Responsible Data Sharing to Respond to the COVID-19 Pandemic: Ethical and Legal Considerations (v 3.0)

The Perspective of the Regulatory and Ethics Work Stream of the Global Alliance for Genomics and Health                           

Notice to the GA4GH community: This is a living document and we are seeking contributions. If you would like to contribute, the Regulatory and Ethics Work Stream kindly requests that you email rews-coordinator@ga4gh.org.

Text in dark grey is new to version 2.0.

Text in navy is new to version 3.0.

Executive summary.

An effective and equitable response to the COVID-19 pandemic requires rapid and sustained international collaboration and data sharing. The Global Alliance for Genomics and Health (GA4GH)’s focus on the creation of technical standards and regulatory/ethics guidance to enable the responsible sharing of human genomic and health-related data means that the GA4GH community is in a unique position to help move forward research into COVID-19. The Regulatory and Ethics Work Stream (REWS) has prepared this overview to assist researchers and others, such as research ethics committee (REC) / institutional review board (IRB) members, in navigating ethical and legal issues during the COVID-19 public health emergency. This is a living document, and we call on the GA4GH community to provide feedback, and to share their experiences and success stories.

Legal and regulatory

For the jurisdictions examined to-date (Australia, Canada, EU, UK, and USA), privacy and data protection law already contains provision for the processing of data for public health purposes provided certain conditions are satisfied. Where research is undertaken as a public health measure (typically under the supervision of a public health authority), privacy law provides avenues for data processing. Engaging in international transfers of personal data may also require a distinct basis in law.

Intellectual property (IP) can be licensed under generous terms for the purposes of responding to COVID-19 through licenses such as the Open COVID License. Some countries (e.g., Germany, Israel, Chile, and others) have also taken measures to more generously license patented technologies relevant to COVID-19.

Genomic tests such as PCR testing are likely to be regulated as in vitro diagnostic medical

devices (IVDs). These tests must present scientific validity, analytical performance, and clinical performance for approval. Certain countries such as Canada have permitted temporary authorizations to be sought, which may allow test developers to rely on a preexisting foreign approval of the device.

Data sharing policy

The exigencies of the pandemic further highlight the need for open science. Sharing interim results and research methods insofar as the integrity of the research allows is essential. To this end, registering research hypotheses or projects in a public database before participant recruitment or data analysis is invaluable. Preprint publishing and other forms of knowledge sharing and exchange are also encouraged. At the same time, responsible use of such data is essential. This means carefully considering preliminary data’s limitations, especially where decisions affecting individuals may be made on the basis of such data.

Ethics

Public health ethics must be distinguished from biomedical ethics. The principle of justice is the bedrock of the former, with its emphasis on the interaction of individuals and communities, on collective responsibilities and common goods. The purposes for which the research is conducted will determine which set of principles are to be given greater weight. There is potential for the inclusion of research infrastructure such as biobanks within the public health system. To ensure such inclusion is done effectively and ethically, ethicists and policymakers should consider how to balance the ethical implications of public health measures with biomedical research.^[1]

Timely Research Ethics Review and Data Access

Research is an integral part of outbreak response, but “despite [the] sense of urgency, research during an epidemic is still subject to the same core scientific and ethical requirements that govern all research on human subjects.”^[2] Researchers should explore creative ways to obtain informed consent via digital means or through a legally authorized representative, where appropriate. Standard exceptions to consent requirements for secondary use of health data may have stronger ethical justification for research directed at pandemic responses. RECs/IRBs have been encouraged to adapt processes to facilitate the robust and timely review of research. Preliminary information from the GA4GH community suggests that RECs and data access committees (DACs) are anticipating some type of expedited review for COVID research.

Introduction

In the midst of a global pandemic, now, more than ever, we need sustained international collaboration and data sharing. Only by coming together to share data and collaborate in research can we as a global community respond effectively to the COVID-19 pandemic and develop solutions that can benefit humanity. As part of this effort, the Global Alliance for Genomics and Health (GA4GH) has signed onto the Wellcome statement Sharing research data and findings relevant to the novel coronavirus (COVID-19) outbreak. The GA4GH community also has various initiatives underway, from COVID beacons to platforms like COVIDaware that facilitate the anonymous collection of user-submitted symptom information. (Information regarding these initiatives can be found here: https://www.ga4gh.org/home/covid-19/).

The founding ethos of GA4GH centres around a human rights approach to responsible data sharing. The current pandemic has brought to the fore the human rights of everyone to obtain the highest attainable standard of health, to non-discrimination, and to the benefits of scientific progress. We note that many of the issues and principles raised in this context are not new; rather, the way in which these principles are weighed and balanced must be applied in an unprecedented public health context and tailored to the current pandemic situation. As citizens, we must also ensure that restrictions on fundamental rights and freedoms must be justified, proportionate, reviewable and temporary.

Responding to the pandemic requires an unprecedented level of collaboration from governments, international organizations, policy makers, scientists, industry, and the public. We consider that research, “whether epidemiological, genetic, preclinical, microbiological, behavioural or operational – can generate new knowledge about an outbreak in rapidly changing situations.”^[3] In the context of COVID-19, this includes, for example, studies about clinical practice and process optimization, diagnostic tests, clinical trials, the virus’ interaction with the human body, validation of serological tests, etc., are all important to better respond to the outbreak.^[4] These types of research implicate three broad types of data: pathogen genomic data, human (host) genomic data, and other types of human clinical data. The ethical and legal issues associated with sharing human data have been documented in the literature. Data governance policies may vary between data types, taking into consideration their scientific value (e.g., reproducibility), connection to the COVID-19 pandemic, as well as their ethical and legal implications.

The GA4GH Regulatory and Ethics Workstream (REWS) holds that the goal of responsible, open, and rapid dissemination of data and knowledge should still conform with ethical and legal principles, security standards, and applicable laws, and also recognizes that dissemination should encourage such sharing to improve responses in the context of public health emergencies. In recognition of the role that bioethics, public health ethics, and law have to play, we have outlined some of the specific issues the COVID-19 pandemic raises, including any relevant responses from regulatory authorities.

Description of the Audience, Goals and Structure of this Document

This document is primarily directed towards the human genomic research community interested in supporting the global effort to combat COVID-19. The goal of the document is to summarize key regulatory pathways and ethical considerations. In particular, we provide information on the kinds of modifications that are being implemented for genomics researchers to contribute in the context of a public health emergency, noting that these will differ between jurisdictions. This document is best read in conjunction with the recommendations and guidelines of the Research Data Alliance’s COVID-19 working group.

We envisage this as a living document, which we will aim to update regularly in response to rapidly changing research, legal and policy contexts. We envisage this document as a beginning of a conversation. To promote community learning, we encourage members of the GA4GH community to fill out a (very) brief survey regarding the existence of any new large-scale genomics or biobanking projects as part of their country’s response to the pandemic. Please see https://forms.gle/AUefrySNgJXZBdd77. We have shared some interim results in section 4 of this document.

1. Legal and regulatory

Law and regulation in the midst of a legitimate public health emergency may present new avenues by which research can be done in conformity with ethico-legal principles and norms. In this section, we detail three principal legal and regulatory areas of interest: privacy and data protection, intellectual property, and medical devices. We have given specific attention to responses in Australia, Canada, the European Union, the United States, and the United Kingdom. Other jurisdictions are also active in developing strategies to respond to the crisis. We acknowledge that the GA4GH community spans far beyond these geographic areas, but focusing on these three areas allows for simplicity while highlighting some diversity of regional and national responses. We believe that the issues dealt with may be transposable to other geographies.

1.1 Privacy and data protection

If the COVID-19 response is to be effective, it must be underpinned by robust science and quick access to data. Some of this data will constitute personal data^[5] and so be regulated by data protection rules. (It is important to note that data that is not personal may be shared freely, as far as privacy and data protection law are concerned, but must still be done in a way that is ethical, compliant with human rights, and public trust.) Linking individual-level data, whether clinical, research, or even location data, to non-personal data such as pathogen genomes, will likely trigger the application of privacy and data protection laws.

In this context, the challenges of data protection remain but mediating privacy with other recognized legal principles is important, when responding to a public health emergency. Privacy and data protection are not absolute but rather are interpreted, as much as possible, in a manner conducive to realising other legal rights and societal values such as public health, access to quality care, and respect for autonomy.

1.1.2 European Union/European Economic Area

In the European Economic Area (EEA), the General Data Protection Regulation (GDPR), along with supervisory authorities and national legislation, provides some flexibility with which to respond to pandemics. The processing of personal data requires a legal basis. Furthermore, the processing of “special categories of data” such as health data still requires an additional legitimation, as these data must be treated with extra care. Lawful transfer of personal data outside the EEA (in the absence of an adequacy decision by the European Commission) also requires a legal mechanism. Where use is made of derogations or COVID-19 specific regulation is set up, the proportionality is still to be respected as well as, where applicable, a time limitation.

As a general proposition, the informed, explicit consent from an individual is sufficient for data processing, including international transfers. However, it has been widely noted that consent collected in the normal course of research or clinical care is often not sufficient to act as a legal basis (or as a derogation for the purposes of Article 9(2) or 49(1)).^[6] Consequently, many data controllers now rely on a legal basis other than consent. Consent to data processing may prove even more difficult to collect in the case of COVID patients, owing to stringent requirements as to the information that must be given to data subjects and to power imbalances between a patient and the treating physician. Other legal bases for processing and international transfer exist, which may be better suited to the circumstances. These include tasks in the public interest, as well as research and public health purposes. The legal basis that can be applied and the legitimations available depend on applicable national legislation. It is useful to note that the so-called “vital interest” basis for both processing and transfers has a limited scope that only applies in cases where the immediate health of the data subject is jeopardized. As such, it is not a useful basis for ongoing research, even in the context of a pandemic.

For a more detailed analysis of the GDPR in the context of COVID-related research, we encourage you to consult:

Becker, Regina and Thorogood, A. and Ordish, J. and Beauvais, M.J.S., COVID-19 Research: Navigating the European General Data Protection Regulation (May 5, 2020). Available at SSRN: https://ssrn.com/abstract=3593579                          

Furthermore, GA4GH’s GDPR Forum publishes monthly briefs on various aspects of the GDPR and its implications for genomic and health-related research. The information contained within these 500-600 word briefs remains relevant. We invite researchers and others to consult this valuable resource for understanding how the GDPR affects COVID-related research.

 Complete list of GA4GH GDPR Briefs 

Notably, the European Data Protection Board and many national supervisory authorities have released multiple statements and guidance on the position of data protection amidst the current crisis. The table below provides links to statements on COVID-19 data processing from such authorities.

1.1.2.1 Spain

Much as the EDPB has done, the Agencia Española de Protección de Datos (AEPD) has published a report which confirms that there is a legal basis for the processing of personal data during health emergency situations, such as a pandemic, by public authorities for the protection of public health. In fact, the Organic Law 3/2018 on Data protection and Digital Rights, states that Articles 9(2)(g)-(j) of GDPR are developed in, among other laws, the Law 33/2011 on Public Health, the law 14/1986, on Healthcare, and the Law 41/2002 on patient’s rights and clinical documentation. These are the most relevant laws that describe the general duty for the public authorities to implement actions in the clinical framework, in order to preserve public health.

Besides this, there is a general empowerment to the public authorities, to take any action needed in case of a health emergency (Organic Law 3/1986, on Special Measures in the Field of Public Health). There is no specification about how the data can be collected, so there is a general empowerment. As a general principle,a proportionality test is needed. The source of the data has been the clinical diagnosis. The purpose has been to take decisions about infrastructures, and the phases of the lockdown. There has been an “Alarm situation declaration”, ratified by the Spanish Parliament, by which the central Government is the “unique” authority (This is very important because Spain is a highly decentralised country).

 In case of epidemiological research, even that carried out by public authorities, citizen consent has been the legal basis for the data processing. In case of scientific research, both consent and scientific research can be the legal basis for data processing. Due to the particular situation of patients, consent has been given orally very often (and documented in the clinical record). In some cases, due to the situation of the patient, information relevant to consent to data processing has been provided after the patient has recovered legal capacity to make decisions.

Selected statements / resources by authority

European Data Protection Board (EDPB)

Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak 

Statement on the processing of personal data in the context of the COVID-19 outbreak

Twentieth plenary session of the European Data Protection Board - scope of upcoming guidance on data processing in the fight against COVID-19

EDPB Letter concerning the European Commission's draft Guidance on apps supporting the fight against the COVID-19 pandemic

UK Information Commissioner’s Office (ICO)

Data protection and coronavirus information hub

Data protection and coronavirus: what you need to know

The ICO’s regulatory approach during the coronavirus public health emergency

MRC Regulatory Support Centre COVID-19 Bulletin 17th April 2020

Agencia Española de Protección de Datos (AEPD) [Spanish Data Protection Authority]

Opinion confirming the availability of legal bases for personal data processing for public health purposes (Spanish only)

International Conference of Information Commissioners (ICIC)

Access to information in the context of a global pandemic

1.1.3 USA

As is the case with other privacy laws, the Health Insurance Portability and Accountability Act (HIPAA) remains applicable in the context of a public health emergency. Researchers and their affiliated institutions are also subject to a patchwork of state privacy laws that regulate access to data. If researchers are regulated by HIPAA, it is useful to remember that protected health information (PHI), including genomic data, that has been de-identified may be shared freely.

Researchers must be aware that most on-going research does not generally qualify as a public health activity under HIPAA. Public health activities include the reporting of disease, as well as investigation and surveillance activities. The distinction between a public health activity and certain types of research may be less clear, such as where epidemiological research is undertaken as part of a public health investigation. While certain requirements of HIPAA have been waived as a response to the public health emergency, these do not apply to most research.

Disclosing a patient’s PHI for research purposes requires their written authorization under HIPAA, unless an institutional review board (IRB) issues a waiver (i.e., the research poses minimal risk and obtaining authorization is impracticable). Researchers may also de-identify the data via the removal of 18 identifiers (so-called “safe harbor” method) or via expert determination that there is only a “very small” risk that the recipient of the PHI could identify the individual to whom the PHI relates. Alternatively, researchers may create a “limited data set” in conjunction with a “data use agreement”. (See the U.S. Department of Health & Human Services’ page HIPAA and Research for more information.)

We furthermore note that public health surveillance activities are not a research activity governed by the Common Rule. These surveillance activities are to be carried out/supported/ordered by a public health authority. (See the Office for Human Research Protections’ dedicated guidance relating to COVID-19 and research.)

Selected resources from the US Department of Health and Human Services (HHS) regarding HIPAA and COVID-19

Office for Human Research Protections Guidance on COVID-19 

Activities Deemed Not to Be Research: Public Health Surveillance 

February 2020 Bulletin: HIPAA Privacy and Novel Coronavirus 

COVID-19 and HIPAA: Disclosures to law enforcement, paramedics, other first responders and public health authorities

HIPAA, Civil Rights, and COVID-19 

HIPAA and COVID-19 Bulletin: Limited Waiver of HIPAA Sanctions and Penalties During a Declared Emergency 

1.1.4 Canada

As the Office of the Privacy Commissioner of Canada notes, provincial public health laws include broad powers for the collection and dissemination of relevant data. Similar to the USA, these public health powers are aimed at facilitating public health surveillance, and not on-going research.

In Canada, then, using personal data for research purposes continues to require that the research project be approved by a research ethics board (REB). Frequently, provincial privacy laws require that the public’s interest in conducting the research be considered. The COVID-19 pandemic in principle heightens this interest. It must nevertheless be mediated with the public’s interest in ensuring privacy protections.

The overlap and interrelations of Canada’s privacy laws can subject entities in different provinces and different sectors (health, private sector, and public sector) to varied obligations. Healthcare institutions should be mindful of which privacy laws apply to them within a particular context.

Selected resources from Canadian privacy commissioners

Office of the Privacy Commissioner of Canada -Privacy and the COVID-19 outbreak 

Order of the Minister of Citizens’ Services of British Columbia - Ministerial order modifying data localization requirements for specific COVID-related purposes

Commission d'accès à l'information du Québec - COVID-19 : Protection des renseignements personnels et sécurité de l'information (French only) 

1.1.5 Australia                  

As with many other countries, Australia is actively participating in the global response to this emergency, within the context of its own ethical, legal and regulatory environment. The Australian Information Commissioner is a member of the Executive Committee of the Global Privacy Assembly, which has issued a statement expressing their confidence that “data protection requirements will not stop the critical sharing of information to support efforts to tackle this global pandemic”.

Bearing in mind that Australia has a mix of federal and state and territory privacy laws, the privacy regulators have collectively formed a National COVID-19 Privacy Team. As noted in the Australian privacy regulators’ response to COVID-19, Australian privacy laws do allow the use of personal information in circumstances such as these, provided that the use is reasonably necessary and the information is protected from inappropriate disclosure. It should further be noted, however, that where the intended use is for the purpose of health research and it is impracticable to obtain individual consent, not only must the information be protected from inappropriate disclosure, but the use must be approved by a Human Research Ethics Committee.

Selected resources from Australian privacy regulators

COVID-19 response from Australian privacy regulators — Office of the Australian Information Commissioner

1.2 Intellectual property

Intellectual property rights, and restrictions arising from their licensing, may hinder the efficacy of responses to the pandemic. We recognize that actors require licenses with simple language that creates robust use and modification parameters. In this vein, the Open COVID Pledge has emerged, which aims to “promote the removal of obstacles involving intellectual property in the fight against COVID-19”. Realizing this goal is achieved primarily by way of the Open COVID License (OCL). Any individual, institution, company or other organization holding intellectual property rights. and with the legal competency to do so, can all make the pledge and commit to the OCL or another compatible licence such as CC0 or CC-BY. This clear, straightforward license grants anyone a global, non-exclusive, royalty-free license to exploit any IP under the license for the purpose of ending the COVID-19 pandemic. The license is valid from December 1, 2019 until one year following the date in which the WHO declares that the COVID-19 pandemic has ended.

Furthermore, national laws that govern IP may be modified. We note that measures related to compulsory licensing (i.e., government-mandated licensing) of certain IP rights for the purposes of responding to the COVID-19 pandemic have been adopted in Canada, Chile, Ecuador, Israel, and Germany.

Stewards of data resources could consider relaxing their IP policies relating to data sharing, where applicable. Some bioresources impose contractual restrictions or benefit-sharing conditions on downstream IP developed using shared resources. Others may impose restrictive or ambiguous licenses or terms of use directly on the data.^[7] These IP approaches could be relaxed in a similar spirit to the permissive licensing of patented technologies promoted by the Open COVID Pledge initiative, or even to license under the CC0 or CC-BY licenses.^[8] More permissive data licensing need only be extended for COVID-19 related uses, or temporarily during the period of the pandemic. Sharing data under clear, permissive licenses or terms of use to ensure there are no copyright, database right, or contractual barriers to rapid re-use of data. Explicit and permissive data licenses are also particularly important to enable the development of artificial intelligence tools, which rely on access to large amounts of data to train and deploy.^[9]

1.2.1 Canada

As part of the federal COVID-19 Emergency Response Act, the Patent Act has been amended. Now, upon application of the Minister of Health, the federal government or other specified individuals can exploit a patented invention for the purposes of responding to the COVID-19 public health emergency. These authorizations are temporary (one-year duration), provide for adequate remuneration to the patent-holder, and are subject to supervision by the Federal Court of Canada. Unless renewed, these special powers expire on September 30, 2020. Such powers represent a significant change compared to the preexisting “abuse of rights” licensing regime.

1.2.2 Australia

Australia has provisions in its Patents Act 1990 allowing use of patented subject matter without the authorisation of the patent holder. There are two ways that this can be achieved. The first is through compulsory licensing, which requires application by the proposed compulsory licensee to the Federal Court of Australia. Such applications are exceptionally rare. There has also long been provision for the Australian government to step in and rely on ‘Crown use’ to use patented technology ‘for the services of the state’, or to licence other providers to do the same. Again, this provision is rarely relied on. Notably, in February 2020, the Crown use provisions were significantly amended, and now explicitly include a provision allowing Crown exploitation in emergencies. The trigger for Crown exploitation in emergencies is that the relevant Minister considers that the exploitation is required, and approves in writing, the exploitation before the exploitation starts. Unlike the general Crown exploitation provisions, previous attempts at negotiating a licence with the patent holder are not required, although just and reasonable remuneration is necessary. Although this amendment to Australian patent law was not triggered by the COVID-19 emergency, it certainly provides a clearer route to use without authorisation of the patent holder, should this be necessary.

1.3 Medical devices

The development and deployment of diagnostic tests are essential in obtaining accurate data. This is true of genomic tests, as well as diagnostic tests specific to SARS-CoV-2. Some genomic tests, especially those used to diagnose or screen individuals (for example, PCR testing) will likely qualify as in vitro diagnostic medical devices (IVDs). Other tests (for instance those that are laboratory developed tests or health institution exempt devices), while not qualifying as IVDs, will be expected to follow good laboratory practice standards, such as ISO 15189 and 17025.

As with other forms of regulation such as data protection, the COVID-19 pandemic does not suspend medical device regulation, but relies on preexisting flexibility already provided for within regulation and evolving flexibility from competent authorities. The table below outlines medical device competent authorities and their responses to COVID-19. In general, these regulatory authorities are seeking to fast-track applications to conduct trials involving diagnostic tests and devices for COVID-19 to ensure they can be rolled out in as safe and fast a manner as possible.

If a genomic test qualifies as an IVD, the device will be required to provide certain assurances with respect to its safety and ability to meet its intended use. For instance, under the incoming EU In Vitro Diagnostic Medical Device Regulation (IVDR), the device will have to meet general safety and performance requirements, the specific conditions varying according to classification of the device (genetic tests typically being classed as Class C devices under Rule 3 IVDR). Compliance with these general safety and performance requirements is evidenced by a performance evaluation conducted according to a performance evaluation plan and collated into a performance evaluation report. Performance evaluation comprises three general pieces of clinical evidence:

1. Scientific validity, referring to the association of an analyte to a clinical condition or physiological state.
2. Analytical performance, referring to the ability of an IVD to correctly detect and measure a particular analyte.
3. Clinical performance, referring to the ability to yield results that relate to a particular clinical condition or physiological state for the intended use and in accordance with target population, and where applicable the intended user.

Notably, many competent authorities both within the EU and outside (for instance, the USA and Canada) have expressed willingness to work closely with manufacturers of COVID-19-related devices to accelerate development. Given such offers, manufacturers should communicate with their competent authority to ensure their device can take advantage of any flexibility offered and meet the appropriate standards.

1.4 Good laboratory practice

The Red Nacional de Biobancos (RNBB) [Spanish National Biobank Network], in collaboration with the Asociación Española de BioSeguridad (AEBioS) [Spanish Biosafety Association] has assembled technical advice from national and international standards regarding the proper storage and handling of biological samples from individuals with COVID-19 in the context of biobanking research.

Red Nacional de Biobancos (RNBB) [Spanish National Biobank Network] - Guide relating to the handling of human biospecimens in light of the COVID-19 pandemic (Spanish only)

Summary of the guide also available (Spanish only)

2. Data Sharing Policy / Legal and Ethical Governance

2.1 Open Science and Data Sharing Policy During a Public Health Emergency

We call attention to the relevance of the ethos and central principles of open science for the human genomics community in the context of COVID-19 research. These principles relate to a broad range of practices relating to improving the transparency and reproducibility of research activities and results, fostering collaboration, as well as timely data sharing.^[10] 

Many of these practices are encouraged by the Wellcome statement on rapid sharing of research findings relating to the novel coronavirus, of which GA4GH is a cosignatory. In particular, the statement recommends that “researchers share interim and final research data relating to the outbreak, together with protocols and standards used to collect the data, as rapidly and widely as possible—including with public health and research communities and the WHO”.^[11] The WHO’s COVID-19 Technology Access Pool (C-TAP) further stresses the paramount importance of open science and social solidarity in ensuring that the benefits of scientific advancement are shared equitably and rapidly.^[12] 

Depending on the nature of the research, best practices guidelines may be available for responsibly sharing different data types, noting that sharing practices will also need to be consistent with maintaining the scientific integrity of any ongoing research. The World Health Organization recommends the public and timely (within 21 days or sooner) release of pathogen sequence data.^[13] The GA4GH provides technical standards and regulatory/ethics guidance to enable the responsible sharing of human genomic and health-related data.^[14] 

It is also important for the human genomics community not only to keep sharing data, but also to share information about research activities and results related to COVID-19 in an accurate and timely fashion. This may include registering research hypotheses or projects in a public database before recruitment or analysis, sharing research methods and tools to facilitate validation, publishing pre-prints of manuscripts, and sharing expertise between research groups and countries. The crisis has demonstrated that different countries have different levels of preparedness for such a crisis, and few if any are entirely self-sufficient. This applies equally in terms of research expertise.

It is also important that data be shared in an effective manner to promote meaningful reuse. To this end, the Research Data Alliance has produced the following recommendations on how to share scientific data well during the current pandemic. Highlights of the recommendations are that a balance should be struck to achieve FAIRness of outputs and the timeliness of sharing, including openly accessible metadata to promote findability, documenting research outputs, and using suitable repositories. For more, see: RDA COVID-19 Working Group. recommendations and guidelines. Research Data Alliance. DOI: https://doi.org/10.15497/rda00046

2.2 Responsible Use

An open science approach that facilitates the rapid and open sharing of findings and data related to COVID-19 is essential. There are, however, considerations related to the role of researchers, companies and regulators in the responsible dissemination and exploitation of COVID-19 genomics. Human genomics research may be used to provide information about susceptibility to infection or the consequences of infection. This may initially have significant research value but limited accuracy or predictive ability, particularly at an individual level. However, experience has suggested that, where genetic information of interest is identified, it may become commercially available in advance of robust clinical evidence.

The premature commercialisation of COVID-19 susceptibility testing may be anticipated in light of the uneven clinical and economic effects of the pandemic and the potential market size. This may have potentially harmful consequences for individuals acting on the basis of uncertain or inaccurate information about increased or reduced susceptibility and wider implications for public trust. The regulation of genetic testing markets is uneven, and complicated by the provision of services through the internet. Nevertheless, action from researchers, regulators and companies, including those that focus on third party interpretation tools, is essential to inform the responsible use of COVID genetic findings, and to establish whether, when and how such findings are incorporated into the pandemic response.

3. Ethics

Responding agilely to the COVID-19 pandemic is an ethical imperative. Core ethical principles such as beneficence, non-maleficence, autonomy, and justice are central to responding to the pandemic. They are not merely afterthoughts. These principles are themselves key aspects of the response. At the same time, the “interpretation of research responsibilities in the context of a crisis such as COVID-19 should be informed by flexibility, consultation and good sense so as to retain the focus on the safety and well-being of those most at risk in our institutions and communities.”^[15] 

3.1 Public health ethics                  

Due to the current situation, COVID-related research has important public health dimensions that may be not present for more general biomedical research. Research ethics is a subset of both public health research and biomedical research. The purposes for which the research is undertaken (i.e., for either public health or biomedical purposes) then determines the leading ethical concerns. In comparison to medical ethics, public health ethics has a greater focus on issues related to the interaction of individuals and communities, reflecting on collective responsibilities and common goods. In this context, the importance of the ethical principle of justice is emphasized and concerns for health maximization and efficiency need also be considered.

Ethical issues related to public health impact the whole population and require collective interventions to promote and protect the health of the public. Foremost here are issues of access to testing and treatment; solidarity in terms of collective, community response to the pandemic and how we should look after the needs and interests of others, especially the more vulnerable in our communities; and, autonomy as regards informed consent to any research and treatment and to a fair balance between fair consideration of) privacy interests and public health interests. In the context of a pandemic, collective interests merit additional consideration when measured against individual autonomy. Reconciling these principles is neither a simple nor an easy task. Accordingly, any response to COVID-19 must be proportionate: it must not over-reach in terms of its interference with individual rights and interests and must be transparent and subject to an accountability framework.

A challenge to introduce biobanking in public health approaches, in the context of a pandemic, is that genetic data would be primarily used for research and not for immediate public health response. Thus its potential for health maximization through monitoring, diagnostic and treatment is uncertain and such benefits are unlikely to materialize in the short term. Yet systematic biobanking, longitudinal follow-up and broad sharing of genetic data across jurisdictions will become essential to better understand, treat and prevent pandemics more rationally in the future. Some groups may, however, be more impacted than others by collective action, and the use of human genomic data may lead to some stratification. As such, such research may identify novel at-risk groups who may be the target of discrimination and exclusion from employment or public space. In a similar vein, existing genetic datasets, including those from biobanks, are uneven in their coverage of different ethnic groups. This suggests an urgent need for ethicists and policymakers to reflect on ways to properly introduce biobanking research into public health frameworks.^[16] For example, lessons may be drawn from previous endeavours to integrate research infrastructure into public health monitoring, as with newborn screening and the storage of residual dried blood spot samples for research.

3.2 Research Ethics Review

The joint statement on COVID-19 from UNESCO’s International Bioethics Committee (IBC) and World Commission on the Ethics of Scientific Knowledge and Technology (COMEST) has highlighted the need to exchange knowledge regarding how RECs are adapting their procedures for the review of clinical research during a public health emergency.^[17] The statement encourages researchers and RECs to pay closer attention to the importance of scientific transparency, timely results, and data sharing (see above), all of which are key to accelerating scientific discovery and translation. RECs have a mandate to uphold the scientific and ethical integrity of health research and to protect the rights, interests, and welfare of research participants. In the face of a public health emergency and high levels of scientific uncertainty, RECs may streamline their approval processes by, for example, convening meetings virtually and fast-tracking approvals through processes that are at once efficient and robust. As the IBC and COMEST note, while a pandemic does not mean that ethical principles can be transgressed, RECs may be permitted in exceptional circumstances to waive some standard ethical requirements in support of a rapid response, where ethically justified.

Some countries have notably adopted processes to respond to the current exigent circumstances. In the UK, for example, the Health Research Authority (HRA) has enabled an expedited review process for studies relating to COVID-19 where there are public health grounds for rapid review. The full process for fast-track reviews is set out in the HRA Standard Operating Procedures for Research Ethics Committees. If an expedited review is agreed, the service can arrange for the application to be reviewed at a scheduled meeting, or for an existing REC to hold an extraordinary meeting, or for a new REC to be formed to consider a particular application. Italy has also adopted flexible processes for RECs and the evaluation of clinical trials, allowing meetings to happen remotely and with whatever frequency the situation requires.^[18] The USA’s Food and Drug Administration (FDA) has created a special Coronavirus Treatment Acceleration Program (CTAP), which provides for rapid review of research protocols and other triage measures for the investigation of potential therapeutic agents.^[19]

RECs may also adapt their processes in light of a public health emergency or waive certain general requirements when reviewing data-intensive health research proposals. Consent remains a primordial ethical requirement. Consequently, the use of waivers remains an exceptional measure. The COVID-19 pandemic does not change the status of either. We encourage researchers to use their creativity to find ways to obtain informed consent for the collection, generation, analysis and sharing of some human genomic and health-related data collected from COVID-19 patients. For example, this may be achieved by using digital consent or seeking consent from a legally authorized representative when necessary. Given the particular urgent context and public health interest of the research, flexibility on the part of ethics committees and of government in the assessment of such processes is essential.

For already existing datasets relevant to a COVID-19 analysis (e.g., respiratory/infectious disease patients, longitudinal study participants, etc.), it may be impossible or impractical to re-consent participants for secondary use of the data. In such circumstances, RECs may be permitted to waive general informed consent requirements if such a process is permitted by law and ethics guidelines. In some jurisdictions such as Australia, New Zealand and Singapore, waivers can only be granted if an additional ‘public interest’ criterion is fulfilled. This poses a higher bar for approval than is required for studies conducted with consent. Meeting the public interest criterion provides assurance that the privacy intrusion of accessing data for research purposes without consent is well-justified by the broader interests advanced by the study.^[20] In the present context, there is very strong public interest in furthering our understanding of COVID-19 in order to combat the devastating disease, and so meeting that criterion will be relatively straightforward.

Nevertheless, and as already mentioned, waivers are exceptional and their availability is tightly circumscribed by preexisting ethical norms. For longitudinal population studies, participants have reposed great trust in researchers regarding the use of their data and samples by way of broad consent with ongoing governance. These participants should be engaged via habitual communication channels about new research projects.

Despite these special arrangements that accommodate the needs of both researchers and society in times of an emergency, RECs should aim to engage in a robust and timely review of research. Mechanisms may be implemented to fast-track reviews, but this should not come at the expense of proper ethical evaluation. Finally, we note that where multisite research studies are involved, steps should be taken to avoid duplicative ethics review, which can only slow down research unnecessarily. We encourage ethics committees to consult the GA4GH Ethics Review Recognition Policy and find commonalities in review processes such that they can accept as valid a REC approval taken at another site and focus their assessment only on site-specific governance aspects, rather than ethical considerations already assessed by the other REC.

Additional resources:

Guidance for managing ethical issues in infectious disease outbreaks (WHO)

Ethics Resources for Conducting Research in Public Health Emergencies (The Hastings Center) 

Ethics and Evidence in the Search for a Vaccine and Treatments for Covid-19 (The Hastings Center) 

Research in global health emergencies (The Nuffield Council on Bioethics) 

Research ethics in a public health crisis 

Report of the Bioethics Committee of Spain on the ethico-legal requirements in research with data from health and biological samples in the context of COVID-19

3.3 Data Access Oversight

Many valuable, large-scale genomic and health-related data repositories are subject to managed access processes to ensure that data is responsibly shared and re-used. Researchers may seek access to these resources for COVID-19 related research studies. Like RECs reviewing data-intensive research projects, organizations may seek to allow their data access committees (DACs) to accelerate or adapt their access review processes to assist in responding to the current public health emergency. Timely review of data access requests has long been a best practice. As a starting point, organizations may want to commit more resources to DACs to allow them to provide even shorter turnaround times. Once an access request is approved, organizations can also speed up technical access processes of authentication and authorization, to further reduce delays. See the UK Biobank for example.^[21]

An open question remains whether or not DACs should adjust their access policies where requests relate to COVID-19 research. It is acknowledged that DACs themselves may have limited flexibility to change access policies, which are set by institutions and reflect a range of obligations towards funders, data contributors, data subjects and communities that cannot be easily modified. Overall, the Research Data Alliance recommends that approval mechanisms for sharing data remain rigorous.^[22] Some modifications in response to a pandemic may be possible and appropriate. For example, DACs might give streamlined permissions to already credentialed researchers to extend their approved research to COVID-19 research for a limited period of time. They might provide access to researchers who do not meet the normal requirements (e.g., geographic location, research qualifications, local research ethics approval), or provide access for research uses not normally permitted (e.g., an autism or diabetes dataset used to study infectious disease). However, these data access rules typically have a strong ethical or legal justification, that may not be easily adapted. We are currently unaware of any specific cases where human genomic databases have adapted their access policies in response to COVID-19, but we encourage GA4GH members to inform us of their experiences.^[23]

Other Resources:

African Academy of Sciences’ Biospecimens and Data Governance Committee On COVID19: Ethics, Governance and Community Engagement

RDA COVID-19; recommendations and guidelines, 5th release (final draft) 28 May 2020 

4. Interim Survey Results on Large-Scale Genomics and Biobanking Projects

Thank you to the community members who filled out a brief survey regarding the existence of any new large-scale genomics or biobanking projects as part of their country’s response to the pandemic. Interim results suggest that the decision to launch such large-scale research initiatives varied widely by country. Of those countries where such initiatives are underway, they are considered either solely as a research project or as a mixed research and public health project. None are considered only as a public health resource. Some countries have also adopted procedures to obtain informed consent where, for example, a potential participant is unable to do so at the time of sample collection.

Countries to which the responses pertain: France, Singapore, Spain, the United Kingdom, and the United States of America.

The brief survey is still available and we encourage members of the GA4GH community to fill out the survey to improve the quality of the collected data. The survey may be accessed here: https://forms.gle/AUefrySNgJXZBdd77 

5. Related Initiatives

A number of research policy organizations are developing similar resources to support responsible research during the COVID-19 pandemic. The REWS strives to coordinate and connect with these initiatives to avoid duplication and ensure the most accurate and up-to-date guidance is provided to GA4GH Members. We invite all GA4GH members to notify us of or formally liaise with related initiatives and resources.

• Research Data Alliance, COVID-19 Working Group

6. Conclusion

The foregoing shows that, much as the pandemic is a global issue, it is also one that brings together a broad spectrum of ethical, legal, and regulatory concerns. For the most part, the standard principles and norms continue to apply. Some specific areas, such as patent rights, have been modified in some countries. But these measures are exceptional for the time being.

If the same requirements stand, we note that there is already significant flexibility in applicable laws and ethics. Researchers, research ethics committees, and regulatory authorities have the opportunity to think creatively in ensuring that processes can be appropriately adapted to maintain important protections and oversight while facilitating timely research and the maintenance of the public’s trust. Consent processes, for example, can be modified while still ensuring that participant autonomy is respected. Data processing activities can look to public health provisions to justify processing. DACs can engage in expedited review of requests related to COVID research. Researchers can implement open science principles from the formulation of hypotheses, to rapid data sharing, to the uploading of manuscripts to preprint servers.

Beyond legal, ethical, and regulatory issues, it is useful to remember that the pandemic is also a test of citizenship.^[24] Humanity’s overarching objective is to eliminate the further spread of COVID-19 and to provide clinical care to those who have the disease. This can only be done with a firmly rooted sense of justice and of equity. Indeed, the world depends on the scientific community to generate the necessary generalizable knowledge to guide the appropriate clinical, epidemiological, and political responses to the pandemic. It is already widely acknowledged that the post COVID-19 world will not be the same as that which came before. During this time, we should therefore consciously be planning through enhanced collaborative effort to take the best of the lessons learnt and to develop new approaches to secure a better future once the pandemic is over.

Contributors