if appropriate, family screening, should be undertaken as a clinical or research activity.

Second, the degree and type of deidentification of the data will determine which parties have the capacity to recontact data contributors about individual findings, and if necessary, facilitate follow-up (eg, further consultation or investigations). If secondary researchers are provided with deidentified data, they will be unable to contact data contributors directly. Conversely, a biobank will have the capacity to ‘reidentify’ contributor data by linking it with identifying information (eg, contributor’s name and address), and contact a participant’s physician in the case of a finding of potential clinical significance.

Third, the potential harms and benefits of disclosure may be less straightforward in the case of secondary research. The potential time delay between acquisition of the data and generating individual research findings may impact the pertinence of the finding to the participant’s health (ie, an MRI scan taken 1 year before may not be an accurate representation of the data contributor’s current health status), as well as how receptive the data contributor may be to being recontacted (eg, a data contributor might react differently to being recontacted 3 years after originally contributing their data, compared with 3 weeks). Indeed, the data contributor may now be deceased, but the individual findings relevant for family members.18 19

Who bears responsibility for determining if individual findings are returned?

There is broad agreement that primary researchers have an obligation to plan for the management of individual research findings, and that participants have a right to have this procedure clearly conveyed to them as part of the informed consent process.20–23 However, there remains significant debate in the bioethics and clinical research community about what the content of these plans should be,7 24 25 and feedback policies may differ considerably between research labs.26 27

The structural features of secondary research imply that any feedback of individual findings must be mediated by the biobank or data archive, or the primary researcher. The biobank or data archive controls access to the data, as well as the means of recontact, if possible, meaning they are responsible for setting the terms of use. Contributors also report preferring the feedback of results to occur via a person they are familiar with28–30—which could either be the primary researcher who enrolled the contributor or collected the data, the data contributor’s primary physician or a representative of the biobank.

How should individual research findings arising through secondary research be managed?

Several strategies for managing individual research findings might be adopted by biobanks or data archives. They could adopt a blanket policy of non-disclosure, with no return of any individual findings regardless of clinical actionability. Such a decision might be motivated by a desire to avoid any psychological harms to contributors (eg, anxiety or confusion arising from individual research results or incidental findings whose clinical utility is unclear)31 and avoid confusion about the non-therapeutic nature of research participation. Scientific validity is also an important consideration; disclosing provisional individual results or incidental findings may cause data contributors to systematically change their behaviours going forward, potentially confounding the data collected in longitudinal studies, or even influencing decisions to take part. Finally, practical constraints such as a lack of resources for processing individual findings or providing necessary support for data contributors after disclosure, may be relevant.

Alternatively, individual research findings might be disclosed based on certain thresholds of clinical significance and actionability, such as when a condition is life-threatening and easily treatable.10 32 33 These standards might be explicitly stated (eg, by providing a list of imaging abnormalities or genes in which pathogenic variants will be disclosed) or be left to the judgement of the individual collecting/analysing the data, or another expert (eg, a radiologist). However, it may be unclear whether individual research results are clinically useful, or if the grounds for disclosure should go beyond medical benefit and include a participant’s wider interests. Disclosing individual research findings may also cause anxiety to data contributors or lead to unnecessary (and potentially costly) follow-up consultations, investigations and treatment. Thus, the net benefits of disclosure are often uncertain. On the other hand, research suggests that many research participants want to have individual research findings made available to them. (For an overview, see Shalowitz and Miller).34 Any feedback policy will need to account for the potential benefits and harms to data contributors, their preferences for feedback, as well as the costs to researchers (and, ultimately, the health system) of analysing and feeding back results.

Arguments in favour of a duty to disclose individual research findings

It is a further question how these management strategies are justified. More specifically, do secondary researchers have moral obligations to data contributors which must be reflected in the feedback policy of a biobank or data archive? Do biobanks or data archives themselves have moral obligations to data contributors? It is to these questions that we now turn.

The obligations of biobanks and secondary researchers

We have argued that none of the standard justifications for an obligation to disclose individual research findings in primary research apply adequately to the case of secondary research. In some cases, this is because there are features of secondary research which distinguishes them from primary research, and renders the standard justifications for feedback inapplicable. In other cases, there are weaknesses in the arguments themselves, and so they fail to justify the feedback of individual results in secondary research. Nevertheless, these accounts do illuminate important considerations. Specifically, the nature of the relationship between secondary researchers and data contributors is an important factor in determining an appropriate strategy for managing individual findings.

When data contributors agree to allow their data to be used for secondary research, they are indirectly granting future researchers discretionary power over their data; how the data are analysed and processed, what ends it will be used for, and how it will be protected and stored. Data contributors have certain expectations for the appropriate use of their data, regardless of the particular secondary researcher who accesses it. In exchange for contributing to the public good of research, they reasonably expect that their interests will be protected, through the establishment and enforcement of adequate regulations for the conduct of research in general (eg, the Declaration of Helsinki, The US ‘Common Rule’) or the use of secondary research data (eg, the GDPR).

These regulations and guidelines help to define the standards for scientific and ethical acceptability of research using secondary data and provide the context in which any relationship between individual researchers and data contributors exists. Secondary researchers have a moral—and legal—obligation to adhere to these standards. By doing so, secondary researchers ensure that the agent-neutral interests of data contributors, such as the interest in privacy and security of their data, are protected. It is a further question whether secondary researchers have additional obligations to data contributors, in virtue of a relationship between them as individuals. We argue that they do not.

We stated above that data contributors indirectly grant secondary researchers discretionary powers over their data. In granting these powers—even indirectly—data contributors necessarily face the risk that this power will be misused. Indeed, it is because of this potential vulnerability that strong oversight and regulation by the state is justified. Within these regulatory boundaries, however, secondary researchers can also affect the interests of data contributors. For example, a secondary researcher might conduct research which risks marginalising a certain social group. The appropriate use of their discretionary powers will depend on the nature of the interests entrusted to them by data contributors.

Secondary researchers are granted access to contributor data for the purposes of conducting research for the benefit of society. The interests entrusted to them are to ensure that data is used for this purpose, and that contributor privacy is protected. It is not to protect or promote their health. Thus, we argue that the appropriate use of their discretionary power is limited to these purposes, which does not require disclosing individual findings.

A similar argument applies to biobanks themselves. The obligation of the state to protect the interests of data contributors, as explicated in ethical regulations, requires biobanks to adhere to strict requirements regarding the acquisition, storage and distribution of contributor health data. However, unlike secondary researchers, biobanks might be argued to have a relationship with data contributors that generates some sort of duty of care. Data contributors directly entrust biobanks with discretionary powers pertaining to the collection, storage, and distribution of their data, as well as further discretionary powers necessary for acquiring this data (eg, the power to conduct tests, collect samples, and curate data). Biobanks may also have access to a range of identifiable contributor health and demographic data. Moreover, because biobanks may follow up with contributors periodically for longitudinal studies, or recontact them to participate in further testing, it is plausible that data contributors may come to view their relationship with the biobank as one in which they have entrusted at least some of their health interests (even if the biobank is explicit that they are not providing care to contributors).

Nevertheless, we argue that even if the relationship between biobank and data contributor is a trust relationship, it does not follow that there is an obligation for biobanks to disclose individual research findings to data contributors. Trust relationships give rise to a range of obligations reflecting the structure of the relationship (ie, where one party entrusts the other with power over a significant practical interest), which may include a duty of care.45 How these duties are specified depends on the interests entrusted. The purpose of the relationship between data contributors and biobanks is the conduct of health research that is broadly in the public interest. When a data contributor provides their data to the biobank, they are entrusting them with the power to use this data to conduct socially beneficial research. The biobank’s ‘duty of care’ amounts to an obligation to act in a manner that meets this trust. For example, they must not allow contributor data to be used for research that might be considered socially harmful.

The disclosure of individual research findings, on the other hand, constitutes a legitimate exercise of the discretionary power of the biobank only insofar as protection of the contributor’s health interests has been entrusted by the data contributor. In such a case, feedback would occur in accordance with what the biobank judges to be consistent with the relevant health interests of the data contributor. Thus, if a biobank imposes a blanket policy of non-disclosure of individual research findings, this is consistent with their obligations to data contributors if the biobank has made clear that data contributors are only entrusting the protection of their data to the biobank, and not entrusting any health interests. Conversely, a biobank may offer to accept responsibility for certain health interests of data contributors. If contributors choose to entrust these interests, the biobank’s duty of care changes accordingly—and may include an obligation to feedback individual research findings—because the nature of the relationship has changed.

Thus, while there is no moral obligation for biobanks to feed back individual research findings, there is also no moral obligation to withhold them. The obligations of the biobank depend on the nature of the relationship that has been established with data contributors. This leads to the possibility of offering to feed back individual research results for pragmatic reasons, such as a desire on the part of the biobank to increase enrollment, or because participants express a desire for them. For example, the Icelandic biopharmaceutical company deCODE, which has collected genomic and other biomedical data from nearly two-thirds of the adult population of Iceland, provides feedback of select individual research results through a secure web-based portal.46 Participants can choose to access their genetic status regarding a pathogenic variant of the BRCA2 gene, and genetic counselling is made available in positive cases. Insofar as this opportunity for feedback is understood as a ‘bonus’ of participation, it does not change the nature of the relationship between the biobank and data contributors. On the other hand, providing some individual research results might be interpreted by data contributors as the biobank accepting responsibility for their health interests.

In either case, it is critical that the nature of the relationship and the interests being entrusted be clearly conveyed to prospective data contributors. Unlike the role of the physician, which has been developed and refined over centuries and whose duty of care is well understood by most patients, the role of the biobank is less familiar. It is possible that some data contributors may believe themselves to be entrusting their health interests to the biobank, and thereby expect the feedback of individual research findings. Clear communication about the role of the biobank is key to ensuring that the expectations of data contributors are aligned with the obligations of the biobank.