Draft version for stakeholder interaction and discussion - Recommendations for a 1+MG Data Inclusion Governance Framework
Creators: name: Thorogood, Adrian
name: Becker, Regina
name: B1MG WP2
name: 1+MG WG2
Publisher: name: Zenodo
Year: 2022
Subjects: 1+MG
B1MG
1+Million Genomes Initiative
Beyond 1 million genomes
ELSI
Data Inclusion
Governance framework
recommendations

description: This document recommends standards to ensure genomic and health-related data can be responsibly and effectively made available through 1+MG for secondary use (for research, healthcare and policy-making purposes). These standards focus on ensuring compliance with applicable laws and ethical principles, and promoting transparency of data access and use conditions. Other standards (e.g., data quality) will be addressed by other 1+MG Working Groups. These recommendations are primarily directed towards 1+MG Data Holders, the institutions with the authority to grant or refuse access to certain genomic and health-related data.1 A Data Holder is a legal entity (i.e., controller), and must be distinguished from technical infrastructure providers, such as 1+MG certified data hubs where data are physically submitted, pre-processed, stored, and made discoverable and accessible. In the context of the 1+MG federated network, a Data Holder “includes” data by confirming that these standards are respected, meaning that data are legally and ethically ready to be made available. Data inclusion in this context does not mean that data are physically transmitted to a central data pool, or that the Data Holder has given up control over the data. We recommend the following ethical and legal standards be established for Data Holders: - Data must be clearly labelled with standard rights metadata describing applicable access and use conditions, to ensure transparency and predictability for data access decisions. - Data must be subject to a commitment to allow users accessing data through 1+MG to archive their data. - GDPR transparency requirements must be demonstrably met (and where applicable additional national transparency and/or consent requirements). - A data protection impact assessment (DPIA) must be conducted to verify and document that making data available in 1+MG complies with both European and national data protection rules and respects the fundamental rights of data subjects. - For genomes generated in research contexts, a research ethics committee (REC) approval must be obtained for making data available in 1+MG, to ensure ethical obligations around consent, respect for vulnerable groups or individuals, and plans for handling incidental findings are addressed. 1+MG intellectual property (IP), commercialisation, and publication policies must be accepted. - A clear recontact policy must be in place describing if and for what purposes recontact is possible (e.g., to access additional/updated data, or to follow-up with a data subject for additional data collection/recruitment). These requirements are primarily procedural, such as DPIAs and REC approvals, rather than substantive (e.g., specific consent clauses). This ensures flexibility for data coming from different countries and contexts, to be shared subject to different access and use conditions, while also Data Holders demonstrate compliance with legal and ethical requirements. Standards are described as minimum requirements or best practices. Where the Data Holder is the organisation that originally collected and generated data, such as in the case of a national genomic medicine initiative, it is solely responsible for meeting these standards. Where the Data Holder has received data from another organisation who was the controller for data collection and generation, it is the responsibility of the Data Holder to coordinate with this other organisation to meet the standards. The role of 1+MG is not to police what data may or may not be ethically and legally included in 1+MG. Rather, the role of 1+MG is to provide support to Data Holders in the form of guidance and checklists to help them prepare for responsible and effective data sharing. National ethics committees and data protection authorities can provide nationally tailored guidelines, and other bodies may be set up to provide advisory services, audit or certification services. While 1+MG cannot take direct responsibility for ethical and legal requirements, it can verify that the Data Holder has appropriately documented compliance.