Genetic Privacy and Identity in Community Settings is a transdisciplinary Center of Excellence in ELSI Research, involving faculty and students from across the Medical Center and University.
Next generation research programs, such as the President’s Precision Medicine Initiative, and indeed much genomics research require gathering data about genomic variation, phenotypes, demographics, and exposures from large numbers of people. Research using these data uncovers contributions of genomic variants to health and disease and provides a powerful lever for understanding how individuals’ life experiences affect outcomes. Discoveries can then be implemented in clinical care to improve health, as already occurs in pharmacogenomics, cancer diagnosis and therapy, and solving previously undiagnosed diseases.
Although many concerns about genomic data impede their use, the impact of worries about privacy and identity in research settings, the focus of this proposed center, looms particularly large. The increasingly blurred domains of genomics research and clinical translation mean that unease about the latter is often relevant as well. Biomedical information, and genomic data in particular, cannot be secured, even if stored using contemporary de-identification approaches. Recent re-identification attacks and widely publicized cases of identity theft and data breaches in the commercial and financial spheres as well as recent revelations of NSA surveillance have markedly increased public concerns about the security of personal information. Although measures have been put in place to protect privacy, Martin Bobrow writes, “[t]o build trust, any significant breaches of data- and material-transfer agreements [in research] should be treated seriously, with appropriate sanctions being imposed, such as prevention of future access to data sets, or forcing the withdrawal of a published paper.” People also fear that data about them will be used in ways they do not like or to harm them; e.g., to deny them and those they love access to important goods of life, such as jobs and insurance. Although examples of such misuse have been hard to come by, reflecting either their rarity or barriers to surfacing them, existing legal rules and their enforcement are not comprehensive in their coverage. Moreover, people worry that genomic data will undermine their self-understanding, for example, by identifying misattributed parentage or challenging beliefs about ancestral history. New platforms are being developed to give individuals more granular control of the use of data derived from them, which are in tension with policies that promote broad research use and data sharing. To assess and address concerns about privacy and identity, the risks—both real and perceived—and the benefits of data gathering need to be better defined to inform the public and policy more effectively.
This project focuses on the hypothesis that many policies regarding genetic privacy are overprotective, while others are underprotective, in ways that impede the optimal conduct of genomics research and its effective translation into clinical care, which reflects (a) an incomplete understanding of the influences on the actors involved in genomics research and translation and (b) too much focus on possible, rather than probable, risks. The ethics and policy communities have paid too little attention to the role of community and social influences in shaping individuals’ and groups’ attitudes toward privacy. Evidence already suggests that the likelihood that a person will be re-identified and suffer harm is quite low, often because the process of re-identifying is burdensome with low payoffs. The GetPreCiSE center will convene a diverse group of scholars with broadly interdisciplinary perspectives and community advisors who will work together to develop a more comprehensive understanding of these influences and to model actual risks to privacy and identity to inform policy making.
To ensure success in our project, the center will be guided by four interacting specific aims:
Specific Aim 1. To enhance our understanding of the impact of threats to privacy and identity in genomic data. Concerns about privacy and identity involve the 1) Individual, who has been the focus of most policy debates, as well as 2) Families, 3) Communities, and 4) various Social institutions, each facing its own distinctive calculus of risk and benefit. All of these are subject to an array of influences.
Specific Aim 2. To measure the efficacy of efforts to protect privacy and identity by 1) IRBs, 2) Institutions that collect, hold, and share genomic and phenomic data, and 3) Law, using quantitative, analytic, and legal analyses.
Specific Aim 3. To develop models to quantify the probability of genomic data re-identification and harm that take into account the set of influencing factors and efforts to protect data, as well as the costs that attacker(s) would incur to mount the attack and the potential benefits and penalties that the attacker(s) might receive with a successful attack.
Specific Aim 4. To address concerns by developing empirically-informed policy alternatives and assessing their potential acceptability to the public.
