The collection, linking and use of data in biomedical research and health care: ethical issues

Decisions and actions informed by the use of data in research and health care may have both beneficial and harmful effects on individuals or on broader groups of people including families, companies, social groups, communities or society in general.

Different people may value these potential benefits and harms very differently – what may be profoundly troubling for one person might be a matter of indifference to another.

Opportunities of data use

There is a strong public interest in the responsible use of data to support the development of knowledge and innovation through scientific research and to improve the wellbeing of all through improved health advice, treatment and care.

The opportunities offered by data use include:

• Making health services more efficient through better informed decisions about how to allocate resources.
• Improving health by building a stronger evidence base to predict, prevent and treat disease, developing new treatments and using data to personalise treatment and care.
• Generating economic growth by driving innovation in the life sciences.

Developments in data science and information technology mean that new opportunities have arisen, and will continue to arise, to extract value from data.

Risks of data use

These opportunities must be balanced against the risks of data use, which may include cyber security threats, state surveillance, discrimination, or the misuse of data leading to harm for individuals or institutions.

Potential harms may include:

• The receipt of suboptimal care through inefficient sharing of data between clinical teams.
• Personal distress through loss of privacy.
• Inhibiting potentially valuable research through loss of public trust in the medical profession.

Many of these potential harms are not recognised or sufficiently dealt with by current legal or regulatory measures.

Independent research commissioned to support this report suggests that it is likely that the consequences of data misuse are intrinsically difficult to identify and significantly under-reported.

There are also a number of obstacles to obtaining redress, including the prohibitive cost of legal action, the fact that victims may not be aware of the harm and the risk of privacy harms being compounded by publicity resulting from the case.

We conclude

• Public and private research funders and the UK Department of Health should ensure there is continued research into the potential harms arising from abuses of data, and should remain vigilant to any new harms that may emerge.
• The Independent Information Governance Oversight Panel and the Health Research Authority (HRA) should maintain maps of UK health and research data flows, and monitor and evaluate the hazards and potential benefits of new and existing policies, standards, or laws governing the use of health data.
• The UK Government should ensure that privacy breaches involving individual data are reported in a timely and appropriate fashion to the individual(s) affected.
• The UK Government should introduce robust penalties, including imprisonment, for the deliberate misuse of data, whether or not it results in demonstrable harm to individuals. [Chapter 2]