A project to harvest information on brain tumours from 9,000 Irish patients has been rejected over concerns about patient consent and the potential sharing of project data with “unknown international third parties”.
The Health Research Consent Declaration Committee (HRCDC) rejected a request from Genomics Medicine Ireland (GMI) and Beaumont Hospital, Dublin for a consent declaration, which is granted to researchers wishing to use human tissues and patient information where permission cannot be obtained directly.
The researchers said they would use the data to build a brain tumour information system and “interrogate biologic and genetic data across a range of tumour types”.
They had sought a consent declaration in relation to the roughly 15 per cent of the 9,000 individuals in a brain tumour tissue archive who are thought to be living. Effectively, if granted, the declaration would have allowed the patient data to be processed without obtaining consent.
However, the HRCDC found that “the involvement of a ‘for-profit’ organisation processing personal data introduces a higher risk that data subjects may have a deeper concern for their privacy rights.
“This, therefore, introduces a higher risk to the privacy rights of the data subject,” the committee continued.
The committee also considered that GMI could allow access to the database built using the patient information “to currently unknown international third parties”.
“Safeguards on such unknown transfers to third parties for unknown purposes are unclear, potentially increasing the risks to the data subjects.”
GMI, which has plans to spend up to €800 million collecting DNA data from 400,000 Irish people, is a wholly owned subsidiary of WuXi NextCode, which has its headquarters in the US and investment links to China. The US department of health and human services has previously been asked to report to congress on the collection of US citizens' DNA by WuXi NextCode and other companies.
Transparency
The HRCDC also criticised the “low level of transparency” attached to the project. Unless direct consent was obtained, “individuals would not expect their data to be used in this way; shared with GMI for genetic sequencing and subsequently shared by GMI via their duplicate database to other third parties for purposes that could include non-health research”.
The Irish State, through its Irish Strategic Infrastructure Fund (ISIF), is also an investor in GMI, putting $70 million (€62.4 million) into a $400 million funding round alongside large US private equity firms and search giant Google.
Privacy campaigners have raised concerns over the company’s business model. Commenting on the HRCDC decision, Digital Rights Ireland director Antoin O’Lachtnain said: “Patients and the public put their trust in their doctors and their hospitals to make sure that their data is dealt with in a proper and lawful way. In particular, it is critical that medics clearly inform subjects of medical research of the risks for them and their families of being involved in genetic studies.
“It’s not good enough to rely on the promise of a largely unknown startup that all the processing is lawful. The GDPR provides for fines and damages, so the doctors, the hospitals and the State are putting themselves on the line for compensation claims in the future,” he said.
Appeal
A spokesman for GMI said it intended to appeal the HRCDC decision and, as such, it could not comment on the ruling at this time.
But Prof Michael Farrell, consultant neuropathologist at Beaumont Hospital, said the system would aid diagnosis and the prediction of behaviour of brain tumours. He said research in the area would be put back by five years or more if the appeal failed.
GMI added: “We firmly believe in the value of the research proposed by Prof Farrell and its proven wide-ranging benefits.”
