# Privacy in the Human Brain Project: The Perspective of Ethics Management

Bernd Carsten Stahl

► To cite this version:

Bernd Carsten Stahl. Privacy in the Human Brain Project: The Perspective of Ethics Management. Anja Lehmann; Diane Whitehouse; Simone Fischer-Hübner; Lothar Fritsch; Charles Raab. Privacy and Identity Management. Facing up to Next Steps: 11th IFIP WG 9.2, 9.5, 9.6/11.7, 11.4, 11.6/SIG 9.2.2 International Summer School, Karlstad, Sweden, August 21-26, 2016, Revised Selected Papers, AICT-498, Springer International Publishing, pp.52-55, 2016, IFIP Advances in Information and Communication Technology, 978-3-319-55782-3. 10.1007/978-3-319-55783-0_5. hal-01629169

HAL Id: hal-01629169

https://inria.hal.science/hal-01629169

Submitted on 6 Nov 2017

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Privacy in the Human Brain Project : The Perspective of Ethics Management

Bernd Carsten Stahl

De Montfort University, Leicester, UK
bstahl@dmu.ac.uk

**Abstract.** The paper describes the ethics management function of the human brain project. It highlights some of the specific privacy-related issues of the project and the strategies that ethics management uses to address these.

**Keywords:** Human Brain Project, neuroinformatics, data protection, privacy, ethics management

The Human Brain Project (HBP; www.humanbrainproject.eu) is a European, Flagship initiative that facilitates and supports a global, united effort to understand the brain by providing platforms and tools along with neuroscientific and medical data, to study the brain, its diseases and to catalyze new brain-inspired technologies [1].

The HBP aims to create and operate a European scientific research infrastructure for brain research, cognitive neuroscience and other brain-inspired sciences. It gathers, organizes and disseminates data describing the brain and its diseases. Of particular importance for us is the stated aim that the **HBP is dedicated to responsible and ethical research.** In addition, the HBP is an extensive collaboration between scientists, researchers and institutions around the world. This includes nature as an open-science initiative. The HBP is developing Information Communication (ICT) Tools that have applications in neuroscience, medicine and computing

It is important to underline that the focus on responsible research and innovation (RRI) figures prominently among the aims of the project. This is explained by the fact that the project's funder, the European Commission, is keen to promote RRI in research [2–4]. At the same time, the HBP raises a number of potential ethical and issues, ranging from the immediate and practical, like the approval of research protocols, to the more general and philosophical, like the possibility of machine consciousness or novel approaches to artificial intelligence (AI).

In order to address these issues, the HBP has a sub-project dedicated to ethics and society. The overall HBP is split in 12 sub-projects which are the organizational home to scientific, technical and administrative activities. The society and ethics sub-project, the home of RRI in the project, is divided into four sections which look at foresight research, conceptual and philosophical analysis, public engagement and ethics management [5]. This abstract highlights the role of privacy and data protection in ethics management.
Ethics management is broken down into several tasks. It covers principles and im-
plementation of ethics management, which includes the development and maintenance
of an overview of ethical issues called the HBP Ethics Map
(https://www.humanbrainproject.eu/ethics-management). Working with other sections
of the society and ethics sub-project as well as the scientists of the scientific and tech-
nical sub-projects, the ethics management team develops bespoke ethics issue action
plans. It develops Standard Operating Procedures (SOPs) and undertakes the identifi-
cation and management triage of ethical issues. In order to ensure that all work in the
HBP happens in accordance with laws and regulations, the ethics compliance task
maintains an HBP Ethics Registry which contains an overview of the ethical issues of
all other tasks and a collection of ethics approvals of those tasks that require them.
Ethics management communicates with the European Commission and its ethics re-
viewers in the context of regular ethics reviews. In order to have an understanding of
specific issues, the ethics management group manages a so-called Rapporteur Pro-
gramme which includes representatives of all other 11 sub-projects. These rapporteurs
are scientists from all areas of the HBP who spend a portion of their time working on
issues of RRI. This includes physical meetings, teleconferences and interaction with
members of the Ethics Advisory Board, which made up of independent experts who
provide advice to the HBP.

Privacy is a key issue that the HBP has to address. There are different types of human
data that are potentially affected by data protection regulation and therefore subject to
scrutiny during ethics review. This refers to research data that was collected from hu-
man volunteers as well as patient data. For volunteer data the processes of collecting
informed consent are fairly well established which links to the possibility of using the
data for research purposes. The use of patient data raises bigger obstacles. The medical
informatics platform, one of the HBP subjprojects which aims to gain neuroscientific
insights by mining patient data has therefore developed a complex process to allow
querying patient data which is held by partner hospitals. This includes several steps of
de-identification, anonymisation and aggregation of the data in order to ensure that no
personally identifiable information is used. While these aspects are concerned with
complying with data protection legislation, including the incoming European data pro-
tection regulation, privacy concerns in the HBP go beyond such reactive measures. The
HBP strives to establish good practice in the data governance of big neuroscience and
aims to put in place ideas of broader data stewardship. The ethics management function
plays a central role in this.

Ethics management operates according to the principle of subsidiarity, which means that the responsibility for appropriately dealing with ethical issues remains with the local Principal Investigator. Ethics management supports these PIs and collects approvals. Most importantly, ethics management works with all stakeholders involved (researchers, ethics reviewers, EC, Ethics Advisory Board) to find ways of appropriate dealing with ethical issues. In this way ethics management seeks to develop good practice for managing ethics in large data-drive biomedical research.

Compliance management follows categorisation of ethical issues as described the Horizon 2020 ethics self-assessment manual. During the ramp-up phase, the first phase of the project which lasted from October 2013 to March 2016 the following approvals
were collected: 19 "animals" 25 "Humans", 1 "Human Cells / tissues", 1 "None" (re-
tained because of general relevance). It was interesting that no issue was collected under
the heading of "privacy". This is not because of a lack of privacy-related issues, but
because they generally fell under human research with privacy being only one aspect
of the complex ethical issues.

In fact, privacy was recognised as a key issue in the HBP and, as a consequence, the ethics and society sub-project, together with the Ethics Advisory Board wrote an Opinion on Data Protection<fnref n="1" />. This was based on work undertaken in all sections of ethics and society as well as prior work of several EAB members. This Opinion made the following recommendations.

* Create coherent data governance

- Nominate individual responsible for data

- Set up data governance committee

- Include stakeholders and general public

- Establish PIA and data audit

- Ensure data stewardship

* Adopt privacy model

The ethics management team is in the process of turning these recommendations into practice. Due to the size and complexity of the project this is not a trivial exercise. The chosen approach is therefore to develop what we call an ethics issue action plan. This is a document that lists all the requirements and suggest possible ways of addressing them. It is developed by the ethics management team and then discussed with the various stakeholders. At the time of writing (January 2017) an internal meeting is being planned to discuss the different measures which include technical measures, implementation of privacy impact assessments, the appointment of a data protection officer and stakeholder engagement with a view to ensuring that the measures are consistent, realistic and fit for purpose.

Ethics management is well placed for such a task, given its prior engagement with all HBP stakeholders. One key insight arising from this work is that privacy and data protection is an important issue, but it is by no means the only one. Different ethical and social issues intersect and privacy issues tend to overlap with other issues in a complex mixture of interests. It is important to create structures that can deal with these issues and that have the potential to react to external developments and learn from mistakes. Ethics management is one such structure that will help the HBP successfully deal with privacy and data protection.

**Acknowledgements.** This project has received funding from the European Union's Horizon 2020 research and innovation programme under grant agreement No 720270 (HBP SGA1).

<footnote n="1">¹ Available at: https://www.humanbrainproject.eu/documents/10180/1384155/EthicsandSocie-
tyOpinionDataProtectionandPrivacy.pdf/3612d948-fc33-4e57-baf3-a9cfe2cd673c, accessed
10.01.2017</footnote>
References

1. Amunts, K., Ebell, C., Muller, J., Telefont, M., Knoll, A., Lippert, T.: The Human Brain Project: Creating a European Research Infrastructure to Decode the Human Brain. Neuron. 92, 574–581 (2016).

2. European Commission: Responsible Research and Innovation - Europe's ability to respond to societal challenges. European Commission, Publications Office, Brussels (2012).

3. Owen, R., Heintz, M., Bessant, J. eds: Responsible Innovation. Wiley (2013).

4. Stilgoe, J., Owen, R., Macnaghten, P.: Developing a framework for responsible in-
novation. Research Policy. 42, 1568–1580 (2013).

5. Evers, K.: The contribution of neuroethics to international brain research initiatives.
Nat Rev Neurosci. advance online publication, (2016).