Data altruism and the "consent" question: a study into the "consent" models used under the GDPR and how the data altruism mechanism can act as a potential solution for the research community in the reuse of health data.

Abstract

Introduction: The General Data Protection Regulation ("GDPR") legal basis for obtaining consent for the processing of personal data for research purposes, where those purposes cannot be fully specified in advance, is provided for in Articles 6, 7 and Recital 33. However, GDPR's requirements for obtaining consent, as to the secondary use and sharing of data in research, have been argued to have generated confusion, whilst the conflicts between the Regulation itself, its practical application and research ethics are well-documented (1). The requirements for "informed consent", as defined within the GDPR, have not been well defined in the context of genome research or clinical trials (2), which has in turn led to the implementation and interpretation of the lawful basis to span into different idiosyncratic models. This naturally has fed into the uncertainty of how the legal basis can be applied in practice and calls for an investigation into the requirements for consent to be "informed" in the context of health research. This work aims to provide a scoping review and analysis of relevant publications with ultimate purpose to examine whether the concept of 'data altruism', as stipulated within Article 2 (10) of the Data Governance Act ("DGA"), addresses the gaps left behind by the application of the legal basis of 'consent', under the GDPR (Art. 6 (1) and 7), in so far as the secondary uses of data for research are concerned. In this light the article, by exploring available solutions found in relevant literature and used in practice in national and European projects, examines how 'data altruism' can add any value and work as a cohesive solution that the research community can use.

Objectives: The article, through its research, intends to answer the following questions:What gaps has the GDPR left when it comes to the interpretation and practical application of "consent" towards the secondary use of health data;Can the DGA, through the mechanism of 'data altruism', address these issues and provide a solution;What solutions have been used so far in practice to address this issue.

Methodology: To address the above-mentioned questions, the Arskey and O'Malley scoping review methodology and best practice, as outlined in the Joanna Briggs scoping review guidelines, have been applied. The research questions have been identified through an extensive literature review and consultation with subject matter experts. The search was conducted using six search engines and utilising a tailored search strategy, with the application of both MESH and non-MESH based search terms. From the identified relevant publications, 148 abstracts were kept to be read and 60 of those publications were kept as relevant. A PRISMA chart showcases the process in which the publications were reviewed and the process which led to the final papers kept as relevant. The title-abstract and full text screening and charting the data were concluded independently by two reviewers. Discrepancies were then resolved by a third reviewer. Results are summarised in both chart and narrative form below.

Results: The final 60 publications were then split into three subcategories: (i) GDPR critique (23 publications listed); (ii) iterations of consent and data altruism (21 publications listed); and (iii) proposed solutions and current practices (31 publications). Certain of the publications fell into more than one of the above subcategories, given the interdisciplinary element of the subject and theme of each paper. Throughout the research, 5 of the publications discuss the Data Governance Act and data altruism, with 4 of those providing a critique over the text used in the DGA and the concept of 'data altruism' in relation to 'consent' as defined within the GDPR and the overall legislative framework for the secondary uses of data.