Substitute consent to data sharing: a way forward for international dementia research?

Abstract

A deluge of genetic and health-related data is being generated about patients with dementia. International sharing of these data accelerates dementia research. Seeking consent to data sharing is a challenge for dementia research where patients have lost or risk losing legal capacity. The laws of most countries enable substitute decision makers (SDMs) to consent on behalf of incapable adults to research participation. We compare regulatory frameworks governing capacity, research, and personal data protection across eight countries to determine when SDMs can consent to data sharing. In most countries, an SDM can consent to data sharing in the incapable adult's best interests. Best interests typically include consideration of the individual's previously expressed wishes, values and beliefs; well-being; and inclusion in decision making. Countries differ in how these considerations are balanced. A clear previous consent or refusal to share data typically binds the discretion of an SDM. Though generally permissive, National patchworks of laws and guidelines cause confusion. Clarity on the applicable law and processes to enhance ethical decision making are needed to facilitate substitute consent. Researchers can encourage patients to communicate their research preferences before a loss of capacity, and educate SDMs about their ethical and legal duties. The research community must also continue to promote the importance of data sharing in dementia.

I. INTRODUCTION

As life expectancy lengthens and populations age, the number of persons suffering from dementia globally is expected to increase from 47.5 million in 2015 to 75.6 million by 2030 and 135.5 by 2050. This trend is not limited to high-income countries.¹ The growing human and financial cost associated with dementia and dementia-related conditions, for which no satisfactory preventive or therapeutic interventions are yet available, calls for coordinated international action.² The systematic collecting, storage, and sharing of research data is key to improving our understanding of dementia. Large sample sizes are needed to characterize the complex interaction of genetic and environmental factors associated with disease etiologies and clinical progression.³ Cohort studies are needed to compare patients with neurodegenerative diseases with non-affected individuals, taking into account co-morbidities and changes in gene expression that accumulate with age. Collaborations between governments, researchers, health care institutions and industry are imperative, as no one entity has sufficient assets or available data to resolve these research questions independently.⁴

International data sharing for research purposes typically proceeds on the basis of informed consent in order to satisfy the overlapping requirements of respect for self-determination, data protection laws, confidentiality regimes, and research ethics guidelines.⁵ Legal uncertainty continues to hinder data sharing efforts, however, as normative regimes rarely anticipate the networked sharing of individual data for research purposes. The situation is more complicated for legally incapable adults,⁶ who cannot give a valid consent. International and national frameworks governing the participation of incapable adults in research have traditionally focused on protecting vulnerable populations from abuse. The argument for such a protectionist approach is, however, less convincing for data-centric research, which does not involve physical intervention, though informational risks remain a concern. These contexts call for a more balanced approach to governance that respects individuals’ privacy and autonomy rights, as well as their right to participate fully in society, and the rights of future patients suffering from dementia to benefit from the progress of science.⁷ A potential way forward for dementia research is to clarify and strengthen processes for seeking consent to data-centric research from substitute decision makers (SDMs). Indeed, SDMs are legally authorized in many countries to make decisions relating to incapable adults’ property, care, and research participation. Fundamental to the ethics and law of substitute decision making is respect for an incapable person's best interests, including his or her previous wishes, values, and opinions.

This paper explores the law of substitute consent to data-centric research and data sharing. As data pertaining to incapable adults may be collected before or after the loss of capacity, we envisage four situations where the legal status of substitute consent needs clarification.

• Can an SDM consent to the collection and sharing of genomic and health data of an incapable adult for research purposes?

• Can an SDM consent to the sharing of an incapable adult's genomic and health data—collected in the clinical care context—for research purposes?

• Where an individual consented to research while capable, can an SDM provide additional information upon re-contact, or ‘re-consent’ to secondary use or data sharing? and

• Where an individual consented to data sharing while capable, can an SDM subsequently request withdrawal from research, withdrawal from further use, or even withdrawal of the data?

Underlying these questions are two central themes. Firstly, there is legal uncertainty over who is the SDM and what kind of decisions an SDM can make on behalf of an incapable adult. Secondly, even where the SDM’s power to consent is clear, researchers need processes in place to support ethical decision making by SDMs. Our review hopes to shed light on both of these questions.

As highlighted in the 2015 OECD Big Data for Dementia report, uncertainties about consent issues in the context of dementia research may undermine participation in longitudinal studies. Forward-looking solutions are needed.⁸ Some projects, such as the 100,000 Genomes Project in England and Wales (United Kingdom), have developed clear SDM processes for consent to, and withdrawal from, international data sharing for incapable adults with a rare disease or cancer.⁹ To see such strategies adopted more widely, researchers, ethics bodies, and SDMs will all need clarity about the legal requirements around substitute consent and withdrawal, as well as practical guidance to encourage ethical decision making.

We conducted an international comparative review of laws and policies to determine if substitute consent can serve as a basis for data sharing for research purposes. For each jurisdiction, we consider the scope of the powers conferred on SDMs in health care and research contexts, as well as the limits imposed on their discretion.

II. METHODS AND LIMITATIONS

We examine international, regional, and national legislative and policy frameworks that apply to substitute decision making in health care, participation in research, and the processing of personal data. Our analysis includes both legally binding instruments and non-binding ‘soft law’ instruments such as declarations and policies. We selected eight countries as examples for analysis: Australia, Canada, Finland, France, Japan, Singapore, the United Kingdom and the United States and where appropriate, a number of their constituent entities such as states or provinces. This selection focuses on countries active in the domain of data-centric science, but also reflects a geographic diversity and a diversity of legal systems. We assessed their normative texts with a view to determining whether or not SDMs may consent to data sharing for research purposes on behalf of incapable adults. Finally, we consulted experts from Japan and Finland, where we had relied on unofficial translations, to validate that our reading of the selected texts is representative of their operant normative framework.

Our focus in this paper is on data-centric research, by which we mean research based on large, rich datasets that may be longitudinal. As a paradigmatic case, we consider datasets that include health data and genomic data, though our analysis applies to other types of data, such as imaging or biomarker data. Importantly, data-centric research does not involve physically invasive procedures or the specific risks posed therein, though data may be derived from samples obtained through an invasive procedure. Data-centric research is also longitudinal, and involves a need to collect, measure, or access information from or about participants over time. We also consider ‘data sharing’, that is, the practice of making large, rich datasets available to the research community through a ‘data commons’ with limited or no formalities. Data sharing initiatives aim to facilitate data-centric research, but give rise to legal and ethical issues concerning individual privacy.

This paper focuses on substitute consent, which we believe could play a central role in facilitating responsible data-centric research with incapable adults. There may of course be other means to access and share data derived from this vulnerable population. First, laws may technically, if not practically, enable individuals to establish advance directives that authorize research use of their personal information before losing capacity.¹⁰ Second, anonymized, that is, irreversibly de-identified, data are often exempt from legal and ethical norms and can be used without consent. Anonymization, however, can undermine data quality, and precludes participant re-contact to collect additional data or to inform them of individually relevant findings. It is also uncertain if new data types, such as whole genome sequences, can be effectively anonymized. Third, many jurisdictions permit access to data for research purposes without the individual consent under exceptional legislative research gateways. Such access, however, is restrictive, and is typically mediated by administrative bodies or ethics bodies, and extensive delays can occur.¹¹ There are also significant variations among research exemptions internationally, including the type of body that approves the research, whether project-specific statutory approval is required and the conditions the body must consider (eg consent is impracticable, confidentiality safeguards are in place, research cannot be carried out with anonymized data), as well as variations in how these conditions are interpreted.¹² Finally, researchers can attempt to obtain the broad consent of individuals to use their data for any future, as yet unspecified research before loss of capacity. Future data sharing will likely rely on a combination of these approaches; we focus here on substitute consent.

The scope of our analysis is limited by the following.

• We focus only on participants who are incapable of consenting to research, either because they are under a protective supervision regime or because they lack the cognitive ability to do so, though we recognize that cognitive capacity may be fluctuating and context specific. We do not examine how incapacity is defined or assessed in each jurisdiction.

• We limit our legal analysis to key statutory provisions, and do not provide an exhaustive review of the statutes, case law, or literature in each jurisdiction.

• In those countries where substitute consent is regulated by the laws of a constituent jurisdiction, we limit our analysis to a sample of those provinces or states we consider representative.¹³

We begin our analysis with a survey of international and regional laws and policies relevant to substitute decision making for research.

III. LEGAL AND POLICY ANALYSIS

A. International laws and guidelines

Binding international law does not explicitly address the involvement of incapable adults in research in great detail, though it does enshrine principles that can guide policy and research respectful of the fundamental rights of incapable participants. The rights of every citizen to privacy, integrity, and autonomy are set forth in the Universal Declaration of Human Rights and Freedoms,¹⁴ and have been integrated into international treaties that are widely ratified.¹⁵ Other international human rights that support the inclusion of incapable adults in research are the right of everyone to benefit from scientific progress,¹⁶ the prohibition of discrimination,¹⁷ and the rights of persons with disabilities to equal participation in society.¹⁸ The Council of Europe's 1997 Convention on Human Rights and Biomedicine speaks directly to the issue of substitute consent. It includes research in its definition of health interventions, and allows such interventions only where the participant or their legally authorized representative consent. In addition to complying with the convention's general requirements, research involving incapable adults without the ‘potential to produce real and direct benefit to his or her health’ is only allowed if it cannot be conducted with capable individuals; it is authorized in writing by the participant's representative; and the participant assents. Where the research does not offer any direct benefit to the participant but aims instead to benefit individuals of the same patient population, it may go forward if ‘the research entails only minimal risk and minimal burden for the individual concerned.’¹⁹

Guidance from the United Nations and its agencies supports the inclusion of incapable adults in research. A 1991 resolution entitled ‘United Nations Principles for Older Persons’ recommends that governments integrate the principles of independence, participation, care, self-fulfillment, and dignity into national programs.²⁰ While research is not specifically addressed, these principles can be interpreted as an endorsement of inclusive research practices. For example, they recommend that older persons be afforded opportunities to engage in community service, and research participation could be seen as such. They call for quality care for older persons; research may be necessary to develop appropriate interventions. The UN Convention on the Rights of Persons with Disabilities, whose scope includes individuals with mental impairment, is based on similar principles of autonomy, non-discrimination, and ‘full and effective participation’.²¹ It recognizes disability as ‘an evolving concept’ that results from ‘the interaction between persons with impairments and attitudinal and environmental barriers’.²² State parties are therefore required to provide support for the exercise of legal capacity, as well as proportionate safeguards to ensure that capacity is exercised in a way that respects the rights, will, and preferences of the person, and avoids conflicts of interest and undue coercion.²³ In 1997, UNESCO adopted the Universal Declaration on the Human Genome and Human Rights, which affirms that states should promote solidarity towards vulnerable populations, by fostering research ‘on the identification, prevention and treatment of genetically based and genetically influenced diseases, in particular rare as well as endemic diseases which affect large numbers of the world's population’.²⁴ Furthermore, its 2005 Universal Declaration on Bioethics and Human Rights permits substitute consent for research involving potential benefits to a group of persons.²⁵ The UNESCO Declarations indicate that acceptance on the basis of group benefit must however be exceptional and limited to situations where compatible with the protection of participants.²⁶

Finally, non-binding ‘soft law’ instruments adopted by civil society organizations addressing research, such as declarations, resolutions, and consensus statements of professional bodies, explicitly endorse the participation of incapable adults in research provided that supplementary protections are in place. For example, the World Medical Association Declaration of Helsinki (1964/2013) sets out ethical principles for medical research involving humans. It accepts substitute consent for incapable adults on the condition that the research is likely to benefit the individual or the group they represent, that it cannot be undertaken with capable individuals, and that it entails only minimal risk and minimal burden.²⁷ The Council for International Organizations of Medical Sciences’ International Ethical Guidelines for Biomedical Research Involving Human Subjects (1982/1993/2002) permits substitute consent for research that potentially benefits a group of persons.²⁸

In summary, there is clear support under international laws and guidelines for the inclusion of incapable adults in research. Substitute consent is recognized as an important safeguard for such research. Not clearly addressed, however, is who may act as an SDM, or how an SDM should exercise his or her authority.²⁹ In the next section, we explore how these questions are addressed under national and sub-national law.

B. National and sub-national substitute decision-making frameworks

In this section, we ask (1) what national and sub-national regulatory frameworks apply to substitute consent to research? (2) who may be designated as an SDM? and (3) what factors must an SDM consider when exercising his or her authority? We find that the approaches of our eight exemplar jurisdictions are generally permissive of substitute consent to data-centric research and data sharing. Designated or appointed SDMs typically have authority to consent, and in their absence, a close relative may provide consent. Jurisdictions are consistent in requiring SDMs to consider the individual's previous wishes, values and beliefs, but vary in whether or not this consideration is given priority.

1. What law applies?

Identifying the applicable law—amid a patchwork of laws and guidelines—is a challenging first step in ascertaining who is or can be the SDM for research, and in turn what conditions govern an SDM’s discretion, namely the incapable person's best interests. Table 1 lists laws across the eight selected jurisdictions that enable substitute consent and are relevant to consent to research. Where there are enabling statutory provisions, they are found in laws that vary in territorial scope and the type of substitute decisions they govern. Some apply nationally, but others are limited to particular constituent entities.³⁰ Substitute consent may variously be governed by mental capacity acts;³¹ public health codes;³² civil codes;³³ health care,³⁴ medical and biomedical research,³⁵or human tissue³⁶ legislation; or data protection laws (discussed in Section C). Consent and capacity laws are prone to either fragmentation or overlap. Fragmentation arises where statute law is ‘silent’ on a particular kind of decision. Overlap occurs where two different laws seem to apply to the same decision. Overlap can lead to disputes between different SDMs. Though researchers must contend with fragmentation and overlap, substitute consent to research does seem possible in all jurisdictions reviewed. These laws must also be understood within the context of the general legal framework of each jurisdiction, whose source may be either general texts adopted by a legislature, such as a civil code, or a body of judicial decisions. Where specific statutes are silent as to whether an SDM may consent on behalf of an incapable adult, one may have to look to the general legal framework for a solution. Finally, where these primary sources of law do not definitively apply and it remains unclear who the SDM is, the courts and other decision makers may turn to ‘soft law’ instruments or codes of professional practice governing research in their assessment of whether particular conduct is reasonable, or complies with the applicable standard of care.³⁷ Japan has not legislated on substitute consent to research and therefore fully relies on its research ethics guidelines.³⁸ In Australia and Canada, for example, national research funding agencies promulgate policies, and compliance is a condition of funding.³⁹

Table 1.

National/subnational laws and guidelines governing research ethics, consent and capacity, and data protection.

Jurisdiction	Research laws and ethical guidelines	Consent and capacity laws	Data protection laws
United Kingdom
England and WalesScotland	Medical Research Council Ethics Guide 2007, Medical research involving adults who cannot consent [MRC Ethics Guide]a	Mental Capacity Act 2005 (England and Wales) c9 [England MCA].
		Adults with Incapacity Act, ASP 2000, c4 [Scotland AIA].	Data Protection Act 1998 (UK), c. 29 [UK DPA]
Northern Ireland		Mental Capacity Act (Northern Ireland) 2016 (NI), c 18 [NI MCA].
France	n/a	Civil Code [France CC]	Loi no 78-17 of 6 January 1978 on Information Technology, Data Files, and Civil Liberty
		Code de la santé publique
		Arts L1121-1 to L1121-16; L1122-1 to L1122-2; L1211-2 [France CS]
Finland	n/a	Guardianship Services Act, No. 442/1999 [Finland GSA]	No. 523/1999 Personal Data Act [Finland PDA]
		Medical Research Act, No. 488/1999 [Finland MRA]
Canada		n/a	Privacy Act, RSC 1985, c. P-21 [Canada PA]
			Personal Information Protection and Electronic Documents Act, SC 2000, c 5b [PIPEDA]
Ontario		Substitute Decisions Act, 1992, SO 1992, c 30 [Ontario SDA] Health Care Consent Act SO 1996, c 2, Schedule Ac [Ontario HCCA]	PIPEDA applies to private sector. Freedom of Information and Protection of Privacy Act [Ontario FIPPA] Personal Health Information Protection Act [Ontario PHIPA]
Québec	Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans 2014 (TCPS2) [TCPS2]	Civil Code of Quebec, CQLR c C-1991 [Quebec CCQ]	An Act Respecting the Protection of Personal Information in the Private Sector [Quebec ARPPIPS]
			An Act Respecting Access to Documents Held by Public Bodies and the Protection of Personal Information, CQLR c A-2.1 [Quebec ARADHPBPPI]
			An Act Respecting Health Services and Social Services, CQLR c S-4.2 [Quebec ARHSSS]
British Columbia		Health Care (Consent) and Care Facility (Admission) Act, RSBC 1996, c 181 [BC HCCCFA]	Personal Information Protection Act [BC PIPA] Freedom of Information and Protection of Privacy Act [BC FIPPA] E-Health (Personal Health Information Access and Protection of Privacy) Act [BC PHIAPP]
United States		n/a
Virginia		Virginia Code Title (2015) 32.1—Health, Chapter 5.1 Human Research [Va Code].
District of Columbia	45 CFR 46 Subpart A (2009) [US Common Rule]	District of Columbia Code (2014) Title 7 Human Health Care and Safety [DC Code].	Health Insurance Portability and Accountability Act Privacy Rule, 45 CFR Part 160 and subparts A and E of Part 164
Pennsylvania		Pennsylvania Consolidated Statutes (2015) Chapter 55—Incapacitated Persons; Chapter 58—Mental Healthcare [Pa CS]
Japan	Ethics Guidelines for Human Genome/Gene Analysis Research 2008d [Japan Guidelines]	n/a	Act on the Protection of Personal Information 2003 No. 57
Singapore	Ethics Guidelines for Human Biomedical Research 2015	Mental Capacity Act (Chapter 177A) (No 22 of 2008) [Singapore MCA]	Personal Data Protection Act 2012 (No. 26 of 2012)
		Human Biomedical Research Act 2015 (No 29 of 2015) [Singapore HBRA]
Australia		n/a	Federal Privacy Act 1988 (Cth) and its Australian Privacy Principles
New South Wales	National Statement on Ethical Conduct in Research Involving Humans 2007 [Australia Statement]	Guardianship Act 1877 (NSW) (No257) [NSW GA] Human Tissue Act 1983 (NSW) [NSW HTA]	Privacy and Personal Information Protection Act 1998 No. 133 (NSW). [NSW HRIPA] Health Records and Information Privacy Act 2002 No. 71 (NSW).
Victoria		Guardianship and Administration Act 1986 (Vic) [Victoria GAA]	Privacy and Data Protection Act 2014 No. 16 (Vic). [Victoria PDPA].
		Human Tissue Act 1982 No. 9860 [Victoria HTA]	Health Records Act 2001 (Vic) [Victoria HRA].

^aThe MRC is one guideline among many in the UK. For a list of discipline-specific texts, see UCL Research Ethics Committee, Codes of Conduct, https://ethics.grad.ucl.ac.uk/codes_of_conduct.php (accessed Dec. 19, 2016).

^bThis is the default regime for the private sector in Canada. Provinces may enact private sector privacy legislation applicable within the province provided that it is deemed to be substantially similar to the federal legislation.

^cThe act expressly excludes procedures whose primary purpose is research from its scope of application (s. 6). We include it here as the legal conditions of substitute consent in the care context provide a useful reference point for research.

^dThe Ethics Guidelines for Human Genome/Gene Analysis Research is a ministerial order and not an operational guideline for a specific law. See Sosuke Iwae & Motomu Shimoda, Public Policy and Regulation System concerning Genetic Medicine in Japan 9 Formosan J Med. Human. 27 (2008).

Our review distinguished three general legislative approaches, with different strengths and weaknesses. First, some jurisdictions address substitute consent to research entirely under a health or research act or guideline (Japan, Virginia, BC). This approach provides clarity as to who can be the SDM, but specific definitions of research can lead to fragmentation, failing to capture evolving practices like data sharing. Second, some jurisdictions rely entirely on general mental capacity laws addressing a wide range of situations (France, Quebec, Ontario, Australia, Pennsylvania, Washington). These jurisdictions typically have research laws or guidelines that entirely defer to a more general mental capacity regime or common law for authorization of the SDM. On one hand, this approach avoids the fragmentation issue by deferring to SDMs with broad powers and offers clarity over which SDMs have priority. On the other hand, it offers less flexibility for research, in that there may be only one specific person who can consent. Third, some jurisdictions take a ‘hybrid’ approach, where certain SDMs (personal representatives, PRs) are entirely authorized and governed under research provisions, whereas other SDMs (designated representatives, DRs, and court-authorized representatives, CARs) are incorporated by reference to more general mental capacity laws (UK, Singapore, Finland). The hybrid approach appears to strike a balance between certainty (laws are coordinated so they do not overlap) and flexibility (researchers have some ability to choose between different potential SDMs).

Confusion over the application of laws to data sharing abounds. Data sharing is perhaps particularly susceptible to both fragmentation and overlap. On one hand, data sharing does not fall clearly into common statutory categories of property, personal care, interventional research, or tissue research. On the other hand, data may be generated and shared from a variety of overlapping personal, health care, and research contexts. Where the definition of research is tied to the notion of intruding on integrity, experimental interventions such as drugs, devices, surgery, or biopsies, the status of data-centric research becomes unclear.⁴⁰ In Victoria (Australia), the Guardianship and Administration Act regulates ‘procedure[s] carried out for the purposes of medical research’, but does not apply to the collection or use of personal information.⁴¹ Health care decision-making legislation may variously include, exclude, or remain silent on consent to research. The Health Care Consent Act of Ontario (Canada) excludes research⁴² leaving authority for SDMs to the ‘less certain authority of the common law’.⁴³ In Australia, New South Wales has a human tissue act that enables substitute consent by reference to a more general capacity law, whereas Victoria's human tissue act provides for substitute consent for minors, but is silent on incapable adults. Does this silence in the specific regime specifically bar substitute consent? While not necessarily barring substitute consent, legislating through silence is sure to create uncertainty. Even general capacity legislation can suffer from fragmentation where it divides responsibilities between property, personal care, and research. While it is clear that data-centric research fits somewhere, it may not be clear which SDM law provides authority over a person's data. In fact, ‘data sharing’ does not have to relate to research specifically. Genomic data, for example, can be shared to support patient matching for health care diagnosis, or pursuits stemming from personal curiosity.

2. Who can be an SDM?

Capacity laws provide rules for determining who can provide substitute consent. Common categories of SDMs include:⁴⁴

• court-authorized representative (CAR): a tutor, curator, guardian, deputy, or other court-appointed representative

• designated representative (DR): a representative designated in an advance directive by the incapable person

• personal representative (PR): a person who qualifies if listed under legislation to make a particular decision—eg spouse, close friend, or family member

• exceptionally, researchers.⁴⁵

These categories emphasize different policy priorities. Requiring court appointment reflects concern for independent assessment of the SDM, to avoid conflicts of interest. Allowing designated representation advances the autonomy of the incapable person. Statutes that allow for PRs provide flexibility that facilitates the search for an SDM, and ensures people have representation. As a general principle, all categories of SDMs are similarly bound to act in the person's best interests, as we discuss in the next section. These categories also reflect the need for independent safeguards (eg court oversight) that is proportionate to the risks to the person's rights and interests. Of course, substitute consent—even by a designated SDM—is an imperfect substitute for individual consent. There is no guarantee that an SDM knows the individual's past wishes, values, and beliefs; and there is a possibility that SDMs have personal or professional conflicts of interest with the participant.⁴⁶ A CAR is typically required for research involving more than minimal risk, or interference with individual ‘integrity’.⁴⁷ In France, consent of the SDM must be supplemented by court authorization where the risk to privacy is ‘serious’.⁴⁸ A CAR must seek input from the incapable person in respect of autonomy, and consult family members, friends, or caregivers on the wishes of the incapable adult if they do not know the adult personally. About half the jurisdictions surveyed appear to allow capable individuals to designate a representative (DR) to make decisions on their behalf in the eventuality they lose capacity.⁴⁹ In addition, the Northern Ireland Mental Capacity Act allows individuals to un-designate persons who they do not want to make decisions on their behalf.⁵⁰ This respects participants’ autonomy while they are capable, allowing them to exercise control over who will make decisions on their behalf. The appointment of a DR, however, is subject to formalities to ensure the advance directive is legitimate. To facilitate health care or research decision making, statutes in most jurisdictions also provide priority lists of possible PRs, who are likely to know the values and wishes of the individual.⁵¹

Researcher may struggle to identify the appropriate SDM. The extent of an SDM’s jurisdiction over decisions is constrained by the scope of the empowering law. An SDM authorized under a health care capacity statute does not have clear authority over research or personal information outside the scope of that law. The SDM may be further constrained by the terms of his or her authorization from the court, or mandate from the previously capable individual. Indeed, the wording of SDM mandates may exacerbate fragmentation or overlap for CARs and DRs. Additionally, empowerments are often shared or divided, for example, between multiple DRs, or between property-related and personal care-related decision makers.

Researchers may be forced to handle disagreements between SDMs or disputes over authority, and therefore need to know which SDMs have priority in a given jurisdiction. Typically, DRs and CARs have priority over PRs. In Virginia, a DR appointed under an advance directive authorizing research decisions has priority over the CAR, who in turn has priority over an ordered list of PRs.⁵² Singapore and Finland have research specific acts that authorize DRs or CARs appointed under more general capacity laws. Only if there is no DR or CAR, does the research act authorize a PR to consent to research. This affects our discussion below of what an SDM must consider. By contrast, England and Wales’ Mental Capacity Act and the Northern Ireland Mental Capacity Act allow researchers to determine if incapable adults may be included in research.⁵³ The researcher must, however, seek advice from a person engaged in the care of the incapable adult or from a person interested in the adult's welfare, and cannot override the consent or refusal of such a person. In short, the researcher must still seek substitute consent.⁵⁴ Researchers may consult DRs and CARs, but these more formal SDMs are not given priority over PRs. This latter approach favors flexibility (ensuring someone can represent the incapable adult) and proportionality (formalities are unnecessary for research that does not have serious effects on the incapable adult's rights and interests). The trade-off is that the rules may create disputes between SDMs. In practice, researchers should have clear processes for determining who is the SDM, for consulting the SDM, and for resolving conflicts between SDMs.⁵⁵ In the next section, we ask what SDMs must consider when exercising their authority.

3. What must the SDMs consider?

Regulatory frameworks across the surveyed jurisdictions consistently recognize SDMs as fiduciaries required to exercise their authority in the best interests of the incapable individual. Definitions of best interests vary. Almost all jurisdictions explicitly require SDMs to consider the incapable adults expressed wishes, beliefs, and values. Almost all laws and guidelines explicitly require SDMs to consider the individual's well-being.⁵⁶ Many jurisdictions also require SDMs to include the individual in decision making to the extent possible. We discuss these three considerations in the following subsections, paying particular attention to differences across jurisdictions in whether or not these considerations are explicitly stated, and how they are ordered. We also discuss the practical challenges SDMs face when assessing best interests in the context of data-centric research and data sharing, and how these challenges can be addressed by research governance practices.

It should be noted that the range of research to which SDMs can consent is limited to research approved by an ethics body. Ethics review thus constitutes a first layer of protection. Most international and national research ethics guidelines only allow approval of research involving vulnerable adults if (1) it is necessary to conduct the research with the vulnerable population; (2) the research does not pose a serious risk⁵⁷; and (3) the research provides a benefit to the individual or to the individual's age or disease group.⁵⁸ The second layer of protection is substitute consent. While our focus in this section is on this second layer, we identify a number of instances where there is a lack of coordination between the two layers of protection.

a. Wishes expressed while capable

The requirement for SDMs to consider previous wishes, values, and beliefs is common across jurisdictions and contexts. Nearly all substitute consent laws and guidelines reviewed explicitly require an SDM to consider the wishes the incapable adult expressed while capable.⁵⁹ This ‘substituted judgment’ approach requires the SDM to act in accordance with what the person would have decided if capable. This supports the person's precedent autonomy by constraining the discretion of the SDM. The importance of precedent autonomy to the best interests is reflected by its explicit inclusion in most definitions of best interests. Only Japan's guidelines do not explicitly require SDMs to consider previous wishes, though they require researchers to select PRs from a priority list that are ‘able to represent the presumed intentions and interests of the donor …’⁶⁰ A number of jurisdictions go further and make previous wishes a priority consideration.⁶¹ Others do not. During consultations about the Northern Ireland Mental Capacity Bill, multiple stakeholders felt that previous wishes and feelings of incapable persons should be given priority.⁶² The Department of Justice decided not to give strict priority to previous wishes because of the ‘wide range of decisions to which the Bill applies’,⁶³ but recognized that an effective advance directive would be decisive, and that special regard should be paid to written statements.⁶⁴ PRs empowered under some research specific acts only have to consider previous wishes. In Finland, PRs authorized to provide substitute consent are only required to consider the individual's ‘supposed will’.⁶⁵ In Singapore, PRs are only asked to consider ‘absence of actual notice of contrary indications by the adult’.⁶⁶ These limited approaches under research-specific legislation may be explained by the fact that ethics bodies can generally only approve research that does not pose a serious risk. The decision to prioritize previous wishes protects precedent autonomy and may facilitate substitute decision making. It may, however, also undermine the importance of other considerations, such as the effect on the individual's well-being, and including the incapable person in decision making.

Research ethics guidelines also address previous wishes but there is more variation from one text to the next. These guidelines primarily address researchers, though some also address SDMs. Australia's guidelines state that participant consent should be followed despite a loss of capacity unless circumstances change in a way that undermines best interests,⁶⁷ and clarifies that people with mental illness or cognitive impairment are entitled to participate in research for altruistic reasons.⁶⁸ Canada's guidelines state that SDMs should consider previous wishes, and that both researchers and SDMs should be guided by ‘research directives’—written instructions of a person's research preferences.⁶⁹ The US National Institutes of Health (NIH) considers a substituted judgment standard preferable, as long as the level of evidence is proportionate to the risks of participation.⁷⁰

A major practical hurdle for research, generally, is that it is uncommon for individuals to express clear wishes about research participation. Researchers can take practical steps to enhance the SDM’s knowledge of previous wishes. Where it is foreseeable that participants may lose capacity during a study, they could be encouraged to identify a future SDM and to discuss their participation with the SDM in advance of losing capacity. SDMs can be encouraged to consult a range of individuals close to the individual, such as family members, care takers, and SDMs with authority over other matters.⁷¹ A consultation by the UK-based Nuffield Council on Bioethics highlighted ‘the possible benefits of open discussion of attitudes to research around the time of diagnosis with the person's opinions about research being clearly documented at the time’.⁷² In 2009, the NIH proposed that an SDM be engaged early in the research process in cases where a participant is expected to lose capacity during the course of the research.⁷³ An exception is where participants have already provided consent to longitudinal data collection or data sharing. In such cases, researchers can share the original consents with SDMs as written evidence of previous wishes, and educate them about their legal and ethical duties to follow such wishes. Researchers should also be alert to potential conflicts of interest between incapable persons and SDMs. An incapable adult's genomic data, for example, may have both direct health and privacy implications for a biologically related SDM. The SDM may want to keep the incapable adult from participating to avoid privacy risks. The SDM may also want to force the incapable adult to participate in order to gain health insights.

b. Well-being

Especially where the substituted judgment test is not determinative, the legal mandate of SDMs is generally to protect the incapable adult's well-being. This consideration is reflected in the basic principles of most substitute consent laws. The French Civil Code states that decisions made under protective supervision regimes must protect the person and his or her patrimonial interests.⁷⁴ In England and Wales, and in Singapore, SDMs empowered under general mental capacity acts are bound to act in the person's ‘best interests’.⁷⁵ In Finland, SDMs must manage property to the benefit of the individual, and must see the person receives care deemed appropriate in view of the person's needs.⁷⁶ Ontario's health care act requires SDMs to consider the effect of treatment on a person's ‘condition or well-being’, and must make sure risks are minimized and outweighed by benefits.⁷⁷ Canada's research ethics guidelines require SDMs to consider a participant's ‘welfare’, defined to include broad social and psychological considerations.⁷⁸ In research-specific statutes or provisions, however, SDMs are often not explicitly called upon to consider the person's well-being (unless authorized by reference to another general capacity act applying a best interests test). Presumably, this is because an ethics body cannot typically approve research that presents a serious risk, or because the duty is already imposed by a more general substitute consent law (where applicable). In some cases, the duty is implied by the identity of the SDM. Research provisions in England and Wales’ Mental Capacity Act, for example, require a researcher to seek consent from someone ‘engaged in caring’ for the person or interested in the person's welfare to consider if the person should take part in the project.⁷⁹

In the likely absence of clear previous wishes, SDMs may be inclined in their fiduciary role to conservative interpretations of the best interests that excludes participation in even minimal risk research if there is no direct benefit to the incapable person. This may be problematic for data-centric research or data sharing, where informational risks seem low but difficult to quantify, and where direct benefits are unlikely, especially for those with advanced aged and advanced dementia. Even where research guidelines consider the inclusion of incapable adults ethical because the research benefits an age or disease group, the SDM’s assessment of benefit seems restricted to the individual's well-being. In jurisdictions where broader conceptions of benefit are adopted into law, it may be easier for SDMs to interpret benefit more broadly. Another coordination issue between substitute consent provisions and research ethics protections arises in jurisdictions where substitute consent provisions prioritize substituted judgment, but research ethics protections impose minimal risk standards. Your clear wishes to participate in risky research after a loss of capacity are moot if an ethics body will never approve the research.

Ethics boards may struggle to classify the risks of data sharing, because research ethics evolved with a focus on physical rather than informational risks. The Council of Europe has defined ‘minimal risk’ as a risk that ‘will result, at the most, in a very slight and temporary negative impact on the health of the person concerned’ and ‘minimal burden on participants’ as a situation where it is ‘to be expected that the discomfort will be, at the most, temporary and very slight for the person concerned’.⁸⁰ The Code of Virginia (United States) defines minimal risk as ‘the risks of harm anticipated in the proposed research are not greater, considering probability and magnitude, than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests’.⁸¹ This echoes the US Common Rule, which applies to all federally funded research in that country.⁸² In Canada, the Tri-Council Policy statement has a similar definition, though it does not mention routine examinations or tests. Instead, it references ‘those aspects of daily life that are relevant to participation’.⁸³ This has been interpreted as a relative standard, meaning that research-related risks must be considered with reference to the potential participant, as opposed to the risks that a typical person might face.⁸⁴ Data-centric research and data sharing may be more problematic in jurisdictions that explicitly include privacy in the definition of risk. The Mental Capacity Act of England and Wales considers privacy to be a risk and requires that there be ‘no significant interference with privacy’ for research if there is no individual benefit.⁸⁵ France's Code of Public Health requires a privacy risk assessment before involving incapable adults in biomedical research.

In summary, conservative interpretations of risks by both SDMs and ethics bodies are barriers to data sharing. Where previous wishes relating to research are unknown or need to be balanced against well-being, SDMs may struggle to assess the risks posed by data sharing. Researchers can help by educating SDMs about such risks during the consent process and instructing them to consider these risks in the context of the particular individual. Even where individuals expressed clear preferences to share data after a loss of capacity, and SDMs are willing to consent, ethics boards may simply not approve data sharing. Some of this uncertainty may be resolved over time as data sharing practices and infrastructure develops, and as evidence accumulates demonstrating that data sharing is both secure and effective. To proactively address these barriers, the research community must continue to make the case that data sharing is essential to accelerate health research, and that the risks to participants are minimal. It is also key to raise awareness about the importance of research and data sharing among patients and their potential SDMs who can be essential partners for promoting more open institutional practices and regulatory frameworks.

c. Supported decision making

The disability rights movement has affected assessment of capacity, as well as the evaluation of an incapable adult's best interests. Recognizing that disability is contextual, there is an international trend towards supported decision making, as reflected by art 12(3) of the Convention on the Rights of Persons with Disabilities, discussed above. Many of the laws reviewed here include explicit emphasis on supported decision making. In England and Wales, for example, SDMs are asked to consider both ‘past and present wishes’ and must permit and encourage the person to participate as fully as possible.⁸⁶ In Finland, guardians must inquire as to the individual's opinion to the extent they can understand.⁸⁷ This consideration is related to, but distinct, from the research ethics concept of ‘assent’ and ‘dissent’. Researchers, too, are typically required to explain research and include incapable adults in decision making to the extent possible, usually with requirements for assent or respect for dissent, understood as a refusal or reluctance to participate or a desire to withdraw.⁸⁸ The England and Wales Mental Capacity Act states that a research must comply with an incapable person's wish to be withdrawn, expressed in any way, without delay.⁸⁹ The French Code of Public Health states that in no circumstances can a researcher override an incapable adult's refusal or revocation of consent to biomedical research.⁹⁰ In Virginia, protest of the incapable adult must be respected, but an explicit exception to respecting dissent is made for applying an experimental therapeutic treatment to a person suffering from incurable dementia.⁹¹

In jurisdictions that do not prioritize substituted judgment, supported decision making raises the potential for disagreement between previous and present wishes. How are SDMs supposed to balance these considerations? Jurisdictions that prioritize substituted judgment make it clearer what an SDM should decide, but may attract ethical criticism for failing to support the autonomy of the incapable person. A lack of coordination between substitute consent provisions and research ethics guidelines adds further confusion. Under many research ethics laws and guidelines, the dissent or protest of the incapable adult is a priority. These rules reflect a traditional protectionist stance and a focus on physical interventions. It seems contradictory to ask researchers to prioritize dissent, and SDMs to prioritize precedent autonomy. In general, legislators and policy makers should ensure that these two layers of protection are better coordinated. They should also consider who is better positioned to make an ethical decision about the individual's best interests: the SDM or the researcher. In practice, issues around dissent may not be critical for data-centric research or data sharing as there are no physical discomforts for the participant to protest. But research governance processes should encourage efforts by both SDMs and researchers to inform the incapable person and to include them in decision making, to the extent possible. In addition, research governance processes should encourage coordination between SDMs and researchers when interacting with the incapable adult. In the next subsection, we explore how issues of incapacity affect the ongoing nature of consent.

4. Termination of consent: loss of capacity, withdrawal by the incapable adult, and withdrawal by the SDM

Here we discuss additional provisions that protect the well-being and autonomy of incapable adults in the context of data-centric research. The principle that consent is ‘ongoing’ raises questions about the effect of a loss of capacity on consent. Should the original consent be respected, or should re-consent from an SDM be required? Should the views of the incapable adult be taken into account on an ongoing basis? What if these views conflict with previous expressions? And finally, to what extent, if any, should previous expressions—in particular consent while capable—restrict the authority of an SDM to withdraw an individual from research?

a. Loss of capacity during research

Consent to research should be ‘ongoing’. That is, the research team should ensure that valid consent is maintained for the full duration of the research. The longitudinal nature of the consent process raises the question of whether consent is terminated by a loss of capacity. Although it might be appropriate to consult with an SDM where physical interventions are involved, it would appear that this is not imperative in the case of data sharing. Here, the principle of ‘consistent use’ from data protection law provides an alternative guidepost: the further use of personal data is typically allowed ‘when the new use is in accordance with the original conditions under which information was collected’.⁹² In a similar vein, the UK Medical Research Council (MRC) states that ‘if an individual has made a decision to participate in research and subsequently loses capacity, it is expected that this consent would be respected in most circumstances and so use of samples or data could continue’.⁹³ In addition, the MRC recommends that the risk of losing capacity be discussed with participants and that consent forms include ‘an option to consent to remain in the study in the event of incapacity’ unless there is a change of circumstances.⁹⁴

b. Withdrawal by incapable adult

As we discussed above, SDMs must support incapable adults in making decisions about participation, and researchers are typically required to respect dissent. As data-centric research involves only minimal direct interaction with participants, however, there may be few interactions with the incapable adult where they would have an opportunity to dissent. To the extent that is feasible, SDMs and researchers should coordinate to consult the incapable adult on an ongoing basis about their participation in data-centric research.

c. Withdrawal by SDM

Ongoing consent to participation in research implies a right to withdraw consent at any time. All research procedures would cease, and the participant may have the right to request that no further information be collected about them, and in some cases that information collected up until the point of withdrawal be destroyed.⁹⁵ Traditional privacy laws have framed withdrawal as the converse of initial consent. For example, in Canada, the Personal Information Protection and Electronic Documents Act, ‘[a]n individual may withdraw consent at any time’,⁹⁶ and this is re-iterated as an ethical duty under the rules of the country's federal funding agencies.⁹⁷ Similarly, the European General Data Protection Regulation (GDPR) coming into force in 2018 will expressly provide that individuals retain the right to withdraw consent at any time.⁹⁸ There are practical limits: once the data has been published or aggregated, it may be difficult or impossible to erase. Where consent remains valid after a loss of capacity, the question of whether an SDM can withdraw consent takes on particular importance. In jurisdictions that require SDMs to make a substituted judgment, an argument can be made that original consent should hold sway unless the SDM has reason to believe that a change in circumstances would have led the participant to seek withdrawal. Consistent with this view and with its interpretation of the Mental Capacity Act, the UK’s MRC indicates (among other factors) that the authority of a representative to withdraw consent when the incapable person had given consent while capable ‘should be considered carefully to ensure that it reflects the wishes of a participant before loss of capacity’.⁹⁹ The Finnish Medical Research Act suggests that the SDM has the authority to withdraw consent on the same terms under which a capable adult may withdraw.¹⁰⁰ In jurisdictions where previous wishes take precedence, valid consent provided by the individual while capable should bind his or her SDM. However, it is unclear if researchers would be willing or able to resist a request from an SDM to withdraw the incapable person's data. On the balance, it would seem preferable for researchers to defer to the full authority of SDMs to withdraw, and focus instead on processes to educate the SDM about his or her legal and ethical duties, and to inform the SDM of the incapable person's preferences expressed through consent.

Participation in data-centric research and data sharing is typically a long term, if not indefinite, affair. This challenges the notion that consent is ongoing, and there may indeed be both principled and practical limits to the right to withdraw. For dementia research, it is additionally unclear which expression of consent should have precedence: a previous expression, an incapable adult's dissent, or the SDM’s withdrawal.

C. Data protection laws and policies

Data protection laws govern the collection, use, and disclosure of personal data, typically defined as data relating to an identifiable individual. These laws may apply to the types of information used in data-centric research. While some suggest that re-identification risks for biomedical data are remote where appropriate anonymization techniques are employed,¹⁰¹ others hold that rich research data such as genomic data should be treated as ‘potentially identifiable information’.¹⁰² Considering that there have been a few rare cases of re-identification based on published data,¹⁰³ the prudent approach is for researchers to ensure they comply with data protection obligations—including confidentiality and adequate security measures—so as to be well positioned if the data are determined to be identifiable. As a general rule, data protection laws require consent of the data subject or legal authorization before personal data can be shared for research purposes. Do they also allow SDMs to consent on behalf of incapable adults? And where data protection laws enable substitute consent to data sharing, do they impose conditions on the SDM?

International data protection guidelines do not address substitute consent in detail, but are generally permissive. The most important of such guidelines, the 1980 OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, outline a series of fair information practice principles now widely adopted into national legislation. The original guidelines do ‘not exclude the possibility of a data subject being represented by another party, for instance in the case of minors, mentally disabled person, etc.’,¹⁰⁴ though the updated version of these guidelines do not speak to the issue directly.¹⁰⁵ While there is no international law on data protection, the European Union has a binding data protection framework, the EU Directive on Data Protection, that governs the processing (ie collection, use, and disclosure) of personal data, subject to legislative interpretation across the Union.¹⁰⁶ In 2018, the EU Data Protection will be replaced in 2018 with a binding GDPR, which will govern all member states across Europe. The GDPR requires the consent of the data subject for processing of personal data whether or not the data are considered sensitive. Exceptions to this rule are limited under the GDPR. An exception is made for a data subject physically or legally incapable of giving consent, but only where processing is ‘necessary to protect the vital interests of the data subject or another natural person’.¹⁰⁷ The GDPR does not explicitly address substitute consent to data processing. Additional derogations to the consent rule must be explicitly established by the Union or Member State law.

In line with the OECD 1980/2013 guidelines, most national data protection laws adopt a permissive stance with regard to substitute consent. Many are silent on the issue of substitute consent.¹⁰⁸ Some, such as health privacy statutes in Ontario (Canada) or New South Wales (Australia), include a general empowering provision for SDMs.¹⁰⁹ Data protection laws are also generally silent as to what an SDM must consider when consent to the collection, use or sharing of personal data.¹¹⁰ Exceptionally, Victoria's public sector and health data protection laws take a hybrid approach, empowering DRs and CARs by reference to more general capacity laws, but also directly empowering PRs.¹¹¹ They also explicitly bind the SDM to respect the incapable person's previous wishes when exercising rights in personal information. The general silence on substitute consent to data processing once again presents the problem of fragmentation. Data processing activities may not clearly relate to common legal categories of property, personal care, interventional research, or tissue research that traditionally delimit SDM authority. A hybrid approach like Victoria's may provide flexibility in identifying an SDM for purely informational research activities.

IV. Conclusion

International data sharing is imperative for data-centric research, where large sample sizes and Big Data analytics drive discovery.¹¹² To date, international data sharing has primarily been enabled through consent-oriented approaches. This is because consent exceptions are internationally recognized across regulatory frameworks governing research, privacy, and confidentiality. Data sharing to support dementia research faces the challenge of involving adults legally incapable of giving consent. We hypothesized that substitute consent could offer a way forward for data sharing in dementia research. The regulatory frameworks we surveyed governing substitute decision making do not fully anticipate or accommodate data-centric research or data sharing. Laws and guidelines lack coordination and clarity within jurisdictions. This confuses researchers, ethics bodies, and potential proxies contemplating the participation of incapable adults in research and international data sharing. All jurisdictions do appear to enable substitute consent to data-centric research and data sharing. Across contexts and countries, SDMs consenting or withdrawing consent must consider the incapable person's expressed wishes and well-being. To facilitate substitute consent to data sharing, the research community can strive to make the risk case for data sharing to the public, and should establish processes to encourage individuals to communicate wishes about the use of their data before a loss of capacity. Given similarities in basic principles across jurisdictions, we remain optimistic that the research community can successfully harmonize policies and processes for substitute consent across projects and jurisdictions, thereby ensuring that data are ‘legally interoperable’ without legislative intervention.¹¹³ Advance research directives present a potential alternative or complementary mechanism to substitute consent. Further comparative research is needed to determine if and under what conditions such directives may also enable international data sharing. Patients and their families would then need to be educated about their options with regard to written instructions. To explore these issues, an international task team has been struck to develop best practices for governance of international data sharing initiatives in dementia research, including best practices for substitute consent for data sharing.¹¹⁴