Health Research with Big Data: Time for Systemic Oversight

In the epoch of big data, biomedical research and health care are set to undergo a massive transformation. Change is affecting the continuum of health-related activities, from the way health data are captured and processed, to how data processing is translated into medical practice, research, and health policy. Pervasive capturing and analysis of diverse data types fuel new capabilities in health research. As a result, data-driven discoveries are expected to play an increasingly important role in biomedical research. The huge variety of big data opens the door to previously unimaginable applications of data mining for disease prevention, diagnosis, and treatment.¹

Precision medicine, predicated on the creation of knowledge networks from diverse data and disci-plines,² is one prominent example of the data-driven approaches in biomedical research and healthcare.³ Not only are such applications of benefit to individuals, they can also lead to more targeted and effective public health interventions. In this respect, precision public health is also emerging as a new way of addressing public health needs through leveraging the potential of big data for precision prevention, digital epidemiology, and digital health surveillance.⁴ Moreover, the possibility of capturing health-relevant data from innovative sources, such as wellness apps, social networks, smartphones, and wearable technologies, has given rise to the overarching concept of digital health, which goes beyond the creation of health-related knowledge through data analyses to health care delivery though digital means.⁵

As these aspirations continue to grow along with the capabilities that fuel them, it becomes difficult to keep up with the challenges they present. Beyond epistemological or technical issues like the value of evidence generated through analysis of disparate data, or the development of robust data security systems, some of the more recalcitrant issues are ethical in nature. Values such as autonomy, privacy, solidarity, and freedom together with the regulatory strategies nations deploy to protect them appear to be under severe pressure. Consider the familiar example of informed consent — a legal requirement and an ethical cornerstone in research with human participants, which in the big data environment struggles to offer sufficient protections and to safeguard autonomy and privacy. How can a norm as important as consent maintain its role when data are routinely collected online? Can we still rely on consent mechanisms to ensure sufficient levels of control of personal data? What privacy safeguards can consent offer in the age of big data?

Such questions are not unique to the domain of health. On the contrary, they pervade any domain affected by big data. As the European Commission’s Onlife Initiative points out, to navigate the increasing complexity of life online we have to rethink our conceptual frameworks, including our ethical and legal ones.⁶ In the domain of health research, such reflection on our conceptual frameworks can facilitate regulatory and policy solutions to ensure that digitalization will not crowd out ethical values that matter to our society.

In this paper, we propose such a conceptual shift. First, we suggest that health research is set to take place within an evolving health data ecosystem; second, we situate the challenge of informed consent within this evolving ecosystem; and, third, we argue for a systemic oversight approach to compensate for the ethical deficits caused by a weakened informed consent.

I. The Evolving Health Data Ecosystem

We propose to conceptualize health data as an evolving ecosystem consisting of three interconnected parts broadly clustered under three rubrics: data sources, data capabilities, and data stakeholders.⁷ Although each part gives rise to specific ethical challenges, their interdependence augments the complexity of each challenge.

Data Sources

Health-relevant data are typically data on individuals that have been obtained through a health-related source for clinical or research purposes. Usually such sources include health services (e.g., electronic health records, prescriptions, diagnostic images, insurance data), health research activities (e.g., clinical trial records, biobanks, registries, genomic databases), and public health activities (e.g., immunization records, disease surveillance, vital statistics, etc.). These data sources have long been used for research purposes. Other sources of data, not necessarily related to health, can also be used for health research. For example, lifestyle and socioeconomic data (such as consumers’ profiles from loyalty cards, educational, and financial data), environmental data (e.g., meteorological records and pollution series), and behavioral and social data (e.g., from wellness apps, social media, wearables, etc.) offer new opportunities for capturing granular aspects of individual health. Linking these various sources can yield a more holistic understanding of health and disease, which in turn could lead to more effective prevention and treatment options.⁸

Health data are often collected under vague terms regarding their future uses. This has been exacerbated by the addition of non-health-related data sources — including data generated by individuals themselves as they act online, use apps and devices equipped with sensing technologies, or generate social media content. Often such technologies are portrayed as tools of empowerment, but they may also introduce new vulnerabilities for individuals, as users produce data for one purpose (e.g., tweets to connect with followers) while being completely unaware of what their data will be used for (e.g., pharmacovigilance research through analysis of Twitter content).⁹ These issues are closely linked to a longstanding problem of the online environment, that is, the blurred distinction between the public and the private sphere.¹⁰

Data Capabilities

Data collection activities have grown in tandem with analytical, technological, and policy capabilities that enable health-related uses of expanded data sources. As vast amounts of data are captured, stored, curated, and linked, novel analytics disclose patterns and infer-ences about health. Policies and governance structures are also being developed to allow interaction between dispersed and non-interoperable data sources. Health data access and interoperability are currently on the agenda of several leading policy agencies.¹¹

New analytic capabilities such as machine learning and neural networks have also begun to be used in biomedical research and health care. The application of these novel methods, however, introduces potential conflicts with some basic tenets of health research. Black-box medicine, for instance, employs opaque algorithms for data analysis that may not meet the transparency standards of evidence-based medicine.¹² Moreover, as these methodologies displace the role of human agents, issues of accountability and liability become more puzzling than ever. Insofar as health research is concerned, the use of automated data analysis methods begs for further ethical consideration — in particular, to guard against the possible revival of genetic determinism and racial categories fueled by the ease of drawing correlations within extensive multi-parametric datasets.

Data Stakeholders

Another crucial part of the ecosystem is the increasing number of stakeholders. Some of these stakeholders have always been involved with health data, for example, the pharmaceutical industry or health care providers. Yet, new ones are emerging, such as the data analytics industry providing sophisticated technical capabilities or social media giants sitting on massive amounts of data. These “insurgents” enter the domain of health bringing corporate cultures that are not necessarily aligned with existing regulations in health research.¹³

New dependencies and constellations of power are emerging. Stakeholders take on leading roles in the health data ecosystem due to their advanced (and often proprietary) technical know-how and their role in setting technical standards. Meanwhile, more traditional stakeholders acquire new roles. For example, citizens and patients use the big data capabilities to access and use their own data for their own purposes — as in the case of the Quantified Self movement, which enables individuals to analyze their own data to make discoveries about themselves.¹⁴ Other potentially more controversial uses include individuals making their genetic and genomic data available for a fee. Some genetic and genomic companies interested in brokering consumers’ data to biotech firms are already exploring such business models.¹⁵ In these cases, patients can provide the missing link to connect disparate datasets ¹⁶ and to enact bottom-up disruptive innovation in health care.¹⁷ Patients organizing their own clinical trials or monetizing their data represent a substantial departure from the investigator-driven model of research premised on participants’ altruistic motivations.

II. The Fate of Consent

Access to data for research purposes, and to human data in particular, should meet certain conditions. Of paramount importance among those conditions is informed consent to the collection, storage, use, and sharing of health-related data. This cornerstone of research ethics enacts respect for research participants and promotes their fundamental ethical interests by disclosing information about a study’s purpose, risks, procedures (including procedures for handling personal samples and data) as well as measures to cope with harms resulting from participation. Yet, many scholars have questioned the function and the efficacy of informed consent in today’s medical and scientific practices. In particular, the role of consent has been challenged in the online environment where data flow from and toward many directions.¹⁸

In the field of biomedical research, complex regulatory requirements linked to the development and review of informed consent forms are often perceived as unnecessary bureaucratic burdens.¹⁹ Informed consent in clinical research has been considered “culturally biased, legalistic, ritualistic and unevenly enforced.”²⁰ A recent New York Times op-ed tellingly referred to it as a “farce.”²¹ In this context, some see consent as an empty “ceremony of individual control and choice,” for which we had better find new alternatives.²²

Doubts can be raised as to whether individuals can have meaningful control over escalating volumes of research data collected, for instance, in large-scale genomic datasets used by multiple researchers over long periods of time. Moreover, when consenting to have biological samples or data collected in biobanks, individuals often implicitly agree to future uses of their material under rather unspecific terms. Both in the United States and in Europe, for example, stored data and samples can generally be shared and reused without seeking additional consent provided they are deidentified. The U.S. Common Rule “incentivize[s] the use of specimens and information by allowing their use without the knowledge or consent of the individual once they have been stripped of identifiers.”²³ These practices are commonplace in the European Union as well,²⁴ undermining individual control over both the type of studies that will be undertaken and the entities with which samples will be shared.

To address this issue, the National Institutes of Health (NIH) Genomic Data Sharing Policy expects grantees to seek broad consent for reuse and sharing of participants’ data and samples, and looks favorably at the possibility of using dynamic or tiered consent.²⁵ The recently promulgated revisions to the Common Rule also promote the use of broad consent²⁶ as an efficient way of ensuring that data and samples are made as widely available as possible for research.²⁷ In recent years, however, some have cited the theory and practice of informed consent to warrant for other — more radical — possibilities. For example, some have argued that, when risks are minimal, consent to the further use of samples originally donated for research can simply be presumed.²⁸ Others, instead, have proposed “blanket consent,” that is, consent to any future research on one’s donated samples, with no further information on future uses, and with no further oversight.²⁹ “Open consent,” adopted by the Personal Genome Project, takes a transparency-based approach and asks donors to have their genetic and genomic data included in an open-access database, with no privacy guarantees.³⁰ Similarly, the so-called “Portable Legal Consent” allows individuals to share sensitive data — such as genome sequences — with a selected pool of research institutions.³¹

What these models have in common is that they maximize the availability of samples and data, impose little or no restriction on their use, and offer limited information or control to the individual. It is fair to ask whether unspecific consent is truly informed consent, a question that has already generated a variety of responses. Among the most popular of them are that unspecific consent promotes the development of science at the cost of “diluting” the ethical interests of donors and research participants;³² that the ethical soundness of unspecific consent is anchored on the role that well-functioning review boards play in research oversight;³³ or that the better solution to this challenge should be found in interactive types of consent that promise to allow participants to express and update their preference regarding the reuse and the sharing of their data and samples.³⁴

These issues are already thorny in the case of research employing what we called standard sources of health data. Further complications arise, however, when standard sources are combined with expanded sources of data produced outside of conventional clinical or academic settings, and collected through commercial devices — such as smartphones and wearable devices — or even over the Internet. In this case, most of the time, informed consent of the sort we are used to seeing in health research is simply not offered. Moreover, Internet users notoriously pay little or no attention at all to online privacy notices, which detail the conditions that people accept to release their data.

This disconnect is only getting worse with the advent of big data.³⁵ Informed consent was not originally con ceived for research relying on this type of data, and there are still no established ethical benchmarks to assess the use of data of this sort in the context of research.³⁶ Moreover, the collection and analysis of such data types can take place without the intermediation of institutional review boards, as in the case of citizen science projects or self-tracking activities.³⁷ Questions also arise about the efficacy of research consent when organizations possess large amounts of data that can be used for research — Facebook’s experiment on emotional contagion is a prominent example.³⁸ Nonetheless, a number of ethically relevant elements need to be taken into account. For instance, such data are not initially collected for the purpose of medical research, and data subjects cannot opt out from specific types of data processing (including research); nor are they given information regarding potential risks and benefits of research with their data. Moreover, some of the most distinctive forms of analysis in the era of big biomedical data, such as the use of machine learning algorithms, give rise to accountability issues that can hardly be managed through individual consent alone. Under these circumstances, it is hard to imagine how informed consent for medical research — as it is currently practiced — could be relevant to such novel types of research.

As the health data ecosystem expands and evolves, informed consent may leave important ethical interests of research participants unattended. In particular, unspecific informed consent seems to err on the side of providing limited information about the possible uses of personal information. This undermines participants’ capacity to exert control on donated data.³⁹ Insisting on consent while knowing that it does not satisfy informational requirements can create an illusion of control, which may compromise data subjects’ rights as well as public trust. What is more, emphasis on maximizing the reuse of samples and data while at the same time reducing the bureaucratic load on science can turn out to be a disincentive to the communication of clinically beneficial information to research participants.⁴⁰

One way of counteracting the tendency to provide less information concerning future uses of biological samples and personal data is to use informed consent models that make room for more individual choice. These solutions have emerged especially in the field of biobanking and genetic research.⁴¹ Authorization-based models and tiered consent, for instance, allow donors to decide upfront which type of studies they approve of,⁴² or even which kind of clinical information they want to receive and how they prefer to be recontacted.⁴³ Others have proposed a partnership-based approach in the field of genetic biobanks that, after initial broad consent, relies on continued communication between researchers and participants in order to keep the latter informed about ongoing research, collect more data, and inform them of clinically relevant results.⁴⁴ “Dynamic consent,” another variant, combines choice and ongoing communication, offering a user-friendly web-based interface that allows participants to receive information and update their preferences over time.⁴⁵

Increased granularity allows data subjects to exert more control over the conditions of exposure of their data. This is to be welcomed, as empirical evidence shows research participants are indeed concerned about not having sufficient control on their data.⁴⁶ Nonetheless, it also loads research participants with more direct responsibilities for the management of their data. Such control may lead to excessively self-protective behaviors — preventing data from becoming accessible for research⁴⁷ — or to over-exposure of personal data - which may harm data subjects by increasing the likelihood of discriminatory practices by insurers and employers. These risks notwithstanding, the value of more granular control over the exposure of self-regarding data cannot be ignored. Yet, as we explain elsewhere, enhanced granularity is more likely to arise from the synergistic effect of new forms of data governance than from innovative consent models alone.⁴⁸

The prospect of linking dispersed data sets raises two important issues: first, authorizations given for the primary data uses (whether the data are from the standard or expanded sources) are unlikely to cover all potential combinations of future uses; second, given the variety of entities involved in big data health research, in terms of both data sources and data capabilities, it is unlikely that the current oversight models will suffice. The combination of weakened consent and insufficient research oversight is potentially detrimental to health research in an evolving health data ecosystem. This state of affairs can result in direct harms to individuals and groups, and also risks damaging public trust in scientific research.

III. The Case for Systemic Oversight

Despite the interest in more granular consent models, there appears to be a tendency toward the wide-spread adoption of broad consent as the default model for data-driven health research. This is especially true of large-scale initiatives in precision medicine (for instance in the United States, United Kingdom, and Switzerland). The revised Common Rule, promulgated in January 2017, also introduces, for the first time, specific requirements for broad consent forms.⁴⁹ To alleviate the tensions built into current data prac tices in health research, we argue, oversight mechanisms should adapt to the ecosystemic features of health data.

We consider oversight activities as constitutive elements of health research governance. We use “gov-ernance” as a broad term encompassing a variety of approaches aimed at orienting and monitoring the activities of a group of stakeholders without relying exclusively on binding legal norms or pure market mechanisms.⁵⁰ Governance refers to activities such as self-regulation; soft law; codes of conduct; review bodies; auditing mechanisms; expert advice; coordination initiatives among public authorities, research-ers, and private actors; deliberation; citizens’ forums; and public engagement initiatives. Some governance mechanisms aim at channeling the activity of stakeholders in ways that correspond to public expectations or to previously declared principles (including ethical principles). These are what we consider the oversight components of health research governance. In different ways and at different levels, oversight mechanisms contribute substantially to the creation and maintenance of public trust in research initiatives. For the sake of brevity, we term the entirety of such components “the oversight pipeline” of health research.

We propose that the oversight pipeline of data-driven health research should be able to shape prac-tices and activities toward socially desirable outcomes. Given the interconnectedness and mutual dependencies of the health data ecosystem, we propose a systemic model of oversight for data-driven health research. The health data ecosystem that we have described in this paper is the result of a complex network of convergent technologies whose boundaries are not easy to set. Yet, converging technologies represent an opportunity for the development of innovative governance approaches.⁵¹ Such an approach should track critical points across the spectrum of data-processing activities and actors and remain attentive to the direction that technological development can take, in order to minimize risks for stakeholders while optimizing the delivery of public benefits.

Before we present the substantive features of a systemic orientation to health research oversight, a few preliminary considerations are in order. Systemic oversight is not limited to any particular phase of the data-processing lifecycle, nor is it undertaken by a specific body charged with oversight responsibilities in health research. Rather, systemic oversight spells out the substantive features that oversight activities should have for health research in an evolving data ecosystem. Such features are intended to create align-ment throughout the oversight pipeline — for existing bodies and mechanism, as well as for new ones that may have to be created in the future. Data-driven medical progress could be hindered by differences in regulatory cultures playing out across the wide spectrum of practices and stakeholders that characterize the ecosystem. Given the difficulty and the potential inefficiency of implementing a unique regulatory framework spanning multiple layers of interdependent data-related activities, common ground is needed for the governance of health research. This is more likely to happen at a higher level of abstraction, namely, with the adoption of a substantive point of reference by all the actors involved in research oversight activities. It is our contention that such common ground could foster coordination, increase trust, and prevent systemic crises for the field due to the misalignment of stakeholders’ motives and expectations.

The key substantive features of systemic oversight are: 1) the capacity to cope with the uncertainty that surrounds data collection and data uses through adaptive and flexible mechanisms; 2) the capacity to address the expanded temporality of data-related activities (from storing to re-analysis) through dynamic monitoring and responsiveness; and finally, 3) the ability to cope with the relational nature of big biomedical data by means of reflexivity and inclusiveness.

To account for the uncertainty that is typical of data-intensive health research, oversight mechanisms should not be seen as procedures for prospective risk assessment, but rather as adaptive instruments that respond to change. Recognizing the limits of anticipatory efforts in a fast-moving data ecosystem and the insufficiency of one-size-fits-all solutions to data governance, adaptivity refers to the capacity to devise specific oversight mechanisms for new data types and uses. The flexibility requirement, by contrast, demands that, for oversight purposes, data are treated under different rubrics depending on their actual use rather than their source. Adaptive and flexible oversight will enhance effective containment of harmful effects in case of security failures (such as data breaches, forced re-identification, and the like).

Large-scale data collection allows virtually infinite possibilities and combinations of data analysis methods that can be used to search for medically relevant correlations in datasets. The power of such analytical capabilities lies in the fact that they can be invented on the go. While certain parameters are set, it is hard to predict what future analytical developments will look like. This undermines the possibility of explicitly defining in advance the purpose of data collection and the commitment to limit data use to that purpose,⁵² thus endangering the creation of public trust around data-driven health research. It is also difficult to specify in advance whether data protection measures taken to ensure the privacy of data subjects can indeed achieve this goal. The effectiveness of privacy impact assessments (PIA), a well-established practice to ascertain privacy risks in data projects, has been challenged for this very reason.⁵³ Moreover, the opacity of algorithmic approaches, black-box medicine and the like, indicates lurking risks and the need for better accountability mechanisms.⁵⁴ Technological transformations are faster paced than in the previous world of standard data sources and analytics. At the same time, it is necessary, especially in the scenario we are depicting, to acknowledge the limits of anticipatory practices.⁵⁵ Since important technological players are bound to have sufficient resources to shape the field to their advantage, regulators may have a hard time trying to fix the downstream effects of such activities. Greater coordination is thus required between public authorities, academic players, and private actors in order to set up converging oversight practices able to adapt rapidly to evolving technological conditions.

Ethical oversight of data collection and use should be a continuous monitoring process aimed at detect-ing signals of novel vulnerabilities for research participants, such as potential harms of discrimination and new privacy risks. Ethical challenges exist throughout the whole data-processing lifecycle. Moreover, each instance of data analysis gives birth to more data with renewed life expectancy. These developments can instigate ethical transgressions that cannot be anticipated at the moment of authorized collection. Responsive measures should aim at preventing vulnerabilities from resulting in harm to individual participants or their community, as well as at containing and compensating harms should they occur. Such measures, however, cannot be entirely established during the evaluation phase of a given research project. Rather they need to be revised regularly to align with the expanded temporality of multiple data reuse.

A fundamental tenet of big data research is the identification of patterns and correlations within large collections of structured and unstructured data. In essence, such patterns will disclose not only how phenomena relate to one another but also how individuals relate to others, or groups of individuals to other groups of individuals. A typical biomedical big data project explores correlations among phenotypic, biological, and behavioral data to ascertain disease patterns. Revealing such relations can quickly implycate individuals and groups of people who were never aware of underlying correlations linking them to one another. This may have especially sensitive implications for both individuals and groups in biographical, cultural, ethnic, and racial terms. Nevertheless, it is impossible for the current one-stop shop model of ethical assessment to anticipate those outcomes and include all these features in the assessment of foreseeable risks.

Oversight activites should be reflexive enough to consider the effects of classificatory practices as they emerge from scientific activities (including their historical load and cultural consequences). It is crucial to cultivate awareness of how and why previous governance models have failed in this respect or have ended up reinforcing dominant interests and power structures over individual entitlements, communities’ interests, and the common good.⁵⁶ Reflexive oversight should thus foster the critical appraisal of the assumptions underlying previous regulatory arrangements.⁵⁷ Reflexivity can be fostered by engaging relevant stakeholders upstream and by including lay or traditionally under-represented voices (such as the voice of patients or that of socially marginalized communities) to promote mutual learning before technological path dependencies⁵⁸ become established.

IV. Points to Consider

Our systemic oversight model is not an isolated example of an approach providing a common ground for a variety of governance actors and activities. To begin with, the contribution of governance to social coordination, accountability, and public trust has long been established in political science and public policy studies. The so-called “new governance” (introduced in the United Kingdom in the 1990s) relies on public engagement of civil society actors, integration across government levels and between government and private actors, decentralization, deliberation, use of soft law instruments, experimentation, and mutual learning.⁵⁹

Many of these features are of relevance to systemic oversight as well. Interestingly, new approaches to governance have enjoyed widespread consideration in the field of science policy, in particular with respect to the public management of environmental issues. Approaches such as public deliberation⁶⁰ and dynamic oversight⁶¹ in nanobiotechnology, reflexive governance for ecological problems,⁶² and constructive technology assessment⁶³ all stress the “limits of prognostic knowledge”⁶⁴ and the importance of continued learning to redress power asymmetries among stakeholders. Moreover, some substantive features of systemic oversight like reflexivity, inclusivity, and responsiveness, are also characteristic of the Responsible Research and Innovation framework,⁶⁵ which aimed at promoting the democratic governance of science and innovation.

Innovative forms of governance have also been discussed in the domain of health research. “Adaptive governance,” for instance, conceptualizes research participants as a collective body to be consulted and included in the definition of genomic biobank policies.⁶⁶ One frequently proposed way to keep research governance structures in line with technological, social, and regulatory change is to adopt deliberative democracy practices. In biobank research, it has been proposed that consent should not be seen as a mechanism for individual choice, but rather as “consent to a governance scheme.”⁶⁷ Deliberative democracy techniques — like citizens’ forums — are tools that allow lay publics to provide input. Such forums can also become institutionalized and take the form of “citizen-led Community Advisory Boards” endowed with the right to propose policies on topics such as secondary findings, communication with participants, and the like.⁶⁸ The collective engagement of research participants in decisions about data governance (including the creation of guiding ethical and privacy principles) seems particularly well suited to the assemblage of large-scale repositories - such as those envisaged in flagship programs like the “All of Us” Precision Medicine Initiative.⁶⁹

In addition, in the field of health research governance, data access review has been proposed as a mechanism to assess precisely the risks connected with the re-use of personal data. Review processes can be focused on assessing coding and security measures⁷⁰ or can instead embrace a more comprehensive evaluation as in the case of Data Access Committees (DACs) in genetic and genomic biobanking. DACs typically evaluate the fit between data access requests and the original purpose of collection, make sure that those seeking access are technically qualified, stipulate data access agreements, and monitor possible violations.⁷¹ Along similar lines, Grady and colleagues endorse broad consent upon condition that future uses are overseen before approval (ongoing oversight) and that, whenever possible, communication with participants, and enforcement and monitoring activities take place.⁷²

These models of expanded and more effective governance in health research are laudable. Many of them possess some of the substantive features of systemic oversight. Yet, they have been proposed for standard sources of data, and they focus either on policy-setting mechanisms for large-scale research initiatives or on review procedures for the use of research resources.

Systemic oversight instead is intended for issues arising when data sources are mixed or when big data research is conducted by organizations that are not conventional players in the field of health research. Moreover, systemic oversight cuts across policymaking and operative decisions at the level of local research initiatives. Finally, this approach considers all data types as potentially sensitive data — irrespective of the context from which they were sourced.

Implementing the principles of systemic oversight across the spectrum of regulatory activities taking place in data-driven health research will certainly have numerous procedural implications, which we do not discuss here. Suffice it to say that oversight bodies adopting a systemic orientation will need to apply the principles of systemic oversight to their composition, their mandate, their operational mechanisms, and their enforcement and monitoring powers. Undoubtedly, this process of adaptation and substantive convergence toward systemic oversight will be complex.

Nevertheless, the required transformations are no greater than the scientific, medical and societal revolutions that big data are causing globally. The scale of the digital revolution in medicine and medical research is such that remodeling regulatory standards with the aim of steering innovation is not only desirable but rather imperative.

The legal landscape around the use of personal data — including for research purposes — is evolving and will continue to evolve in the years to come, as evidenced by the European General Data Protection Regulation (GDPR)⁷³ — adopted in 2016 and to become operative in 2018 — or by the planned revision of the Swiss law on data protection.⁷⁴ New legislation may also introduce new elements to the existing oversight pipeline, as is the case with the GDPR demanding the presence of data protection officers (DPOs) at each research institution.⁷⁵ While those developments are necessary, legal solutions alone cannot address the full complexity of the heterogeneous ecosystem of data-driven research. As noted by Laurie, legal frameworks for specific kinds of health practices (e.g., biobanking) have often proved ineffective and burdensome.⁷⁶ Moreover, nation-specific legal approaches to health data management may hinder cross-border collaboration and exchange. New legally required oversight components — like DPOs — will need to be aligned with the other pieces of the pipeline.

Efficient governance will require a common orientation between the various components of the oversight pipeline.⁷⁷ Systemic oversight endorses the idea of distributed responsibility for the processing of health data. This may lead to difficulty in tracing responsibility for decisions that affect different stakeholders in different ways. To avoid the dilution of accountability, we argued that the systemic oversight processes should remain modifiable through the input of concerned stakeholders (inclusivity).

The complexity of the health data ecosystem will require concerted effort to address emerging ethical issues. Enhancing the granularity of consent should definitely continue to be pursued. In addition, innovative research governance models need to be given appropriate consideration and tested in practice. However, the new reality of big data research within the evolving data ecosystem demands ethical controls that are spread throughout the continuum of regulatory activities and can respond to unexpected events across the life cycle of data use. We have argued that this can be achieved through the implementation of a systemic oversight approach tailored to the features of the health data ecosystem. Systemic oversight, we have argued, can become a catalyst for ethical health research in the big data era and holds the key to public trust in research. We have sketched the substantive cornerstones of such an approach without discussing the necessary procedural adaptations. Our aim is to generate discussion around the conceptual shift toward the systemic oversight approach, to make progress toward its operationalization.