Accessing person-level data in health care: debating the key issues

In 2010 the Nuffield Trust invited Dr Sarah Clark and Professor Albert Weale from University College London to look at the current regulations relating to the use of NHS data by researchers and analysts and to reflect on the social values such regulations invoke. 

Their full report, together with a summary from the Nuffield Trust that explores the issues, can be downloaded from the publications area of our website.

One of the elements of Clark and Weale’s report that I found particularly striking was their argument from public benefit.  As they explain, regulations for NHS data are usually interpreted as requiring  researchers  either to ‘consent or anonymise’, that is, to either obtain explicit consent from data subjects for the use of data about them, or anonymise any data they use so that the individuals can never be identified. 

However, their report argues that existing data governance laws and regulations could be interpreted differently: namely, they put data guardians under a duty to weigh up values such as privacy and consent, against the value research is expected to generate for the public. 

In their report, Sarah Clark and Albert Weale emphasise that this alternative interpretation of the data governance regulations is 'poorly articulated' in law at the moment. 

They argue that we need ‘more clarity about what constitutes a public benefit’, and, ‘some form of argument by which the obligations arising from rights and the benefits of public action can be brought into balance’. 

Yet, provided these conditions can be met, they argue that such an interpretation could allow for a more nuanced approach to data governance, in particular by facilitating the use of pseudonymous data – something that researchers at the Nuffield Trust would be keen to promote.

There seems a lot that is right about Clark and Weale’s argument. Certainly, researchers often complain that the ‘consent or anonymise’ approach is too blunt to deal with the complexities of data linkage and modern data analyses. 

However, playing devil’s advocate, I think there are some elements of the public benefit approach which one could question.  In particular, one could ask whether the public benefit approach necessarily captures the special status of the data subject when it comes to using data about them.

To explain: I think one of the reasons why we ask for a data subject’s consent before we use data about them is because we recognise that it is the data subject who bears the risk of such data being lost, stolen, or used in another inappropriate way. 

So, we give the data subject a special say in whether data is used because we recognise that if anything goes wrong, they are the person who pays the price (even if, in almost all cases, it is a very small price to pay).

Now, I agree with Clark and Weale that, insofar as the ‘consent or anonymise’ approach gives data subjects the ultimate say over whether data about them, it goes too far.  However, one could still worry that the public benefit approach doesn’t seem to recognise the ‘special status’ of the data subject at all. 

Under the public benefit model, the person who decides whether or not to use a person's data is not the person who bears the risk of any misuse of that data, but an independent third party. In this model, the third party simply speculates what the opinion of the data subject would be; they are not required to consult the data subject themselves.

In light of this concern, I wonder whether what is needed is a hybrid model of data governance, one in which data subjects are given some sort of say in how data about them is used but not, perhaps, the ultimate say. 

One way to achieve this would be to give a representative sample of data subjects a vote when deciding whether or not research is justified.  A vote, that is, not a veto. This would mean the views of data subjects were respected but not to a fault.

Can you see any other problems with a public benefit approach to information governance? Join the debate by commenting below.

Read Dr Sarah Clark’s response to Benedict’s blog: Accessing health care data: the importance of collective reasoning.