Global Alliance for Genomics and Health: Consent Policy
Preamble
This Policy aims to guide the sharing of genomic and health-related data in a way that supports the autonomous decision-making of data subjects while promoting the common good of international data sharing, allowing everyone to share in the benefits of scientific progress and its applications as is their right. It builds on the GA4GH Framework for Responsible Sharing of Genomic and Health-Related Data (“{DefT.Framework}”), and should be read in combination with other GA4GH Policies.

1. Context
   
   1. Background
      Informed consent is a bedrock principle underlying the ethical conduct of clinical practice and health research involving humans. Seeking data subjects’ consent to international data sharing shows respect for their ability to make their own decisions, and upholds the trust essential for the effective practice of medicine and research. Consent, in any form it takes, will only be valid if freely given by a capable data subject (or the legal representative) who has had enough time, materials, and support to make an informed decision. Data may be accessed and re-used long after consent has been given, yet it may not be possible to fully specify the scope of data sharing at the time of that consent. Also, if the consent requested is too specific, or presented too vaguely, it may be difficult to share data in a way that respects the data subject’s expectations. Like the Framework, this policy addresses both sharing of prospective (not yet collected) data, as well as retrospective (already collected) data. It promotes the sharing of data in a manner consistent with the data subjects’ consent, authorization by competent authorities, and/or lawful bases, so as to comply with applicable laws and general ethical principles.
   2. Purpose
      This policy describes how to maximize the responsible and respectful international data sharing through the design of consents for prospective data collection and through the assessment of existing consents for retrospective data sharing.
   3. Principles
      This Policy is founded on the following basic principles:
      1. Consent is an open, communicative, and continuing relationship.
      2. The processes for taking consent and any ongoing communications between researchers and data subjects should be straight-forward, easy to use, and accessible to all.
      3. The consent process should be situated within and overseen by appropriate governance mechanisms.
      4. To the extent possible, the consent process should clearly describe to data subjects any plans to share data across research groups, institutions, sectors (e.g., research, clinical, and commercial), and borders, and any associated limitations or conditions. iii. Best practices and technologies should be adopted to ensure commitments made to data subjects concerning data sharing are captured, tracked, and communicated across data sharing networks.
   4. Definitions
      The following definitions are intended to align with the Framework and other GA4GH policies. They are not intended as a substitute for definitions found in relevant laws or regulations.
      • “anonymized data” means data that are rendered anonymous in such a way that the data subject is not or is no longer identifiable.
      • “controlled access” means a data access model whereby qualified researchers apply for data access and their research plans are reviewed, often by a committee. Also known as managed or restricted access.
      • “data subject” means the individual whose data have been processed, i.e., collected, generated, held, used, or shared.
      • “pseudonymized data” means data which have been processed in such a manner (e.g. by assigning one or more random codes) that the data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the data are not attributed to an identified or identifiable natural person. Also known as coded data.
      • “registered access” means a data access model whereby qualified researchers apply for data access to one dataset or multiple datasets at once by providing details of their identity for authentication and agreeing to terms and conditions of data use during the registration process.
2. Consent Best Practices
   These Best Practices are founded on the Core Elements of the Framework and should be interpreted in a proportionate manner that acknowledges different levels of risk for different data types, data sharing contexts, and cultures.
   1. Transparency
      
      • Consent materials and discussions should clearly indicate if data may be shared, for example, outside of institutions, across borders, for long-term deposition in repositories, or for commercial purposes, where applicable.
      • It should be clear what forms data will take, the sources from which the data have been or will be derived, and with whom and for what purposes data will be shared.
      • Consent materials and discussions should make it clear that while every reasonable effort will be made to protect privacy, a risk of re-identifying individuals from their data remains, especially if the data subjects have already made their data available in other forms, such as public platforms (e.g., genealogy websites).
      • Individuals should be given the option to opt-out of data sharing plans without affecting their care or participation in research. However, if this is not possible due to the nature and goals of the activity, this should be made clear.
      • Where it may be impractical or impossible to retrieve or destroy data once shared, this should also be specified.
      • Once shared, details on how data have been shared and with whom should be made available to data subjects, as well as any general research results. This information should also be shared with the public to the greatest extent possible, in order to highlight the benefits of data sharing to advance health research.
      • Best practice guidance and available tools should be used in the development of consent materials to support data subject understanding.
   2. Accountability
      
      • The consent process, in any form it takes, should be properly documented and subject to quality control measures, addressing versioning of consent, the mapping of data subjects to respective versions, options chosen or withdrawn, and the communication tools used to ensure data are shared as agreed.
      • Data sharing plans and consent materials should be regularly reviewed, updated, and made available, according to applicable regulations and policies.
      • Easy to use and accessible procedures and instructions should be in place for researchers and data subjects to contact each other with updates, questions regarding data sharing, withdrawal, complaints, or inquiries about policies and practices relating to the sharing of genomic and health-related data.
      • Data sharing plans and consent materials should anticipate if a data subjects’ legal status might change (e.g., when a minor reaches majority or when a data subject loses capacity or passes away) to ensure the future availability of data while respecting data subjects’ choices.
      • Consent requirements should not unnecessarily exclude individuals with diminished capacity, or individuals who are deceased, from participating in data sharing as long as appropriate protections are in place (e.g., oversight, representation).
      • Consent materials and discussions should be adapted to support the appropriate involvement of individuals with diminished capacity in decision-making.
   3. Privacy, Data Protection, and Confidentiality
      
      • Consent materials and discussions should specify what categories of data will be shared (e.g., DNA analyses, health record data), the processes used to de-identify those data (e.g., rendering data pseudonymized or anonymized), and the governance and security provisions in place to protect those data (e.g., controlled access, registered access, secure computing environments).
      • If applicable, consent materials and discussions should mention if data may be shared with parties in countries where there is an increased privacy risk and provide information on any potential implications or safety measures being taken.
      • Consent materials and discussions should acknowledge that data sharing may have implications for family members.
3. Retrospective Data Sharing
   
   • Prior to retrospective data sharing or a substantial change to data sharing plans, the following review process should be conducted:
     • The existing consent materials and associated policy documents should be assessed to determine if (broader) data sharing was foreseen.
     • If (broader) data sharing was not foreseen, data subjects should where possible and practical be given an opportunity to re-consent to (broader) data sharing, or they should be notified and given an opportunity to opt-out.
     • If re-consent or notification with opt-out are not possible or practical, it may still be appropriate to share a limited, anonymized version of the data, or to seek authorization from a competent authority (e.g., consent waiver).
   • Regardless, careful consideration should be given to whether or not (broader) data sharing is justifiable based on the potential risks and benefits.
   • Data sharing consortia or repositories should provide tools and guidance to allow contributors to assess if their consent materials cover the desired level of data sharing. They should also request attestations or demonstrations from contributors that data sharing is permitted.
4. Implementation Mechanisms and Amendments
   
   • Organizations and bodies supporting this Policy should take all reasonable and appropriate measures, whether of a regulatory, contractual, administrative or other character, to give effect to this Policy and promote its implementation, monitoring, and enforcement. Procedures and policies should be transparent and accessible. Attention should be paid to the interrelation of this Policy with other GA4GH Policies (e.g., Data Privacy and Security Policy, Accountability Policy).
   • Any persons, organizations or bodies supporting this Policy may propose one or more amendments to the present Policy by communicating the amendments to the GA4GH’s Regulatory and Ethics Work Stream (REWS). The REWS shall publicly circulate such amendments for comments and possible inclusion in this Policy.
   • The REWS, in collaboration with biomedical, patient advocacy, and ethical and policy organizations and committees, will routinely review its provisions, be aware of advances in basic research and technology, and ethical and legal developments, and attempt to ensure that this Policy is fit for purpose.
5. Acknowledgements
   This Policy was developed by the Regulatory and Ethics Work Stream of the GA4GH, and is the result of the collaborative work, comments, and input of many individual and organizational contributors.

Policy Revision History
Policy Number/Version Date Effective Summary of Revisions

1. POL 002 / v 2.0 September 2019 Global revision
2. POL 002 / v. 1.0 June 2015 Original document