Informed consent should be sought before data are used by registries

EDITOR—The news story on the possibility that cancer registries might collapse as a result of new guidance on patient confidentiality issued by the General Medical Council highlighted the difficulties faced by doctors who must deal with increasing bureaucracy.1 In conjunction with a multidisciplinary team from different parts of the United Kingdom I was involved in establishing a prospective register of pregnant women with epilepsy. Pregnancy in women with epilepsy is associated with an increased risk of fetal malformation.

As with cancer, there are variations in the routine treatment of epilepsy in pregnancy. It would be considered unethical to carry out a clinical trial of treatment, but because many pregnancies occur in women already taking a variety of anti-epileptic drugs (for many of which no reliable data on teratogenicity in humans exists) valuable information could become available if only it was collated. It was on this premise that the UK Epilepsy and Pregnancy Register was established.

From the outset we identified the need for confidentiality, and all patients included in the register give informed consent. Few patients have refused or withdrawn consent, and indeed most are delighted that some research is being carried out on this subject. Although case ascertainment would probably be higher if informed consent was not necessary, this is an inevitable trade off made to maintain patients' trust.

A further difficulty faced by registries is that of formal ethical approval. Approval for our register was obtained from a multicentre research ethics committee, but this did not obviate the need to apply to over 200 local research ethics committees. Many of the local committees had idiosyncratic requirements and made idiosyncratic responses to our request. Dealing with our share of the bureaucracy occupied the best part of 12 months and probably caused the loss of a medium sized Amazonian rainforest. Thus, we feel that this mechanism is an even greater hurdle than that of confidentiality.

Along with other physicians and patients, we believe that there is much information available on the way we manage many conditions if only this information could be more easily collated. The information provided by registries will increase knowledge and ultimately benefit patients. However, the issue of informed consent and the bureaucracy surrounding multicentre ethical approval needs urgent review.

GMC is greater threat to research than the act

EDITOR—Like Strobl et al the North Staffordshire Local Research Ethics Committee has been seriously considering data protection issues while not wishing to impede research unnecessarily.1 We were concerned about the implications of the Data Protection Act. We advised researchers to consider its implications, sought advice from the data protection commissioner (emailed March 2000, response awaited), and as a last resort actually read the act.2 This is not a task to be undertaken lightly: the language is convoluted and arcane. None the less, section 33 of part IV of the act exempts research from most of the provisions of the act; further processing of data for purposes for which it was not originally collected (section 33 (2)) and publishing it is allowed provided the data has been anonymised (section 33 (4)(b)). The transfer of data outside the European Union, however, is prohibited (data protection principle 8) unless adequate data protection has been ensured by the country outside the union. This could present difficulties for international multicentre collaborations involving countries outside the European Union. Section 30 (1) allows the secretary of state to order that health information be exempted from the provisions of the act.

The General Medical Council's view that consent has to be obtained from participants to allow data that is already on a registry to be processed is a greater threat to epidemiological research than the Data Protection Act.3 We may end up in the ridiculous situation in which non-medical scientists are able to do epidemiological work but registered doctors are not. There has to be a considered approach to the need for explicit consent; this approach will depend on the degree to which records have been anonymised and the degree to which data processing has separated data from individuals. If the GMC's current position is followed to absurdity the Cochrane collaborators would have to get written consent from all participants before performing a meta-analysis.

In general, the provisions of the Data Protection Act are sensible, and researchers would do well to comply with them or be able to justify any failure to do so. Although research is exempt from some important provisions, consent is the cornerstone of ethical research and the good intentions of researchers and the inconvenience of obtaining consent will not be sufficient to explain to patients or research ethics committees the unauthorised processing of personal data.

New Zealand model of consent offers solution

EDITOR—Strobl et al raise important issues about interpreting data protection legislation and its effects on research.1 These issues are familiar to researchers in New Zealand.

We have used computerised patient data for research since 1989 when the Royal New Zealand College of General Practitioners' Dunedin Research Unit established its computer research network.2 Before the network conducted any research, the proposal was reviewed and approved by the local ethics committee. Subsequently, each proposed project has been subjected to review by the committee. The data contained on the network are anonymous: no names, addresses, or telephone numbers are ever seen by researchers. Later in the network's development, the unique alpha-numeric code used by the New Zealand public health system was attached to many files. Through a complicated process it was initially possible to identify individual patients using this code. When this was recognised, a further step was added to ensure that researchers received only encrypted identifiers. The de-encryption program is held in a central government agency and the research data are held in a university.

But where does this leave the patient's consent? Patients are informed by notices in the offices of practices affiliated with the research network that information from their consultation, investigation, or referral may be used for research once it has been stripped of identifying data. Patients are assumed to have given consent if they continue to be seen in practices affiliated with the network. So effective are the anonymisation processes that individual patients cannot be identified, even to withdraw their data. Data from whole practices can be excluded from research projects but data from individual patients cannot.

This is not a perfect system. It requires patients to act in accordance with the social responsibility they incur when they use public health systems: that is, to accept responsibility to contribute to research that advances medical knowledge. It requires researchers to act responsibly in the public interest rather than promoting the commercial interests of health related industries. It requires ethics committees to have a breadth of understanding of issues in medical research that is difficult to achieve when there is short term committee membership and high turnover. It requires everyone to question constantly what they are doing and why. But it has worked in New Zealand for more than a decade. This model may be effective in other countries.