In the short term, interim models should be adopted that are broadly consistent with the principles of the proposed permit mechanism. Specifically: (1) determination of a researcher’s bona fides may be internet based, but it must involve formal proof of institutional status; (2) each permit must be linked to an identified registered individual, using a universal ‘‘researcher ID’’ system such as the one already promoted by the GEN2- PHEN project (http://www.gen2phen. org); and (3) large-scale secondary data providers should be expected to adhere to the same standards and practices as primary data providers when releasing data to a researcher holding a permit. For this to work, it would require international recognition of the necessity and feasibility of such a strategy, as happened with the Bermuda Principles [4]. Such a proactive framework would contribute to sustaining ongoing public trust and participation in beneficial geno- mic research. George Church’s Viewpoint: Considering a Creative Commons Universal Waiver There is a clear movement to give all taxpayers access to government-funded research data [5]. We could debate amazingly sophisticated ways of encrypt- ing public gene+trait data and even more amazing methods to thwart such encryp- tion. However, we should acknowledge that the biggest security gaps are often social in nature. Getting researchers and their administrators to sign a legal form doesn’t even begin to guarantee compli- ance. For example, high-security defense data access requires psychosocial security checks of relatives, past colleagues, and personality tests (far beyond NIH require- ments). Nevertheless, authorized individu- als occasionally take classified data outside of secure environments. Human gene+trait data seem destined to be amazingly useful, to be in huge demand, and to be capable of study from a vast number of angles. It is hard to guess who will make the biggest out-of- the-box analytical breakthroughs, but it is likely that these insights will come from highly integrative approaches, in which individuals are evaluated in cohorts holisti- cally, just as a physician would—not as one disembodied organ plus one key SNP. It is likely that many of these insights will come from people outside of the clinical specialty of the original study (e.g., computer scientists and systems biologists). The more people granted access to these datasets, the more likely it is that someone will decide that it is ethically imperative (or cost-effective, or expedient) to share the data with researchers outside of the secure vault (or with the study participants/patients). The alternative model ([6], http://www.personalgenomes.org/) is to consent in advance with the understand- ing of full disclosure (not legalese weasel- words about ‘‘trying hard’’ to maintain anonymity). Furthermore, to help ensure informed consent rather than merely obtain- ing legal signatures on long consent forms, one can require 100% scores on tests of comprehension of the contents of the consent form and related materials. This has the side benefit of educating participants before the start of the study rather than after some potentially alarming result needs to be communicated back to them. Finally, the standard IRB (institutional review board) practice respects the autonomy of the individual research participant, hence does not require the consent of other family members. In the increasingly (re)identifiable datasets, increasing levels of family buy-in will likely be desirable, for example, in constructing pedigrees containing trait data. Fortunately there are many altruists who participate in medical research. However, one well-publicized incident of data leakage with inadequately informed consent could cause a backlash comparable to what happened with gene therapy in 1999 or Vioxx (rofecoxib) in 2004. In contrast, if we don’t overpromise on anonymity and if these participants and their families are deeply engaged (not merely treated as de- identified animals) and they see direct value from these studies, then they might tell their stories widely and it may become increasingly easy to recruit more partici- pants. The ability to make personal cell lines (http://www.personalgenomes.org/) and gene+trait data available under the new Creative Commons universal waiver, CC0 (http://creativecommons.org/weblog/ entry/13304), could greatly enable unprec- edented levels of commercial and academic creativity and collaborations. Catherine Heeney, Naomi Hawkins, Jantina de Vries, Paula Boddington, and Jane Kaye’s Viewpoint: The Changing Context of Data Sharing—Types of Identifiability in Genomic Data In 2003, a consortium of scientists working largely in public institutions triumphed over Celera in the race to map the human genome [7]. A willingness to make their data freely available on the Web played a part in this achievement. Subsequently, this approach to data shar- ing has become a norm in genomic research [8] and often a requirement of funding [9]. However, genomic informa- tion is not restricted to the research community. There are now private com- panies (for example, 23andMe) collecting sequence data and related information [10]. The real problem for genomic research is not that the information is available within the scientific research community, but that genomic sequence information is accessible to people outside of this community, who are not subject to the same safeguards, oversight, and pro- fessional codes of conduct. This has significant implications for our ability to protect the privacy of research partici- pants. Risks to privacy can arise because of the very nature of genomic sequence data [1,11], but also because information can be inferred from other available data [12]. The ability to combine datasets exacer- bates the problem [13]. For example, Gitschier demonstrates that by the itera- tive comparison of surnames in genealog- ical registries and data on Y chromosomes from the HapMap project, held in the CEU dataset, genetic information about named individuals could be inferred with considerable accuracy [13]. Moreover, Nyholt and colleagues show the difficulty of concealing sensitive genomic data by using linkage disequilibrium and data on other polymorphisms to infer information, which had not been directly released, about James Watson’s ApoE gene [14]. Genomic data, combined with other information sources freely available on the Web, enables inferences about individuals, family members, or population groups that can undermine privacy. Inference is a reasonable stand-in for direct information and can even be used to support decisions about individuals, as it regularly is in the fields of insurance and credit [15]. The Internet supports access to everything, from Facebook to individual birth records, while ever-evolving data processing tech- nologies enable efficient data collection and comparison of available datasets [16]. Raising these issues may appear alarmist; however, as Greenbaum et al. recently suggested, promising anonymity may al- ready be a thing of the past due to the potential to infer information and the nature, amount, and variety of data freely available [17]. Requirements for the ethical manage- ment of research data have sought to balance the privacy of data subjects with the benefits of research, utilising anonymi- sation and informed consent [18]. How- ever, it is now unrealistic to promise participants in research projects absolute PLoS Genetics | www.plosgenetics.org 2 October 2009 | Volume 5 | Issue 10 | e1000665