Data Sharing and the Public Interest in a Digital Pandemic*
COVID-19 is our first digital pandemic. An effective response to COVID-19 is reliant on access to data that can be used to identify COVID-19 hotspots, guide national and localised responses, as well as be used in research aimed at developing COVID-19 diagnostics, therapies and vaccines. This digital pandemic has thus seen a shift in our data practices. “Open science” and the rapid data sharing of the results of clinical trials, observational studies, operational research, routine surveillance, information on the virus and its genetic sequences, as well as the monitoring of disease control programmes has been pushed to a new level. Data sharing is not only considered to be the norm, but expected during COVID-19, but this early sharing of data has been credited with the rapid development of diagnostics and vaccines and as such we have told “open science saves lives”. As a result, a key feature of the global public health response in this digital pandemic has been to lock our physical bodies down, but ensure that our digital body has been very much on the move and widely shared across borders.
This reliance on data sharing is unsurprising as COVID-19 comes at a time when there has been an increase in the datafication of health and the human body. Data and technology help us understand the virus, but are also essential to better inform our clinical, public health and wider social response to the virus. There is a clear public interest in accessing and sharing this data. Such data, given on the principle of solidarity, is often identifiable personal data and it is well acknowledged that public trust in the use of this data is a necessary prerequisite. Trust, however, is too elusive a concept to guide the use and sharing of data. Indeed, trust and solidarity without appropriate governance procedures is a potential breeding ground for exploitative data practices. A public health emergency response along with its exceptions in the protocols to speed up research, is contingent on the rapid access to and sharing of data, but the long-term sustainability of such data practices are contingent on the appropriate governance and management of this data.
The public interest includes much more than simply getting access to and sharing this data but must be balanced with other rights and interests such as the impact on local communities, privacy, autonomy, data protection and data stewardship. Considering the long-term impact that data practices during COVID-19 will have on future pandemics specifically and data use more broadly, a reflection on the governance of data during this public health emergency is essential.
Data Practices and the Public Interest in this Digital Pandemic
This pandemic has seen a limitation of many of our rights including our freedom of assembly, our freedom of movement, and our right to privacy. These limitations have been justified on the basis that they are necessary to enable us to respond to and supress COVID-19. In other words, it is in our collective interest that there are limitations on our individual rights.
This “public interest” is also framing and influencing data practices and data use. In the context of COVID-19 research, there have been calls by scientists to reduce barriers to data access for research that is in the public interest. Funders of research and many prominent journals have committed to making COVID-19 research data rapidly available to the World Health Organisation (WHO). The use and sharing of personal data in the European Union to respond to COVID-19 without the consent of the data subject is also potentially permitted on grounds of public interest under the General Data Protection Regulation (GDPR). The European Data Protection Board (EDPB) has made it clear that Article 6(1)(e) in combination with Article 9(2)(i) can provide a legal basis for the processing of health related personal data in the public interest. However this must be subject to law and this law must provide for “for suitable and specific measures to safeguard the rights and freedoms of the data subject”. The caveat that reliance on the public interest clause to process personal data as part of a COVID-19 response must be subject to measures to safeguard a data subject’s rights and freedoms is crucial, as the use of personal data in this context can limit many of our rights provided by the GDPR.
While ending the COVID-19 pandemic is clearly in the public interest, the binary choice that is often presented as rights versus public health, presents a limited and purely biomedical view of the public interest that fails to reflect the inter-connectedness of health, economics, and democracy. Looking at data use and data practices during this pandemic, framing the debate as one of public health v privacy fails to acknowledge the public interest in continuing to safeguard our privacy.
Right to Privacy, Data Protection, and the Public Interest in a Public Health Emergency
In the context of our evolving data practices and the surge in “techno-solutionism”, the narrative on the importance of data sharing must be balanced with the reality that the use of these data driven technologies impact our right to privacy, can lead to individual and group discrimination, racism, exploitation, and systematic marginalisation of different communities. There is also the ever-present danger that the emergency situation will be exploited to get access to personal data. Governments have an interest in accessing COVID-19 related data, but this is not always for purposes that are directly linked to our COVID-19 response. There have been reports from Hong Kong that samples for COVID-19 testing are being used for forensic DNA profiling and that data collected as part of contact tracing in Singapore tracing may now be turned over to the police. Private companies also see a commercial value in accessing and exploiting this data and Israel has agreed to share disaggregated medical data with Pfizer in return for continued access to vaccines. However, using data for a purpose other than what it was collected for is not only potentially an incursion on our right to privacy, but also risks damaging public trust and support in the future use of data.
Thus, while it is in the public interest to access and share data, there is a clear public interest in doing this in a way that respects and upholds our human rights, notably our right to privacy and our right to data protection. Our fundamental rights must continue to be applied to the use of personal data during COVID-19. In the context of the use of personal data and data practices during COVID-19, it is not privacy or the public interest, but privacy and the public interest.
The importance of continuing to safeguard our individual and collective privacy during this pandemic, more accurately reflects the public interest in the preservation of privacy, even in this emergency situation. Indeed, the WHO, UN, OECD, European Data Protection Supervisor, the Council of Europe, and the ACT-Accelerator have all emphasised the importance of using personal data in accordance with the right privacy and the principles of data-protection during COVID-19. They recognise that although the right to privacy can be limited, our privacy interests must continue to be safeguarded during this pandemic. Thus, any limitation on the right to privacy and the right to data protection must be necessary to the purpose of the use of the personal data, it must be a proportionate limitation to achieve the aim, and the limitation must be time-bound and limited to the duration of the pandemic or when the purpose of the data use has been achieved, whichever is first. Importantly, if a particular aim or purpose can be achieved without limiting the right to privacy, that must be pursued. These principles on the limitation of the right to privacy and right to data protection are critical, as the second year of this pandemic brings the danger of the normalisation on the limitations of our rights and freedoms.
Data and Equity in a Public Health Emergency
As we enter this second year of this digital pandemic, it is becoming apparent that data use and data practices are perpetuating inequity between groups, both within and among nations. This global pandemic requires a global response. It requires not just the sharing of data, but the global sharing of data. As the virus evolves and new variants emerge, the sharing of data related to these new variants is essential for surveillance, but also the efficacy of tests, treatments and vaccines on these new variants must be tested and shared. Research must also done on and data collected from populations across the globe to ensure that dosage and frequency can be tailored to suit local populations. This global sharing of data, however, must be matched with global benefits. In a public health emergency, these benefits at a minimum, must be equitable access to tests, treatments and vaccines.
The call for global data sharing during COVID-19 has been justified on the basis of “solidarity”. Yet solidarity in data sharing has not been met with equitable distribution of the fruits of this data sharing. Vaccines have predominately been administered in high income countries (HICs) and the cost of some vaccines in low and middle income countries (LMICs) are double that of HICs. This inequitable distribution of the vaccines can give rise to new vaccine-evading variants and negatively impact the global economy, thus vaccine nationalism could have a global and lasting impact.
The global limitation of rights that have enabled this data sharing have not been met with a global benefit. There has been an imbalance between the erosion of individual rights in the name of public interest vis a vis results that are distributed in the name of national and private interest and economic gain. Data use and data practices during this pandemic are reinforcing the social gradient of health and global data sharing does not led to a global public interest. Rather it is to serve the interests of the global north that reinforces existing healthy inequity and power asymmetries. If there is no local, or indeed national benefit, that arises from data sharing, how can the use and sharing of data be justified on grounds of public interest?
Data Stewardship After the Public Health Emergency
Turning to a post-pandemic world, data collected during COVID-19 will be of benefit to researchers, governments, and commercial entities and it can be used to inform our pandemic preparedness and future pandemic responses. However, the public interest justifying limitations on our rights will have passed and we now need to consider the appropriate management and use of this data in the future. Previous experiences from the West Africa Ebola epidemic has demonstrated that a lack of coordination and accountability mechanisms made tracking the availability of the data and use of the data challenging. It is currently unclear whether industry will continue to support access to and sharing of the data for research if there is no clear economic return in a post-pandemic world.
To ensure the long-term sustainability and continued access to the data, there is a need for appropriate stewardship of the data. Data stewardship is an approach to management of data that ensures the “long term care” of the data. It seeks to both protect and promote the use of the data and conveys a level of responsibility in the use of this data. An important part of this data stewardship is unpacking what is meant by the appropriate use of this data. Data that was given on the basis of solidarity that it will be used in the public interest, must continue to be used in this way if we are to honour the social contract between the public and those using their data in research.
Discussions on the appropriate stewardship of this data in a post-pandemic world must start now. The publics’ expectations on the use of their data in research must be determined, and it is particularly important to involve vulnerable and marginalised groups in this discussion. The expectations from industry on data access and data sharing must be made clear, as data will have been shared with them with them on the basis that it will be used for a global benefit. The interests in accessing and using the data will have changed and the data practices must equally change to reflect this. The sustainable use of COVID-19 data will in part depend on identifying and balancing the new competing interests.
Governance of Data in a Public Health Emergency
COVID-19 will have a considerable impact on the use of data. Data practices developed during COVID-19 will inform our data practices in future public health emergencies as well as research and public health more broadly. COVID-19 has demonstrated that there is a need for policies on data use and data sharing to be adopted during health research and that these policies must be developed in advance of a public health emergency. At this stage of the pandemic, it is clear that there are at least three factors that must be considered in developing such policies.
First, there is a clear public health interest to be met in developing new diagnostics, therapies and vaccines during a public health emergency. The need for timely access to data will continue to be at the forefront of any public health response, but it is not the only interest at stake. The protection of our fundamental rights and freedoms, that includes the right to privacy and data protection, must continue to be safeguarded in the use of data during a public health emergency. Thus the discussion must be framed with a consideration of our interests in a public health emergency that extends beyond our biomedical interests and how best to address and protect them.
Second, the global need for data must be met with assurances that there will be global benefits. Data sharing policies must include clear and legally enforceable benefit sharing clauses. It is clear that would accountable governance, data practices during a pandemic will perpetuate global health inequity.
Finally, there must be consideration of how best to steward data during and after public health emergencies. A fair balance between public health and our other interests can only be ensured by sustainable data management solutions.
Access and the sharing of our digital body in a pandemic is not a binary choice between public health and privacy. Equally ensuring the appropriate governance and oversight of data is not about restricting data use or hampering our pandemic response. It is about ensuring that it is used in a manner that continues to safeguard our rights and interests and embed trustworthy data practices.
* The author is grateful for the comments of Deborah Mascalzoni and Andrea Parziale on an earlier version of this post.