# A proposal for an international Code of Conduct for data sharing in genomics

Amal Matar, Mats Hansson, Santa Slokenberga, Adam Panagiotopoulos, Gauthier Chassang, Olga Tzortzatou, Kärt Pormeister, Elias Uhlin, Antonella Cardone, Michael Beauvais

► To cite this version:

Amal Matar, Mats Hansson, Santa Slokenberga, Adam Panagiotopoulos, Gauthier Chassang, et al. A proposal for an international Code of Conduct for data sharing in genomics. Developing World Bioethics, 2022, 10.1111/dewb.12381. hal-04087650

HAL Id: hal-04087650

https://hal.science/hal-04087650

Submitted on 3 May 2023

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
ORIGINAL ARTICLE

<figure><img src="image_2.png" /></figure>

WILEY

# A proposal for an international Code of Conduct for data sharing in genomics

Amal Matar ID

Mats Hansson

Santa Slokenberga ID

Adam Panagiotopoulos

Gauthier Chassang ID

Olga Tzortzatou ID

Kärt Pormeister

Elias Uhlin

Antonella Cardone ID

Michael Beauvais ID

**Correspondence**

Amal Matar, MD, PhD, Centre for Research
Ethics and Bioethics, Uppsala University,
Uppsala, Sweden.

Email: amal.matar@crb.uu.se

**Funding information**

Horizon 2020 Framework Programme,
Grant/Award Number: 741716

**Abstract**

As genomic research becomes commonplace across the world, there is an increased need to coordinate practices among researchers, especially with regard to data sharing. One such way is an international code of conduct. In September 2020, an expert panel consisting of representatives from various fields convened to discuss a draft proposal formed via a synthesis of existing professional codes and other recommendations. This article presents an overview and analysis of the main issues related to international genomic research that were discussed by the expert panel, and the results of the discussion and follow up responses by the experts. As a result, the article presents as an annex a proposal for an international code of conduct for data sharing in genomics that is meant to establish best practices.

**KEYWORDS**

biobanking, cloud computing, code of conduct, data protection, genomics, international data transfers, privacy

1 | INTRODUCTION

The call for an international code of conduct (CoC) for data sharing in genomics has been reiterated by lawyers and bioethicists alike.<fnref n="1" />,<fnref n="2" /> In a recent article by Phillips et al,<fnref n="3" /> specific questions were raised in the pursuit of this code of conduct. According to the authors, issues relating to consent procedures and withdrawal of consent, return of results and data portability, compelled disclosure and identifiability of personal data

remain unresolved. Importantly, as a consolidation of best practices, a CoC could act as a framework for nations, where little in terms of guidance or laws or regulations are provided, for example in low- and middle-income countries (LMICs).<fnref n="4" /> It is worth noting that the Biobanking and BioMolecular resources Research Infrastructure-European Research Infra-structure Consortium (BBMRI-ERIC) is in the process of drafting a *General Data Protection Regulation* (GDPR)-compliant CoC specifically for health. This, however, in line with its nature under Article 40 of the GDPR is expected to focus on the GDPR and understanding of the GDPR provisions in the context of scientific research.<fnref n="5" />

This is an open access article under the terms of the Creative Commons Attribution-NonCommercial-NoDerivs License, which permits use and distribution in any medium, provided the original work is properly cited, the use is non-commercial and no modifications or adaptations are made.
© 2022 The Authors. *Developing World Bioethics* published by John Wiley & Sons Ltd.

<footnote n="1">¹Knoppers, B. M., Harris, J. R., Tassé, A. M., Budin-Ljøsne, I., Kaye, J., Deschênes, M., & Ma'n, H. Z. (2011). Towards a data sharing Code of Conduct for international genomic research. *Genome Medicine*, 3, 1-4.</footnote>

<footnote n="2">²Phillips, M., Molnár-Gábor, F., Korbel, J. O., Thorogood, A., Joly, Y., Chalmers, D., Townend, D., & Knoppers, B. M. (2020). Genomics: data sharing needs an international code of conduct. *Nature*, 31-33.</footnote>

<footnote n="3">³Ibid.</footnote>

<footnote n="4">⁴Bull, S., & Bhagwandin, N. (2020). The ethics of data sharing and biobanking in health research. *Wellcome Open Research*, 5, 1-5.</footnote>

<footnote n="5">⁵Mitchell, C., Ordish, J., & Hall, A. (2020). Genomic medicine and research: how does the GDPR apply. *Foundation For Genomics And Population Health*. pp. 1-27.</footnote>
In response to the recognized need for a CoC, the SIENNA (Stakeholder-Informed Ethics for New technologies with high socio-ecoNomic and human rights impAct) project convened an expert panel consisting of representatives from various fields to discuss a draft CoC proposal, which was formed via a synthesis of existing professional codes of conduct. While our CoC is not a GDPR one in the sense of article 40 GDPR, understanding the data protection issues that genomic and health-related research pose in an international context was largely conducted through a GDPR lens. That is to say, notions of identifiability, legal basis for data processing, transfer rules, etc. featured prominently in the conversation. This is principally due to composition of the expert group, which was comprised of individuals mainly based in Europe. Even those from other continents are involved in European data protection issues and thus the GDPR provided a common language for understanding certain issues. This is a strength when one considers the GDPR's global impact. Indeed, more broadly, the GDPR may be understood as a sophisticated, more comprehensive version of the fair information principles, which are the basis for much of data protection and privacy law the world over.<fnref n="6" /> However, the reliance on the GDPR as a prism to understand issues is also a weakness because other jurisdictions may have different ways of conceptualizing data protection and privacy issues, and therefore the CoC may prove more difficult to adapt to local circumstances.

## 2 | THE GDPR, INTERNATIONAL DATA TRANSFERS AND GENOMIC DATA

One of the problems pertaining to international data sharing in genomics are the differing levels of data protection and privacy rules across the globe. Within the European Economic Area (EU & Norway, Iceland, Lichtenstein), the GDPR creates a directly applicable framework for the processing of personal data, and thus, of genomic data. However, at the same time, it co-exists with the national and international legal frameworks regulating both, the processing of health and genetic data as well as scientific research. Health-related data generally and genomic data specifically are considered "special-category" sensitive data and therefore warrant special protections. However, if these data are used for research purposes, there is some flexibility to the generally more stringent rules concerning sensitive data.<fnref n="7" />

In the context of genomic research, data subjects are granted certain rights under the GDPR. These include, but are not limited to; "the rights to information (Article 13, 14), data access (Article 15) and portability (Article 20), the rights to erasure (Article 17) and rectification of data (Article 16), rights to object (Article 21) and

not be solely a subject to automated data processing (Article 22)."<fnref n="8" /> The aforementioned rights are thoroughly discussed in the context of genomic research by Mitchell et al.<fnref n="9" /> Transfers of personal data from the EEA/EU to third countries are permitted if the European Commission (EC) has decided that an adequate level of protection is ensured (adequacy decisions). If those are not in place, additional safeguards or a derogatory transfer basis are permissible under the GDPR (Article 45(1), Article 46, Article 49).<fnref n="10" /> So far, the Commission has approved "Andorra, Argentina, Canada (only commercial organizations), Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, the UK under the GDPR and the Law Enforcement Directive (LED),<fnref n="11" /> Uruguay, South Korea and Japan". Data transfers to these countries are "expressly permitted" without the need to use additional transfer safeguards or a derogatory transfer basis.<fnref n="12" />

One such adequacy decision, the US-EU Privacy Shield agreement, was invalidated by the Court of Justice of the European Union (CJEU) in July 2020,<fnref n="13" /> which regulated the transfer of personal data from the EU to the US.<fnref n="14" /> This agreement allowed the transfer of personal data from the EU to US companies that self-certified pursuant to the Privacy Shield program operated by the US Federal Trade Commission. The overreaching surveillance regime of the US national security apparatus and police enforcement, which allow access to personal data with minimal restrictions and without sufficient redress mechanisms, led to the agreement's invalidation.<fnref n="15" /> In addition to invalidating Privacy Shield, the Court further decided that standard contractual clauses (SCCs), a widely used mechanism for transferring genomic and health-related data, must also provide for an "essentially equivalent" level of data protection, viz. the same level of protection mandated by an adequacy decision of the EC. Data exporters bear the burden of ensuring that the jurisdiction to which they export personal data is capable of offering an essentially equivalent level of data protection pursuant to the SCCs.<fnref n="16" /> If not,

<footnote n="8">⁸Ibid.</footnote>

<footnote n="9">⁹Mitchell, et al., op. cite note 5.</footnote>

<footnote n="10">¹⁰European Parliament and Council of European Union, op. cit. note 7.</footnote>

<footnote n="11">¹¹European Parliament and Council of European Union. (2016). Law enforcement Directive (LED) - Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA). Retrieved September 22, 2022, from https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex:32016L0680</footnote>

<footnote n="12">¹²The European Commission. (2019). Adequacy decisions. Retrieved September 1, 2021, from https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en</footnote>

<footnote n="13">¹³Jacques R. Z. (2020). *The Court of Justice invalidates Decision 2016/1250 on the adequacy of the protection provided by the EU-US Data Protection Shield*. Retrieved August 15, 2020, from https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf</footnote>

<footnote n="14">¹⁴Court of Justice of the European Union. (2020). Case C-311/18 Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems. Retrieved September 22, 2022, from https://curia.europa.eu/juris/liste.jsf?num=C-311/18</footnote>

<footnote n="15">¹⁵Bennett, S. C., Daley, M. J., & Gerlach, N. (2012). Storm Clouds Gathering for Cross-Border Discovery and Data Privacy: Cloud Computing Meets the USA PATRIOT Act. *Sedona Conference Journal*, 13, 235-252.</footnote>

<footnote n="16">¹⁶Jacques, op. cit. note 13.</footnote>

<footnote n="6">⁶Borgesius, F. Z., Gray, J., & van Eechoud, M. (2015). Open data, privacy, and fair information principles: Towards a balancing framework. *Berkeley Technology Law Journal*, 30, 2073-2131.</footnote>

<footnote n="7">⁷European Parliament and Council of European Union. (2016). General Data Protection Regulation. Retrieved September 22, 2022, from https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679</footnote>
supplementary measures must be undertaken to ensure the protec-
tion of data, lest the transfers be suspended outright.

While high-income countries negotiate legal intricacies, LMICs express fears and scepticism of sharing their data in international platforms. Researchers and participants from LMICs worry about exploitation of their efforts, data misuse and inequitable access to benefits arising from research.<fnref n="17" /> Indeed, there are already claims of data misuse through commercialisation following data transfers from Africa to a host country.<fnref n="18" /> To assuage these fears, researchers advocate measures such as building local capacities in disadvantaged export countries, community engagement in the process of research and data transfer and full transparency within international research endeavours.<fnref n="19" /> Furthermore, transferring data from Africa to the EU faces few challenges, but data moving in the opposite direction must confront a number of hurdles due to the EU's stringent standards. This can be construed as worrisome in collaborative research.<fnref n="20" />

A CoC with an international vocation must then contend with
these varied concerns regarding international genomic research and
transfers of personal data. Individuals – both participants and
researchers – must be protected while also giving clear rules for
the responsible conduct of genomic and health-related research
(Refer to Annex 2).

3 MATERIALS (OR SUBJECTS) AND METHODS

To develop this code of conduct we adopted a mixed method
approach. It consisted of the following:

1. Determining the gaps in current professional codes of conduct and identifying a need for a CoC within the human genomics field – through a literature review and consulting past SIENNA deliverable reports.<fnref n="21" />,<fnref n="22" />,<fnref n="23" />,<fnref n="24" />

2. Synthesizing of some of the most relevant existing professional codes that address biological data and specimen use to develop a

preliminary draft of the CoC (See below Annex 1 for exhaustive
list of documents). The list was selected via a literature review,
and some documents were suggested by SIENNA stakeholders
and reviewers.

3. Involving stakeholders in the process of refining the proposed draft, an expert panel meeting was held on September 10, 2020, to discuss the proposed CoC and obtain input on gaps as identified in the literature.

4. The method was reiterative, involving other stakeholders as well: a) SIENNA scientific advisory board and b) SIENNA's stakeholder list (via email contact) to review and suggest further amendments to the proposed CoC.

5. Some members of the expert panel provided further comments and suggestions for the CoC.

3.1 | The expert panel

A panel of experts composed of 17 members convened online to discuss a proposal for an international code of conduct for data sharing in genomics in September 2020. The purpose of the meeting was to give feedback on the proposed CoC and to identify gaps and concerns. The panel consisted of bioethicists, lawyers, a scientist, medical doctors, a patient organisation representative and a sociologist and two research communicators (see Table 1). In terms of country representation, most of the participants were from Europe, however there were also representatives from Africa, North America and South America.

The members of the panel received a draft of the proposal
beforehand. The session was recorded and transcribed by the
corresponding author. Follow-up questions were sent to the expert
panel via email. Feedback from both the workshop and answers
obtained to follow up questions were incorporated into the CoC
(Refer to Annex 2).

3.2 | SIENNA stakeholders and Scientific Advisory Board

The SIENNA project is one of the European Union's (EU) H2020 research and innovation programme.<fnref n="25" /> Its main objective is to address ethical, legal, social and economic aspects of three technology areas, one of which is human genomics and genetics. In addition, the SIENNA consortium produced operational tools that can feed into existing documents to advance ethical research and professional conduct. Part of the SIENNA approach is engaging stakeholders in all different aspects of the analysis and development of operational tools.<fnref n="26" /> Consequently, they developed a list of

<footnote n="17">¹⁷Serwadda, D., Ndebele, P., Grabowski, M. K., Bajunirwe, F., & Wanyenze, R. K. (2018). Open data sharing and the Global South—Who benefits? *Science*, **359**, 642-643.</footnote>

<footnote n="18">¹⁸Moodley, K., & Kleinsmidt, A. (2020). Allegations of misuse of African DNA in the UK: Will data protection legislation in South Africa be sufficient to prevent a recurrence? *Developing World Bioethics*, 1-6.</footnote>

<footnote n="19">¹⁹Serwadda, et al., op. cit. note 17.</footnote>

<footnote n="20">²⁰Slokenberga, S., Reichel, J., Niringiye, R., Croxton, T., Swanepoel, C., & Okal, J. (2019). EU data transfer rules and African legal realities: is data exchange for biobank research realistic? *International Data Privacy Law*, **9**, 30-48.</footnote>

<footnote n="21">²¹Soulier, A., Niemiec, E., & Howard, H. C. (2019). SIENNA D2.4: Ethical Analysis of Human Genetics and Genomics. Retrieved September 22, 2022, from https://zenodo.org/record/4068016#.Yyyqb1zMLIU</footnote>

<footnote n="22">²²Howard, H. C., Niemiec, E., & Soulier, A. (2019). SIENNA D2.1: State of the art review of human genomic technologies. Retrieved September 22, 2022, from https://zenodo.org/record/4067912#.Yyyqn1zMLIU</footnote>

<footnote n="23">²³Howard, H., Niemiec, E., Tambornino, L., & Lanzerath, D. (2019). SIENNA D2.3: Survey of REC approaches and codes for genomics. Retrieved September 22, 2022, from https://zenodo.org/record/4066865#.YyyrP1zMLIU</footnote>

<footnote n="24">²⁴Siemaszko, K., Rodrigues, R., & Slokenberga, S. (2020). SIENNA D5.6: Recommendations for the Enhancement of the Existing Legal Frameworks for Genomics, Human Enhancement, and AI and Robotics. Retrieved September 22, 2022, from https://zenodo.org/record/4121082#.YyyrrFzMLIU</footnote>

<footnote n="25">²⁵SIENNA Communication Team. (2018). SIENNA: Technology, ethics and human rights. Retrieved November 10, 2020, from https://sienna-project.eu/</footnote>

<footnote n="26">²⁶Rodrigues, R., & Broadhead, S. (2018). D1.1: The Consortium's Methodological Handbook. Retrieved September 22, 2022, from https://www.sienna-project.eu</footnote>
<figure><img src="image_3.png" /></figure>

<table><caption>TABLE 1 A Panel of Experts by Profession</caption><thead><tr><td>Profession</td><td>Number</td></tr></thead><tbody><tr><td>Bioethicists</td><td>5</td></tr><tr><td>Lawyers</td><td>5</td></tr><tr><td>Bio-scientist</td><td>1</td></tr><tr><td>Medical doctors</td><td>2</td></tr><tr><td>A patient organization representative</td><td>1</td></tr><tr><td>Sociology and medical humanities</td><td>1</td></tr><tr><td>Research/science communication professional</td><td>2</td></tr><tr><td>Total</td><td>17</td></tr></tbody></table>

stakeholders with contact information, which partners frequently consulted during the course of the project.<fnref n="27" /> Furthermore, a scientific advisory board was assigned to the project and they met regularly with the consortium in order to give feedback and scientific advice during SIENNA research activities and report-writing to the European Commission (EC).<fnref n="28" />

The authors solicited input on the proposed CoC via an email sent to a total of 15 stakeholders and 6 responded to our request. Only those who provided written feedback had their input considered and incorporated.

## 4 | FINDINGS AND DISCUSSION

The main purpose of the workshop was to get the experts' views on a preliminary draft CoC as well as to provide some answers to issues raised in the literature regarding international data sharing. Below we discuss those concerns in context of experts' input and the relevant literature.

### 4.1 | Identifiability

Genome sequence data can individuate persons and be linked to other data about them.<fnref n="29" /> At present, only 30 single nucleotide polymorphisms are required to identify an individual from their sequence data.<fnref n="30" /> Under GDPR, genetic data are defined as a "special category" of data necessitating higher standards of protection and more safeguards (GDPR, Article 9).<fnref n="31" /> Similarly, genetic data may also be considered sensitive data in other

jurisdictions.<fnref n="32" /> To complicate matters further, with the expanding use of big databases whether they are for genomics or health-related purposes or both, acquiring "richer" data will be made easier, which would further facilitate identification via cross-linking and extrapolations of various data inputs.<fnref n="33" /> Furthermore, huge genetic databases, are created through collaborating research projects, providing to researchers a vast amount of masked or aggregated genetic data during the past few decades.<fnref n="34" /> Therefore, pseudonymisation may need to be complemented with further organisational and technical measures that make re-identification more difficult.<fnref n="35" /> It would, be wrongful to consider the application of safeguards, such as pseudonymization, on behalf of data custodians, as merely a panacea or a "highway" to data protection. Instead, a dynamic procedure of pre-assessing the de-identification risks and taking into account the current technological developments, should be a prerequisite before genetic data processing takes place. To that extent an international CoC might prove as an indispensable tool, defining specific criteria and requirements that should be applied by the data custodians for the de-identification assessment, especially for those data custodians established in countries where data protection regime is not strong or present at all.

These concerns largely echoed those of Philips et al.,<fnref n="36" /> who brought forward specific concerns regarding identifiability in an international data sharing context. Infringements to privacy rights and interests are sometimes elusive and difficult to account for because of the unclear chain of responsibility, particularly with the use of big transnational databases and cloud computing services. Moreover, a lack of common terminology regarding identifiability leads to varying degrees of misunderstandings among stakeholders.<fnref n="37" /> For instance, in the US de-identification of health data, is perceived as the process of removing 18 specific identifiers, considered to be personally identifiable information, e.g. the data subject's name, telephone number, address, etc.<fnref n="38" />

The expert panel questioned the overemphasis on identifiability and protection of privacy within regulations, particularly in the context of genomic data. Some experienced first-hand how this has hindered genomic research. They agreed that sharing of data and transnational transfers are essential to maximally capitalize on genomic research. They further argued that instead of rigid requirements of privacy applied within the research context and the research use of data, regulators and bioethicists should prescribe

<footnote n="27">²⁷Rodrigues, R., & Broadhead, S. (2018). D1.2: Stakeholder Analysis and Contact List. Retrieved September 22, 2022, from https://www.sienna-project.eu</footnote>

<footnote n="28">²⁸Rodrigues & Broadhead, op. cit. note 26.</footnote>

<footnote n="29">²⁹Rodriguez, L. L., Brooks, L. D., Greenberg, J. H., & Green, E. D. (2013). The complexities of genomic identifiability. *Science*, 339, 275-276.</footnote>

<footnote n="30">³⁰Dankar, F. K., Ptitsyn, A., & Dankar, S. K. (2018). The development of large-scale de-identified biomedical databases in the age of genomics—principles and challenges. *Human Genomics*, 12, 19.</footnote>

<footnote n="31">³¹European Parliament and Council of European Union, op. cit. note 7.</footnote>

<footnote n="32">³²Mitchell, et al., op. cit. note 5.</footnote>

<footnote n="33">³³Ibid: 1-17.</footnote>

<footnote n="34">³⁴Bovenberg, J., Peloquin, D., Bierer, B., Barnes, M., & Knoppers, B. M. (2020). How to fix the GDPR's frustration of global biomedical research. *Science*, 370, 40-42.</footnote>

<footnote n="35">³⁵Mitchell, et al., op. cit. note 5.</footnote>

<footnote n="36">³⁶Phillips, et. al., op. cit. note 2.</footnote>

<footnote n="37">³⁷Laurie, G. T., & Coleman, C. H. (2020). Biobanks. In *The Oxford Handbook of Comparative Health Law*.</footnote>

<footnote n="38">³⁸US Department of Health & Human Services. (2012). *Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule*. USA: Retrieved March 20, 2021, from https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html</footnote>
safeguards against harms that may ensue outside the research context from identifiability and mere breaching of privacy. For example, if the possible harm is authorities accessing sensitive information and using those for law enforcement purposes, including monitoring, profiling or targeting, measures should be in place to prohibit government or law enforcement from illegally accessing such data. A good example is the law that regulates the Estonian Biobank which states specifically that the data held in the biobank may not be used for any other purpose, especially not in civil or criminal proceedings.<fnref n="39" />

We note that a CoC cannot provide for robust safeguards in this regard because it is a matter of international and public law. Nevertheless, a CoC can specify that entities subject to it will ensure the validity of access requests by law enforcement, i.e., that the access request is a legal one and not an informal one, and complies with the appropriate formalities.

## 4.2 | Compelled disclosure

One of the problems associated with (international) genomic data sharing is the problem of compelled disclosure – i.e. disclosure to public authorities mandated by law.<fnref n="40" /> Compelled disclosure is an issue both for domestic and international research.<fnref n="41" /> The problem with compelled disclosure – as with many nuances regarding privacy rules applicable to cross-border genomic research – is the fragmented nature of rules, even within the EU. The GDPR leaves a number of important aspects, like the rules pertaining to the research use of special categories of data (including genomic and health-related data), and rules regarding compelled disclosure, for the laws of the Member States to regulate.<fnref n="42" /> At the same time, the GDPR does not establish which laws should be followed in a cross-border (research) scenario within the EU.<fnref n="43" /> The problem of compelled disclosure becomes even more highlighted in the context of data transfers to the US.

As noted, compelled disclosure is a situation when a government authority requests access to personal or health-related data of research subjects/data subjects. In the US, there are special protections provided at the federal and/or the state level against compelled disclosure with regards to divulging research subjects' information. The National Institute of Health can issue a 'certificate of confidentiality', which shields research participants' confidential information given during research. These certificates are applicable on a federal level and on many occasions have safeguarded subjects against courts' demands of such information. However, concerns

have been raised regarding conditions for waivers of confidentiality, the extent of the concept of identifiability, ambiguity of some definitions and the scope of these certificates.<fnref n="44" />

Furthermore, the certificates can be challenged by the Patriot Act of 2001, which can oblige companies to share data with US authorities. For example, the National Security Agency (NSA) can issue an order for an American cloud company (such as Amazon or Google) to impart data of certain individuals. The injunction has a long reach because it is not confined to US territories only, it extends to data under American companies' "control, custody and possession".<fnref n="45" /> Therefore, it can include other geographical areas outside the US. Furthermore, the order is acquired by a secret court and the company for which the order is issued, is forbidden to disclose such a breach to its clients.<fnref n="46" /> Similarly, the EU does not protect against such transgressions either. However, national regulations of EU member states may provide such protections which are made possible under GDPR Art 23 but requires much justification.<fnref n="47" />

Bennett et al. proposed tools to overcome or reconcile these conflicting legal intricacies. Some of them have been invalidated in the EU such as the safe harbour in October 2015⁴⁸ and the Privacy Shield agreement in July 2020⁴⁹, while others need further corroboration that they actually work. They include:

- Standard Contractual Clauses (SCCs)

- Binding Corporate Rules.

The European Data Protection Board (EDPB) proposed the SCCs as a legal method to limit data access requests by local authorities. These SCCs would mandate that companies use technical processes such as "encryption, pseudo-anonymisation or split processing of data".<fnref n="50" /> Data importers are compelled to report data access requests (or actual data breaches) by local authorities or failure to fulfil any related contractual agreements to data exporters. Moreover, data importers should provide legal support and means of challenging public authorities' data access requests.<fnref n="51" /> According the EDPB, split processing of data consists of sending chunks of data to different processors to reduce the chances that the data that were sent to each individual processor being personal data.

In an answer to compelled disclosure, the expert panel had several suggestions; some of which were legal while others functional. While the former reflected many of the recommendations of the EDPB, one expert suggested that foreign legal authorities

<footnote n="39">³⁹Pormeister, K. (2018). Genetic research and applicable law: the intra-EU conflict of laws as a regulatory challenge to cross-border genetic research. *Journal of Law and the Biosciences*, 5, 706-723.</footnote>

<footnote n="40">⁴⁰Phillips, et al., op. cit. note 2.</footnote>

<footnote n="41">⁴¹Pormeister, op. cit. note 39.</footnote>

<footnote n="42">⁴²Tzortzatou, O., Slokenberga, S., Reichel, J., da Costa Andrade, A., Barbosa, C., Bekaert, S., van Veen, E.-B., et al. (2021). Biobanking Across Europe Post-GDPR: A Deliberately Fragmented Landscape. In S. Slokenberga, O. Tzortzatou, & J. Reichel (Eds.), GDPR and Biobanking. Law, Governance and Technology Series, Vol 43. Springer, Cham.</footnote>

<footnote n="43">⁴³Pormeister, op. cit. note 39.</footnote>

<footnote n="44">⁴⁴Bennett, et al., op. cit. note 15.</footnote>

<footnote n="45">⁴⁵Ibid.</footnote>

<footnote n="46">⁴⁶Ibid.</footnote>

<footnote n="47">⁴⁷European Data Protection Board. (2021). Guidelines 10/2020 on Restrictions under Article 23 GDPR (Version 2.0). Brussels: Available at https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-102020-restrictions-under-article-23-gdpr_en</footnote>

<footnote n="48">⁴⁸Monteleone, S., & Puccio, L. (2017). From safe harbour to privacy shield: advances and shortcomings of the new EU-US data transfer rules. *European Parliamentary Research Service (EPRS)*, 1-39.</footnote>

<footnote n="49">⁴⁹Jacques, op. cit. note 13.</footnote>

<footnote n="50">⁵⁰EDPB. (2020). EDPB recommendations, supplementary measures transfers tools ensure compliance with the EU level protection of personal data.</footnote>

<footnote n="51">⁵¹Ibid.</footnote>
requiring access to protected data should do so through legal channels, i.e.: contacting national authorities of the data subject to obtain authorization.

## 4.3 Broad consent

A broad consent refers to a consent form in which research participants can agree to future and unspecified research with ongoing governance. The exact breadth of consent depends on circumstances, with participants typically consenting to areas of scientific research. Generally, a broad consent includes delegating some of the decision making to an independent oversight body, usually a research ethics committee and/or data access committee and the commitment to ongoing future communication with research participants or donors of biospecimens.<fnref n="52" /> However, donors or research participants have indicated their unwillingness to the use of their samples in certain kinds of research, e.g., research undertaken by for-profit companies, research on indigenous populations, and human cloning.<fnref n="53" />,<fnref n="54" />,<fnref n="55" />,<fnref n="56" />,<fnref n="57" /> Furthermore, it has been shown that research participants are not so much concerned with the specific purpose of a planned project but more concerned about the protection of their personal data against unauthorized use, i.e., illegitimate use by non-researchers.<fnref n="58" /> Broad consent may imply a broad description of the purpose of research, e.g., cancer research or research on rare diseases, but involve a more specific description regarding the processes of research, e.g., collaboration with sharing of data across national borders, collaboration with commercial entities or use of genomic analyses.

For an international CoC, broad consent provides an alternative that is viewed practical but still lacks consensus as to its prerequisites. Furthermore, there are challenges to keep data subjects abreast with information regarding new studies that make use of their data.<fnref n="59" />

The expert panel reflected on other models of consent as alternatives to individualized informed consent, some experts

mentioned familial consent in the context of genomic data while others discussed broad consent. The former is a type of consent that has been used in the context of rare disease research where results were returned to family members of research participants.<fnref n="60" /> Using familial consent in genomic research would warrant consideration of the cultural context in which participants are located. Further sociological research could address cultural nuances of family, sensitive information and data sharing. With regards to broad consent, the panel reiterated what the literature discussed in terms of delineating requirements for a broad consent and creating processes to support participants' input and preferences.

## 4.4 | Return of findings, portability and access

Participants' right to access of genomic data has been debated for some time now. These include discussions of return of uninterpreted data as well as clinically valid and actionable data. While some form of consensus has been reached in the return of incidental findings as to fulfil certain criteria; upon participants' approval (see for example<fnref n="61" />) and clinically valid and actionable results,<fnref n="62" /> the access to "uninterpreted" genetic data is still being debated. However, there are legal as well as ethical foundations that support such access whether in the context of clinical care or genetic research. Some authors have described a few limitations to such rights: risks of serious harm to data subject; to protect confidentiality and privacy and if involves excessive or disproportionate labour.<fnref n="63" /> An international CoC, according to Phillips et al., should address an optimal way for data subjects to access and transfer their genomic data securely as well as procedures for responsible disclosure of research or health findings. These questions, together with the right of access, return of results and portability were addressed during discussions with the expert panel.

According to the panel, the right to access should incorporate two aspects: access to information about one's data processing and sharing, and right to acquire a copy of one's data. There was a consensus among the experts in response to portability of data query. For data subjects to make use of their genomic findings, there should be some flexibility to move their data around. They proposed technical tools that would provide secure, user friendly and interoperable file formats and platforms. However, whenever vulnerabilities in security of data exist, transparent communication

<footnote n="52">⁵²Grady, C., Eckstein, L., Berkman, B., Brock, D., Cook-Deegan, R., Fullerton, S. M., Greely, H., Hansson, M. G., Hull, S., & Kim, S. (2015). Broad consent for research with biological samples: workshop conclusions. *The American Journal of Bioethics*, *15*, 34-42.</footnote>

<footnote n="53">⁵³Brothers, K. B., Morrison, D. R., & Clayton, E. W. (2011). Two large-scale surveys on community attitudes toward an opt-out biobank. *American Journal of Medical Genetics Part A*, *155*, 2982-2990.</footnote>

<footnote n="54">⁵⁴Gaskell, G., Gottweis, H., Starkbaum, J., Gerber, M. M., Broerse, J., Gottweis, U., Hobbs, A., Helén, I., Paschou, M., & Snell, K. (2013). Publics and biobanks: Pan-European diversity and the challenge of responsible innovation. *European Journal of Human Genetics*, *21*, 14-20.</footnote>

<footnote n="55">⁵⁵McCarty, C. A., Chapman-Stone, D., Derfus, T., Giampietro, P. F., & Fost, N. (2008). Community consultation and communication for a population-based DNA biobank: The Marshfield clinic personalized medicine research project. *American Journal of Medical Genetics Part A*, *146*, 3026-3033.</footnote>

<footnote n="56">⁵⁶Stegmayr, B., & Asplund, K. (2002). Informed consent for genetic research on blood stored for more than a decade: a population based study. *BMJ*, *325*, 634-635.</footnote>

<footnote n="57">⁵⁷Tupasela, A., Sihvo, S., Snell, K., Jallinoja, P., Aro, A. R., & Hemminki, E. (2010). Attitudes towards biomedical use of tissue sample collections, consent, and biobanks among Finns. *Scandinavian Journal of Public Health*, *38*, 46-52.</footnote>

<footnote n="58">⁵⁸Hoeyer, K. (2016). Denmark at a crossroad? Intensified data sourcing in a research radical country. In B. Mittelstadt, & L. Floridi (Eds.), *The Ethics of Biomedical Big Data: Law, Governance and Technology Series*, Vol 29. Springer, Cham.</footnote>

<footnote n="59">⁵⁹Phillips, et al., op. cit. note 2.</footnote>

<footnote n="60">⁶⁰Nguyen, M. T., Goldblatt, J., Isasi, R., Jagut, M., Jonker, A. H., Kaufmann, P., Quillade, L., Molnar-Gabor, F., Shabani, M., & Sid, E. (2019). Model consent clauses for rare disease research. *BMC Medical Ethics*, *20*, 55.</footnote>

<footnote n="61">⁶¹Johansson, J. V., Langenskiöld, S., Segerdahl, P., Hansson, M. G., Hösterey, U. U., Gummesson, A., & Veldwijk, J. (2019). Research participants' preferences for receiving genetic risk information: a discrete choice experiment. *Genetics in Medicine*, *21*, 2381-2389.</footnote>

<footnote n="62">⁶²Hehir-Kwa, J. Y., Claustres, M., Hastings, R. J., van Ravenswaaij-Arts, C., Christenhusz, G., Genuardi, M., Melegh, B., Cambon-Thomsen, A., Patsalis, P., & Vermeesch, J. (2015). Towards a European consensus for reporting incidental findings during clinical NGS testing. *European Journal of Human Genetics*, *23*, 1601-1606.</footnote>

<footnote n="63">⁶³Narayanasamy, S., Markina, V., Thorogood, A., Blazkova, A., Shabani, M., Knoppers, B. M., Prainsack, B., & Koesters, R. (2020). Genomic Sequencing Capacity, Data Retention, and Personal Access to Raw Data in Europe. *Frontiers in Genetics*, *11*, 1-15.</footnote>
of the risks of holding a copy of one's own data to users is vital to maintain trust. Some suggested a data protection impact assessment (DPIA) as part of the data management plan to determine the risks of procedures to return results and access of data.

Whereas data access is about “pulling” data at the data subject's request, the return of results is akin to “pushing” data, i.e., at the controller or researcher's determination. The expert panel reflected on the ethical permissibility of returning results as well as its feasibility. In response to what constitutes “responsible communication” of these findings, the members in expert panel stated; firstly, a data subject/patient has indicated their preference to receive findings; secondly a decision is made of whether the findings possess clinical validity, utility and actionability; thirdly ensuring communication of good quality data (accurate and reliable); and lastly, advice on professional support e.g., a genetic counsellor. A distinction was made between patients and volunteers in regards to their expectations. Patients might expect to receive relevant findings but volunteers may not.

## 4.5 | Withdrawal of consent

Conventionally, withdrawal of consent has been an essential pillar in human subject research and was clearly stated in informed consent documents as a valid choice for research participants.<fnref n="64" /> However, guaranteeing withdrawal of consent becomes tricky in genomic therapies and diagnostics, since the genetic sequence of patients or volunteers can be incorporated in these new treatments or investigative tools. An infamous example of a cell line being generated and widely disseminated without proper consent (and thus no possibility of withdrawal) concerns the HeLa cell line.<fnref n="65" />

The panel discussed the ways that respecting the withdrawal of consent is reconciled with the interest in continuing the research. Data protection law may specify, although the data subject's right to withdraw consent is inalienable, the consequences of doing so might not hinder research, as data erasure is not necessarily required and further processing for research purposes might still be possible. Under the GDPR, the right to be forgotten (i.e. erasure of the data), and the right to object to the further use of the data, can be limited in genomic research when such rights would adversely tamper the research process.<fnref n="66" />

The pressing issues that would need to be addressed in an international CoC with respect to withdrawal of consent are: How researchers can fulfil research subjects' withdrawal of data from genomic databases; how aggregate data would be managed and; creating a system to notify third parties of data withdrawal.<fnref n="67" />

Most respondents in the expert panel agreed that aggregate data per se is not personal data and therefore need not be considered for withdrawal of consent. Yet the opinion was to ensure transparency in conveying all the restrictions and prerequisites to all data subjects of when withdrawal of consent can be granted, at the onset of genomic research or the genomic data processing endeavour. For example, stem cell research norms may specify that consent can only be withdrawn up until a certain point, e.g., until the cell lines are in use. In addition, they expressed that a contact person should be assigned to take charge of protection of such rights, for instance, a Data Protection Officer (DPO). Some members suggested to implement “privacy by design methods” to infrastructures, such as cloud computing, in order to reduce the burden of privacy protection off researchers. To ensure withdrawal of consent and data from third parties, the suggestion was to implement “data mapping” of all third parties involved, extent of their data acquisition, information on onward data transfers etc. Data access committees (DAC) should establish clear and transparent structures and policies that include formal requests to third parties who have accessed/used data, maintaining a catalogue of responses and actions taken by third parties and communicating the results to data subjects.

## 4.6 | Cloud computing

One of the solutions suggested to adopt a uniform 'privacy-by-design' IT structural approach in genomic research that would lessen the privacy-related burdens on researchers are standardized cloud computing systems. A genomic cloud computing system is defined as "a scalable service where genetic sequence information is stored and processed virtually (i.e., in the 'cloud') usually via networked, large-scale data centres accessible remotely through various clients and platforms over the Internet."<fnref n="68" /> Researchers can access and handle petabytes (1,000 terabytes) of data from their local office or lab. This is in contrast to a setting that was previously adopted, where research institutes shopped local servers for accessing and processing their data. The technology prides itself as being "locationless", however as noted earlier, unfortunately, privacy laws and regulations are still location-bound and country specific.<fnref n="69" />

There are four deployment models for cloud computing<fnref n="70" /> namely:

- private clouds, where infrastructure is for the sole use by a single organization

- community clouds, where infrastructure is for the use of multiple groups who share a concern or interest

<footnote n="64">⁶⁴van Delden, J. J., & van der Graaf, R. (2017). Revised CIOMS international ethical guidelines for health-related research involving humans. JAMA, 317, 135-136.</footnote>

<footnote n="65">⁶⁵Nature. (2020). *Henrietta Lacks: science must right a historical wrong*. Editorial. Retrieved September 9, 2022, from https://www.nature.com/articles/d41586-020-02494-z</footnote>

<footnote n="66">⁶⁶Bovenberg, et al., op. cit. note 34.</footnote>

<footnote n="67">⁶⁷Phillips, op. cit. note 2.</footnote>

<footnote n="68">⁶⁸Langmead, B., & Nellore, A. (2018). Cloud computing for genomic data analysis and collaboration. *Nature Reviews Genetics*, *19*, 208-220.</footnote>

<footnote n="69">⁶⁹Dove, E. S., Joly, Y., Tassé, A.-M., & Knoppers, B. M. (2015). Genomic cloud computing: legal and ethical points to consider. *European Journal of Human Genetics*, *23*, 1271-1278.</footnote>

<footnote n="70">⁷⁰Langmead & Nellore, op. cit. note 68.</footnote>
- public clouds, where infrastructure is for the use of the general public

- hybrid clouds, which combines two or more of the aforementioned models and binds them together using software that permits data and application portability

These infrastructures may be supplied by a cloud service provider (CSP), which together with a client agree on Terms of Service (ToS) via either a negotiable contract or a standard non-negotiable one. The common practice is that clients agree to the pre-set contract.<fnref n="71" />,<fnref n="72" />

Among the advantages that cloud computing has over traditional local servers are: relative affordability since it reduces the capital expenditure of research institutes and allows researchers the flexibility to choose services per request from third parties (this function has been called elasticity); global accessibility; reproducibility (since researchers use the same IT tools as provided by cloud service); possible enhanced data security measures; and lastly they are considered environmentally friendly.<fnref n="73" />,<fnref n="74" />

Despite their advantages, cloud computing commercial infrastructures pose certain ethical and legal issues. Dove et al. discuss four major areas of concern namely: data control; data security and confidentiality; data transfer; and lastly accountability. The authors also put forth recommendations to genomic researchers,<fnref n="75" /> which we believe are essential to take into account in a code of conduct for international genomic data sharing. To avoid some of these concerns (such as accepting predetermined contracts, risk of compelled disclosure), academic cloud services are growing in number.<fnref n="76" />

Scope Europe, a trade association for the information economy, in collaboration with the EC, has published their own GDPR-compliant CoC on cloud computing, which is non obligatory and addresses primarily data processing between businesses, what is referred to “business to business (B2B) cloud computing”.<fnref n="77" /> In contrast the proposed CoC concerns sharing of genomic data in the context of research (Refer to Annex 2).

List of acronyms/abbreviations

<table><thead><tr><td>Abbreviation</td><td>Explanation</td></tr></thead><tbody><tr><td>CIOMS</td><td>Council for International Organizations of Medical Sciences</td></tr><tr><td>CoC</td><td>Code of conduct</td></tr><tr><td>CSP</td><td>Cloud service providers</td></tr><tr><td>DAC</td><td>Data access committee</td></tr><tr><td>DMC</td><td>Data management committee</td></tr><tr><td>DPIA</td><td>Data protection impact assessment</td></tr><tr><td>DPO</td><td>Data protection officer</td></tr></tbody></table>

<table><tr><td>EDPB</td><td>European Data Protection Board</td></tr><tr><td>GDPR</td><td>General Data Protection Regulation</td></tr><tr><td>LMICs</td><td>Low-and-middle income countries</td></tr><tr><td>SCC</td><td>Standard contractual clauses</td></tr><tr><td>ToR</td><td>Terms of reference</td></tr><tr><td>ToS</td><td>Terms of service</td></tr></table>

Glossary of Terms

Term Explanation

Aggregate data: A collection of data that have been re-expressed by a summary statistic.

Anonymous information: Anonymous information does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. The GDPR does not therefore concern the processing of such anonymous information, including for statistical or research purposes. (GDPR Recital 26).

Broad consent: “The GDPR allows for the possibility that when scientific research involves collecting personal data, it may be impossible to fully specify the precise purposes of any data processing in advance. Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research” (GDPR, Recital 33).

Controller: “The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data” (GDPR Art 4 (7)).

Data cycle: This describes the flow of data from a data subject through data storage, access, use and sharing and until relevant findings and results are communicated back to a data subject.

Data subject: For the purpose of this document, a data subject is the person who donates his/her genomic data or biospecimens or partakes in genomics research.

Incidental findings: “A finding concerning an individual research participant that has a potential health or reproductive importance and is discovered in the course of conducting research or diagnostic procedures but is beyond the aims of the study”.<fnref n="78" />

Processing of data: “Any operation or set of operations which is performed on personal data such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction” (GDPR Art 4 (2)).

<footnote n="71">⁷¹Dove, et al., op. cit. note 69.</footnote>

<footnote n="72">⁷²Langmead & Nellore, op. cit. note 68.</footnote>

<footnote n="73">⁷³Dove, et al., op. cit. note 69.</footnote>

<footnote n="74">⁷⁴Langmead & Nellore, op. cit. note 68.</footnote>

<footnote n="75">⁷⁵Dove, et al., op. cit. note 69.</footnote>

<footnote n="76">⁷⁶Langmead & Nellore, op. cit. note 68.</footnote>

<footnote n="77">⁷⁷The European Union. (2020). EU Cloud Code of Conduct. Retrieved September 20, 2022, from https://eucoc.cloud/en/home</footnote>

<footnote n="78">⁷⁸Wolf, S. M., Lawrenz, F. P., Nelson, C. A., Kahn, J. P., Cho, M. K., Clayton, E. W., Fletcher, J. G., Georgieff, M. K., Hammerschmidt, D., & Hudson, K. (2008). Managing incidental findings in human subjects research: analysis and recommendations. *The Journal of Law, Medicine & Ethics*, 36, 219-248.</footnote>
Processor: "A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller" (GDPR Art 4 (9)).

Pseudonymisation: "Means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person" (GDPR Art 4(5)).

5 | CONCLUSION

Against this rapidly changing background, the genomics community must confront the realities and complexities of legal and ethical norms. For example, recently the EC has issued a new proposal for a regulation titled "the European Health Data Space".<fnref n="79" /> The proposal seems to raise more questions than provide answers or the much-anticipated clarity about health data sharing. In fact, the initial reactions are unfavourable.<fnref n="80" /> As such, the draft CoC combined with the opinions of the expert panel's members illustrated that high-level concerns revolve around international data transfers, the identifia-bility of data, access to data by government entities (compelled disclosure), consent, withdrawal of consent, the return of results, and cloud computing. Therefore, the proposed CoC may provide an alternative solution till legal complexities are harmonized.

While complying with the best practices described in this CoC does not guarantee compliance with applicable local norms, it does much to guide genomics researchers in the design and conduct of their research. Local conditions will always be a challenge for a CoC, which must be flexible and sensitive to the possibilities of differences. Moreover, any CoC must be periodically reviewed to ensure that it remains responsive to the normative and technical environments in which genomics research operates. Finally, it is hoped that this CoC will spur further discussion within the international genomics community about the future of such instruments (Refer to Annex 2).

ACKNOWLEDGEMENTS

This article has been adapted from/is based upon the Deliverable 5.2 report of the SIENNA project (Stakeholder-informed ethics for new technologies with high socio-economic and human rights impact) - which has received funding under the European Union's H2020 research and innovation programme.

We would like to extend our thanks to Manuel Guerrero, Konrad Siemaszko and Stefan Eriksson for their insightful comments and

review of the manuscript. We are also grateful for SIENNA's scientific advisory board and expert stakeholders for their valuable advice and input on the CoC particularly, we name: Prof. Roger Brownsword, Prof. Benjamin Caps, Prof. Bartha M. Knoppers, Prof. Christine Patch, Prof. Francesca Forzano, and Dr. Mark Coeckelbergh.

CONFLICTS OF INTEREST

Authors declare no conflict of interests.

DISCLAIMER

This article and its contents reflect only the views of the authors and does not intend to reflect those of the European Commission.

FUNDING

Funded by SIENNA project, which has received funding under the European Union's H2020 research and innovation programme under grant agreement No 741716.

ORCID

Amal Matar ID http://orcid.org/0000-0001-6691-7549

Santa Slokenberga ID https://orcid.org/0000-0002-5621-8485

Gauthier Chassang ID https://orcid.org/0000-0002-6573-4035

Olga Tzortzatou ID https://orcid.org/0000-0001-6223-1443

Antonella Cardone ID https://orcid.org/0000-0003-3685-1512

Michael Beauvais ID https://orcid.org/0000-0002-8371-3836

AUTHOR BIOGRAPHIES

**Amal Matar**, MD, PhD, is a researcher at Centre for Research Ethics and Bioethics and a project coordinator at the Human Brain Project. Her research interests include but are not limited to research ethics especially focused on LMICs, genomics ethics, ELSI of emerging technologies and more recently empirical neuroethics. She also acts as an ethics expert for the European Commission.

**Mats Hansson** is a Senior Professor of Biomedical Ethics at the Centre for Research Ethics & Bioethics, Uppsala University. He completed his first degree, a BSc in biology in 1976, and he graduated in ethics at the Department of Theology, Uppsala University in 1991. He has 150 publications in the field of bioethics and founded the Centre for Research Ethics and Bioethics at Uppsala University which he directed between 2008-2019.

**Santa Slokenberga**, LLD, is a senior lecturer in Administrative Law at Uppsala University. Santa's research focuses on the regulation of health technologies and biobanking, and the protection of personal data. Her other research interests include child's rights in healthcare and scientific uncertainty.

**Adam Panagiotopoulos** is a qualified lawyer experienced in data protection, privacy and information governance. He has acted as an external and in-house legal counsel for law firms, public bodies

<footnote n="79">⁷⁹Directorate-General for Health and Food Safety, the European Commission. (2022). Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the European Health Data Space. In COM/2022/197 final. Brussels. Retrieved September 20, 2022, from https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A52022PC0197</footnote>

<footnote n="80">⁸⁰van Kessel, R., Wong, B. L. H., Forman, R., Gabrani, J., & Mossialos, E. (2022). The European Health Data Space fails to bridge digital divides. *British Medical Journal*, **378**, e071913.</footnote>
and multinational companies with a particular focus on healthcare and telecommunications. Adam has also worked at highly ranked universities as a tutor and legal researcher, published books on biobanks and bioethics, and contributed to papers on the regulation of emerging technologies and digital ethics. This paper is associated with his former employment at Trilateral Research Ltd.

Gauthier Chassang is a lawyer working at Inserm since 2010. He is specialised in EU law, (bio)ethics, human rights, ICTs in health, Al, biobanking, governance and privacy protection applied to health research activities. Based at the University of Toulouse Faculty of Medicine, he actively participates in expertise and counselling services at Inserm and in the context of the Genotoul Societal Platform "Ethique et biosciences", as well as in several EU and international research projects.

Olga Tzortzatou is an Attorney at Law, qualified to stand before the Court of Appeals. Her field of expertise is privacy law, intellectual property law and bioethics. She also serves as an external ethics expert for the European Commission.

44444Kärt Pormeister, PhD, is the legal counsel of the Estonian Biobank, which is part of the Institute of Genomics of the University of Tartu, and holds the genetic and health data of more than 200k Estonians. Kärt obtained an LLM in health law as a Fulbright scholar from the University of Houston in Texas, USA. In her PhD studies at the University of Tartu, Kärt focused on transparency in relation to data subjects in genetic research.

Elias Uhlin, PhD, defended his PhD from the Karolinska Institute with a thesis titled "iPS Cells In Regenerative Medicine" and followed it up with a post doc investigating a cryopreservable off the shelf cell therapy for spinal cord injury. He recently concluded his work as a lead scientist for the CDMO CCRM in Toronto, Canada, and is currently active at Lund University within the Indicell network focused on building a pre-GMP facility infrastructure to accelerate ATMP development.

Antonella Cardone, MSc, MBA, is the Cancer Patient Advocacy expert of Pancreatic Cancer Europe (www.pancriccancereurope.eu), of which she was Vice-Chair. She was the Director of the European Cancer Patient Coalition (www.ecpc.org) and she sat on the Board of All.Can (https://www.all-can.org/). She holds a Master's in Science and one in Business Administration (MBA).

Michael J. S. Beauvais is a doctoral candidate at the University of Toronto's Faculty of Law. His doctoral research on children's privacy from their parents brings together thinking on privacy, children's agency, parental authority, and information-communication technologies. He also writes about data protection law and its interaction with health-related research.

**How to cite this article:** Matar, A., Hansson, M., Slokenberga, S., Panagiotopoulos, A., Chassang, G., Tzortzatou, O., Pormeister, K., Uhlin, E., Cardone, A., & Beauvais, M. (2022). A proposal for an international Code of Conduct for data sharing in genomics. *Developing World Bioethics*, 1-14.
https://doi.org/10.1111/dewb.12381

## ANNEX 1

### LIST OF DOCUMENTS, ETHICS AND PROFESSIONAL CODES THAT HAVE BEEN SYNTHESIZED TO DRAFT THE COC

* CoC for user access to the RD-Connect Genome-Phenome Analysis Platform (GPAP) for health-related information.<fnref n="81" />

* BBMRI-ERIC for access to and sharing of biological samples and data.<fnref n="82" />

* International Charter of principles for sharing bio-specimens and data.<fnref n="83" />

* WHO's CoC for open and timely sharing of pathogen genetic sequence data during outbreaks of infectious disease.<fnref n="84" />

* Ethical and legal issues of genomic cloud computing.<fnref n="85" />

* GFBR: ethics of data sharing and biobanking in health research.<fnref n="86" />

* Framework for responsible sharing of genomic and health-related data.<fnref n="87" />

* The FAIR guiding principles for scientific data management and stewardship.<fnref n="88" />

## ANNEX 2: THE CODE OF CONDUCT - A PROPOSAL

### Preamble

The CoC is not a binding legal document but prescribes best practices for big data and cloud computing services. All activities within the SCOPE of this CoC are drafted and intended to be applied in line with the international standards for conducting research such as Declaration of Helsinki and the Universal

<footnote n="81">⁸¹Hansson, M. G., Beltran, S., Thompson, R., & Reichel, J. (2018). Code of Conduct for User Access to the RD-Connect Genome-Phenome Analysis Platform (GPAP) for Health-Related Information.
Retrieved September 29, 2022, from https://rd-connect.eu/wp-content/uploads/2018/05/RD-Connect Code-of-Conduct GPAP 20180525.pdf</footnote>

<footnote n="82">⁸²BBMRI-ERIC. (2017). BBMRI-ERIC Policy for Access to and Sharing of Biological Samples and Data Retrieved September 29, 2022, from https://www.bbmri-eric.eu/wp-content/uploads/AoM_10_8_Access-Policy_FINAL_EU.pdf</footnote>

<footnote n="83">⁸³Mascalzoni, D., Dove, E. S., Rubinstein, Y., Dawkins, H. J., Kole, A., McCormack, P., Woods, S., Riess, O., Schaefer, F., & Lochmüller, H. (2015). International Charter of principles for sharing bio-specimens and data. *European Journal of Human Genetics*, *23*, 721-728.</footnote>

<footnote n="84">⁸⁴World Health Organization. (2018). World Health Organization's code of conduct for open and timely sharing of pathogen genetic sequence data during outbreaks of infectious disease. Retrieved September 29, 2022, from https://www.who.int/blueprint/what/norms-standards/gsdsharing/en, 1-6.</footnote>

<footnote n="85">⁸⁵Dove, E. S., Joly, Y., Tassé, A.-M., & Knoppers, B. M. (2015). Genomic cloud computing: legal and ethical points to consider. *European Journal of Human Genetics*, *23*, 1271-1278.</footnote>

<footnote n="86">⁸⁶Bull, S., & Bhagwandin, N. (2020). The ethics of data sharing and biobanking in health research. *Wellcome Open Research*, *5*, 1-5.</footnote>

<footnote n="87">⁸⁷Knoppers, B.M. (2014). Framework for responsible sharing of genomic and health-related data. *The HUGO Journal*, *8*, 1-6.</footnote>

<footnote n="88">⁸⁸Wilkinson, M. D., Dumontier, M., Aalbersberg, I. J., Appleton, G., Axton, M., Baak, A., Blomberg, N., Boiten, J.-W., da Silva Santos, L. B., & Bourne, P. E. (2016). The FAIR Guiding Principles for scientific data management and stewardship. *Scientific Data*, *3*, 1-9.</footnote>
Declaration of Human Rights. Specific customizations, adaptations and adjustments may be necessary to respect local cultural and ethico-legal norms.

* **Scope**

The target groups are stakeholders in the process: Researchers, controllers, Data Management Committees (DMC), Data Access Committees (DAC), cloud service providers and other stakeholders involved in processing of genomic data.

* **Purpose**

This proposal of a CoC is developed for researchers/stakeholders who are conducting international genomic research and are utilizing or contributing to big databases which may incorporate cloud computing services.

* **A proposal for ethical principles for the CoC**

The proposed ethical principles are well established and are featured in many ethical guidelines within the biomedical field. The principles listed below follow a hierarchy, where the first principle takes precedent over the second and the second principle ranks higher than the third one and so forth. They have been arranged according to their relative importance as judged by the corresponding author. Some of the principles are adopted and/or adapted from the American College of Epidemiology Policy Committee<fnref n="89" />, while others adapted from guidelines of human subject research.<fnref n="90" />

- **Respect for persons:** This is achieved through informed consent procedures and respecting the privacy of data subjects and confidentiality of their data.

- **Beneficence and non-maleficence:** Research oversight, maximising benefits while minimising risks and transparency of communicating both risks and benefits of data sharing, are measures that fulfil beneficence and non-maleficence.

- **Protect and respect for vulnerable populations:** For groups and populations that have decreased capacity to give consent and are prone to exploitation, extra protections should be provided to safeguard their rights and wellbeing.

- **"Freedom of scientific enquiry:** custodianship (stewardship) should encourage openness of scientific enquiry, and should maximize data use and sharing to the extent that it promotes health."<fnref n="91" />

- **Transparency:** Researchers should communicate transparently their motivations and research plans with relevant stakeholders. Transparency should be a principle that is maintained throughout the data cycle and include and not limited to communicating potential risks, respecting privacy and informing of unauthorized access to data.

- **Accountability:** The data cycle should have a clear chain of responsibility, where stakeholders such as researchers, data

processors and controllers, have clearly defined functions and comply to legal and ethical regulations.

- **Fair share of benefits and non-exploitation.** Whenever data yields benefit in the form of new therapeutics or clinically actionable information, these should be shared fairly with local communities who donated their data when requested.

- **Community protection and engagement.** This is particularly relevant for data sharing involving minority groups. Whenever possible, local researchers and community leaders should be engaged in research endeavours since they can identify local research needs and best ways to protect data subjects.

- **"Attribution: recognizing that the intellectual investment of investigators involved in the creation of data registries is often substantial, and could be acknowledged by mutual agreement".<fnref n="92" />**

- **Data accuracy and minimization:** "That the data you transferred are relevant, accurate and limited to what is necessary in relation to the purposes for which it is transferred to and processed".<fnref n="93" /> (Figure A1).

* **Best practices for (International) data sharing in genomics**

A- **A governance system**

**Article 1:** A data governance system "specifies decision rights and accountabilities for an organization's decision- making about its data. Furthermore, data governance formalizes data policies, standards, and procedures and monitors compliance"<fnref n="94" /> (refer to Diagram 3).

We suggest the formation of a data management committee (DMC) that establishes a governance system, which among other things, would oversee relationships with cloud service providers and review requests of transfer and share of data by researchers or research teams. For every project where data sharing is necessary or proposed, a request is reviewed by the DMC with the ultimate goal to pursue the FAIR principles (findability, accessibility, interoperability and reusability) of data use.<fnref n="95" /> The DMC would have a Data Protection Officer (DPO), at least a patient group representative, a member from the research team, IT security personal, a bioinformatician, a bioethicist, a clinician and a public representative. The DMC would ensure the compliance to a robust governance system and guide those who are responsible to:

a- Establish Terms of reference (ToR) for use of cloud computing or big databases which include: Clear definitions of terminology, defined roles of stakeholders and harmonize terminology used among the stakeholders. Each defined role or function within the

<footnote n="89">⁸⁹Ness, R. B. (2007). Biospecimen "ownership": point. *Cancer Epidemiology and Prevention Biomarkers*, 16, 188-189.</footnote>

<footnote n="90">⁹⁰Mascalzoni, et al., op. cit. note 3.</footnote>

<footnote n="91">⁹¹Hansson, et al., op. cit. note 1.</footnote>

<footnote n="92">⁹²Ibid.</footnote>

<footnote n="93">⁹³European Data Protection Board. (2020). EDPB recommendations, supplementary measures transfers tools ensure compliance with the EU level protection of personal data.</footnote>

<footnote n="94">⁹⁴Abraham, R., Schneider, J., & Vom Brocke, J. (2019). Data governance: A conceptual framework, structured review, and research agenda. *International Journal of Information Management*, 49, 424-438.</footnote>

<footnote n="95">⁹⁵Wilkinson, et al., op. cit. note 8.</footnote>
<figure><img src="image_4.png" /><figcaption>FIGURE A1 The governance system for data-sharing</figcaption></figure>

data cycle should include extent of data access, processing and sharing.

b- Defining a chain of reporting and responsibility among stakeholders (users, processors of data, controllers, funders, cloud computing services providers, etc.) in terms of data import and export, processing, access, return of data-processed findings and security.

c- Establish an error management system and related standard operating procedures to report incidents of data breach or hacking or misuse or unauthorized access by law enforcement and third parties.

d- Establish auditing systems both internally and externally to ensure compliance to ToR.

e- Lay down measures to settle conflicts that arise between different stakeholders.

f- Set procedures to ban or penalize non-compliant partners from using the database.

g- Define research goals and direction

h- Negotiate contracts with commercial cloud service providers, transfer and share of data upon requests by researchers or research teams.

A- Data collection

**Article 2:** Researcher should ensure that data subjects (patients, volunteers and/or research participants) receive sufficient information as defined by the local legal regime. Informed consent offered should depend on the nature and type of research, whether a protocol which can be disease context/sub-population specific or very broad i.e., creating a data resource/biobank for use by others. The data subject should obtain the following information:

a- Data controller/s information and contact details.

b- Voluntary nature of data or sample donation.

c- The purposes (specific or broad according to the nature of research) of the processing including possibility of secondary use of data, if needed.

d- Potential risks to identifiability of processed data.

e- The likelihood of transnational data transfers as well as secondary transfer.

f- If complementary information will be added through linkage to different data registries, medical records, etc.

g- Methods of funding whether academic or mixed model funding with commercial entities.

h- The process for reporting of research results and incidental findings (refer to Article 7 for more details).

i- That consent may be withdrawn and how this is done." (refer to Article 5 for more details (adapted from RD- connect, 2018)<fnref n="96" />).

j- Reconsent procedures from children and new-borns who have had their genomic data collected, when they come of legal age. Also, participants who are engaged in long term cohorts should reconsent periodically (for example every 10-15 years).

k- How records of consent, reconsent are maintained and kept up to date.

**Article 3:** Any consent form and process should comply to international ethical requirements and should be approved by the local research ethics committee. Other models of consent should be adapted and adopted as alternatives to accommodate cultural and social differences as well as nature of research (see Article 2 above).

**Article 4:** To fulfil broad consent requirements:

a- Researchers should develop tools (a platform with a notification alert to new projects whenever a donor sample is used) for keeping donors/research participants informed about the types of research being conducted on their data.

b- Researchers should conduct periodic re-assessment of attitudes and research preferences of the data subjects.

c- Researchers should be aware that broad consent can differ across geographical areas since research should have a social value for the targeted community.

d- Data collectors/researchers should record and report patients' or data subjects' preferences (e.g.: to participate in only certain types of research) to their data use. This would warrant extra resources and an ongoing communication with data subjects.

**Article 5:** Researchers should enable the option of withdrawal of consent to data use in research - which is limited by:

a- If it is practically impossible to withdraw the data (data has been used to manufacture therapies or diagnostics - e.g.: cell cultures, stem cell therapies).

b- If it would critically impact the purpose to which data was processed.

c- If the data has been aggregated.

In situations where withdrawal of consent is set up, researchers shall create the appropriate channels of communications and

<footnote n="96">⁹⁶Hansson, et al., op. cit. note 1.</footnote>
reporting to data subjects, third parties, and data processors to ensure withdrawal of data from all partners.

**Article 6:** Researchers should ensure the quality of the data used in their research projects by complying to international standards.

**Article 7:** Researchers should return genomic data findings to data subjects, while explaining the risks that are associated with such reidentification. The measures should be appropriated to local healthcare and legal systems. To return the findings researchers should:

a- Return findings to data subjects who indicated their interest to receive findings and in keeping with local healthcare and legal systems.

b- Return findings that are clinically valid, actionable and have been confirmed by a clinical laboratory.

c- Recommend that data subjects seek professional advice such as a genetic counsellor or their General Practitioner.

d- If clearly stated in the research protocol and research participants request uninterpreted data for diagnostic purposes, researchers might provide secure, user-friendly and interoperable platforms i.e., presented in a language and a format that can be machine and human readable.<fnref n="97" />

## B- Data storage

**Article 8:** Data collected can be stored in local servers, international and/or cloud computing services (commercial, academic or public). Whatever the platform used, researchers should ensure security and safety of data are maintained.

### a- Cloud computing storage

For the purpose of this CoC, the focus will be on best practices of cloud computing storage. The procedures have been adopted from.<fnref n="98" />

**Article 9:** Research institutions should as much as possible opt for academic cloud services, or cloud services that can abide by SCCs, whenever possible and feasible.

**Article 10:** When using commercial cloud services, research institutions/data management committees should arrange for negotiable contracts with commercial CSPs and avoid standard predetermined contracts.

**Article 11:** To negotiate Terms of Service (ToS) with CSP, data management committees/research institutes should have, Amendments to ToS:

- Clear procedures for proper notification of amendments in ToS including allocating adequate time for response and acceptance by cloud users.

a- Support and maintenance

- Clear instructions on upholding confidentiality of genomic data, while CSPs conduct their support activities such as maintenance of cloud computing service.

- Restrict CSP monitoring of stored data.

- Clear safeguards against data breaches, damage or loss of data.

### b- Deletion of data and cloud exit strategies

- Unambiguous provisions on data deletion, including backups and duplicates, and duration of the grace period (if applicable) and incurred costs for data deletion in the event of CSP contract termination.

- State the agreed grace period where data is kept on the cloud after contract termination.

- Clauses that researchers can retrieve stored and processed genomic data and that a CSP cannot retain it or use it after the contract ends.

- Clear provisions for exit strategies are stated and agreed upon in the event that a cloud service is acquired by a third party.

### c- Data privacy and confidentiality

- Agreement to treat health and genomic data as "special type of data" that warrants extra security measures and protection of confidentiality.

- Provisions on data encryption, while at rest and as it is being transferred.

**Article 12:** Researchers should limit authorizing access to cloud services or genomic database to only members of the research team conducting research (e.g.: technicians, bioinformaticians, research assistants) who have been approved by a DMC or a DAC.

**Article 13:** Researchers should only deposit encrypted data for storage in a database or a cloud computing service and ensure there are regular back up of the data. For traceability, all submitted datasets are linked to the username of the data submitter within the system.<fnref n="99" />

**Article 14:** In cases of breaches to data safety (e.g.: data losses or damage) or security (unauthorized access), the CSP should notify researchers within a brief specified period.

## C- Data sharing, transfer and access

**Article 15:** To share or transfer or exchange data, researchers must do so by using minimal data for the purpose, encrypting genomic data and only using secure channels that are protected against unauthorized access.

**Article 16:** Researchers should transfer data that are relevant and limited to what is necessary in relation to the purposes for which it is transferred and processed.

**Article 17:** Researchers should maintain records of data transferral, users' activity and logging to the database or cloud service for auditing purposes and accountability.<fnref n="100" />

<footnote n="97">⁹⁷Wilkinson, et al., op. cit. note 1.</footnote>

<footnote n="98">⁹⁸Dove, et al., op. cit. note 5.</footnote>

<footnote n="99">⁹⁹Hansson, et al., op. cit. note 1.</footnote>

<footnote n="100">¹⁰⁰Ibid.</footnote>
**Article 18:** Data protection officer should, in coordination with CSPs and researchers, decide to store data and applications only in designated regions, where there are adequacy decisions or compatible regulations to national laws.<fnref n="101" />

**Article 19:** Data access committees or data management committees should evaluate requests for data access, exchange and transfer and validate requester's identity, credentials and research goals. They should ascertain that researchers will abide by the code of conduct, relevant laws or adherence agreements.

**Article 20:** Proper attribution and intellectual property should be accorded as appropriate. Sharing of data shall follow criteria for the acknowledgement of intellectual contributions and originality through rules of authorship and intellectual property rights.<fnref n="102" />

### D- Compelled disclosure

**Article 21:** Any requests of unauthorized data access by law enforcement or national security agents of a foreign country for example data importers, without data subject knowledge should be barred by CSP or DMC. This should be clearly stated in ToS and SCCs.

### E- Data handling from LMIC

**Article 22:** The local values, cultures and customs should be respected throughout the data processing activities (e.g., data collection, transferring, etc.). To that respect, transparency of the research procedures and methods, as well as of the scientific goals, is essential for enhancing community engagement and building trust between researchers and local groups (Refer to Article 3).

### F- Public and community engagement

**Article 23:** A community may be defined by a disease, an age group, a geographical location, a culture and an ethnicity. Measures should be taken to actively engage communities and data subjects. This can be achieved through:

a- involving members of specific communities, patient groups and the public in DMC (refer to a governance system Article 1) depending on the type and nature of research.

b- Periodically assessing data subjects' attitudes and research preferences (refer to broad consent Article 4).

c- As members of research ethics committees when specific research protocols address particular community.

<footnote n="101">¹⁰¹Dove, et al., op. cit. note 5.</footnote>

<footnote n="102">¹⁰²Hansson, et al., op. cit. note 1.</footnote>