Access to Personal Information for Public Health Research: Transparency Should Always Be Mandatory

Au Québec, la Loi sur l’accès aux documents des organismes publics et sur la protection des renseignements personnels offre une exception en matière de transparence à la plupart des institutions publiques où la recherche en santé publique est menée en leur permettant de ne pas divulguer leurs utilisations de données à caractère personnel (souvent collectées sans le consentement des personnes étudiées). Cette exception est éthiquement problématique en raison de préoccupations importantes (ex. : la protection de la vie privée et les inconvénients potentiels des utilisations secondaires de données) et nous soutenons que tous ceux qui mènent des recherches doivent être transparents et responsables du travail qu’ils accomplissent dans l’intérêt public


Introduction
Public health surveillance activities (e.g., of communicable diseases, cancers) and public health research requires access to a wide variety of personal data, often without the consent of citizens or research participants. Access to population data is crucial for evidence-based decision-making and the development of informed public policy and interventions [1]. With recent advances in data collection and analysis (and "Big Data"), there is enormous potential for public health research to help address many of the most challenging problems facing society. But even when conducted with a clear public interest in mind (i.e., to promote public health and prevent disease and disability), public health research can raise important concerns about the protection of privacy, the validity of individual consent and potential harms of secondary use of personal data [2][3][4].
It is widely accepted that research participants have a fundamental right to give free and informed consent to participate in research. Normative guidelines in Europe and North America provide robust safeguards to ensure that research participants are protected against the potential harms of unregulated and unrestricted data access and sharing [5][6][7][8][9]. But while these norms are clear for health and social research involving human participants, there is ambiguity for public health research. This is especially the case when public health researchers and surveillance teams involve the same colleagues using the same datasets that stem from other projects and designed for other purposes. It is unclear that normative research ethics frameworks are adapted to current (e.g., epidemiological) and future (e.g., Big Data) public health research, particularly with regards to the protection of individual information and transparency about what research is being conducted, by whom and for what purposes.
In Québec, the Act Respecting Access to Documents Held by Public Bodies and the Protection of Personal Information [10] (hereafter, the Access Act) provides a good example of this problem. This law governs access to information and the protection of personal information and privacy, a fundamental right in the Province of Québec, Canada, as is clearly proclaimed in Chapter 1 of the Québec Charter of Human Rights and Freedoms [11, Art. 5]. While most governmental organizations and agencies are legally required to disclose, on an institutional website, an inventory of all personal information files held [10], an exception is made for the very places where most public health research is conducted, that is, universities, hospitals and public health research centres. These concerns are particularly problematic when we consider that most personal data collected by public health institutions in Québec is allowed by public health legislation, with little or no public awareness [12]. Without real transparency about the use of citizens' medical data and other personal information, there is no way for the Québec population to ensure that their data are used properly, and ultimately, to know that their trust in actors of the state is well placed.
In the last few years, there has been a push, from both the scientific [13] and political [14] community, to revise data access provisions and processes. In response, a reform of the Access Act was presented by the government to the National Assembly in May 2018 [15]. Bill 179 focused on allowing more access to personal health data for population-based research, unfortunately, but it did not include any provisions for more transparency regarding the uses of personal health data (especially for public health research). While this Bill died on the order paper [16], we argue that there is a window of opportunity for adding provisions in a revision of the Access Act to address an exceptionalism (granted to certain institutions) that is detrimental to the public interest.
Page 95

An Inequitable Transparency Requirement
A growing number of personal information files (PIF) are stored on the servers of universities, hospitals and public health research centres. This information is collected for public health activities, such as the surveillance of cancers or infectious diseases [17] or for research purposes [18], sometimes with and at other times without individual consent [8,10,12,19]. In Québec, public health stakeholders or researchers may have access to personal information without individual consent, with permission granted by institutional actors such as the Director of Professional Services of a hospital [20,Art. 19.2] or the Québec Access to Information Commission [10, Art. 67 to 68.1 and 125]. These authorizations may be granted following specific conditions: 1) individual consent is unfeasible (e.g., epidemiologic studies with large populations), 2) intended use is necessary to accomplish a public health mandate or for research purposes, 3) purposes pursued cannot be achieved unless the information is communicated in a form allowing persons to be identified, and 4) personal data will be used in a manner that will ensure its confidentiality [10,20,21].
The Québec law specifies that public bodies regulated by the Access Act are required to disseminate on a website an inventory of their PIF, as well as "studies, research or statistical reports produced by or for the public body, whose distribution is of interest for the purposes of public information" [22,Art. 4]. As prescribed by the Access Act [Art. 76], PIF inventories must be kept up-to-date, disseminated and must include: (1) the title of each file, the classes of information it contains, the purposes for which the information is kept and the method used to manage each file; (2) the source of the information entered in each file; The inventory includes the list of all PIF that have been communicated under the application of a law, a mandate or a service contract [10]. For example, the Quebec Breast Cancer Screening Program contains personal identifiers, health data and demographic data (classes of information) on women between 50 and 69 years of age (categories of persons). Access to this file is restricted to some professionals (categories of persons) of the Institut national de santé publique du Québec (INSPQ), a public health organization that has a mandate from the Québec Ministry of Health and Social Services (MSSS) for this program 2 .
Interestingly, unlike government organizations regulated by the Access Act, universities and hospitals are not required to comply with the Access Act's regulation, i.e., Regulation Respecting the Distribution of Information and the Protection of Personal Information [22] (hereafter Regulation). Also, public health research centres (e.g., Institut national d'excellence en santé et services sociaux du Québec) that have access to significant amounts of personal information to carry out mandates entrusted by government organizations (e.g., Ministry of Health) [23], including public health research, do not have to comply with some parts of the Access Act and its Regulation. Specifically, these institutions do not need to disseminate on their websites information regarding their PIF inventories or publish the list of studies using PIF, which may include information extracted from patient medical records. Public health research centres usually disseminate on their websites information regarding studies, research or statistical reports but they do not publish their PIF inventories [24,25]. As a result, there is no way for the Québec population to know what institutions are currently using their personal information without their consent.

Respect of Privacy and Transparency as Crucial Ethical Norms
The current asymmetry between legal requirements and the exemption enjoyed by the very centres where most public health research is conducted raises important ethical issues. The exemption comes without any binding, accessible and long-lasting evaluation mechanisms that could enable the general public or research participants to ensure that public health stakeholders or researchers are compliant with expected ethical obligations, including respect for privacy and the protection of confidential information. Public health research centres are thus exempted from an important legal requirement and ethical responsibility. Even if research ethics boards (REB) in Québec normally assess research data management plans when reviewing protocols, their oversight is limited to particular projects. Further, they are rarely equipped to do long-term surveillance of data management practices [8], and they and their institutions do not normally make publicly available the list of studies being conducted. Also, the line between data collection for public health surveillance activities (not requiring research ethics review) and the secondary use of the same data for public health research (normally requiring ethics review) can be a source of some confusion for public health researchers [26,27]. Finally, the role and responsibilities of REBs in evaluating public health 1 The Access Act does not define the terms 'classes of information' or 'categories of persons'. Based on the information available on the website of the Ministry of Health and Social Services in Québec (MSSS), these terms are related to the type of data (e.g., health, education, personal identification), the persons concerned by these data (e.g., client, employee, citizen), and the persons who have mandated access to these data (e.g., authorized employees  [8] applies the principle of respect for autonomy to all participants in research, including "those who are participants because their data…are used in research". More generally, it also includes "a commitment to accountability and transparency in the ethical conduct of research" [8]. But what means are available to the general public or research participants to ensure compliance with their consent and protection of their privacy when it may be exceedingly difficult, if not impossible, to inventory PIF or even the number of studies performed? In the absence of inventories, it is not possible to independently assess the appropriateness of the use of citizen or participant information or appreciate the number of studies for which an REB has approved secondary use of data. Participants cannot exercise their right to withdraw from a study or to be informed of its findings, if they are unaware that their data is being used. While the TCPS2 highlights the importance of transparency and accountability when it comes to clinical trials [8], more public transparency regarding the use of personal data in public health research is also needed. The Québec case is interesting because it highlights an asymmetry in data use accountability by various institutions. Current trends in data use add an extra dimension to the complexity of the case and a paradoxical situation for individuals. On the one hand, more and more personal data are collected which is making it easier to re-identify individuals simply by crossing certain datasets. On the other hand, it is more difficult than ever for a person who wishes to revoke their consent to ask for data withdrawal; whereas data is widely shared and stored on servers that are accessible to various institutions and individuals (i.e., less under the control of a single entity having full authority over its use), it is difficult (if not impossible) to ensure that a person's data will be removed. In such a situation, it is necessary both to rethink the very notion of consent to the use of personal data for various purposes (e.g., research, public health), but also to raise awareness of the fact that personal data is more accessible than ever and that it is difficult to control access to data and to remove datasets. In such a context, transparency is key to enabling individuals to better understand the (potential) uses that are made of their data.
As proposed by the Québec Commission d'accès à l'information in 2016 (14), legislation should evolve to ensure uniformization of the requirements for data use (i.e., all institutions should be subject to the same conditions) and take into account the potency of new data use practises and the impact on the expression of individual consent (implicit or explicit). Exceptionalism for some is not in the public interest; data access and usage should always entail high levels of transparency and accountability. There is a growing pressure to revise the Access Act, especially to ease and speed up data access processes [14,28,29]. Whether it is through a new version of Bill 179 or any future attempts to revise the Access Act, it is imperative that transparency and accountability be sine qua non values for data access and usage.

Conclusion
If privacy "refers to an individual's right to be free from intrusion or interference by others [and] is a fundamental right in a free and democratic society" [8 p.57], then the obligation to disseminate PIF inventories and results obtained from their use in universities, hospitals and public health research centres should also apply to these institutions. Attention to transparency is an important way to ensure the implementation of efficient management mechanismssuch as laws, regulations, REB review and oversight, self-regulation -which together can help restore a balance between researchers' pursuit of knowledge and participants' right to privacy [30]. There is no right to conduct research, but there is still a right to privacy [19 Art. 3]. Researchers should only collect and access the information needed for their research, and not simply collect everything they can [2,31], especially if they agree with the importance of protecting privacy as a fundamental right [11]. Institutions must ensure that public health research is conducted in an ethical and responsible manner, and that good research does not come at the expense of the protection of privacy. In so doing, by being transparent, institutions demonstrate that they are accountable and working in the public interest; they are trustworthy because they demonstrate that they have nothing to hide [32].
Ringuette is PhD student at Université de Montréal and analyst at the Commission d'accès à l'information du Québec (on leave without pay to complete her PhD studies), the office of the privacy commissioner in the Province of Québec. The content of this article reflects the opinions of the authors and not those of any organization or institution. All the authors declare that they have no conflicts of interest related to this manuscript. Ringuette is an Editor of the Canadian Journal of Bioethics (CJB; formerly BioéthiqueOnline), Bélisle-Pipon is cofounder and former Executive Editor of BioéthiqueOnline, and is a member of CJB Editorial Advisory Board. Williams-Jones is the Editor-in-Chief of CJB. None of the authors were involved in any part of the editorial review process.
Reviewer evaluations are given serious consideration by the editors and authors in the preparation of manuscripts for publication. Nonetheless, being named as a reviewer does not necessarily denote approval of a manuscript; the editors of Canadian Journal of Bioethics take full responsibility for final acceptance and publication of an article.