Ethical data sharing in forensic research

Protecting human research participants is paramount in all scientific fields. In biomedical research, extensive policies and regulations protect the privacy of human subjects. Centralized protected databases exist for researchers to access anonymized data. These safeguards are not as extensive or regulated for academic research in the forensic sciences. Practices like those used in the biomedical field should be implemented by crime labs and police agencies to protect victim privacy.

In biomedical research, robust infrastructure protects the privacy of human research participants. Biobanks and databases steward health information including clinical, demographic, and genetic information [[1], [2], [3], [4], [5]]. Researchers may access the information via a rigorous approval process that vets both the researcher and the scientific hypotheses. Various data dissemination methods and philosophies are debated considering ethical, legal, and practical requirements [[6], [7], [8]]. Explicit legal agreements are signed, including consequences for research malpractice. In addition to the safeguards created by data stewards, individual institutions are required to provide training for researchers [9,10] as well as execute an explicit approval process for each research project whereupon the institution accepts liability (e.g. Institutional Review Boards, IRBs). Moreover, as weaknesses in this process are found, such as re-identification via genomic data [11], new measures are implemented to improve human subject privacy.

In the United States, a centralized protected database does not exist for criminal data, likely due to the decentralized nature of data within the criminal justice system. As such, crime labs within state or municipal jurisdictions do not necessarily participate in a nationalized data warehouse. Therefore, academic collaborators often work directly with a local crime lab or law enforcement agency to obtain data. Currently, enforced standards for ensuring victim privacy in this decentralized data environment in forensic science do not exist. With the skyrocketing popularity of ‘data science’, there is a growing interest in analyzing crime data to improve the justice system. As an example, we note two papers recently published about using machine learning to predict outcomes of evidence from sexual assault kits [12,13]. These efforts used very similar variables in their models, including time between the assault and forensic exam, age of the victim, gender of the victim, and whether a probative DNA profile was generated from the sexual assault kits. Other data - much more sensitive and private data - detailing the victim, assailant, and nature of the crime do exist in both crime labs and law enforcement databases. We fear that the lack of regulatory systems and the lack of education/awareness will lead to inappropriate data release as well as inappropriate publication of private data.

All human data needs to be rigorously protected, regardless of the scientific domain. Considering the safety and privacy of victims and their data should be the focus of crime labs when disseminating information [14]. Within criminal justice, we call on crime labs and law enforcement agencies to maintain victim privacy and be proactive and protective data stewards through strict implementation of the following practices. We obviously object to the release of any data that could be used to identify the victim. This includes but is not limited to the following: name, date of birth, specific crime location, date of crime, date of report/hospitalization, and law enforcement agency and case number. This data should never be contained within a research database. Where variables have research utility, like age of the victim, this information should be anonymized to a range and not a specific value, e.g. age decade especially within smaller datasets. This anonymization practice would broadly apply to information about the date/location of the crime. Additionally, we note that some variables can be combined to become identifiable, such as race or minority genders. Groups with small numbers should not be included in the dataset, as small cohorts can lead to easy identification. If data is released, the variables should be robustly tested for the potential for re-identification.

To complement these anonymization practices, crime labs should implement a vetting process like those used in biomedical research. Before being given access to data, researchers should submit documents detailing their research question, an institutionally approved IRB, method for safeguarding data, and proof of ethical research training. Crime labs can then determine if the researcher and research proposal qualify for access to sensitive data.

Crime labs and/or law enforcement agencies should also be clear with researchers on the publication of datasets in academic journals. Publication of datasets is a growing trend to allow for statistical analysis verification yet must be closely scrutinized to ensure the anonymity of victims and assailants.

As a final topic, we note that in biomedical research, all data is collected/released only after informed consent. However, in the aftermath of a crime, gaining consent from traumatized survivors cannot be pursued. Consent for data collection/release is ever more poignant because the information is about a non-consensual violent act and the survivor's unwilling involvement robs them of the autonomy and mental clarity that would be required for consent in classical ethical frameworks. Data with minors and vulnerable adults should also be guarded with extreme caution. The lack of consent from survivors should be considered carefully by researchers in study design and dissemination of findings.

Protecting the individual is paramount. The guidelines proposed herein will provide a stronger infrastructure to protect victim privacy. Crime labs and law enforcement agencies are stewards over sensitive information and must ensure victims are protected. Anonymizing data, releasing a minimal subset of the data, vetting researchers, and enforcing IRB approval will improve current processes.

Declaration of competing interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.