Introduction

Genomic data sharing is vital for optimizing the use of research data funded by public resources. Given the legal barriers related to the trans-border exchange of samples, sharing data resulting from analyses of these samples is advantageous. Funders of health research issued a joint statement in 2011 that endorsed “greater access to and use of data” in equitable, ethical, and efficient ways.1 International and national policies and guidelines have established general frameworks to guide researchers in their data sharing endeavors.2,3,4,5,6

To protect the rights and interests of involved parties in genomic data sharing, a level of control regarding data access is necessary.7 To this end, data access committees (DACs) have been introduced as a core element of this controlled-access model. DACs have the responsibility of reviewing and assessing access requests.8 Some DACs are constructed at the level of institutions or consortia, have developed formal regulations, and hold regular meetings. Others are managed by principal investigators within individual research groups9,10,11,12 ( Table 1 ). The database of Genotypes and Phenotypes (dbGaP) of the National Institutes of Health (NIH) and the European Genome–phenome Archive (EGA) exemplify controlled-access databases in which users’ access to the main data sets is dependent on approval from DACs, either of the National Institutes of Health or of the data contributors, respectively.13,14

Table 1 Types of data access committees
Full size table

As a governance mechanism, DACs have been included in some data sharing policies over the past few years.15 However, to date, DACs have received limited attention in the literature,16,17 and their tasks, procedures, and functionality are relatively understudied. Given the increasing calls from the scientific community to share genomic data, examining the role of DACs as a governance mechanism is timely. To this purpose, we investigated the experiences and attitudes of DAC members and experts regarding the role and adequacy of DACs in access review. To our knowledge, this is the first qualitative study with international DAC members and experts to focus on DACs and data access. In this paper, we report the opinions of DAC members and experts on the goals of access review and controlled access, their experiences with reviewing the ethical and scientific aspects of proposals, and their views on the adequacy of those mechanisms. The experiences and opinions of DAC members and experts on the assessment of users’ qualifications are not discussed here.

Materials and Methods

Twenty semi-structured interviews were conducted with key informants. We conducted 16 semi-structured interviews with members of DACs involved in reviewing access requests for genomic data available in databases such as the EGA and the dbGaP. To identify DAC members, we consulted the lists of DACs from such databases. In addition, we interviewed four experts in the field who either had published in this field or were members of advisory committees related to data sharing ( Table 2 ). The study protocol was based on an extensive literature review.18,19 Invitation letters were sent by e-mail, and interviews were conducted via telephone, Skype, or in person between November 2014 and May 2015; these were audio-recorded. Audio files were anonymized and transcribed verbatim. Preliminary coding was conducted by M.S. and discussed within a team for validation. M.S. performed the final analysis of the transcripts using NVivo 10 software; M.S. and P.B. had further discussions regarding the final analysis and validation of codes. The main themes were developed on the basis of the final codes. The study was approved by the Social and Societal Ethics Committee of the University of Leuven in October 2014.

Table 2 Overview of the interviewees by location, professional/educational background, and type of DAC
Full size table

Results

DAC members and experts outlined the underlying reasons for controlled access and access review procedures. Subsequently, they reflected on reviewing the ethical and scientific aspects of proposals and the adequacy of the current tools and mechanisms.

Goals of access review

DAC members and experts indicated that protecting data subjects’ privacy along with data producers’ professional interests are the main underlying reasons and goals of access review and the controlled-access model.

Protecting data subjects. All DAC members and experts endorsed genomic data sharing because of its notable benefits for science and society. They also highlighted direct benefits of data sharing for patients at times. Nevertheless, they perceived that the minimal risks associated with data sharing require a degree of protection. This protection was considered crucial to maintaining public trust. Potential misuse of data and risk of re-identification were highlighted as the main potential harms to data subjects. According to some, re-identification concerns are intensified when higher volumes of data are shared, such as data from whole-genome sequencing and in linked data sets.

“Because, like in the past times, when you submitted some data they were some SNPs, maybe 50–200, but never whole-genome data, never whole-exome data, which actually makes it very easy to identify a person.” (Interview 13, DAC member)

Precautionary approaches toward genomic data protection were deemed necessary despite the current low risks associated with re-identification. However, owing to technical limitations, the promise of full privacy protection seemed unlikely to be fulfilled.

“So [if] there is [even a] very small risk that something goes wrong [that] can be enough for study participants to say no, I don’t want to be part of it. And especially, of course, if the study is quite small, then people may know who has participated in that study and it is difficult to foresee what can happen, but I can imagine that the wrong thing can happen.” (Interview 19, DAC member)

One DAC member questioned the need for the controlled-access model, claiming that genomic privacy risks are exaggerated. Likewise, some argued that the privacy risks associated with genomic data sharing are no greater than those associated with other types of personal data sharing that are not often controlled.

“Now, in terms of the protection of the subjects, I actually think this is a very exaggerated issue in genetics. I think the risks for individuals are negligible, and I think it is a matter of culture of the field.” (Interview 7, DAC member)

Protecting data producers’ interests. In addition to protecting data subjects and maintaining public trust, access review seems to play a crucial role in addressing the professional concerns of data producers. Crafting mechanisms to adequately acknowledge the data producers’ efforts in the collection and initial analysis of the data was considered necessary. The interviewees mentioned various ways of acknowledging data producers that can be incorporated into data access agreements or publication policies. These included citing the data producers or acknowledging the data sets by the data users.

“I think it is important to think about ways to recognize the contribution of the data collectors. So, these are people working on the disease cohorts for ten years and then after the first publication they need to make all the data fully public. And then Bioinformaticists from other institutes do the rest. They can’t publish on it anymore. Then the biobank people lose their incentives [for] this complex, tedious, long-term work.” (Interview 19, DAC member)

Enabling data producers to control downstream use of the data sets was seen as another advantage of access review. Some DAC members took this opportunity to discuss collaboration with applicants when common research interests emerged in the access review. However, adding collaboration as a condition of data access was not considered necessary by all DAC members.

“There was one study where we found overlap. Essentially, the group was trying to do the same study as I did. I mean they were working in the same direction, and then we talked—the advantage of having the DAC. I talked to them, and then we decided we will be working in collaboration.” (Interview 6, DAC member)

Review of the ethical aspects of proposals

Providing DACs with a short description of the proposed data use, often in the form of a scientific abstract, is a requirement to gain access to the data sets. DAC members and experts often see this as an opportunity to check the consistency of the uses proposed against the potential limitations of data use. The limitation placed on commercial bodies’ access to data was cited as a classic example.

“We also had quite a few requests from commercial enterprises...diagnostic testing companies as well as clinical diagnostic labs within academic institutions. So we had [a] lot of discussions about how we should deal with that, because in our Data Access Agreement form we state data is not for commercial use, profit-making use.” (Interview 8, DAC member)

In addition to the scope and pertinent limitations of data use, DAC members and experts voiced their concerns over potentially controversial data uses. Research proposals concerning culturally or politically sensitive issues exemplified controversial cases that some DAC members had encountered in their experience with access review. Research with the potential to stigmatize vulnerable populations was also mentioned. On some occasions, involving ethics committees or consulting informants to discuss such cases on an ad hoc basis seemed necessary. Nevertheless, the very low frequency of controversial cases was reported.

“We had some studies that sometimes people propose to do something that is not an opposition to the data use limitation, but maybe not appropriate. We had some investigators who wanted to do the ancestry and characterization study in a small isolated population, things that just did not seem correct. And other cases that people wanted to look at cognitive ability and education with regard to race.” (Interview 11, DAC member)

Furthermore, applicants might be asked to follow the requirements of their home institution regarding ethics approval. This allows home institutes to assess the ethical aspects of the proposed uses if required. However, challenges with such approach were identified. In particular, a DAC member highlighted the limitations of verifying whether applicants adequately meet those requirements. Establishing the correct level of oversight was highlighted as a major consideration to ensure fast and easy access to data in a responsible fashion.

“People are actually telling you “I need ethics approval and I have got it,” and they will send you a copy. But it is in Chinese. What would you do with that? You can’t really read it, and at the same time you don’t want the process to be too cumbersome, where you would actually ask somebody that you can translate this form for me. So sometimes it is just a matter of dosing. You want the right amount of oversight, but you don’t want too much to the point where it gets overly complicated to access the data.” (Interview 5, DAC member)

Review of the scientific aspects of proposals

The majority of DAC members and experts favored a minimalistic approach toward scientific review of the proposed uses. In general, the DAC members thought that only assessment of the feasibility of the research proposals to use the requested data was necessary. Consequently, a DAC member believed that the term “administrative review” would better reflect these processes to avoid confusion.

“The review that comes in is a little bit scientific to the extent that we wanted to make sure that the research question that they are saying they want to act with the data can actually be addressed by the data they have requested. And also to make sure that the scientific question they are asking [is] consistent with the limitation for the data.” (Interview 12, DAC member)

On some occasions, the scientific merits of the proposed research were the subject of concern for some DAC members. However, members expressed ambivalence regarding the responsibility of DACs on this matter. Nonetheless, most said they believed that conducting a quality-control review or second-guessing the scientific values of the proposed uses are beyond the remit of DACs.

“Research, of course, should be sound...we don’t want to have rubbish, although we are not a quality control. So if they really insist they will get the data as long as they conform to the ethical, legal permissions.” (Interview 10, DAC member)

Tools and mechanisms

DAC members and experts listed some tools and mechanisms that have been utilized to achieve the ultimate goals of access review. These commonly included consent forms, data access agreements, and guidelines.

Consent form. DAC members said they use consent forms to check the consistency of the proposed uses with the data- uses limitations. However, the availability of consent forms for DAC members can be challenging when the data were originally collected elsewhere.

“So we had to actually make some efforts to make sure that our patients’ consent was [obtained] in a way that we could share the data via the database. I mean, we succeeded, of course, but it had to go back to the clinic to check with the original papers to be sure that we are on the safe side.” (Interview 13, DAC member)

In addition, to determine the consistency of the proposed uses with the wishes of the data subjects, consent forms occasionally required interpretation. One expert said that reasonable expectations of data subjects should guide the interpretation of consent forms but this should be assessed on a case-by-case basis.

“I think all one can try to do is seek to interpret them in ways that would protect public confidence, which is to say one tries to interpret it purposefully and with the view to ensuring the access taking place only in circumstances that you think people have reasons to accept.” (Interview 15, Expert)

Furthermore, some DAC members and experts discussed the use of complementary mechanisms to better inform individuals about the use of their data. For this purpose, some suggested additional involvement of research participants in decisions about participation or withdrawal. Several respondents also highlighted the importance of transparency in communication with research participants. Seeking the input of research participants on the study design or access review was also recommended.

“You can think about better models. We had a paper about a model where participants can choose for themselves. They are the data access committee, and they choose to participate in the study. They basically study contacts directly or they just decide certain parameters and they want all studies to comply with these parameters they want to be part of.” (Interview 20, Expert)

Data access agreements. Data access agreements have been used as a legal instrument to delineate users’ responsibilities with respect to data producers and data subjects. The main provisions of these agreements include not transferring data to third parties, respecting the publication rights of the data producers, and the terms and conditions of termination of a contract. Data access agreements drafted by institutes or consortia are often used as a template, with inclusion of minor adjustments required by local laws and regulations. Some respondents highlighted the scarcity of mechanisms to monitor compliance of the users, with some noting that the relationship between DACs and users is based mainly on trust.

“In a way it looks very solid, but, of course, you don’t know what happens in practice. I mean, in practice the only thing you could do is trust the person on the other side.” (Interview 19, DAC member)

Regardless, DAC members and experts did not expect to see major violations, and very few had reported any actual violations to date; most of those reports were of minor misdemeanors. These minor violations were believed to be unlikely to result in harm to data subjects and were mostly due to carelessness.

“Uncommonly you get some slip-ups, like one student leaves a project and another person comes in and the lead researcher forgets to tell us that it is a different PhD student working on this. They shouldn’t do that, but it is not a kind of major problem, it doesn’t lead to any damage.” (Interview 2, DAC member)

Guidelines. According to DAC members and experts, guidelines and policies are instrumental in providing general direction for access review, although assessments are usually conducted on a case-by-case basis. Extensive involvement of some institutes and consortia in drafting data access policies was reported. Some said these policies and guidelines could be used as a template.

“I think what will happen is that it will be some policies that try to make the situation a little clear, by anticipating some of the obvious questions that may arise and coming up with answers to them. But then quickly individual cases would begin [to be tested] and then the policy would be revisited and developed in the light of the experience gained through the individual cases.” (Interview 15, Expert)

Moreover, the international guidelines were recognized for their beneficial role in globally streamlining data sharing and access policies. The universal and cross-nation guidelines are expected to standardize processes and thus facilitate researchers’ access to data across the world. For example, some DAC members and experts referred to the policies and framework developed by the Global Alliance for Genomics and Health. The role of funding agencies and scientific journals in developing policies to facilitate data sharing, thereby improving access procedures, was also discussed.

“In fact, there are lots of cohorts, lots of DACs. It is not particularly uniform in terms of how they behave. We should be issuing guidance around us, and that’s one of the things being discussed: guidance to funders, guidance to scientists. Funders monitor the performance of the things that they fund, and the standard behavior of these kind of committees should be a factor in that monitoring.” (Interview 1, DAC member)

Adequacy of the current structure

The DAC members and experts generally favored a quick and “light-touch” review. They said that an optimal review would entail minimal formality, proportionate to the associated risks, that would result in fast and easy access to data sets for users. In general, DAC members objected to the addition of extra layers to the review procedure, although adding clarifications to sharpen boundaries between appropriate and inappropriate research—for both users and DACs—would be welcomed.

“So, in this respect, overly burdensome requirements are problematic. Once it is the case that data have been de-identified sufficiently, then there should be minimal barriers for distributing them and sharing them and minimal formality that one has to [observe].” (Interview 3, DAC member)

In terms of workload, respondents said the actual infrastructure of DACs is able to meet the current demands. Nevertheless, there were expectations of potential challenges in managing the increasing volume of data in the future, and some DAC members discussed delegation of access review responsibilities to central DACs. Most respondents used examples of DACs in the dbGaP and the EGA to illustrate a central approach and local or distributed model, respectively. Some suggested that a central DAC could potentially meet access review needs in a more efficient, uniform, and sustainable way. “Because that means the data sets are handled in a uniform way, and researchers know what to expect when they are applying.” (Interview 17, DAC member) Others, however, perceived central DACs as sometimes being bureaucratic, leading to delays in access.

Discussion

The results of this study show that DAC members and experts believe that the complexity of access review should correspond to the concerns associated with genomic data sharing. In line with this, they criticized the cumbersome access procedures. Despite differences in educational or professional backgrounds, DAC members and experts shared fairly similar perspectives on the underlying concerns. They noted that privacy risks seem possible but are not an imminent threat. Given the limited examples of actual privacy violations of research data security to date, some said that privacy risks are overstated. Nevertheless, the DAC members and experts agreed that implementing a level of protection proportionate to the sensitivity of the data is crucial to maintaining public trust. Until innovative models of data sharing with better data protection and lower barriers on access are fully established, the current controlled-access model managed by DACs appears to be an adequate response to privacy concerns.20,21,22

In addition, checking the consistency of proposed uses with original consent forms underpins access review. In the face of data sharing practices, the importance of the consent mechanism to respect the autonomy of research participants and maintain their trust is underscored in the literature.23 However, analyzing the consistency between the proposed use and the original consent form is not always straightforward because of the challenges for DACs in accessing the forms. DACs also cited the challenge of accessing sufficient tools and expertise to interpret consent forms. Although members said they favor broad consent forms that authorize a wide range of data uses, the usage limitations of some consent forms may be unclear about the scope of permissible uses. In addition, at times the consent forms fail to encompass all aspects of data sharing, particularly with respect to the retrospective use of samples and data. In principle, when there is ambiguity, consent forms should be interpreted in line with the reasonable expectations of data subjects.7 Greater involvement of data subjects in the process of access review and research governance could be beneficial in order to recognize their preferences.24 Consulting informants in order to collect contextual knowledge regarding what data subjects would reasonably expect and broader implications of research for communities would be instrumental, as suggested by de Vries et al.25 Consent forms could also be improved by using the experience of DACs in dealing with ambiguous language in existing consent forms.

Furthermore, data access agreements can be utilized to set legal grounds for the liability of data users and their affiliated institute in cases of wrongdoing.26 Although the DAC members and experts questioned the robustness of the oversight mechanisms of users’ compliance by such agreements, they were wary of introducing a “heavier” oversight procedure. We could stipulate two main reasons for this cautious approach. First, the limited number of contract breaches experienced to date suggests that stringent oversight is unnecessary. Second, additional oversight is resource-intensive and therefore logistically unfavorable. Having the correct level of oversight was described as a key consideration in ensuring that data are used responsibly without hindering research. Likewise, the recent report on governance of data access by the UK Expert Advisory Group on Data Access underscored the need to monitor compliance with data access agreements in a “proportionate manner.”27 Further studies are required to determine the “right” level of oversight and how this can be accomplished. To this end, home institutes could play an active role in overseeing research activities conducted within their facilities.

The respondents said they considered streamlining access review and introducing a uniform procedure instrumental to achieving the ultimate goals of data sharing. They also pointed out that international guidelines could provide general directions for institutes and consortia and ensure consistency of review protocols. The consent policy developed by the Global Alliance for Genomics and Health, among others, is an example that can guide data producers in the preparation of consent forms that adequately address data sharing aspects.28 Concurrently, funding organizations can play an active role in streamlining these procedures or building a centralized access review infrastructure efficiently.29,30 Funding organizations are also well placed to enforce data sharing policies and to reinforce both prepublication and postpublication data sharing.31 The current examples of the central infrastructure set up by some institutes could be used as templates. However, the extent to which data producers should be involved in a centralized structure of DACs remains to be determined. This is a significant concern of some data producers because they see access review either as a mechanism to maintain control of downstream use of data or as an opportunity to collaborate with data users.32

Disclosure

The authors declare no conflict of interest.