DATA DONATION FAQ

Why Portable Legal Consent Matters

1. Why should I care?
2. Why should I participate?
3. How can I impact scientific discovery? 

About This Project

4. Where did Portable Legal Consent come from?
5. Why is it called Portable Legal Consent?
6. What is Common Genomics Research?
7. What is the potential benefit to science of Common Genomics Research?
8. Who is running it?
9. Who is funding it?
10. What is it creating?
11. Who can use it?
12. How does it work?
13. Who owns all this data?
14. What about copyrights and patents?
15. Are you going to release tools for other kinds of research, such as social science?
16. What are the terms and conditions of Common Genomics Research?
17. What’s the difference between public genomic research and common genomic research?
18. How are Sage Bionetworks and Portable Legal Consent related?

Informed consent, privacy and risks

19. What is informed consent?
20. What does de-identified mean?
21. I’m worried about my privacy. Should I get involved?
22. What are the risks?
23. How can I provide comment on the consent forms?

Getting involved

24. How do I use Portable Legal Consent?
25. When will Portable Legal Consent be ready?
26. Why isn’t Portable Legal Consent ready now?
27. Can I get my data out of another study with PLC?
28. I’ve changed my mind. How do I withdraw my data?
29. I’m a data provider. How can I integrate my users’ data into PLC?
30. I’m a researcher. How can I gain access to the data available under PLC?
31. I’m looking to recruit people into clinical studies. Can I contact people who have consented under PLC?

Why Should I Care?

Systematic clinical studies are the way we make progress in medicine. Despite all the new technologies which allow us to learn about biology and diseases through animals, cell lines, or molecular experiments, at some point a new treatment has to be tested in humans for the first time. This is inherently risky, and there’s no way around the fact that somebody (or really somebodies) has to go first. Informed consent documents were developed to make sure participants understood both the potential risks and benefits before entering a clinical trial. Mostly this has covered what the particular medical benefits and risks were of a particular new therapy for a particular disease, and this aspect of informed consent continues to provide valuable protection to patients.

This system has worked well for decades, but it is now becoming apparent that another aspect of informed consent is preventing scientific progress from occurring as well as it could. The problem is that people running clinical trials have tended to create informed consent documents that narrowly defined the types of research that could be done on the data, and the researchers who could do it.

This narrow focus was originally done to protect patient privacy, and didn’t hamper the people running the clinical trial because they mostly care about one thing: can those particular researchers or company prove the treatment works better than the existing standard of care. In fact, it actually benefited the companies and scientists running the trial because it gave them exclusive access to data that could give them an advantage over their academic and industrial competitors. However, given the wealth of clinical and genetic information now collected in a clinical trial it is becoming apparent that there are a variety of secondary uses of clinical trial data that could greatly enhance the rate of scientific progress in a variety of ways not foreseen by the original study developers. The same is true with epidemiological and/or observational studies.

A good example a study being reused is the Framingham Heart Study, from which more than 1000 papers have come – including new research on how patterns of cardiovascular illness are correlated through social networks, something that was far from the minds of the study’s designers in 1949.  Although Framingham is a different kind of study (longitudinal and observational) it serves as a reminder that many of the benefits that might emerge from research are hard to imagine at the time data is collected, and that we might benefit as a society from making data available for unanticipated research.

Currently, the terms of most existing informed consents greatly limit the ability of the study authors to share data with colleagues, even when they want to, as it’s not usually possible to go back and ask patients about a new use for their data after the study has completed. We believe that in many cases this situation is not in the patient’s interest. What is in the patient’s best interest is for their data to be exposed to as many researchers as possible, as this minimizes the amount of time and money needed for medical break-throughs to occur.

Portable Legal Consent is being developed as a tool to allow patients to tell the doctors, researchers, and companies that are experimenting on them, that they, the patients, have rights with respect to the data generated from their bodies. PLC states that what the patient desires is for the data to be shared broadly in the public domain, to serve scientific progress as a whole, regardless of the particular individual or institution that makes the breakthrough.

PLC is completely voluntary. It’s for people who want to be the somebody who goes first.

Right now, most people don’t have “computable” data about themselves. So if you don’t already have your genotype sequenced, or an electronic version of your medical records, this project can still accept your data, but it’s not as likely to be used in computational research. You can either commission the creation of this kind of data (such as from a genomics provider like 23andme), or you can join in the growing movement for democratization of data by asking for it from your medical providers.

2. Why should I participate?

(adapted from the Personal Genome Project)

Scientific research is an ongoing source of hope for individuals and families affected by illness. The promise of improved diagnoses, therapies, and prevention strategies has motivated many individuals to get more directly involved in the promotion of scientific research on conditions affecting themselves and their family members. Disease advocates have made significant contributions to medical advancement and human welfare.

A motivating force behind the creation of Portable Legal Consent is to provide individuals with a mechanism to share their personal medical information with the scientific research community for purposes that promote human welfare through the advancement of scientific and medical discovery.

The information in our medical records, our DNA, our physical traits, and our environmental exposures has the potential to provide insights that can change our ability to manage and prevent debilitating diseases. Whether one is healthy or dealing with illness, everyone possesses information that may ultimately contribute toward improving the health of others and future generations.

3. How can I impact scientific discovery? (adapted from the Personal Genome Project)

The answers to many fundamental questions about our basic biology, our experiences as individuals, and our history as a species will likely be illuminated by scientists once they have access to large datasets that contain many human genomes tied to other forms of personal information, such as medical history or physical traits. Thus far, only a handful of individuals in the world have been extensively sequenced and studied by the research community. Portable Legal Consent aims to change this by giving individuals an opportunity to share their genome sequences alongside other personal information with researchers to advance scientific discovery.

4. Where did Portable Legal Consent come from?

Portable legal Consent (PLC) emerged from the 2011 Sage Bionetworks Commons Congress, where Group D focused on the need for standardized approaches to privacy and patient empowerment. It became clear that two approaches were needed: one to populate the Synapse platform with patient data that could be used to perform computational research with as few barriers as possible, and one to empower patients to take control of their own data. The first approach became PLC, while the second approach is still forming around the “THAT’S MY DATA” campaign.

The legal inspirations for PLC are the informed consent process developed by the Personal Genome Project (from which we draw both ideas, and even some text in our own consent document at times). PLC also draws on the idea of “human readable” interfaces to complex legal documents that Creative Commons made famous.

Portable Legal Consent embeds the idea that we should disclose risks about research inside the idea that data should be something that can be remixed, to allow unexpected discoveries to emerge from the combination of earlier studies by later scientists. If a person completes the Portable Legal Consent process, she will have an informed consent that travels with her from one upload of data into an environment that allows many studies – that is portable from a research perspective, and that she controls. Portable consent means that the data she chooses to upload into a Common Genomics Repository will be able to support a broad range of genomic and health research without the unintended fragmentation of data created by traditional consent systems.

6. What is Common Genomics Research?

Common Genomics Research is based on the broader idea of the commons – a resource that is jointly held, that no single entity can control. It is built on top of standardized legal forms that guarantee access to data, but also impose some restrictions. Creative Commons famously coined the phrase “some rights reserved” to describe their copyright commons, and we have adopted a similar approach here. In CGR, you grant researchers the right to use your data, but you reserve the right to stay de-identified, and you require them to agree to be bound by contract share the research results that they publish back through our Open Access requirement.

7. What is the potential benefit to science of Common Genomics Research?

In the short term, the most likely benefit will be a greater ability to understand how specific changes from one genotype to the next affect health outcomes – so that we understand why one person responds well to a drug, but another does not. In the long term, we want to make data available to researchers so that they can study and explore new areas – even if they don’t have a lot of money or research grants.”.”. Indeed, we want anyone who can analyze big data to become a genomic explorer irrespective of whether they have lots of money/funding or not. The biggest impacts of that change are by definition hard to describe right now, just as it was hard at the dawn of the internet to imagine the modern web, or at the dawn of the web to imagine the smartphone revolution.

8. Who is running it?

PLC is led by John Wilbanks, a member of the Sage Bionetworks Board of Directors, formerly of Creative Commons, an organization specialized in the development of standardized legal and technical systems that facilitate voluntary sharing. Technical implementation of the project is by Fabricatorz and 5AM Solutions. Pro bono legal assistance is provided by Dan Vorhaus at Robinson Bradshaw & Hinson (though this does not construe an endorsement of the project by RBH). Significant input is provided by staff at Sage Bionetworks, the Ewing Marion Kauffman Foundation, and Lybba.

9. Who is funding it?

Funding for Portable Legal Consent, a project of the Consent to Research initiative is provided by Inspire2Live, Sage Bionetworks, the Ewing Marion Kauffman Foundation, and Lybba.

10. What is it creating?

Consent to Research is creating standardized informed consent agreements. They’re completely voluntary, they’re technically enabled, and they’re designed from the ground up to connect research, not fragment it. They build a commons of data for research, a commons that is user-generated and directly available to researchers who agree to a certain set of norms: to play fair and to publish openly. They are not intended to displace traditional informed consent, but to complement it.

The technology we’re creating is simple: a way to upload data about yourself. We’re starting with your genome and your health record / history, but we’ll be expanding the kinds of data you can upload as the project grows. At launch we’ll support data from the larger Direct to Consumer genome providers, including 23andMe, and health records and self-observations that are available under the Blue Button format. We expect to add support for many devices from the Quantified Self community that people use to record data about themselves, as well as support for smartphone applications that can provide additional rich context to genomic and health information.

11. Who can use it?

There are two kinds of users. First, as an individual, you can use PLC to get consented and start uploading data about yourself.

Second, we are designing PLC to be implemented by a significant number of “Common Genomics Research” groups. These will include disease advocacy foundations, biomedical research foundations, and even companies – anyone who wants to be a place where people come together to make data available for research under common terms.

12. How does it work?

There are three core pieces of the puzzle. There is the consent process itself, which is comprised of a user “wizard” and the consent agreement. There is the user database, which contains information about you that is held by the Common Genomics Research Environment (CGRE) that hosts the instance of Portable Legal Consent. Then there is the de-identified database in which your health, genome, and other data is held, which can be collected by researchers who have obtained the necessary permissions and promised to abide by the terms and conditions of Common Genomics Research. Sage Bionetworks is the first “Common Genomics Research Environment” and will be the first place to store PLC-CGR data, and Synapse will be the first place where researchers can access and use PLC-CGR data.

13. Who owns all this data?

This is a tough question. It’s hard to “own” data the way that you own a house, or even an apple. Property laws that govern other kinds of digital, distributable content, such as copyright and patent, don’t fit very well to your genomic data and health data. Your data are much more like trade secrets than they are like “own able” property – once they become generally available, they stop looking like traditional property.

Thus, if you decide to share your data, you will lose a significant amount of control. You’ll stop “owning” it in the traditional sense, and start providing rights to use it.  However, these rules have a flip side, which is that we can tell you that no one else will “own” your data either. All the data collected under the PLC project will be commonly held, which means that no single entity will be able to control it. Your data won’t be locked up by corporations, researchers, or anyone else with a competitive reason not to share it, because their competition will always be able to come back to the PLC network and get their own free copy -and so can you.

14. What about copyrights and patents?

Copyrights govern “creative works” – they don’t typically apply to facts of nature or raw data like those you can upload into PLC systems. But it’s emerging that some creative works, like photographs of the food on a plate, are transformable into data, and that the line between creative works and data is blurring. To ensure freedom to operate in a copyright sense, you’ll be required to provide either a Creative Commons Zero or Attribution 3.0 unported license to any files you load into the system (some files, like genotypes and health records, will default to Zero, and others, like .jpg image files, will default to Attribution). The Consent to Research project will license all its own original content under one of these two licenses, and all software we create will be available under the Creative Commons Zero license as well. We are not filing any patents on our own work. But patents on the use of the data we collect may apply, and patents may emerge on discoveries based on the data available under PLC.

15. Are you going to release tools for other kinds of research, such as social science?

Possibly. We have received interest from social science and social media groups to provide a similar service in those fields. But right now we’re working on health and disease in genomics. If you’re interested in helping us move out into other spaces, contact us.

16. What are the terms and conditions of Common Genomics Research?

Our goal is to set a minimum standard for terms and conditions, and to make the barrier to reuse as low as possible. Anyone that wants to collect data and distribute it for research will have to agree to require at least three things from the researchers who would ask for it: first, they will not attempt to re-identify you. Second, they will not redistribute the data to anyone who hasn’t signed the same terms and conditions. Third, they will make the results of their research publicly available by publishing their work as Open Access scholarship (as defined by the Budapest Open Access Initiative) and publishing all software and data needed to reproduce their results, as laid out in the Reproducible Research Standard.

17. What’s the difference between public genomic research and common genomic research?

Common genomic research is governed by a set of rules, which are in turn implemented by a legal document (terms of use) and some basic technical requirements. For example, our implementation of CGR uses its terms of use to impose a requirement that researchers do not attempt to re-identify individuals who sign up and provide data. Public Genomic Research has no rules or restrictions on the reuse of data by researchers, terms of use, or other systematic conditions.

Portable Legal Consent emerged from Working Group D at the 2011 Sage Bionetworks Congress, which examined legal and regulatory issues related to the creation of a Commons of genomic data. John Wilbanks serves on the Board of Directors at Sage Bionetworks and was a co-chair of Working Group D. Sage Bionetworks will be the first CGRE to collect and redistribute data collected under PLC and serves as a constant source of conversation, refinement, ethical advice, and inspiration. Sage Bionetworks and Inspire2Live together provide significant funds for PLC.

At its most basic level, informed consent is a legal agreement that a patient signs, giving permission for a medical study or procedure. But it is far more than a signature on a piece of paper. It’s a recognition that a patient has learned the risks and benefits of a study or a procedure, and that the patient is authorizing it in full understanding of those risks and benefits. Informed consent has been traditionally the result of a doctor-patient conversation – but as patients gain the power to create their own data, that system is failing to keep up. PLC is a new type of informed consent, but is not intended to replace the old system – simply to take a place alongside traditional consents so that patients who already have their data, and who understand the risks, can choose to upload it for sharing and research.

20. What does de-identified mean?

De-identification is based on the idea that your data can have its identifying elements removed – either by stripping out information that identifies you, like your name, or by using statistical methods that make it hard to know that your data is tied to you. Your data that can be distributed under PLC will be de-identified data – no direct identifiers will be made available to the researchers, although it is possible that someone might attempt to figure them out based on the information that is made available, or that a CGRE database (which will contain direct identifiers) might be compromised and connected to your de-identified data.

21. I’m worried about my privacy. Should I get involved?

Probably not. This is a totally voluntary system, and is one that explores the boundaries of modern genomic data sharing. Although PLC based systems will implement commons-based conditions, it is plausible to imagine that those conditions can be evaded by people with malicious intent, such as crackers, or by simple accident, such as the leaving of a laptop on a bus or airplane seatback. You should both understand the risks and also believe that the potential benefit to science is worth it.

22. What are the risks?

The best place to learn about the risks is inside the consent process and forms themselves. And the Personal Genome Project perhaps summarizes the risks most succinctly: in principle, someone could use information from your health and genomic backgrounds to infer paternity or other features of your family history, make claims that could affect your employment, insurance, or other financial services, incriminate relatives, make and place synthetic DNA as evidence, or reveal propensity for a disease that has no treatment. In context however, the dropping cost of genome sequencing and the wide availability of your health records to those who are already in position to perform these actions must be considered. The cost of genotyping is already under $100 for variation analysis, and thousands of people already have access to your health records – they just can’t perform research on them or use them in discovery. These risks are real, but the Consent to Research project exists specifically to allow patients who wish to share data a mechanism to balance those risks against the potential scientific innovation that shared data can enable.

23. How can I provide comments on the consent forms?

We are engaged in private review of the forms during the alpha testing phase. We will open up the forms in March 2012 for broader view at http://weconsent.us/consentform. If you’d like to be alerted when that period begins, email us at admin@weconsent.us.

24. How do I use Portable Legal Consent?

If you’re an individual and want to make your data available, you can explore the consent process, learn about the risks and benefits, and if you wish, become part of the PLC group. You’ll run through the consent process and then be presented with the opportunity to upload your data. You can currently access PLC via Sage Bionetworks, PatientsLikeMe, Mount Sinai Hospital, the Genetic Alliance, and the Pachyconychia Congenita Project.

If you’re interested in knowing when the Portable Legal Consent system is ready for prime time, sign up for the Consent-to-Research  mailing list.  We’ll never sell your information to anyone, or hit you with lots of mail.

If you’re interested in becoming a Common Genomics Research Entity and running an instance of PLC, please get in touch with us and we’ll help you get set up.

25. When will Portable Legal Consent be ready?

Alpha testing is complete and we are submitting the project for IRB approval in March 2012. We expect the system to be fully functional in April 2012.

26. Why isn’t Portable Legal Consent ready now?

Informed consent isn’t something that we want to rush into. We are working with a group that includes bioethics experts, privacy advocates, attorneys, Institutional Review Boards, top biological modelers, and more to make sure that what we release is something that is ethically sound, scientifically useful, and legally open. We won’t declare the system fully operational until we have approval from at least one Institutional Review Board to use the data collected under PLC.

27. Can I get my data out of another study with PLC?

Not currently. The study that you are already enrolled in is subject to its own protocols and PLC does not apply.

28. I’ve changed my mind. How do I withdraw my data?

Contact us at withdraw@weconsent.us and we will take your data down within a month from the CGRE database. However, the digital nature of data, and the fact that de-identified versions of your data will be archived in systems that make backups to allow scientific investigation of models and disease, means that it is unlikely that all copies of your data will be found and deleted. Please proceed carefully with this knowledge.

29. I am part of an organization that would like to help collect data – to be a “Common Genomics Research Entity.” How can I get PLC up and running?

It depends on how aggressive you are as an organization. If you want to be an early adopter, contact us and we’ll see if it’s a good fit, both for you and for us. We’re looking for savvy organizations with institutional review board experience to be our early adopters. If you want to use PLC once it’s fully launched, sign up for notification.

On a technical level, we’re designing PLC to be as easy as possible to use, in as many different forms as possible. You’ll be able to download a disk image of PLC, configure it, and run it yourself if you want. You’ll also be able to act as a recruiter, which means running advertising flyers for patients and potentially the consent process embedded on your website, with Sage Bionetworks providing back-end hosting of the databases. We want to eventually see hundreds of Common Genomics Research Entities collecting data.

30. I’m a researcher. How can I gain access to the data available under PLC?

The first place you’ll be able to work with the data is inside Sage Bionetworks, via the Synapse platform. This is because Sage Bionetworks will be the first entity to receive approval from its own Institutional Review Board to collect and redistribute the data under PLC. Data redistributed inside Synapse will be processed and cleaned, with full provenance and workflow preserved, and with access back to the raw data as well. If you would like to collect the raw data directly from the various Common Genomics Research entities, you will need to obtain permission from your own Institutional Review Board to build a freestanding copy of the database in your own manner – not because we want control, but because of the realities of privacy law and regulation. Once you have obtained IRB approval to build a database, contact us and we’ll provide access to the federated network for you.

31. I’m looking to recruit people into clinical studies. Can I contact people who have consented under PLC?

It depends on that person’s choice inside the system. The technical architecture supports re-contact – email addresses are captured by Common Genomics Research Entities as part of the consent process – but it’s up to each person to decide if they want to allow re-contact. If they decide to allow, the technology will allow you to send a message to the CGRE, who can in turn forward it to the individual, who again can decide if they want to respond. As with all our tools, the choice and the control rest with the users.