[Natalie Harrower]

Hi, I leave these with the legal/ethical group for consideration. Deadline 4pm UTC today thanks.
Ideally, consent should be sought for collecting, processing, sharing and publishing data. However, there are other legal bases for processing personal data. Some specific examples from the European General Data Protection Regulation (GDPR, 2016) are described below. Our recommendation would therefore be as follows:
1. Where possible, use data where the data subject has provided a valid consent that includes or is compatible with intended use of the data and complies with the requirements on consent in the specific country or region.”
I am not aware of any general, across-the board, context-independent justification for preferring informed consent as a preferable legal basis of data processing.
For example: in some EU countries and Switzerland, the use of COVID 19 contact tracing (voluntary) app is regulated by law, the legal basis for all uses of data (for contact tracing purposes and, in an anonymized fashion, for research) is the law. The national law specifies much more rigorous and strict criteria of data protection than terms and conditions subjected by (allegedly) “informed” consent of data use by the app users would ever achieve. The law also demands rigorous guarantees of de-anonymization, something that most users even ignore. I cannot imagine a better protection for the use of such data (both for public health purposes and for scientific purposes) through the mechanisms of using informed consent (as opposed to the law of the state) as a legal basis for processing all the data in question.
Hence, I do not support such claims by the ethics work package.
Michele Loi
Institute of Biomedical Ethics and the History of Medicine
University of Zurich
From Claire Austin
LEGAL/ETHICAL
1. The notion of broad consent may not be supported by law and may only be allowed by some research ethics policy guidelines under strict conditions. In Canada, the Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans-2, does not use the term broad consent. Rather, research ethics boards are able to relax rules for fully informed and ongoing consent under certain conditions. This is particularly important for the secondary use of research data and is critically important when establishing biobanks of human biological material and associated data.
2. Put as the first obligation that all research projects using human data must be approved by an independent research ethics board (or research ethics committee, or institutional research board) prior to the recruitment of participants and the collection of data. This is a universal requirement for all research involving humans and so should be the very first item in the list.
3. In Canada, IRB/REC are Research Ethics Boards do not only provide guidance. They have authority beyond just a review of a project. They approve, reject, require modification, and stop research projects.
4. The term ‘expedited’ is not used in Canadian research ethics policy statements because it can imply less ethically stringent REB review. Rather, in Canada we support efficient ethics review while maintaining high ethical standards. So, we do not agree with this part of the recommendation as stated. Also, we don’t see how it would be possible for a REB to both review projects expeditiously and seek public approval. In fact, REBs never seek public approval for their decisions. So, we don’t understand the second part of this recommendation.
5. Suggest also considering the OECD Recommendations on Health Data Governance. Sets out best practices related to: consent frameworks, review and approval procedures, safeguards to protect personal info, etc. https://www.oecd.org/health/health-systems/Recommendation-of-OECD-Counci…
_______
Read our statement on ‘Playing Our Part during COVID-19’
_________________
Dr. Natalie Harrower
Director, Digital Repository of Ireland
Royal Irish Academy
***@***.*** | @natalieharrower
http://www.dri.ie | @dri_ireland
RDA COVID-19 Working Group
European Commission FAIR data expert group
European Open Science Cloud (EOSC) FAIR working group
The Academy is subject to the FOI Act 2014, the Data Protection Acts 1988-2003 and 2018, GDPR (EU 2016/679) and S.I. No. 336/2011, EC Privacy & Electronic Communications Regulations. For further information see our website http://www.ria.ie/privacy-and-data-protection

Discussion