1. The Nuffield Council on Bioethics Report : The collection, linking and use of data in biomedical research and health care: ethical issues. Martin Richards Transitions in Health Care: Exploring the Impact of Emerging Technologies Conference. Oxford. June 2015

2. The Nuffield approach 10 member working party. Consultation Fact finding and evidence gathering meetings Commissioned evidence reviews – actual harms from security breaches & public and private sector in genomic research External review of report And input from NCoB Council http:/nuffieldbioethics.org/project/biological-health-data/

3. Background Generating more data about people’s health, diseases, biology, social life, from more sources including health records, clinical trials, cohort studies, monitoring devices and health apps. Advances in information technology and data sciences means its easier, cheaper and more valuable to gather, transfer, repurpose, link, store, and analyse these data. There are significant opportunities to generate new knowledge, improve medical practice and drive innovation. But potential privacy and other risks for participants.

4. Governance and security Data initiatives in a double bind : to generate use, and access to data, but also to protect data. Traditional reliance on anonymisation or consent. But data may be vulnerable to re- identification and consent cannot in itself protect privacy interests. So additional controls on data are required such as who is permitted access, for what purposes, how researchers conduct themselves. Criminal penalties for deliberate misuse of data whether or not harms are caused.

5. Moral values and interests People have privacy interests in use of their data. Also share public interests in wider use of data for public good through research, treating diseases, improving care etc. Need to reconcile the articulation of the private within the public and the public within private. So define a set of morally reasonable expectations about how the data will be used in a data initiative, giving proper attention to the morally relevant interests at stake. Considerations include i) norms of privacy and disclosure. ii) the ways in which individual freedoms are respected, eg freedom to modify these norms by consent. Iii) governance to provide assurance that expectations will be met.

6. Ethical principles for data initiatives The set of expectations about how data will be used in a data initiative should be grounded in the principle of respects for persons. The set of expectations should be determined with regard to established human rights. The set of expectations and appropriate measures and procedures for ensuring that those expectations are met, should be determined with the participation of people with morally relevant interests. A data initiative should be subject to effective systems of governance and accountability that are themselves morally justified.

7. Practical precepts for data initiatives Identify prospectively the morally relevant values and interests in any data initiative Take special care to identify those interests that may be especially at risk or that arise from diverse values Establish what existing privacy norms are engaged by the uses of data Involve a range of those with morally relevant interests in the design of data initiatives State explicitly the set of morally reasonable expectations about data use Involve those with morally relevant interests in continuing governance and reviews

8. In practice: Data use in the NHS England Health and Social Care Information Centre (HSCIC). Collects information from health and social care bodies Holds the information within a secure environment Make information available for others to turn into ‘actionable business intelligence’ Recommendations re defining reasonable expectations of data use, accounting for data use and delivering outcomes in the public interest.

9. In practice: Data use in the NHS Care.data ‘Better information means better care’ Bring together more data including extracting GP data and further hospital data Public reaction. Withdrawn and relaunch Recommend an independent group of participants to develop public statement re use of HSCIC data to complement Code of Practice on confidential information

10. In practice: NHS data in Scotland Scottish Health Information Programme (SHIP) Develop research platform to support systematic collection, governance and research use of linked EPRs. Academic collaboration began with public engagement to ascertain acceptability. Data not held centrally. Locally held datasets linked within a safe haven with privacy protection.

11. In practice: population research UK Biobank UK 10K Rare Genetic Variants in Health and Disease International Cancer Genome Consortium Open data : Personal Genome Project Participant led research: PatientsLikeMe

12. In practice : UK Biobank Consultation involving interested parties and public Ethics and Governance Framework Ethic and Governance Council Evolution of governance arrangements and stake holders Overlap between research and medical care. Feedback of results

13. The Collection, Linking and use of data in biological research and health care:ethical issues The Report, A guide to the report, Summary of the report all available to download or order from the Nuffield Council on Bioethics website : www.nuffieldbioethics.org