OmicsXchange episode 6: regulatory/ethics perspective on COVID-19 data sharing — an interview with Johan Ordish

1 Jun 2020

We continue our series on the role of data sharing during the COVID-19 pandemic, where we speak with members of the international genomics community about new initiatives that leverage collaboration, interoperability, and open science to advance research into the novel coronavirus. This episode, we hear from Johan Ordish, active member of the GA4GH Regulatory & Ethics Work Stream, on COVID-19 data sharing from a regulatory and ethics perspective.

Angela Page: Welcome to the OmicsXchange. I’m Angela Page. This episode, we continue our series on the role of data sharing during the COVID-19 pandemic in which we speak with members of the international genomics community about new initiatives that leverage collaboration, interoperability, and open science to advance research into the novel coronavirus. Today we hear from Johan Ordish, active member of the GA4GH Regulatory and Ethics Work Stream—or REWS. He spearheaded the REWS response to the COVID-19 pandemic, which includes guidance on the legal and ethical considerations for data sharing during this time, as well as navigating the GDPR, or the European General Data Protection and Regulation, in regards to COVID-19 research. Welcome Johan.

Johan Ordish: Thanks for having me. Glad to be here.

Angela Page: What is the GA4GH Regulatory and Ethics Work Stream doing to facilitate responsible data collection and sharing right now?

Johan Ordish: The REWS team have two main kinds of response at the moment. The first is the Responsible Data Sharing to Respond to the COVID-19 Pandemic—that’s a living document, it’s updated at certain intervals to make sure it’s up to date. So that document has three main pillars and it congeals a lot of collective information around the regulatory policy, ethical policy, and then just governance and policy in general. So under that, it’s a good place to start when you’re thinking through the regulatory and the ethical and governance issues that come with COVID-19 genomic work. The other piece is called COVID-19 Research: Navigating the European General Data Protection Regulation. So that is a paper that is in preprint. And that is a bit of a longer explanation of what are the particular issues that arise with GDPR and COVID-19 research in genomics. So that will cover in more depth say if you’re processing personal data, what are your obligations, what do you have to do, but also some of the strengths and weaknesses of the different tools that are available to you.

Angela Page: So what is the goal of this living document, the first project you mentioned?

Johan Ordish: Its main goal was to signpost—to say if you’re confused about this go here, if you’re confused about that go here. So it’s certainly not legal advice. It’s a few ideas about what your main responsibilities will be, what your main obligations are, and the main tools you’ll have to address those, and then tells you, you know, if you’re in the UK, you should go to this website that has that information.

Angela Page: And is there a plan to incorporate guidance for other countries as well?

Johan Ordish: Anyone who has regulatory expertise in any other jurisdiction, absolutely please get in contact. I think for the moment we have expertise from the EU, United States and Canada.

Angela Page: To any of our listeners with regulatory expertise from other areas, if you would like to contribute to this project, please send us an email at info [at] www.ga4gh.org. So now to switch gears, could you tell us a little bit about the other paper you mentioned, COVID-19 Research: Navigating the European General Data Protection Regulation?

Johan Ordish: There are many responsibilities that come with processing personal data. So the first thing if you are processing personal data is that you’ll need a legal basis. So they’re actually enumerated in the GDPR. So there’s an article which just lists them. So you have a smorgasbord kind of like going to eat sushi, you just pick the one that comes by on the tray, you know, which suits your purposes and that you can rely on; they’re enumerated in in Article Six to the GDPR. So you just have to pick one. But of course, picking one is easier said than done. And so the document gives some ideas about what kind of legal bases would be appropriate and what works well for COVID-19 research in genomics. We note that there are some that are more flexible, some that are more  restricted. So for example, consent is absolutely central to research and for data protection purposes is one of the more difficult legal bases to rely upon. So it often leaves you vulnerable to people who donate their data, it’s difficult to a high bar to actually reach for data protection, especially in the circumstances where people have a deadly virus. It’s very difficult for them to freely consent to that kind of research. But there are other flexible ones, for instance, public interest. But public interest requires your national member state to actually have a piece of law already waiting for you there. So that’s one of the changes that we have kind of advocated for—that this  public interest legal basis is really important to facilitate research in the European Union, and also transferring that data outside the European Union to help with efforts globally. At the moment. Not all member states of the European Union actually have that law in place. Some do, some don’t.

Angela Page: That’s very interesting, so what are the different considerations about sharing data internationally, even beyond European countries?

Johan Ordish: So transferring data overseas, if it’s personal data can be a bit of a headache. And the other thing is that the GDPR doesn’t just apply in the European Union, it can apply outside it—it has what lawyers called extraterritorial effects. So even researchers in the United States, depending on what data they have, and how they process it, and where they’re located, can be caught on it. Say you want to transfer data outside the EU, and that’s personal data, you’ll need a legal mechanism. So there is one for the United States called Privacy Shield. That doesn’t help in all situations. But there are mechanisms in place to facilitate that data transfer. But what was also found, which is mentioned in the paper, is that those legal mechanisms between countries, there’s a conflict of laws so the United States does not want to be covered by the GDPR and doesn’t want to be governed. And so the legal mechanisms that would facilitate the transfer from the EU to the US, often don’t work.

Angela Page: And is your team at PHG Foundation pursuing any other activities related to COVID-19?

Johan Ordish: Yes, we’ve got a couple of activities, probably the main one—we’ve been engaged in a year-long project with the UK Information Commissioner’s Office, which is the regulator for data protection in the UK. So they commissioned us to do an independent report and a roundtable on data protection and genomic datasets. It covers a lot of the issues that the community is currently dealing with with the COVID crisis. For example, to what extent is genomic data personal data, to what extent is it governed by the GDPR, and also discussion of the legal mechanisms for international data transfer as well.

Angela Page: So in your opinion Johan, why is it so critical to be able to easily and quickly share data around the world during a pandemic?

Johan Ordish: The standard reasons for data sharing apply, they’re just heightened in this context. So in the genomics community, the research is really challenging. But in particular, you know, you need large datasets, new diverse datasets. So as a host of community members at the moment looking at things like the genetic determinants of COVID-19. So who’s going to get it? How severe is it going to be and what are their outcomes. To test that hypothesis, you’re going to need large datasets. But it’s also been noticed that minority populations have worse outcomes. If you want to test that hypothesis, you’re going to have to have a diverse dataset. Those kinds of things together with that emergency, you know, really heighten the need and speed for data sharing. And but also in the US is one of the in recent memories as you know, truly an international crisis as well. It’s across borders. No one seems to be immune, and paired with that we have countries with exactly the same motivation. We all want to solve it. We all want the vaccine, we want to understand its spread and stop its spread. So we have you know, talented  researchers across the world that need large datasets, diverse datasets, and we’re all motivated to share that data as best we can.

Angela Page: How is sharing data during a pandemic different from normal times, specifically from a regulatory and ethics perspective?

Johan Ordish: The general rule is to say that the regulation isn’t suspended, there are just certain kinds of flexibilities that are implemented., there are two main kinds of flexibility you might think of. So, the first is you might find some flexibility already present in the law. So an example of that would be the general data protection regulation. So there is some flexibility to allow sharing for important reasons for public interest, even cross border, overseas and internationally. But also, I think you’ll find that the regulatory authorities, they’re also making sure that they’ve made themselves available, flexible and contactable, to make sure that interpretation is also made flexible. With those two things together you find that things are made slightly more flexible. With ethics as well, I think the general rule is proportionality, you know, realize that there are ethical principles, and they still apply—that we need to make sure that those processes are sped up, that they’re flexible, they’re open to innovation in these kinds of circumstances.

Angela Page: And what role does the Regulatory and Ethics Work Stream play in addressing the challenges that become apparent in a time like this?

Johan Ordish: I think the first issue is just translating each other’s law, each other’s concerns each other’s principles. A large amount of the Regulatory and Ethics Work Stream is just that kind of translation project, making sure everyone’s on the same page. Once you know that, once you know where everyone stands, you can start to triangulate upon a solution. So a lot of it is just laying all the tools out on the table and everyone says, “Well, I can’t use that one. I can use this one. I can’t use that one.” We see what we have left. If there’s nothing left, or if the solutions feel more problematic rather than solutions, we advocate for change.

Angela Page: And how does this work fit into larger overarching themes of GA4GH more broadly?

Johan Ordish: The heart of GA4GH for me is accelerating innovative science through data sharing. And so a lot of the work that was done is to make sure that data sharing can occur in a responsible and lawful manner. But also to make sure the community is getting the essential data they need to carry out their fantastic research. At least I myself in my role in REWS, we’re the facilitator and kind of servant of the overarching community. Our idea is just to make sure that the data can get where it needs to go. You know, sometimes the law is in there for good reason. But sometimes, you know, law needs to be loosened or it needs to be, you know, massaged in such a way that the data can get where it needs to go.

Angela Page: So as you know, all of the work that GA4GH produces is based on The Framework for Responsible Sharing of Genomic and Health Related Data. And we always like to point out that this document centers around the human right to benefit from scientific advancement, which is a right set forward by Article 27 of the Universal Declaration of Human Rights from 1948. What does this right have to do with the current atmosphere, specifically with regards to data sharing during the COVID-19 pandemic?

Johan Ordish: There is a general right to science articulated in multiple international inventions, which I think GA4GH has hung its hat on, in particular, to say, you know, this is one of the main legal principles of human rights—principles that underpins all of our work to facilitate that data sharing. I think in this circumstance, that’s also a really powerful, ethical and legal principle to push as well. I think we just need to recognize our competing interests, you know, the right to science is important; it’s absolutely vital work. But we also need to take into account the rights of individual data subjects and people who have that right to privacy and to ensure that their medical information is kept confidential where possible.

Angela Page: Well, I think you summed that up perfectly. Thank you so much for speaking with us, Johan.

Johan Ordish: Thank you so much for having me. It’s been an absolute pleasure.

Thank you for listening to the OmicsXchange—a podcast of the Global Alliance for Genomics and Health. The OmicsXchange podcast is produced by Stephanie Li and Caity Forgey, with music created by Rishi Nag. GA4GH is the international standards org for genomics, aimed at accelerating human health through data sharing. I’m Angela Page and this is the OmicsXchange.