Overly strict interpretation of the law is hampering epidemiological research. Here, one research team shows why regulators and organisations holding data should adjust their approach The United Kingdom's Data Protection Act 1998 has had a substantial impact on health research, although that was not its primary purpose. It is a wide ranging piece of legislation that safeguards individuals' fundamental right to privacy when personal data are processed.1 The act supplements the common law of confidentiality developed through judicial decisions. The medical and academic community is concerned that current interpretation of the law is changing the face of medical research.2 We use our experiences in studying UK military personnel to present empirical data in support of a more balanced interpretation of the act. Data Protection Act and the law of confidentiality Although some medical researchers blame the law for increasing the bureaucratic barriers to research,3 others, including the Information Commissioner and the Lord Chancellor, dispute this.4 The Lord Chancellor stated in the House of Lords: At present the 1998 Act allows medical data to be used for any medical research purpose without the need for consent of individuals. It is not necessary to define the term "medical research" nor to make specific provision for it to include the monitoring of public health, which for these purposes is regarded as medical research.4 Current difficulties seem to stem from interpretations of the law that fail to appreciate the methods of epidemiology and the relatively minor privacy interferences that most epidemiological research entails. Currently most codes of conduct recommend informed consent for any medical research, whether it involves direct contact with participants or access to their records. But as a matter of law, this is not an absolute rule. Both the law of confidentiality and the Data Protection Act envisage circumstances in which personal health information may …

Response rates (%) for military studies by method of contact, reasons for non-response, and rate of complaints
Attrition of Gulf war cohort over time

Figures - uploaded by Matthew Hotopf

Author content

All figure content in this area was uploaded by Matthew Hotopf

Content may be subject to copyright.

ResearchGate Logo

Discover the world's research

  • 20+ million members
  • 135+ million publications
  • 700k+ research projects

Join for free

Analysis and comment

Epidemiology

Consent, confidentiality, and the Data Protection Act

Amy Iversen, Kathleen Liddell, Nicola Fear, Matthew Hotopf, Simon Wessely

Overly strict interpretation of the law is hampering epidemiolog ical research. Here, one research

team shows why regulators and organisations holding data should adjust their approach

The United Kingdom's Data Protection Act 1998 has

had a substantial impact on health research, although

that was not its primary purpose. It is a wide ranging

piece of legislation that safeguards individuals'

fundamental right to privacy when personal data are

processed.

1

The act supplements the common law of

confidentiality developed through judicial decisions.

The medical and academic community is concerned

that current interpretation of the law is changing the

face of medical research.

2

We use our experiences in

studying UK military personnel to present empirical

data in support of a more balanced interpretation of

the act.

Data Protection Act and the law of

confidentiality

Although some medical researchers blame the law for

increasing the bureaucratic barriers to research,

3

others, including the Information Commissioner and

the Lord Chancellor, dispute this.

4

The Lord Chancel-

lor stated in the House of Lords:

At present the 1998 Act allows medical data to be used for

any medical research purpose without the need for consent

of individuals. It is not necessary to define the term "medical

research" nor to make specific provision for it to include the

monitoring of public health, which for these purposes is

regarded as medical research.

4

Current difficulties seem to stem from interpreta-

tions of the law that fail to appreciate the methods of

epidemiology and the relatively minor privacy inter-

ferences that most epidemiological research entails.

Currently most codes of conduct recommend

informed consent for any medical research, whether it

involves direct contact with participants or access to

their records. But as a matter of law, this is not an abso-

lute rule. Both the law of confidentiality and the Data

Protection Act envisage circumstances in which

personal health information may be accessed and used

for medical research without explicit consent or full

anonymisation. Since the Human Rights Act 1998

became law, privacy interferences of this kind are per-

missible if the research investigates an important ques-

tion, the research is in the public interest, is of a public

nature (a term undefined in the Data Protection Act),

and the degree of interference is proportionate to this

goal (and no more than necessary).

Although the courts have not given an authorita-

tive statement related to medical research, previous

judgments suggest they would interpret current law as

supporting large epidemiolog ical studies that require

record linkage, access to cancer registries, or data on

names and addresses in order to identify potential par-

ticipants (who would then be contacted in order to

obtain informed consent for participation).

5–7

Confusion also arises about the Data Protection

Act's requirement that individuals be given informa-

tion about the purposes of the proposed data process-

ing.

1

This is different from consent

—

it is the "fair

processing requirement" based on a principle of "no

surprises." Even here the law is not as absolute as many

believe. An epidemiologist who proposes to process

personal data obtained from someone other than the

patient must take proportionate steps to contact the

patient as soon as practical to inform them of the

processing. Disproportionately burdensome steps

need not be taken, and the researcher is not obliged to

wait for a response from the individual. Furthermore,

when the research is historical or statistical, the fair

processing requirement is relaxed, provided that the

data are not used to take any decision relevant to that

particular individual, that subsequent publication does

not lead to identification of the subject, and that it is

unlikely to cause substantial damage or distress.

1

Statistics: missing in action

TOY/REX

King's Centre for

Militar y Health

Research, King's

College London,

Institute of

Psychiatry, London

Amy Iversen

clinical lecturer

Matthew Hotopf

professor of general

hospital psychiatry

Simon Wessely

professor of

epidemiological and

liaison psychiatry

Faculty of Law,

University of

Cambridge and

Cambridge

Genetics

Knowledge Park,

Cambridge

Kathleen Liddell

lecturer in law

Academic Centre

for Defence Mental

Health, King's

College London

Nicola Fear

senior lecturer

Correspondence to:

A Iversen,

Department of

Psychological

Medicine, Weston

Education Centre,

London SE5 9RJ

A.Iversen@

iop.kcl.ac.uk

BMJ 2006;332:165–9

165 BMJ VOLUME 332 21 JANUARY 2006 bmj.com

Since 2001, a further system has been in place in

England (but not Scotland) whereby researchers can

apply for permission to process health data without

consent. The Patient Information Advisory Group

advises the secretary of state for health whether a

breach of confidentiality should be permitted for a

necessary and proportionate interference. This is

referred to as section 60 exemption.

8

In theory, therefore, several avenues permit the

proper use of personal information without always

seeking informed consent. Despite this, many of those

who control access to healthcare data are not allowing

these legitimate and sensible exceptions to be put into

practice. As an example, we describe the difficulties

encountered by our research group.

The problem

Since 1995, our team has conducted several large epi-

demiological studies of military and former military

personnel in the United Kingdom.

9–11

Our original

study, examining the health effects of service in the

1991 Gulf war, included 8195 participants.

9

In this

study, and in a subsequent larger study of personnel

who participated in the 2003 Iraq war, we made initial

contact using details provided by the Ministry of

Defence (without their consent). The ministry released

the data after taking into account the public health

importance of the study and legal advice on the

obligations of the previous Data Protection Act.

To compare the outcomes of those serving in the

1991 Gulf war with general military health we also

collected data on the health of UK military personnel

who served in UN peacekeeping operations in Bosnia

in 1992-6.

12

After we started these studies, concerns

were voiced in the media and the veterans' community

about possible cancer risks among Bosnia veterans,

fuelled in part by speculation regarding depleted

uranium exposure. As we had already been able to link

records on Gulf war veterans with cancer registrations

without explicit consent,

13

we assumed that we would

also be able to flag our Bosnia cohort with the NHS

Central Register (which holds details of all cancer and

death registrations in England and Wales).

However, when we attempted this in 2004 we were

told that we needed section 60 exemption from the

Office of National Statistics advisory group for medical

research. After about eight months' delay we were told

that participant consent was required in order for this

sample to be flagged. Although the Office for National

Statistics could give us details of those who had died

and provide information to allow us to trace those who

were alive to ask for consent, they were unable to grant

us access to information on cancer diagnosis without

consent.

The requirement to seek consent will introduce

participation bias as seeking consent will inevitably

reduce the response rate and those most likely to

respond are likely to be those for whom the study has

greatest salience

—

that is, those who have developed

cancer.

As a result, the study is likely to become too small

and biased to reach useful conclusions. We believe that

the Office of National Statistics has not to date taken

sufficient account of the exceptions permissible in law

outlined above. We argue that the disclosure that we

are requesting is indeed proportionate, and unlikely to

cause distress, and that the information cannot be

obtained by any other means. Discussion with ONS is

ongoing, but until now we had no empirical data to

support or refute our position. Other researchers face

similar predicaments. We therefore examined our pre-

vious data for evidence, which we present below.

Table 1 Response rates (%) for military studies by method of contact, reasons for non-response, and rate of complaints

Method of contact

Response rate

(%) Refusal (%)

Wrong address or

number (%)

Person not available

(%)

Reason unknown

(%) Complaints (%)

Face to face contact researcher

MCTC* (n=135) 134 (99.3) 1 (0.7) NA NA NA 0 (0)

Telic† (n=6258) 3088 (49.3) 26 (0.4) NA 3144 (50.2) NA 1 (0.02)

Telephone contact by researcher‡

Gulf 1

9

(n=200) 139 (69.5) 22 (11) 11 (5.5) NA 28 (14.0) 2 (1)

Veterans

17

(n=496) 315 (63.5) 56 (11.3) 125 (25.2) NA NA 2 (0.4)

Telic† (n=675) 61 (9.0) 34 (5.0) 514 (76.1) 66 ( 9.8) NA 1 (0.1)

Postal questionnaire sent by researcher

Gulf 1 (1st wave)

(n=11 710)

9

4511 (38.5) 7 (0.06) 418 (3.6) NA 6774 (57.8) 2 (0.02)

Gulf 1 (2nd wave)

(n=7192)

9

1684 (23.4) 163 (2.3) 401 (5.6) NA 4194 (68.7) 0 (0)

Gulf 1 (3rd wave)

(n=5345)

9

1308 (24.5) 315 (5.9) 393 (7.4) NA 3329 (62.3) 0 (0)

Telic† (n=15 895) 5526 (34.8) 21 (0.1) 880 (5.5) NA 9468 (59.6) 4 (0.03)

Contact by government departments

Veterans

17

§ (n=65) 8 (12.3) NA 10 (15.4) NA 47 (72.3) NA

Administrative

discharges*¶ (n=6)

0 NA 5 (83.3) 1 (16.7) NA NA

*Study of post discharge mentoring of vulnerable service leavers, the Military Correction and Training Centre Colchester and those who had received an

administrative discharge (in progress).

†Study of the physical and psychological health of those who deployed on Operation Telic (in progress). The study involves postal questionnaires being sent to

participants and base visits where participants are invited to fill in their questionnaires with researchers to hand for advice.

‡Studies (or parts of studies) where initial contact from the research team is established on the telephone. For the Gulf 1 study and the Telic study, this was

attempted telephone contact with people who had not returned the postal questionnaire. For the veterans' study, it was telephone contact with individuals who had

taken part in a previous study and had consented to follow-up. The low response rate in the Telic study reflects the fact that tracing is ongoing.

§The Department of Work and Pensions offered to contact by letter (on our behalf) those whose contact details we were unable to trace.

The Ministry of Defence offered to contact service leavers on our behalf. They were able to reach only one individual who had been given an administrative

discharge, and he was unavailable at the time of the call. This methodology was subsequently abandoned.

Analysis and comment

166 BMJ VOLUME 332 21 JANUARY 2006 bmj.com

Response rates vary by method of contact

Epidemiological research requires representative sam-

ples and high response rates. Response rates matter for

two reasons. Firstly, if the sample size is reduced, the

study loses statistical power and, therefore, may not be

able to identify (and quantify) any true effects.

Secondly, a low response rate means that participation

bias is almost inevitable. Epidemiologists therefore

spend a large proportion of their time selecting an

appropriate sample and then contacting and tracing

them to get acceptable response rates.

14 15

One way of

avoiding disclosing personal information to research-

ers is to use proxies to contact subjects on behalf of the

research team. The cur rent data controller

—

for exam-

ple, the individual's general practitioner or employer

—

contacts the potential subject and invites him or her to

contact the researcher.

Our experience is that using proxies to obtain con-

sent is unsatisfactory. In the first place it is difficult to

secure the necessary commitment from proxies

because of the resource implications. More impor-

tantly, our data show a hierarchy of success for various

methods of contacting people (table 1). Potential

participants have greater trust in the researchers, espe-

cially when they meet them face to face, than they have

in their employers.

In our studies, we obtained the highest response

rate from face-to-face interviews conducted by civilian

researchers within a military prison. The interviews

were entirely voluntary, and all participants were given

an information sheet and completed a consent form.

The participants in this study ought to be the sample

hardest to recruit, being largely young men with high

rates of substance misuse and antisocial behaviours.

This suggests that participants' willingness to consent is

influenced by who does the asking.

Table 1 also supports the view that few people

complain about being contacted by a researcher. Taken

together, these data support the argument that it is

both necessary and proportionate to grant researchers

access to personal data to enable them to contact

people for consent and that the use of proxies is not a

satisfactory alternative.

Tr ue refusal rates are generally low

One objection to a more liberal interpretation of the

Data Protection Act is that low response rates in epide-

miological studies reflect an informed decision not to

take part. If this is so, these preferences should be

respected. But is it? In our experience, low response

rates do not stem from people objecting to the

research topic or protocol (table 1). Instead non-

response is often due to more mundane problems of

tracing (when contact details are out of date) or

people's failure to complete the questionnaire (apathy).

This is evidence that the privacy interference arising

from epidemiological research without consent is not

as serious as sometimes presumed.

Non-response is not necessarily due to

distress

Because we have been better resourced and more per-

sistent than is possible for some follow up studies, we

have been able to look at reasons for non-response in

some detail at each wave of data collection and after

different methods of tracing or outreach. We have con-

sistently found, as others have,

16

that non-response is

related to demographic factors, and that non-

responders are more likely to be young, unmarried

men.

91117

We have not found that lack of response is

related to health factors, such as greater emotional dis-

tress from the study; in fact, we have repor ted the

opposite.

18

Non-response is therefore more likely to be

due to factors such as time constraints (for long postal

questionnaires) or lack of interest than to distress. This

again speaks to the proportionality of some privacy

interferences

—

that is, research where it is reasonable to

think that a poor response rate is due to apathy rather

than principled objection.

Problem of natural attr ition

At the point of recruitment to a cohort study, it is not

always possible to gain consent for what will later turn

out to be important research questions. It is never pos-

sible to predict all relevant exposures that might

happen during active service

—

information about some

environmental exposures may not appear until many

years later. In our example, concern about possible

health effects of depleted uranium used in former

Yugoslavia and the Gulf war took some years to

develop, by which time most of those potentially

exposed had left the military. They could not be easily

contacted by either their former employers or the

research team since last known addresses are valid for

only a brief period in most service leavers.

Currently, for studies of such late occurring effects

data controllers and regulators prefer that the cohort is

re-contacted. But how possible or proportionate is

this? Table 2 shows the natural attrition over time for

our Gulf cohor t, whom we contacted in 1997,

9

2001,

11

and 2003,

17

and concur rent decline in the representa-

tiveness of the cohort. This bias is important because

restricting the analysis to those whom we can trace

increases the possibility of missing an important health

effect.

14

The legal implication is that, in longitudinal

cohorts of this kind, it is sometimes necessary to

proceed without specific consent. There is also a case

for arguing that it would be proportionate to do so as

explained below.

Research participants trust

epidemiologists, once engaged

Regulators seem to presume that participants distrust

epidemiologists. Hence they take the view that it is a

serious breach of an individual's autonomy and privacy

to proceed without specific consent for subsequent

research. Our data do not support this conclusion.

When we eventually manage to contact individuals for

follow-up studies, few refuse access to further data such

Table 2 Attrition of Gulf war cohort over time

Year of study

Response rate for study

(%)

% Of original sample

available

1997

9

65.1 65.1

2001

11

71.6 46.6

2003

17

63.5 29.6

Analysis and comment

167 BMJ VOLUME 332 21 JANUARY 2006 bmj.com

as medical or vaccine records (table 3). Our data

suggest that study participants, once engaged, continue

to trust medical researchers with personal health

data.

19

From this, it is reasonable to conclude that if we

were able to locate the missing members of the cohort,

they would be likely to have similar views on

permitting access to information. Thus, allowing the

research to proceed without follow-up consent (that is,

allowing it to proceed on the basis of the initial

consent) would not be a disproportionate interference

in privacy.

Risks of par ticipation are negligible

Governing bodies often presume that information

based research requires the same review procedures

and strict principles about consent as interventional

research. Little regard is given to the different sorts of

risks entailed. Informational privacy is important, but it

is not nearly as fundamental as the right not to be

physically assaulted against your will by a medical

researcher, which is the issue potentially at stake with

an intervention study. The proportionality principle is

misapplied if the risks associated with epidemiological

research are equated with interventional research.

Existing research about research participants' atti-

tudes tend to support the view that the risks of epide-

miological surveys, even when direct contact is made,

are low.

20

In our studies few people complain about

taking part, as shown in table 1, and the objective rate

of side effects or adverse consequences is extremely

low. To our knowledge, our studies have caused

distress on just two occasions in the past 10 years, and

we have contacted more than 25 000 people in that

time. On both occasions we inadvertently wrote to the

family of a serviceman who had just died. This was

regrettable, but none of the proposed alternatives

(such as requiring a proxy to make contact on our

behalf) would have avoided this. We have reduced this

risk by improving the way in which our data are kept

contemporaneous. More cumbersome methods of

contact will increase (not decrease) this problem, by

building in a time lag. Many of the study participants

we directly contacted indicate that they appreciate the

time we spend with them and our ability to point them

towards services where relevant.

These data should encourage a less rigid policy

towards data sharing in epidemiological research. Epi-

demiological research is usually a positive or at wor st

neutral experience for participants, and deviations

from the consent rule should more often be perceived

as proportionate.

Conclusions

The current confused, and confusing, legal position is

acting as a barrier to important medical research.

Nothing proposed in this article is against either the

spirit or the letter of the legal framework. The law has

foreseen the importance of data sharing, the

difficulties with anonymising data fully, and the ethical

reasons for balancing the right to pr ivac y against other

rights and interests. But those who implement the law

have not always grasped this. Accordingly, they fail to

recognise situations where it is necessary and

proportionate to relax consent requirements in epide-

miological research.

We are not arguing that epidemiological research

should always proceed without consent. But it should

be allowed to do so when the privacy interference is

proportionate. Regulators and researchers need to

improve their ability to recognise these situations. Our

data indicate a propensity to over-predict participants'

distress and under-predict the problems of using prox-

ies in place of researchers. Rectifying these points

would be a big step in the right direction.

Contributors and sources: SW is a member of the working party

of the Academy of Medical Sciences on the Use of Patient Data

in Medical Research, has a longstanding interest in this subject,

and conceived the idea for the study. AI extracted the relevant

data from previous studies, did the analysis with assistance from

NF, and co-authored the paper with SW. KL provided legal

advice. MH and SW led the original research team and coordi-

nated the series of studies described, and both commented fur-

ther on the paper. MH dealt with AGMR/ONS.

Competing interests: None declared.

1 Data Protection Act 1998. Section 33(2). www.uk-legislation.hmso.gov.uk/

acts/acts1998/19980029.htm (accessed 15 Sep 2005).

2 Coleman MP, Evans BG, Barrett G. Confidentiality and the public inter-

est in medical research

—

will we ever get it right? Clin Med 2003;3:219-28.

3 Strobl J, Cave E, Walley T. Data protection legislation: interpretation and

barriers to research. BMJ 2000;321:890-2.

Table 3 Numbers (percentages) of participants consenting to

release of additional information

Study

Medical

records (%)

Vaccination

records (%) Next of kin

Gulf 1

9

(n=8195) 7785 (95.0) NA NA

Telic*(n=7535) 7160 (95.0) 7258 (96.3) 6248 (82.9)

MCTC† (n=135) 135 (100) NA 125 (93)‡

Screening study§

(n=2925)

2182 (74.6) NA NA

*Study of the physical and psychological health of those who deployed on

Operation Telic (in progress).

†Study of post discharge mentoring of vulnerable service leavers, the Military

Correction and Training Centre Colchester. We sought consent for results of

educational tests taken during their prison stay rather than for medical records.

‡Those who did not provide data often did not consider themselves to have a

next of kin or could not remember their full address.

§Screening of active service personnel for mental health problems: 18.5% of

the sample refused and 6.8% did not fill in this part of the consent form.

Summary points

The UK Data Protection Act (1998) is changing

the way that medical research is conducted

The law allows personal information to be used

and disclosed without explicit consent, subject to

certain safeguards, when it is impractical to obtain

consent and an important public interest is at

stake

Despite this, some data controllers continue to

interpret the law in a restrictive way

The main barriers to epidemiological research

are that people cannot be contacted or are

approached by proxies who know little about the

study

Adverse events or detriment from participation in

this type of research are extremely rare

Analysis and comment

168 BMJ VOLUME 332 21 JANUARY 2006 bmj.com

4 Falconer C. House of Lords Hansard 2000 Nov 14. www.parliament.the-

stationery-office.co.uk/pa/ld199900/ldhansrd/vo001114/text/01114-

35.htm (accessed 15 Sep 2005).

5 Campbell v Mirror Group Newspapers Ltd [2004] 2 AC 457 (HL).

6 R v Chief Constable of South Yorkshire ex parte S and Marper [2004] 4

All ER 193 (HL).

7 R v Department of Health Ex p Source Informatics Ltd [2001] QB 424

(CA).

8 Health and Social Care Act 2001. London: Stationery Office, 2001.

www.uk-legislation.hmso.gov.uk/acts/acts2001/20010015.htm (accessed

3 Jan 2006).

9 Unwin C, Blatchley N, Coker W, Ferry S, Hotopf M, Hull L, et al. The

health of United Kingdom Servicemen who served in the Persian Gulf

war. Lancet 1999;353:169-78.

10 Ismail K, Kent K, Brugha T, Hotopf M, Hull L, Seed P, et al. The mental

health of UK Gulf war veterans: phase 2 of a two phase cohort study. BMJ

2002;325:576-81.

11 Hotopf M, David AS, Hull L, Nikolaou V, Unwin C, Wessely S. Gulf war

illness

—

better, worse, or just the same? BMJ 2003;327:1370-2.

12 Hotopf M, David AS, Hull L, Ismail K, Palmer I, Unwin C, et al. The health

effects of peace-keeping in the UK ar med forces: Bosnia 1992-1996. Pre-

dictors of psychological symptoms. Psychol Med 2003;33:155-62.

13 Macfarlane GJ, Biggs AM, Maconochie N, Hotopf M, Doyle P, Lunt M.

Incidence of cancer among UK Gulf war veterans: cohort study. BMJ

2003;327:1373.

14 Jousilahti P, Salomaa V, Kuulasmaa K, Niemela M, Vartiainen E. Total and

cause specific mortality among participants and non-participants of

population based health surveys: a comprehensive follow up of 54 372

Finnish men and women. J Epidemiol Community Health 2005;59:310-5.

15 Prince M, Stewart R, Ford T, Hotopf M. Practical psychiatric epidemiology .

Oxford: Oxford University Press, 2003.

16 Eaker S, Bergstron R, Bergstrom A, Adami H, Nyren O. Response rate to

mailed epidemiologic questionnaires: a population-based randomized

trial of variations in design and mailing routines. Am J Epidemiol

1998;147:74-82.

17 Iversen A, Dyson C, Smith N, Greenberg N. Goodbye and good luck; the

mental health needs and treatment experiences of UK veterans. Br J Psych

2005;186:480-7.

18 Wood AM, White IR, Hotopf M. Using number of failed contact attempts

to adjust for non-ignorable non-response. J R Stat Soc (in press).

19 Muir-Gray JA. Post modern medicine. Lancet 1999;354:1550-3.

20 Tyrer P, Seivewright H, Ferguson B, Johnson T. "Cold calling" in psychiat-

ric follow up studies: is it justified? J Med Ethics 2003;29:238-42.

(Accepted 23 November 2005)

Commentary: Evidence will help achieve consensus

Peter Goldblatt

Iversen and colleagues identify the problems that UK

researchers have in gaining access to confidential

patient information without consent.

1

The issues that

arise are both legal and ethical. These are summarised

in Confidentiality: NHS Code of Practice.

2

This document

identifies four main areas of law that constrain or regu-

late the use and disclosure of personal health informa-

tion: common law of confidentiality, the Data

Protection Act 1998, the Human Rights Act 1998, and

administrative law. At present, disclosure of identifiable

information without consent is permitted for medical

purposes other than direct healthcare (research and

epidemiology) if the use is supported by section 60 of

the Heath and Social Care Act 2001. This provision is

a temporary measure until anonymisation or consent

can be put in place. Support is provided only on the

advice of the statutory Patient Information Advisory

Group.

The impression given by Iversen and colleagues

that few epidemiological studies have been given

section 60 support is potentially misleading. The

Patient Information Advisory Group has approved

more than 100 applications for support, including

class support for the activities of all cancer and

congenital anomaly registers and the use of the NHS

Central Register for medical research studies. Under

the class action covering the NHS Central Register,

over 250 studies have support. The real issue, then,

lies in the stringency of the criteria for support. Specifi-

cally, the requirements to show conclusively that it is

impractical to obtain consent and that a high

non-response rate will reduce the scientific validity of a

study.

What is disproportionate effort?

Little consensus exists on these issues. On the one

hand, the decisions of those responsible for controlling

access to sensitive information and protecting privacy

seem to suggest that the effort required to obtain con-

sent has to be overwhelming before they are inclined to

accept that a researcher need not seek consent on the

grounds of "disproportionate effort." When there is

evidence of non-response, researchers also have a

strong requirement to show that this does not reflect

tacit withdrawal of consent.

On the other hand, many researchers argue that if

levels of non-response are high, studies based only on

those who consent will suffer from serious response

bias among those population subgroups known to be

difficult to contact. Furthermore, the need to obtain

sufficient respondents to achieve adequate statistical

power substantially increases the funding required for

record based research to levels for which there is

currently no provision.

It is therefore important to have evidence on what

constitutes "disproportionate effort" in such studies

and the extent to which non-response might or might

not mask refusal to consent. Iversen and colleagues

provide valuable information on these factors from an

important study population. Fur ther evidence from

other studies would undoubtedly help to take the

debate forward, establishing those circumstances in

which the effort and impact of seeking consent under-

mines the public interest in quantifying suspected

health risks to some, or all, of the population.

Competing interests: None declared.

1 Iversen A, Liddell K, Fear N, Hotopf M, Wessely S. Consent, confidential-

ity, and the Data Protection Act. BMJ 2006;332:165-9.

2 Department of Health. Confidentiality: NHS Code of Practice. London: DoH,

2003.

Endpiece

Not lucrative

Medicine is not a lucrative profession. It is a divine

one.

John Coatley Lettsom (1744-1815). Oxford

Dictionary of Medical Quotations.

Oxford: Oxford University Press, 2004

Submitted by Lyndon Mason, senior house officer,

Wales

Analysis and comment

Office for National

Statistics, London

SW1V 2QQ

Peter Goldblatt

chief medical

statistician

Peter.Goldblatt@

ons.gsi.gov.uk

169 BMJ VOLUME 332 21 JANUARY 2006 bmj.com

... 44 As a result, new dynamic socio-technological relations have evolved that pull in state, commercial actors, and citizenry into a new paradigm that seeks to sustain the social solidarity benefits of insurance while also respecting civil liberties and rights. [45][46][47][48] With these novel information flows come a new set of risks that require new agreements between stakeholders to provide balance. 14 This can only be achieved and managed by interrogating new governance regimes 49,50 informed by the risks. ...

... The Geneva Papers on Risk and Insurance-Issues and Practice, 37(1), pp. [27][28][29][30][31][32][33][34][35][36][37][38][39][40][41][42][43][44][45][46]. In the Irish Republic, the Minister of State in the Department of Finance with special responsibility for financial services, credit unions, and insurance has promised to tackle this practice stating "Insurance companies have a duty to treat their customers fairly and honestly (See https://www.independent.ie/business/ ...

  • Martin Mullins Martin Mullins
  • Christopher P. Holland
  • Martin Cunneen

The European Union (EU) has a strong reputation and track record for the development of guidelines for the ethical use of artificial intelligence (AI) generally. In this paper, we discuss the development of an AI and ethical framework by the European Insurance and Occupational Pensions Authority (EIOPA), for the European insurance market. EIOPA's earlier report on big data analytics (EIOPA, 2019) provided a foundation to analyze the complex range of issues associated with AI being deployed in insurance, such as behavioral insurance, parametric products, novel pricing and risk assessment algorithms, e-service, and claims management. The paper presents an overview of AI in insurance applications throughout the insurance value chain. A general discussion of ethics, AI, and insurance is provided, and a new hierarchical model is presented that describes insurance as a complex system that can be analyzed by taking a layered, multi-level approach that maps ethical issues directly to specific level(s).

... Such rich sources of information can be used for a range of purposes that are rarely envisaged by tweeters. Even the use of health data for which there may be a clear public health benefit is controversial (Iversen et al. 2006;Vayena et al. 2015). As Iversen et al. (2006) point out, using personal information without explicit consent is legally permitted in the U.K. provided certain safeguards are in place; however data controllers may not interpret the law in this way and impose additional access restrictions. ...

... Even the use of health data for which there may be a clear public health benefit is controversial (Iversen et al. 2006;Vayena et al. 2015). As Iversen et al. (2006) point out, using personal information without explicit consent is legally permitted in the U.K. provided certain safeguards are in place; however data controllers may not interpret the law in this way and impose additional access restrictions. ...

The proliferation of digital data and internet-based research technologies is transforming the research landscape, and researchers and research ethics communities are struggling to respond to the ethical issues being raised. This paper discusses the findings from a collaborative project that explored emerging ethical issues associated with the expanding use of digital data for research. The project involved consulting with researchers from a broad range of disciplinary fields. These discussions identified five key sets of issues and informed the development of guidelines orientated to meet the needs of researchers and ethics committee members. We argue that establishing common approaches to assessing ethical risks of research involving digital data will promote consistency in the ethical standards for research, enable the smooth functioning of ethics committees, and sustain public confidence in research. We conclude with recommendations for the development of educational resources for ethics committees, data management guidelines and further public education.

... An evaluation of the July 7, 2005, London bombings program suggested that people contacted through the MPS witness list as opposed to via other means were least likely to respond to a questionnaire and least likely to report being aware of the screening program, despite having previously received two letters about it (Brewin, Fuchkan, & Huntley, 2009). Contact of potential participants via government departments has also previously been shown to lead to a poor response rate in other contexts (Iversen, Liddell, Fear, Hotopf, & Wessely, 2006). The requirement that people be contacted through the MPS may therefore have contributed to poor response rates in this instance. ...

... The requirement that people be contacted through the MPS may therefore have contributed to poor response rates in this instance. Data protection issues are a commonly cited difficulty in both epidemiological studies (Iversen et al., 2006) and in the coordination of emergency responses (H.M. Government, 2007). Additional work to develop a standard operating procedure to facilitate data sharing for future screen-and-treat programs may be worthwhile. ...

... While this study is focused on examining access to administrative health data in Canada, it has relevance beyond the Canadian context. The use of administrative health data for generating evidence to inform decisionmaking at various levels of health systems is becoming more widespread, however, researchers in many jurisdictions outside Canada struggle with issues related to data access [61][62][63][64]. The findings of this study may help support efforts to improve data access in these jurisdictions, particularly in those employing a similar governance framework to that in Canada (i.e. an institution-based research ethics model intersecting with information legislation regulating the access, use, and disclosure of personal health information for research purposes). ...

Introduction: In Canada, most provinces have established administrative health data repositories to facilitate access to these data for research. Anecdotally, researchers have described delays and substantial inter-provincial variations in the timeliness of data access approvals and receipt of data. Currently, the reasons for these delays and variations in timeliness are not well understood. This paper provides a study protocol for (1) identifying the factors affecting access to administrative health data for research within select Canadian provinces, and (2) comparing factors across provinces to assess whether and how they contribute to inter-provincial variations in access to administrative health data for research. Methods: A qualitative, multiple-case study research design will be used. Three cases will be included, representing three different provinces. For each case, data will be collected from documents and interviews. Specifically, interviews will be carried out with (1) research stakeholders, and (2) regulatory stakeholders (10 individuals/group * 2 groups/province * 3 provinces = 60). During within-case analysis, interview data for each stakeholder group will be analyzed separately using constant comparative analysis. Document analysis will occur iteratively, and will inform interview guide adaptation, and supplement interview data. Cross-case analysis will involve systematic comparison of findings across cases. Discussion: This study represents the first in-depth examination of access to administrative health data in Canada. The main outcome will be an overarching mid-range theory explaining inter-provincial variations in access to administrative health data in Canada. This theory will be strengthened by the inclusion of the perspectives of both researchers and those involved in the regulation of data access. The findings from this study may be used to improve equitable and timely access to administrative health data across provinces, and may be transferable to other jurisdictions where barriers to access to administrative health data have been reported.

... Behavioural analytics and image processing alongside protocols around sentiment analysis and event detection have transformed relations between citizens and corporate entities as well as state bodies (Godard, Godard, Schmidtke, Cassiman, & Aymé, 2003). As a result, new dynamic socio-technological relations have evolved that pull in state, commercial actors and citizenry into a new paradigm that seeks to sustain the social solidarity benefits of insurance whilst also respecting civil liberties and rights (Hayden, 2012;Iversen, Liddell, Fear, Hotopf, & Wessely, 2006;Regidor, 2004;Tassé, Budin-Ljøsne, Knoppers, & Harris, 2010). With these novel information flows come new set of risks which require new agreements between stakeholders to provide balance (Cunneen, Mullins, & Murphy, 2019a). ...

... On the specific issue of consent, this is very much an area of open debate. We refer the reader to articles by Singleton and Wadworth (2006), Iversen et al (2006) and Haynes et al (2007) for general discussions about the issue. More recently, Cruise et al (2015) discuss consent issues related to data linkage and Hallinan and Friedewald (2015) raise the important issue of whether consent can ever truly be informed. ...

We've developed a practical guide to de-identification for government agencies and businesses including not-for-profit and private sector organisations. Our framework can help data custodians to identify and address the key factors relevant to their particular data sharing or release situation, including privacy risk analysis and control, stakeholder engagement, and impact management. De-identification is not an exact science and, even using the De-Identification Decision-Making Framework (DDF), it requires complex judgement calls. The DDF is intended to help data custodians make sound decisions based on best practice, but it is not a step-by-step algorithm. We recommend that users seek expert advice on the de-identification process, particularly with the more technical risk analysis and control activities.<br/

Background: The rising digitisation and proliferation of data sources and repositories cannot be ignored. This trend expands opportunities to integrate and share population health data. Such platforms have many benefits, including the potential to efficiently translate information arising from such data to evidence needed to address complex global health challenges. There are pockets of quality data on the continent that may benefit from greater integration. Integration of data sources is however under-explored in Africa. The aim of this article is to identify the requirements and provide practical recommendations for developing a multi-consortia public and population health data-sharing framework for Africa. Methods: We conducted a narrative review of global best practices and policies on data sharing and its optimisation. We searched eight databases for publications and undertook an iterative snowballing search of articles cited in the identified publications. The Leximancer software © enabled content analysis and selection of a sample of the most relevant articles for detailed review. Themes were developed through immersion in the extracts of selected articles using inductive thematic analysis. We also performed interviews with public and population health stakeholders in Africa to gather their experiences, perceptions, and expectations of data sharing. Results: Our findings described global stakeholder experiences on research data sharing. We identified some challenges and measures to harness available resources and incentivise data sharing. We further highlight progress made by the different groups in Africa and identified the infrastructural requirements and considerations when implementing data sharing platforms. Furthermore, the review suggests key reforms required, particularly in the areas of consenting, privacy protection, data ownership, governance, and data access. Conclusions: The findings underscore the critical role of inclusion, social justice, public good, data security, accountability, legislation, reciprocity, and mutual respect in developing a responsive, ethical, durable, and integrated research data sharing ecosystem.

  • Luca Cardillo
  • Fidelma Cahill
  • Harriet Wylie
  • Mieke Van Hemelrijck Mieke Van Hemelrijck

Background observational research is increasingly important in clinical decision-making. Opt-out consent has been proposed as a more practical way to obtain participants' consent for such research. The authors evaluated patients' views on opt-out consent for observational research by identifying perceived benefits and barriers. Methods following a systematic literature review of research on participants' perspectives on opt-out consent, a focus group interview was conducted with oncological patients and their family members. Results the review identified 13 articles detailing perspectives on opt-out consent. Perceived advantages included benefitting medicine and future generations. These findings were confirmed in the focus group. The main reported barriers to opt-out consent are concerns regarding privacy and the sharing of data with third parties. Participants also demonstrated concerns on insufficient education on opt-out consent. Conclusion participants demonstrated willingness to participate in observational studies utilising opt-out consent. Special focus should be placed on outlining existing safeguards in research.

  • Kirstine Kolsrud
  • Linn-Merethe Rød
  • Katrine U. Segadal

This chapter describes the increased interest and usage of auxiliary data in a multinational survey context, viewed from a data protection perspective. It explores issues relating to confidentiality and consent when combining survey and auxiliary data in light of ethical guidelines, current legislation and practice, and anticipated new research conditions in Europe and the United States. The need for a harmonized legal framework in Europe is one of the reasons the European Commission in January 2012 proposed a comprehensive reform of the current data protection rules. One of the aims of the new European General Data Protection Regulation (GDPR) is to build trust by assuring a high level of privacy protection. One of the essential elements of a harmonized legislation on privacy protection is a uniform understanding of the term personal data. Restricting the data may result in loss of analytical power, depending on the type and magnitude of the restrictions.

  • Evangelia Papadaki

The overall objective of this thesis is to identify the gaps in the current EU legal framework surrounding the security obligations of data controllers and make recommendations to help advance the discussions around the possible ways of effectively addressing the problem of cyber insecurity. The thesis adopts an interdisciplinary approach to data security, which involves legal analysis enriched with considerations from the fields of Computer Science and Managerial Economics. In response to the rapidly changing landscape of emerging technologies, which challenges the conventional thinking of regulators, the thesis calls for a shift in the data security regulation paradigm. The contribution of the thesis to knowledge in this field lies in reframing the elements that need to be incorporated into the laws regulating the security obligations of data controllers. The thesis proposes a holistic, dynamic, hybrid and layered approach to data security, which systematically tailors the security obligations of data controllers to the level of re-identification risk involved in data processing operations, and suggests security measures depending on the security level required while laying down the security objectives to be achieved. The proposed regulatory model can serve as guidance for regulators on the law-making process concerning the security obligations of data controllers. The proposed model aspires to provide adequate clarity to data controllers in terms of the initial phase of the design of security measures, while abstaining from imposing technology specific security requirements in order to grant flexibility to data controllers to adapt the security mechanisms to their particular business model and the given data environment.

To examine the prevalence of psychiatric disorders in veterans of the Gulf war with or without unexplained physical disability (a proxy measure of ill health) and in similarly disabled veterans who had not been deployed to the Gulf war (non-Gulf veterans). Two phase cohort study. Current and ex-service UK military personnel. Phase 1 consisted of three randomly selected samples of Gulf veterans, veterans of the 1992-7 Bosnia peacekeeping mission, and UK military personnel not deployed to the Gulf war (Era veterans) who had completed a postal health questionnaire. Phase 2 consisted of randomly selected subsamples from phase 1 of Gulf veterans who reported physical disability (n=111) or who did not report disability (n=98) and of Bosnia (n=54) and Era (n=79) veterans who reported physical disability. Psychiatric disorders assessed by the schedule for clinical assessment in neuropsychiatry and classified by the Diagnostic and Statistical Manual of Mental Disorders, fourth edition. Only 24% (n=27) of the disabled Gulf veterans had a formal psychiatric disorder (depression, anxiety, or alcohol related disorder). The prevalence of psychiatric disorders in non-disabled Gulf veterans was 12%. Disability and psychiatric disorders were weakly associated in the Gulf group when confounding was adjusted for (adjusted odds ratio 2.4, 99% confidence interval 0.8 to 7.2, P=0.04). The prevalence of psychiatric disorders was similar in disabled non-Gulf veterans and disabled Gulf veterans ( 19% v 24%; 1.3, 0.5 to 3.4). All groups had rates for post-traumatic stress disorder of between 1% and 3%. Most disabled Gulf veterans do not have a formal psychiatric disorder. Post-traumatic stress disorder is not higher in Gulf veterans than in other veterans. Psychiatric disorders do not fully explain self reported ill health in Gulf veterans; alternative explanations for persistent ill health in Gulf veterans are needed.

Developments over the last decade in legislation and professional guidance on confidentiality and medical research in the UK are reviewed. Despite the General Medical Council's guidance, and recent changes to the common law on confidentiality in England and Wales, confusion remains about what is lawful and professionally acceptable in the handling of identifiable data. The GMC has contributed to this confusion. Professional bodies should jointly produce new guidance. The Health and Social Care Act 2001 is a temporary legislative solution. Public consensus is required on an acceptable balance between the citizen's right to privacy and the responsibility of society--to which all citizens belong--to protect the public health. The Government should survey public opinion, inform NHS patients better, initiate wide public debate, and legislate to protect both citizens' rights and medical research that is demonstrably in the public interest. Registration of cancer and communicable diseases should become statutory.

  • Peter Tyrer Peter Tyrer
  • Helen Seivewright
  • B Ferguson
  • T Johnson

The ethics of cold calling-visiting subjects at home without prior appointment agreed-in follow up research studies has received little attention although it is perceived to be quite common. We examined the ethical implications of cold calling in a study of subjects with defined neurotic disorders followed up 12 years after initial assessment carried out to determine outcome in terms of symptoms, social functioning, and contact with health services. The patients concerned were asked at original assessment if they would agree to be followed up subsequently and although they agreed no time limit was put on this. To decide if cold calling was ethically justifiable and, if so, to set guidelines for researchers. The study was a cohort study of patients with neurotic disorder treated initially for 10 weeks in a randomised controlled trial. At follow up by a research medical practitioner 18 of the 210 patients had died and of the remaining 192 patients 186 (97%) were seen or had a telephone interview. Four patients refused and two others did not have interviews but agreed to some data being obtained. However, only 104 patients (54%) responded to letters inviting them to make an appointment or to refuse contact and the remainder were followed up by cold calling, with most patients agreeing readily to the research interview. The findings illustrate the dilemma of the need to get the maximum possible data from such studies to achieve scientific validity (and thereby justify the ethics of the study) and the protection of subjects' privacy and autonomy. More attention needs to be paid to consent procedures if cold calling is to be defended on ethical grounds but it is unreasonable to expect this to be obtained at the beginning of a research study in a way that satisfies the requirements for informed consent. A suggested way forward is to obtain written consent for the research at the time that cold calling takes place before beginning the research.

  • K. Ismail

Objectives To examine the prevalence of psychiatric disorders in veterans of the Gulf war with or without unexplained physical disability (a proxy measure of ill health) and in similarly disabled veterans who had not been deployed to the Gulf war (non›Gulf veterans). Design Two phase cohort study. Setting Current and ex›service UK military personnel. Participants Phase 1 consisted of three randomly selected samples of Gulf veterans, veterans of the 1992›7 Bosnia peacekeeping mission, and UK military personnel not deployed to the Gulf war (Era veterans) who had completed a postal health questionnaire. Phase 2 consisted of randomly selected

  • S Eaker
  • R Bergström
  • Anna Bergström
  • O Nyrén

Although self-administered questionnaires are major sources of information in epidemiology, comparatively little has been done to study practical aspects of design and mailing. The objective of this study was to evaluate various measures taken to increase the response rate. A questionnaire was mailed in July 1995 to a random sample (n = 2,000) of the Swedish population aged 20-79 years. Using a randomized factorial study design, the questionnaire and mailing procedures were changed in three ways: preliminary notification, length of the questionnaire, and mention of telephone contact. The overall questionnaire retrieval rate was 49%. Preliminary notification (adjusted odds ratio of receiving a completed questionnaire = 1.30, 95% confidence interval (CI) 1.08-1.56 relative to the absence of preliminary notification) and short length of the questionnaire (odds ratio = 1.24, 95% CI 1.04-1.48 relative to a long questionnaire) were both independently associated with a higher retrieval rate. Of eight possible combinations, the one comprising preliminary notification, a short questionnaire, and no mention of telephone contact gave the highest retrieval rate, 56%. The lowest retrieval rate, 40%, was observed for the combination of no preliminary notification, a long questionnaire, and mention of telephone contact. Young age, male sex, and urban residence significantly lowered the retrieval rate. Although there was a positive association between the questionnaire retrieval rate and partial nonresponse (missing answers in retrieved questionnaires), the marginal losses due to the latter did not cancel the gains by optimized mailing routines. Old age was the strongest determinant of partial nonresponse. The data provide evidence that design and mailing strategies, as well as demographic characteristics, may greatly influence the response rate of mailed epidemiologic questionnaires.

  • Catherine Unwin
  • Nick Blatchley
  • William Coker
  • Simon Wessely Simon Wessely

Various symptoms in military personnel in the Persian Gulf War 1990-91 have caused international speculation and concern. We investigated UK servicemen. We did a cross-sectional postal survey on a random sample of Gulf War veterans (Gulf War cohort, n=4248) and, stratified for age and rank, servicemen deployed to the Bosnia conflict (Bosnia cohort, n=4250) and those serving during the Gulf War but not deployed there (Era cohort, n=4246). We asked about deployment, exposures, symptoms, and illnesses. We analysed men only. Our outcome measures were physical health, functional capacity (SF-36), the general health questionnaire, the Centers for Disease Control and Prevention (CDC) multisymptom criteria for Gulf War illness, and post-traumatic stress reactions. There were 8195 (65.1%) valid responses. The Gulf War cohort reported symptoms and disorders significantly more frequently than those in the Bosnia and Era cohorts, which were similar. Perception of physical health and ability were significantly worse in the Gulf War cohort than in the other cohorts, even after adjustment for confounders. Gulf War veterans were more likely than the Bosnia cohort to have substantial fatigue (odds ratio 2.2 [95% CI 1.9-2.6]), symptoms of post-traumatic stress (2.6 [1.9-3.4]), and psychological distress (1.6 [1.4-1.8]), and were nearly twice as likely to reach the CDC case definition (2.5 [2.2-2.8]). In the Gulf War, Bosnia, and Era cohorts, respectively, 61.9%, 36.8%, and 36.4% met the CDC criteria, which fell to 25.3%, 11.8%, and 12.2% for severe symptoms. Potentially harmful exposures were reported most frequently by the Gulf War cohort. All exposures showed associations with all of the outcome measures in the three cohorts. Exposures specific to the Gulf were associated with all outcomes. Vaccination against biological warfare and multiple routine vaccinations were associated with the CDC multisymptom syndrome in the Gulf War cohort. Service in the Gulf War was associated with various health problems over and above those associated with deployment to an unfamiliar hostile environment. Since associations of ill health with adverse events and exposures were found in all cohorts, however, they may not be unique and causally implicated in Gulf-War-related illness. A specific mechanism may link vaccination against biological warfare agents and later ill health, but the risks of illness must be considered against the protection of servicemen.

Peace-keeping duties are associated with unique stresses for military personnel. There have been few reports on the effects of peace-keeping on psychological health. We used data from a cross-sectional study originally established to examine health effects of service in the Gulf War, which included a control group who had been deployed in Bosnia (N= 2049). This group was examined to establish which demographic, occupational, and deployment-related risk factors were associated with psychological distress measured on the General Health Questionnaire (GHQ-12) and stress symptoms akin to a post-traumatic stress reactions. The main risk factors for stress symptoms in the Bosnia group were--lower rank, being deployed early in the campaign, having more deployment-related exposures, and serving on staff duties. There was no protective effect of previous deployments to the Falklands or Northern Ireland, and time off following deployment was not protective. For GHQ-12 cases, the main risk factors were: female gender, lower rank, increased deployment-related exposures and serving on staff duties. This study suggests that stress symptoms and GHQ-12 cases, are strongly predicted both by experiences during deployment and demographic factors.