- Email: [email protected]
Cancer registration, public health and the reform of the European data protection framework: Abandoning or improving European public health research?
European Journal of Cancer (2015) 51, 1028– 1038
Available at www.sciencedirect.com
ScienceDirect journal homepage: www.ejcancer.com
Cancer registration, public health and the reform of the European data protection framework: Abandoning or improving European public health research? Mette Rye Andersen ⇑, Hans H. Storm, on behalf of the Eurocourse Work Package 2 Group Danish Cancer Society, Cancer Prevention& Documentation, Strandboulevarden 49, DK 2100 Copenhagen, Denmark
Available online 10 October 2013
KEYWORDS Cancer registry Cancer registration Epidemiology EU data protection Public health Confidentiality Consent Ethical guidelines
Abstract The importance of cancer- and other disease registries for planning, management and evaluation of healthcare systems has been shown repeatedly during the last 50 years. Complete and unbiased population-level analyses on routinely collected, individual data concerning health and personal characteristics can address significant concerns about risk factors for cancer and provide sound evidence about public health and the effectiveness of healthcare systems. The existence of quality controlled and comprehensive data in registries, allowed to be used for quality control, research and public health purposes are taken as granted by most health professionals and researchers. However, the current revision of the European Union (EU) data protection framework suggests a harmonisation of requirements for confidentiality and individual consent to data processing, likely at the expense of proper use of registry data in the health sector. Consequences of excessive confidentiality rules that may lead to missed data linkages have been simulated. The simulations provide one possible explanation for observed heterogeneity among some cancer incidence data. Further, public health, quality control and epidemiological research on large populations can no longer provide evidence for health interventions, if requirements for consent renders research impossible or where attempts to obtain consent from each data subject generates biased results. Health professionals should engage in the on-going debate on the Commission’s proposal for a General Data Protection Regulation. The nature and use of registry data in public health research must be explained and known to policy-makers and the public. Use of cancer registry
⇑ Corresponding author:
E-mail addresses: (M.R. Andersen).
[email protected],
[email protected]
0959-8049/$ - see front matter Ó 2013 Elsevier Ltd. All rights reserved. http://dx.doi.org/10.1016/j.ejca.2013.09.005
M.R. Andersen, H.H. Storm / European Journal of Cancer 51 (2015) 1028–1038
1029
data and other epidemiological activity will terminate abruptly if an unnecessarily strict EU data protection regulation is adopted. Research based interventions, as well as the international recognised standing of cancer registries and register-based research institutions in Europe are at stake. Ó 2013 Elsevier Ltd. All rights reserved.
1. Cancer registration and public health The importance of cancer- and other disease registries for planning, management and evaluation of healthcare systems has been shown repeatedly during the last 50 years. Complete and unbiased population-level analyses on routinely collected, individual data concerning health and personal characteristics can address significant concerns about risk factors for cancer and provide sound evidence about public health and the effectiveness of healthcare systems [1–14]. Register-based, epidemiological research has examined an extraordinary range of questions: from the predictive use of cancer screening programmes, to shifts in bacterial antibiotic resistance, to the cost effectiveness of various drug and surgical treatments, long-term effects of exposure to radiation be it medical, accidental or environmental, to the efficacy of bicycle helmets in reducing head injury. The list of important research results is long [8,15], and due to this kind of research it has been possible to protect human lives and avoid premature death. Epidemiological research is based on accurate individual data compared to population groups with similar characteristics. Data from each individual in the population studied are paramount for reliable research. Record linkage is a very powerful tool in this respect. However, analysis will concern grouped data of relevance to a larger population, and epidemiological research findings are reported in statistical format only, without any possibility to identify individual data subjects. The Prostate Cancer data Base Sweden (PCBaSe) serves as example of a unique resource for public health research. In the PCBaSe the Swedish National Prostate Cancer Register (NPCR) has been matched against the cancer register, cause of death register and more than 10 other national population based registers [16,17]. In the PCBaSe it is now possible to connect cancer data to for instance family history, prescriptions of medication, other disease, etc. In such a setting confidentiality is crucial since information is gathered from different sources composing a rich data set that does not normally exist. Hence it is important to secure confidentiality of individual data and to regulate and control register activity. If the EU imposes restrictions that hinder collection and/or linkage of personal data, such as health data, valuable research projects will be abandoned, with serious consequences for policy interventions that influence
the lives of all European citizens1 Table 1, lists the advantages of register-based research at stake. 2. EU data protection Protection of personal data has a long history originating from the Nuremberg code in 1947, followed by the first Helsinki declarations by the World Medical Association since 1964, the Belmont report in the United States (US) in 1979 and the Council of Europe convention 108 in 1981. Table 2, summarises the Council of Europe convention. In 1995 the EU adopted the European data protection directive (95/46/EC) [20] on protection of individuals with regard to the processing of their personal data and the free movement of such data. In general, EU directives lay down end results that must be achieved in every Member State. National authorities have to adapt their laws to meet these goals, but are free to decide how to do so.2 While Directive (95/46/EC) (henceforth ‘Directive’) set out European data protection objectives and standards for the collection, storage and use of personal data, Member State implementation has led to rather heterogenic regulation regarding the use of data for public health research across the EU [21], moreover hindering data sharing for research purposes. While some Member States have been favourable to register-based research, such as the Nordic, other Member States have imposed serious constraints on disease registry operation [22,23], and in some cases disabled or even forced the closure of long-established cancer registries.3 Constraints intended to improve patient confidentiality and protect personal data from misuse, regrettably failed to take account of the public health impact by creating obstacles to the development and monitoring of policies aimed at improving public health [8,24]. 1 In Norway interpretation of data protection regulation lead to problems in evaluating the Norwegian Breast Cancer Screening Programme as women without cancer should be deleted from the files, unless they consented to use of the data again. Source: http:// www.forskningsradet.no/prognett-mammografi/Nyheter/Mammografievaluering_i_gang/1253973915651/p1226994052839, http:// www.kreftregisteret.no/Global/Publikasjoner%20og%20rapporter/ Special%20Issue/Special_Issue_Cancer_in_Norway_2009.pdf. 2 http://ec.europa.eu/eu_law/directives/directives_en.htm. 3 In the former West Germany (1991), former East Germany (1991) and Hungary (1992) constraints caused the closure of several cancer registries and very nearly did so in the UK (2000) (Gouveia et al.)
1030
M.R. Andersen, H.H. Storm / European Journal of Cancer 51 (2015) 1028–1038
Table 1 Important advantages of register-based research [18]. Unbiased data collection on the entire population reflects real life situation and may point to interventions that benefit at the population level in the future. Fast and cost effective compared to experimental or other prospective studies. Retrospective approach is possible when studying exposures with long latency (such as radiation), and often is the only resource when latency time is of essence. Analysis based on very large data sets increasing the statistical power limiting erroneous conclusions. Possible re-examination of data accrued in other research settings (such as clinical trials). Unexpected findings, i.e. differences among subpopulations not included in clinical trials. Review outcomes, such as patterns of diagnostic accuracy, conformity of practice with guidance, or other matters of routine that do not lend themselves well to experimentation. Only option when controlled trials are simply not possible for ethical reasons. Can help study questions, generate hypotheses, identify potential recruits for experimental studies and inform the design of other research. Need not include the data subject’s involvement.
Table 2 Council of Europe - European Treaty Series - No.108 [19]. Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data Article 5 of the Convention states that personal data undergoing automatic processing shall be: – obtained and processed fairly and lawfully; – stored for specified and legitimate purposes and not used in a way incompatible with those purposes; – adequate, relevant and not excessive in relation to the purposes for which they are stored; – accurate and, where necessary, kept up to date; – preserved in a form which permits identification of the data subject for no longer than is required for the purpose for which those data are stored.
Last year the European Commission proposed to replace the Directive by the General Data Protection Regulation.4 The overall intention of this reform is to protect personal data and to facilitate a free flow of data within the EU; also aiming to overcome problems alluded to by the research community concerning data sharing across borders for research purposes. The outcome of the data protection reform is crucial to all epidemiological activities and clinical quality control in the EU. In contrast to a directive, a regulation is binding by itself and does not need implementing legislation by the Member States. It implies a harmonisation of data protection measures across the EU, including use of data for public health purposes such as prevention and evaluation of screening programmes. On the one hand harmonisation may facilitate valuable data sharing for research purposes, but on the other, excessive regulation can easily disable even simple monitoring of cancer, with disastrous consequences for public health information [25]. For these reasons a revised directive, leaving room for national adaptation, may be a better regulatory instrument than an EU regulation for promoting public health and European research. This is still debated in the on-going policyprocess.
The proposed regulation counts 118 pages and includes 91 articles, some of which should be changed while others must be preserved in their present wording. The latter applies particularly to the articles concerning processing of personal data concerning health (article 9), the right to be forgotten (article 17) and processing of data for historical, statistical and research purposes (article 83). These articles contain exemptions without which cancer and other routine monitoring of diseases, survivorship, treatment outcome and research into risk factors for diseases will terminate abruptly.5 Article 9 prohibits any processing of personal data concerning health, exemptions made for cancer registration and public health research (article 9.2). Article 17 concerns the right to be forgotten, vital exemptions made. Storage, use and reuse of data across generations must be possible, and databases will lose their value for research and public health, including the use of historical series if the exemptions currently contained in article 17 are removed. Further article 83 provides an exemption to the principle of explicit consent for processing data for historical, statistical and research purposes. Content and exact wording of the proposed regulation is subject to change during the on-going reading of the European Parliament and negotiations in the Council. Amendments proposed during the European Parliament’s current reading suggest a removal of
4
The European the Commission’s Proposal for a Regulation of the European Parliament AND OF THE Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (COM(2012)11).
5
For a more comprehensive account on the policy implications of the proposed regulation for European register based research see www.encr.org or www.eurocourse.org.
M.R. Andersen, H.H. Storm / European Journal of Cancer 51 (2015) 1028–1038
indispensable research exemptions, if adopted hampering possibilities to conduct register-based research.6,7 While the underlying intention of reforming the EU data protection framework is welcomed, the pursuit of greater legislative coherence across the EU must be balanced fairly against the possibilities to conduct registerbased research in countries proved excellent in this. The on-going policy-process must be followed closely. 3. Confidentiality and personal data Epidemiological research depends on the balance between preserving patients’ integrity and anonymity while also enabling important research to improve people’s health and the quality of care [26]. In carrying out research for public good there must be adequate data protection to safeguard personal data against misuse, and the person against discrimination and stigmatisation. The need to safeguard the confidentiality of personal data is therefore conscientiously observed8 [28]. Guidelines on confidentiality and ethics for cancer registries have existed both for Europe (ENCR) since 1992 and worldwide (IARC) since 1991 [9,29]. The European Guidelines were revised in 2004 and in 2012 [27,30]. They define the measures to be taken to protect the privacy of the individual patient, the doctor and the hospital. They specify that information must be regarded confidential, and set out measures for establishment and periodic review of both physical and electronic security procedures, the requirements to be met before release of confidential data for research and other purposes, and the constraints to be satisfied by any publication derived from the data.9 A cancer/disease registry must maintain the same standards of confidentiality in handling identifiable data as customarily apply to the doctor–patient relationship. This obligation extends indefinitely, even after the death of the patient [27], even when data are pseudonymised. Pseudonymisation of personal data is essentially the replacement of personal identifiable information, such as name, address, social security number etc. Personal 6 Tabled amendments and procedure files concerning the proposed regulation: http://www.europarl.europa.eu/oeil/popups/ficheprocedure.do?reference=2012/0011(COD)&lg=en. 7 For more detail on epidemiological research and amendments called for by the European Parliament’s Committee on Civil Liberties, Justice and Home affairs see for example: Ploem MC, Essink-Bot ML, Stronks K. Proposed EU data protection regulation is a thread to medical research. BMJ 2013; 346:f3534. 8 Confidentiality can be described as the respectful handling of information disclosed within relationships of trust, such as healthcare relationships, especially as regards further disclosure. Confidentiality serves privacy, which is, though elusive, a widely understood and deeply felt concept regarding the status of information about aspects of an individual’s life [27]. 9 See for example ENCR (2012): Guidelines on confidentiality and ethics for population-based cancer registrationand linked activities in Europe.
1031
identifiable information is earmarked by codes, while the link (key) between the code and the information is stored separately.10 Pseudonymised data can be considered anonymous data, depending on the circumstances [31]. It is important to notice that not all Member States consider data, pseudonymised before they reach the research domain, anonymous to the researcher. The latter is the case in the Nordic countries, where unwanted re-identification is considered possible as long as the key between code and information exists. In most settings the use of registry data for research purposes depends upon review by an ethics board ensuring that the use of registry data is in line with societal values at the given time. 4. Confidentiality and public health in conflict Collection of unambiguous identifying information on each data subject is essential, both in order to maintain the quality of registry data, avoid duplicate registrations to enable follow-up e.g. linkage to death certificates, and for use of the data for research and quality control. In some countries methods are used that mask the true identity of the individuals such as encryption or pseudonymisation for data processing – both as security and as confidentiality measure. Pseudonymisation and encryption systems however, are influenced by trivial errors in the data used in the anonymisation process. Such errors will appear irrespective how perfect a system is rated and increase the risk of missed linkages of data on single individuals. A simulation of errors in linkage has shown major effects on long-term survival – overestimating survival after 10 years of follow-up by more than 10% if 5% linkages on date of death were missed – which without a unique personal number was not uncommon [32]. In Germany an encryption system is required in order to allow for the establishment of epidemiological cancer registries. German cancer registries are working on the basis of trusted third party (TTP)/privacy enhancing technology (PET) concepts (Tables 3 and 4). Cancer registration is by law divided into two separate offices; a notification office where the ID of a person is known, and a registration office that receives the data from the notification office with the ID encrypted. For 3 months it is possible to link back to the actual individual data, after this period linkage and data analysis is conducted on the encrypted data [33,34]. New data can be added only using the same/pseudonymisation key as when data was recorded. Errors in the original data cannot be found and corrected as the link to the actual individual is lost.
10
Source: http://www.sapior.com/news/2007-07-23.
1032
M.R. Andersen, H.H. Storm / European Journal of Cancer 51 (2015) 1028–1038
Table 3 Trusted third party (TTP). The trusted third party is an entity which facilitates interaction between two parties (sender and receiver) who both trust the third party. The Third Party reviews all critical transaction communications between the partiesa The standard TTP does not exit. In health care the TTP functions to mask the identity of the data subject. The patient data will be pseudonymisedb a b
http://en.wikipedia.org/wiki/Trusted_third_party. van Veen EB, Patient data for health research, MedLawconsult 2011, p. 57–62.
Table 4 Privacy enhancing technology (PET). PET is a general term for a range of different technologies to protect sensitive personal data within information systems. PET comprises a set of computer tools, applications and mechanisms which protects personal identifiable information by eliminating or minimising personal identifiable data thereby preventing unnecessary or unwanted processing of dataa http://en.wikipedia.org/wiki/Privacy-enhancing_technologies.
The TTP/PET system is costly. Two independent and staffed offices are needed, and all IT-structures must be build-up twice. Additionally, the communication between both offices and between the reporting physicians is time consuming and known to be difficult. A crude estimate of the additional costs of the TTP system for German cancer registries is 30–50% cost of registration [35]. To this adds problems in relation to anonymised data if based on imprecise reported or changed ID data. Since anonymisation algorithms rely on gender, date of birth and name, and can be supplemented by place of residence, one may assume such a system to be rather robust. However, people change names, misspellings occur, residence may change and small errors in the name, date and year of birth used by the encryption software may result in missed linkage and duplicate entries may be introduced into the cancer registry. A missed link to a death certificate, one pillar in proper cancer registration, and/or to an already reported case may influence not only the incidence but also the estimation of survival. In the study of occupational risk factors for cancer, which often is determined on few cases, a missed link between a worker and a rare cancer like leukaemia may completely change conclusions and refute a true risk or implicate a false risk. The argument that other methods than register-based research are used when studying occupational cancer is often raised. These methods however, may be subject to ascertainment and recall biases which rarely influence routine monitoring (Table 1). A simulation of the consequences of missed linkages to mortality data was carried out by Eero Pukkala from the Finish Cancer registry [32] (Fig. 1). As can be seen the deviation from the true standardised incidence ratio (SIR) is quite large even with a small error about 2% in mortality linkage. The error increases in importance by increasing the age of the study subjects.
In order to assess the span in overall cancer incidence and mortality (Fig. 2), we studied cancer incidence trends from 1987 to 2007 in four countries with long standing cancer registration (Denmark, Finland, Iceland and the Netherlands) using the ECO website (http:// eco.iarc.fr//Default.aspx 16-10-2012) developed under the EUROCOURSE project. The differences in incidence (age adjusted European standard) between the countries are about 50 cases per 100.000, the trends are increasing both due the ageing of the population and impact of risk factors for cancer, whereas the mortality is decreasing as a sign of better treatment and earlier diagnosis. Comparing this to Germany (Fig. 3.) where we have selected six La¨nder, those with highest, lowest and intermediate incidence, we see a span of 100 cases per 100.000 from a low incidence in Berlin to a very high in Saarland – i.e. twice the span seen between the Nordic countries and the Netherlands. The trends in incidence recorded in Germany behave rather unexpectedly with a decline in Schleswig– Holstein and Munich, stability at a high level in Saar-
1000
Error 0%
100
Error 2%
SIR
a
Error 5% Error 10%
10
Error 20%
1 40-49
50-59
60-69
70-79
80+
Age
Fig. 1. Change in standard incidence ratio (SIR) by error in linking mortality data to a cancer registry. Source: http://eco.iarc.fr/.
M.R. Andersen, H.H. Storm / European Journal of Cancer 51 (2015) 1028–1038
1033
Fig. 2. Cancer incidence and mortality at all sites of Finland, Denmark, Iceland and the Netherlands, in men. Age-standardised rate – EU Standard (ASR(E)). Source: http://eco.iarc.fr/.
land, a clear artefact between year 2000 and 2001 in Hamburg, and a low incidence in Berlin. The declines may be a result of picking up prevalent cases or duplicate cases which could be related to the registration procedure with encryption and poorer control over the data in the earlier years of cancer registration. The Hamburg graph can only be explained by a registration change with inclusion of either a new data source or a new entity. The stability of the rates in Saarland is contrary to the expected, if life expectancy is increasing as in the Nordic countries. One may argue that trends in all cancer (excl. skin) are a poor comparison, hence we studied lung cancer incidence and mortality, where due the poor prognosis incidence and mortality should follow each other closely (Fig. 4). The span between incidence and mortality is higher in Germany than in the Netherlands, Denmark and Finland and indeed the trends in some of the German La¨nder are of concern. It is not possible from these observations to other than speculate on the reason behind the differences. It may be artefactual linked to the registration procedures.
Be it in reporting and/or inability to do routine quality control of the reports on an individual level without a cumbersome procedure through a trusted third party (TTP), such as the Notification office, which is necessary if one needs to asses if all linkages pertain to the same individual. It is obvious that observed differences if true are really important, as this may point to exposures and behaviours of population that may impact the cancer pattern and care. Likewise it is obvious that if differences are based on registration differences and even artefacts, false conclusion may be drawn that can potentially harm large populations or at least in vane change the life of thousands of people. A requirement of monitoring is that the data must be correct [19]. If confidentiality regulation and security procedures lead to less correct data and in turn to erroneous conclusions on analysed data, more harm than benefit for the societies and for the individual will be the result. Another tool to safeguard autonomy over personal data is consent, e.g. giving the data subject control over the processing of his/her data. As discussed below, consent plays an important role in clinical research. Yet depending on the context, this does not exclude the
1034
M.R. Andersen, H.H. Storm / European Journal of Cancer 51 (2015) 1028–1038
Fig. 3. Cancer incidence and mortality at all sites in six German La¨nder, Finland, Denmark and the Netherlands, men. Age-standardised rate – EU Standard (ASR(E)). Source: http://eco.iarc.fr/.
possibility that consent is an unfortunate basis for processing of data for register-based research purposes. 5. Principles of research ethics Some of the basic principles in all research ethics are the individuals’ right to integrity, autonomy, and to refrain from participation in research. In the medical research practice this implies that research subjects should never be exposed to a risk in association with a research project without their explicit consent.11 This practice was advocated following World War II [36], in part to protect subjects from harm in experimentation and in part from personal data protection regimens based on human rights. It concurs with the duty of medical confidentiality and the need to protect patients, research subjects and 11 Explicit consent can be defined as any freely given specific and informed decision of the data subject with which the data subject signifies his or her agreement to personal data relating to him or her being processed [27].
personal data remains unquestioned. It is, however, increasingly acknowledged that the thinking behind explicit consent is premised on the clinical encounter between doctor and patient. In modern health care systems with highly complex data flows, such a form of consent is unlikely to be adequate for all purposes [18]. The obligation for clinical researchers to acquire explicit consent from their research subjects is a means to ensure that the decision to participate in any medical research is in fact the research subject’s [37–39]. In register-based research, however, there is no risk to the health of the data subjects as there in general is no direct contact to the data subjects. Likewise the potential risk of breach of confidentiality or unauthorised use of collected data is effectively kept low, and results presented in tabular or graphical format from where no individuals can be identified. On these grounds there is a growing recognition that the codes of conduct in medical and in epidemiological research should be considered separately.
M.R. Andersen, H.H. Storm / European Journal of Cancer 51 (2015) 1028–1038
1035
Fig. 4. Lung cancer incidence and mortality in six German La¨nder, Denmark, Finland and the Netherlands, men. Age-standardised rate – EU Standard (ASR(E)). Source: http://eco.iarc.fr/.
5.1. The consent tradition and epidemiological research ethics The consent tradition arguably has a liberal ideological background with a strong emphasis on an individual’s right to self-determination [40]. Fierce proponents of this tradition argue that the costs to an individual cannot be balanced with the benefits to society. Serving as research ethics any use of an individual’s data require explicit consent, strongly favouring individuals’ rights, mainly as to limitation of purpose and onward disclosure of data [18]. In the EU access to medical care has become a right to all citizens. Whether universal or insurance-based, European healthcare systems are based on solidarity and sharing of risk. From a communitarian perspective the right to health care includes the responsibility to allow information gained in the course of treatment to be used for the benefit of others who develop a similar disease, or are at risk of developing it [41]. The ethical framework for research is focussed on collective values, such as reciprocity, citizenry and universality [36,42]. A lot can be lost if these complex and abstract issues of inherently conflicting ethical notions of personal right to self-determination and collective responsibility are
viewed too rigidly. European citizens and hence also policy-makers face concrete requirements for more accountability and performance assessment in health care, requirements for effective health protection, and efficient administration of the healthcare systems. In sum there is an increasing need for more and better information on public health and quality of the health care provided. The objective of epidemiological research ethics is to protect vital data subject interests, e.g. the interest of profiting from new research findings and the right to protection of personal data. 5.2. Derogation to the requirement for explicit consent Today ethics in medical research are enshrined in different ethical guidelines such as the Helsinki Declaration and CIOMS ethical guidelines.12 According to both the Helsinki Declaration [43], Article B 26 and the CIOMS ethical guidelines [44] individual consent should not be 12
Although the ethical principles are often shared, such guidelines and recommendations have no legal standing. International ethical guidelines do, however, provide an important benchmark for researchers and policy makers to accommodate fundamental ethical principles into research practice and policies.
1036
M.R. Andersen, H.H. Storm / European Journal of Cancer 51 (2015) 1028–1038
Table 5 Consequences of explicit consent to register-based research [45]. – Studies involve analysis of tens or hundreds of thousands of cases in order to gain coverage and statistical power. The practical burden of seeking consent would be disproportionate, lead to inefficient use of public funds for research and in long-term be deleterious to the public’s health. – Exclusion of deceased data subjects introduces a significant selection bias, while inclusion cannot harm the data subject. – Repeated burden for patients/ relatives being asked to consent is of concern. – Low response rates leads to biased research results. – Seeking general consent imposes unacceptable work load on medical personnel and low completeness of cancer registration. – From a strict legal point of view, consent only remains valid for a limited period of time. Not possible to foresee future research questions. – Incompleteness of registration as a result of differences in the manner in which consent is sought or given invalidates international comparisons. – Documented differences between individuals who consent to participation in research and those who do not, entailing disastrous selection bias [40].
required in cases where conduct of the research would be impossible or impracticable, for example in secondary use of subjects’ records from large databases [26]. The legitimacy of weighting practicability, or feasibility, in deciding whether it is necessary to seek consent for retrospective studies is also endorsed with the Directive [31]. The Directive holds basic principles regarding the processing of patient data and exemptions to some of those principles as well. One of the basic principles of the Directive is that of ‘explicit consent’ for the use of sensitive data, such as data about health (article 8.1 of the Directive). However, sections 8.3 and 8.4 of the Directive provides for exemptions on this principle. A provision is incorporated to allow processing of sensitive personal data without the consent of the data subject, as long as the processing is carried out ‘for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of healthcare services’. This derogation includes all the components required for disease registration and most uses of registry data for research purposes. National legislation may add further exemptions or restrictions by law or legal order. These do not override the requirement for data processing to be ‘fair and lawful’ under the Directive. According to the article 29 Data Protection Working Party13 research cannot be based on article 8.3 of the Directive and should be based on article 8.4, which allows Member States to lay down further exemptions for reasons of substantial public interest, subject to suitable safeguards [31]. Many member states consider cancer research such a public interest and the conditions by which cancer registries operate as suitable safeguards.
13 The Article 29 Data Protection Working Party is made up of a representative from the data protection authority of each EU Member State, the European Data Protection Supervisor and the European Commission. The Article 29 Data Protection Working Party was set up under the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. http://ec.europa.eu/justice/data-protection/article-29/.
If there were no exemptions to the principle of explicit consent (see Table 5), cancer registration and most epidemiological activity would terminate at once [40,45]. In the Nordic countries using personal data for research purposes and the processing of pre-existing data for research purposes so far has not be considered incompatible with the purpose for which they were collected. Public health and research in public health has been acknowledged to be of specific importance to the society, thus overriding individual consent by data subject – often counted in millions – but subject to acceptance by Data Protection Agencies and in some countries also ethical vetting. This has not for decades given rise to any published problems nor breaches of the confidentiality of the individuals included in the research done on the collected data. The existence of carefully written guidelines evidently has been a reason for this [28]. 6. Addressing health care challenges of tomorrow Policy-makers across Europe face challenges of designing effective and sustainable healthcare systems, and protecting the ageing population from preventable health threats. Population-level analyses are essential in this respect. In the absence of sound population based epidemiological research, actions would be founded on anecdotes, small trials and stakeholder interests. Oncologists, health professionals and researchers must join forces and support action to explain and raise awareness of the need for cancer and other disease registries and analysis of data, for disease control, prevention, screening, outcome research and the production of sound evidence in measuring quality of care or other health interventions. This is in line with the Directive on cross boarder health care article 14 on use of data for research purposes.14 Register-based research is a rational and cost-effective means to gain new knowledge and scientific results 14
Directive 2011/24/EU OF THE European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in crossborder healthcare.
M.R. Andersen, H.H. Storm / European Journal of Cancer 51 (2015) 1028–1038
that can be translated into action. Population and disease registers are of incontestable value, and the benefits from epidemiological research will increase even further with personalised medicine, the development of clinical databases and large scale bio-banking facilities provided they can be combined and used for large populations. Research can lead to findings into new therapies, diagnostics and methods of prevention. Any new EU directive or regulation, whatever instrument is chosen, that hamper the possibility for public health research should be severely contested. Losing access to register data, compromising data quality and the analysis hereof at the expense of confidentiality and data protection regulations will neither serve the individual nor the society. Conflict of interest statement None declared. References [1] Dalton SO, Schu¨z J, Johansen C, et al. CANULI – social inequality in cancer incidence and survival in DK. Eur J Cancer 2008;44(14):1933–2086. [2] Pokrel A et al. Education, survival and avoidable deaths in cancer patients in Finland. Br J Cancer 2010;103:1109–14. [3] Auvinen A, Karlajalainen S. Possible explanations for social class differences in cancer patient survival. In: Kogevinas et al., editors. Social inequalities and cancer. Lyon: IARC Scientific Publications; 1997. p. 377–97. [4] Pukkala E, Martinsen JI, Lynge E, et al. Occupation and cancer – follow-up of 15 million people in five Nordic countries. Acta Oncol 2009;48:646–790. [5] Shkolnikov VM et al. Linked versus unlinked estimates of mortality and length of life by education and marital status: evidence from the first record linkage study in Lithuania. Soc Sci Med 2007;64:1392–406. [6] Andrae B, Kemetli L, Silfverdal L, et al. Screening-preventable cervical cancer risks: evidence from the Swedish nationwide audit of cervical cancer screening histories. J Natl Canc Inst 2008;100:1–8. [7] Barlow L, Westergren K, Holmberg L, Talback M. The completeness of the Swedish Cancer Register: a sample survey for year 1998. Acta Oncol 2009;48(1):27–33. [8] EUROCOURSE, ENCR Working Party. Position paper on the Commission’s proposal for a General Data Protection Regulation; 2012. www.eurocourse.org. [9] Jensen OM, Parkin DM, Maclennan R, Muir CS, Skeet RG. Cancer registration: principles and methods. Lyon: IARC Scientific Publications; 1991. [10] Sant M, Alleman C, Santaquilani M, Knijn A, Marchesi F, Capocaccia R. EUROCARE-4. Survival of cancer patients diagnosed in 1995–1999. Results and commentary. Eur J Cancer 2009;46(6):931–91. [11] Verdecchia A, Francisci S, Brenner H, Gatta G, Mangone L, Kunkler I. Recent cancer survival in Europe: a 2000–02 period analysis of EUROCARE-4 data. Lancet Oncol 2007;8(9):784–96. [12] Coleman MP et al. Cancer survival in Australia, Canada, Denmark, Norway, Sweden, and the UK, 1995–2007 (the International Cancer Benchmarking Partnership): an analysis of population-based cancer registry data. Lancet 2011;377(9760): 127–38.
1037
[13] Coleman MP et al. Cancer survival in five continents: a worldwide population-based study (CONCORD). Lancet Oncol 2008;9(8):730–56. [14] Janssen-Heijnen MLG et al. Prevalence of co-morbidity in lung cancer patients and its relationship with treatment: a populationbased study. Lung Cancer 1998;21(2):105–13. [15] Stenbeck M, Andersson G, Berglund A, et al. Swedish registries – a unique resource for health and welfare; 2013. Available from: www.simsam.nu. [16] Hagel E, Garmo H, Bill-Axelson A, et al. PCBaSe Sweden: a register-based resource for prostate cancer research. Scand J Urol Nephrol 2009;43:432–9. [17] Van Hemelrijck M, Wigertz A, Sandin F, et al. Cohort profile: the National Prostate Cancer Register (NPCR) of Sweden and Prostate Cancer data Base Sweden (PCBaSe) 2.0. Int J Epidemiol 2012:1–12. [18] Lowrance WW. Learning from experience: privacy and the secondary use of data in health research. London; 2002. [19] Council of Europe. Convention no 108, convention for the protection of individuals with regard to automatic processing of personal data; 1981. [20] Directive 95/46/EC of the European Parliament and of the Council of October 24 1995 on the protection of individuals with regard to the processing of personal data and the free movement of such data; 2012. Available from: http://ec.europa.eu/justice/ policies/privacy/docs/95-46-ce/dir1995-46_part1_en.pdf [accessed Feb 1 2012]. [21] van Veen EB. Obstacles to European research projects with data and tissue: solutions and further challenges. Eur J Cancer 2008;44(10):1438–50. [22] Rahu M, McKee M. Epidemiological research labelled as a violation of privacy: the case of Estonia. Int J Epidemiol 2008;37:678–82. [23] Stiller CA. Cancer registration: its uses in research, and confidentiality in the EC. J Epidemiol Community Health 1993;47:342–4. [24] Gouveia J, Coleman MP, Haward R, et al. Improving cancer control in the European Union: conclusions from the Lisbon round-table under the Portuguese EU Presidency, 2007. Eur J Cancer 2008 Jul;44(10):1457–62. [25] Hakulinen T et al. Harmonization may be counterproductive – at least for parts of Europe where public health research operates effectively. Eur J Public Health 2011;21(6):686–7. [26] Stenbeck M, Allebeck P. Do the planned changes to European data protection threaten or facilitate important health research? Eur J Public Health 2011;21(6):682–3. [27] ENCR. Guidelines on confidentiality and ethics for populationbased cancer registration and linked activities in Europe; 2012. Available from: www.encr.org. [28] IEA. Guidelines for proper conduct in epidemiologic research; 2007. Available from: http://ieaweb.org/2010/04/good-epidemiological-practice-gep/. [29] International Association of Cancer Registries. Guidelines on confidentiality in the cancer registry. IARC: Lyon; 1992. [30] International Association of Cancer Registries. Guidelines on confidentiality for population-based cancer registration. International Association of Cancer Registries; 2004. [31] van Veen EB. Patient data for health research. The Hauge: MedLawconsult; 2011. p. 57–62. Available from: http:// www.medlaw.nl/?=435. [32] Pukkala E. Nordic biological specimen bank cohorts as basis for studies of cancer causes and control: quality control tools for study cohorts with more than two million sample donors and 130,000 prospective cancers. In: Dillner J, editor. Methods in biobanking, methods in molecular biology; 2011. p. 61–112. [33] Bellach B, Scho¨n D. Legislation to protect individual confidentiality: the case of cancer registration in Germany. Sci Total Environ 1996;184(33):36.
1038
M.R. Andersen, H.H. Storm / European Journal of Cancer 51 (2015) 1028–1038
[34] Katalinic A. Epidemiologische Krebsregistrierung in Deutschland. Bundesgesundheitsblatt Gesundheitsforschung Gesundheitsschutz 2013;47(5):422–8. [35] Katalinic A. Personal communicaton; 2012. [36] Sutrop M. Viewpoint: how to avoid a dichotomy between autonomy and beneficence: from liberalism to communitarianism and beyond. J Intern Med 2011;269(4):375–9. [37] Hansson MG. The need to downregulate: a minimal ethical framework for biobank research. Methods Mol Biol 2011;675:39–59. [38] Agulanna C. The requirement of informed consent in research ethics: procedure for implementing a crucial ethical norm in African communal culture. Eur J Sci Res 2010;44(2):204–19. [39] Moreno JD et al. Informed consent. Encyclopedia of applied ethics. San Diego: Academic Press; 1998.
[40] Hansson MG, Chadwick R. Is medical ethics doing its job? J Intern Med 2011;269(4):366–9. [41] Doll R, Peto R. Rights involve responsibilities for patients. BMJ 2001;322(7288):730. [42] Callahan D. Individual good and common good: a communitarian approach to bioethics. Perspect Biol Med 2003; 46(4):496–507. [43] World Medical Association Declaration of Helsinki, 2008 revision; 2008. [44] CIOMS. International etical guidelines for biomedical research involving human subjects. Geneva: CIOMS/WHO; 2002. [45] An Informative Report on This Topic is Canadian Institutes of Health Research. Secondary use of personal information in health research: case studies. November 2002. Available from: http:// www.cihr-irsc.gc.ca/e/1475.html [accessed 20th May 2012].
Available at www.sciencedirect.com
ScienceDirect journal homepage: www.ejcancer.com
Cancer registration, public health and the reform of the European data protection framework: Abandoning or improving European public health research? Mette Rye Andersen ⇑, Hans H. Storm, on behalf of the Eurocourse Work Package 2 Group Danish Cancer Society, Cancer Prevention& Documentation, Strandboulevarden 49, DK 2100 Copenhagen, Denmark
Available online 10 October 2013
KEYWORDS Cancer registry Cancer registration Epidemiology EU data protection Public health Confidentiality Consent Ethical guidelines
Abstract The importance of cancer- and other disease registries for planning, management and evaluation of healthcare systems has been shown repeatedly during the last 50 years. Complete and unbiased population-level analyses on routinely collected, individual data concerning health and personal characteristics can address significant concerns about risk factors for cancer and provide sound evidence about public health and the effectiveness of healthcare systems. The existence of quality controlled and comprehensive data in registries, allowed to be used for quality control, research and public health purposes are taken as granted by most health professionals and researchers. However, the current revision of the European Union (EU) data protection framework suggests a harmonisation of requirements for confidentiality and individual consent to data processing, likely at the expense of proper use of registry data in the health sector. Consequences of excessive confidentiality rules that may lead to missed data linkages have been simulated. The simulations provide one possible explanation for observed heterogeneity among some cancer incidence data. Further, public health, quality control and epidemiological research on large populations can no longer provide evidence for health interventions, if requirements for consent renders research impossible or where attempts to obtain consent from each data subject generates biased results. Health professionals should engage in the on-going debate on the Commission’s proposal for a General Data Protection Regulation. The nature and use of registry data in public health research must be explained and known to policy-makers and the public. Use of cancer registry
⇑ Corresponding author:
E-mail addresses: (M.R. Andersen).
[email protected],
[email protected]
0959-8049/$ - see front matter Ó 2013 Elsevier Ltd. All rights reserved. http://dx.doi.org/10.1016/j.ejca.2013.09.005
M.R. Andersen, H.H. Storm / European Journal of Cancer 51 (2015) 1028–1038
1029
data and other epidemiological activity will terminate abruptly if an unnecessarily strict EU data protection regulation is adopted. Research based interventions, as well as the international recognised standing of cancer registries and register-based research institutions in Europe are at stake. Ó 2013 Elsevier Ltd. All rights reserved.
1. Cancer registration and public health The importance of cancer- and other disease registries for planning, management and evaluation of healthcare systems has been shown repeatedly during the last 50 years. Complete and unbiased population-level analyses on routinely collected, individual data concerning health and personal characteristics can address significant concerns about risk factors for cancer and provide sound evidence about public health and the effectiveness of healthcare systems [1–14]. Register-based, epidemiological research has examined an extraordinary range of questions: from the predictive use of cancer screening programmes, to shifts in bacterial antibiotic resistance, to the cost effectiveness of various drug and surgical treatments, long-term effects of exposure to radiation be it medical, accidental or environmental, to the efficacy of bicycle helmets in reducing head injury. The list of important research results is long [8,15], and due to this kind of research it has been possible to protect human lives and avoid premature death. Epidemiological research is based on accurate individual data compared to population groups with similar characteristics. Data from each individual in the population studied are paramount for reliable research. Record linkage is a very powerful tool in this respect. However, analysis will concern grouped data of relevance to a larger population, and epidemiological research findings are reported in statistical format only, without any possibility to identify individual data subjects. The Prostate Cancer data Base Sweden (PCBaSe) serves as example of a unique resource for public health research. In the PCBaSe the Swedish National Prostate Cancer Register (NPCR) has been matched against the cancer register, cause of death register and more than 10 other national population based registers [16,17]. In the PCBaSe it is now possible to connect cancer data to for instance family history, prescriptions of medication, other disease, etc. In such a setting confidentiality is crucial since information is gathered from different sources composing a rich data set that does not normally exist. Hence it is important to secure confidentiality of individual data and to regulate and control register activity. If the EU imposes restrictions that hinder collection and/or linkage of personal data, such as health data, valuable research projects will be abandoned, with serious consequences for policy interventions that influence
the lives of all European citizens1 Table 1, lists the advantages of register-based research at stake. 2. EU data protection Protection of personal data has a long history originating from the Nuremberg code in 1947, followed by the first Helsinki declarations by the World Medical Association since 1964, the Belmont report in the United States (US) in 1979 and the Council of Europe convention 108 in 1981. Table 2, summarises the Council of Europe convention. In 1995 the EU adopted the European data protection directive (95/46/EC) [20] on protection of individuals with regard to the processing of their personal data and the free movement of such data. In general, EU directives lay down end results that must be achieved in every Member State. National authorities have to adapt their laws to meet these goals, but are free to decide how to do so.2 While Directive (95/46/EC) (henceforth ‘Directive’) set out European data protection objectives and standards for the collection, storage and use of personal data, Member State implementation has led to rather heterogenic regulation regarding the use of data for public health research across the EU [21], moreover hindering data sharing for research purposes. While some Member States have been favourable to register-based research, such as the Nordic, other Member States have imposed serious constraints on disease registry operation [22,23], and in some cases disabled or even forced the closure of long-established cancer registries.3 Constraints intended to improve patient confidentiality and protect personal data from misuse, regrettably failed to take account of the public health impact by creating obstacles to the development and monitoring of policies aimed at improving public health [8,24]. 1 In Norway interpretation of data protection regulation lead to problems in evaluating the Norwegian Breast Cancer Screening Programme as women without cancer should be deleted from the files, unless they consented to use of the data again. Source: http:// www.forskningsradet.no/prognett-mammografi/Nyheter/Mammografievaluering_i_gang/1253973915651/p1226994052839, http:// www.kreftregisteret.no/Global/Publikasjoner%20og%20rapporter/ Special%20Issue/Special_Issue_Cancer_in_Norway_2009.pdf. 2 http://ec.europa.eu/eu_law/directives/directives_en.htm. 3 In the former West Germany (1991), former East Germany (1991) and Hungary (1992) constraints caused the closure of several cancer registries and very nearly did so in the UK (2000) (Gouveia et al.)
1030
M.R. Andersen, H.H. Storm / European Journal of Cancer 51 (2015) 1028–1038
Table 1 Important advantages of register-based research [18]. Unbiased data collection on the entire population reflects real life situation and may point to interventions that benefit at the population level in the future. Fast and cost effective compared to experimental or other prospective studies. Retrospective approach is possible when studying exposures with long latency (such as radiation), and often is the only resource when latency time is of essence. Analysis based on very large data sets increasing the statistical power limiting erroneous conclusions. Possible re-examination of data accrued in other research settings (such as clinical trials). Unexpected findings, i.e. differences among subpopulations not included in clinical trials. Review outcomes, such as patterns of diagnostic accuracy, conformity of practice with guidance, or other matters of routine that do not lend themselves well to experimentation. Only option when controlled trials are simply not possible for ethical reasons. Can help study questions, generate hypotheses, identify potential recruits for experimental studies and inform the design of other research. Need not include the data subject’s involvement.
Table 2 Council of Europe - European Treaty Series - No.108 [19]. Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data Article 5 of the Convention states that personal data undergoing automatic processing shall be: – obtained and processed fairly and lawfully; – stored for specified and legitimate purposes and not used in a way incompatible with those purposes; – adequate, relevant and not excessive in relation to the purposes for which they are stored; – accurate and, where necessary, kept up to date; – preserved in a form which permits identification of the data subject for no longer than is required for the purpose for which those data are stored.
Last year the European Commission proposed to replace the Directive by the General Data Protection Regulation.4 The overall intention of this reform is to protect personal data and to facilitate a free flow of data within the EU; also aiming to overcome problems alluded to by the research community concerning data sharing across borders for research purposes. The outcome of the data protection reform is crucial to all epidemiological activities and clinical quality control in the EU. In contrast to a directive, a regulation is binding by itself and does not need implementing legislation by the Member States. It implies a harmonisation of data protection measures across the EU, including use of data for public health purposes such as prevention and evaluation of screening programmes. On the one hand harmonisation may facilitate valuable data sharing for research purposes, but on the other, excessive regulation can easily disable even simple monitoring of cancer, with disastrous consequences for public health information [25]. For these reasons a revised directive, leaving room for national adaptation, may be a better regulatory instrument than an EU regulation for promoting public health and European research. This is still debated in the on-going policyprocess.
The proposed regulation counts 118 pages and includes 91 articles, some of which should be changed while others must be preserved in their present wording. The latter applies particularly to the articles concerning processing of personal data concerning health (article 9), the right to be forgotten (article 17) and processing of data for historical, statistical and research purposes (article 83). These articles contain exemptions without which cancer and other routine monitoring of diseases, survivorship, treatment outcome and research into risk factors for diseases will terminate abruptly.5 Article 9 prohibits any processing of personal data concerning health, exemptions made for cancer registration and public health research (article 9.2). Article 17 concerns the right to be forgotten, vital exemptions made. Storage, use and reuse of data across generations must be possible, and databases will lose their value for research and public health, including the use of historical series if the exemptions currently contained in article 17 are removed. Further article 83 provides an exemption to the principle of explicit consent for processing data for historical, statistical and research purposes. Content and exact wording of the proposed regulation is subject to change during the on-going reading of the European Parliament and negotiations in the Council. Amendments proposed during the European Parliament’s current reading suggest a removal of
4
The European the Commission’s Proposal for a Regulation of the European Parliament AND OF THE Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (COM(2012)11).
5
For a more comprehensive account on the policy implications of the proposed regulation for European register based research see www.encr.org or www.eurocourse.org.
M.R. Andersen, H.H. Storm / European Journal of Cancer 51 (2015) 1028–1038
indispensable research exemptions, if adopted hampering possibilities to conduct register-based research.6,7 While the underlying intention of reforming the EU data protection framework is welcomed, the pursuit of greater legislative coherence across the EU must be balanced fairly against the possibilities to conduct registerbased research in countries proved excellent in this. The on-going policy-process must be followed closely. 3. Confidentiality and personal data Epidemiological research depends on the balance between preserving patients’ integrity and anonymity while also enabling important research to improve people’s health and the quality of care [26]. In carrying out research for public good there must be adequate data protection to safeguard personal data against misuse, and the person against discrimination and stigmatisation. The need to safeguard the confidentiality of personal data is therefore conscientiously observed8 [28]. Guidelines on confidentiality and ethics for cancer registries have existed both for Europe (ENCR) since 1992 and worldwide (IARC) since 1991 [9,29]. The European Guidelines were revised in 2004 and in 2012 [27,30]. They define the measures to be taken to protect the privacy of the individual patient, the doctor and the hospital. They specify that information must be regarded confidential, and set out measures for establishment and periodic review of both physical and electronic security procedures, the requirements to be met before release of confidential data for research and other purposes, and the constraints to be satisfied by any publication derived from the data.9 A cancer/disease registry must maintain the same standards of confidentiality in handling identifiable data as customarily apply to the doctor–patient relationship. This obligation extends indefinitely, even after the death of the patient [27], even when data are pseudonymised. Pseudonymisation of personal data is essentially the replacement of personal identifiable information, such as name, address, social security number etc. Personal 6 Tabled amendments and procedure files concerning the proposed regulation: http://www.europarl.europa.eu/oeil/popups/ficheprocedure.do?reference=2012/0011(COD)&lg=en. 7 For more detail on epidemiological research and amendments called for by the European Parliament’s Committee on Civil Liberties, Justice and Home affairs see for example: Ploem MC, Essink-Bot ML, Stronks K. Proposed EU data protection regulation is a thread to medical research. BMJ 2013; 346:f3534. 8 Confidentiality can be described as the respectful handling of information disclosed within relationships of trust, such as healthcare relationships, especially as regards further disclosure. Confidentiality serves privacy, which is, though elusive, a widely understood and deeply felt concept regarding the status of information about aspects of an individual’s life [27]. 9 See for example ENCR (2012): Guidelines on confidentiality and ethics for population-based cancer registrationand linked activities in Europe.
1031
identifiable information is earmarked by codes, while the link (key) between the code and the information is stored separately.10 Pseudonymised data can be considered anonymous data, depending on the circumstances [31]. It is important to notice that not all Member States consider data, pseudonymised before they reach the research domain, anonymous to the researcher. The latter is the case in the Nordic countries, where unwanted re-identification is considered possible as long as the key between code and information exists. In most settings the use of registry data for research purposes depends upon review by an ethics board ensuring that the use of registry data is in line with societal values at the given time. 4. Confidentiality and public health in conflict Collection of unambiguous identifying information on each data subject is essential, both in order to maintain the quality of registry data, avoid duplicate registrations to enable follow-up e.g. linkage to death certificates, and for use of the data for research and quality control. In some countries methods are used that mask the true identity of the individuals such as encryption or pseudonymisation for data processing – both as security and as confidentiality measure. Pseudonymisation and encryption systems however, are influenced by trivial errors in the data used in the anonymisation process. Such errors will appear irrespective how perfect a system is rated and increase the risk of missed linkages of data on single individuals. A simulation of errors in linkage has shown major effects on long-term survival – overestimating survival after 10 years of follow-up by more than 10% if 5% linkages on date of death were missed – which without a unique personal number was not uncommon [32]. In Germany an encryption system is required in order to allow for the establishment of epidemiological cancer registries. German cancer registries are working on the basis of trusted third party (TTP)/privacy enhancing technology (PET) concepts (Tables 3 and 4). Cancer registration is by law divided into two separate offices; a notification office where the ID of a person is known, and a registration office that receives the data from the notification office with the ID encrypted. For 3 months it is possible to link back to the actual individual data, after this period linkage and data analysis is conducted on the encrypted data [33,34]. New data can be added only using the same/pseudonymisation key as when data was recorded. Errors in the original data cannot be found and corrected as the link to the actual individual is lost.
10
Source: http://www.sapior.com/news/2007-07-23.
1032
M.R. Andersen, H.H. Storm / European Journal of Cancer 51 (2015) 1028–1038
Table 3 Trusted third party (TTP). The trusted third party is an entity which facilitates interaction between two parties (sender and receiver) who both trust the third party. The Third Party reviews all critical transaction communications between the partiesa The standard TTP does not exit. In health care the TTP functions to mask the identity of the data subject. The patient data will be pseudonymisedb a b
http://en.wikipedia.org/wiki/Trusted_third_party. van Veen EB, Patient data for health research, MedLawconsult 2011, p. 57–62.
Table 4 Privacy enhancing technology (PET). PET is a general term for a range of different technologies to protect sensitive personal data within information systems. PET comprises a set of computer tools, applications and mechanisms which protects personal identifiable information by eliminating or minimising personal identifiable data thereby preventing unnecessary or unwanted processing of dataa http://en.wikipedia.org/wiki/Privacy-enhancing_technologies.
The TTP/PET system is costly. Two independent and staffed offices are needed, and all IT-structures must be build-up twice. Additionally, the communication between both offices and between the reporting physicians is time consuming and known to be difficult. A crude estimate of the additional costs of the TTP system for German cancer registries is 30–50% cost of registration [35]. To this adds problems in relation to anonymised data if based on imprecise reported or changed ID data. Since anonymisation algorithms rely on gender, date of birth and name, and can be supplemented by place of residence, one may assume such a system to be rather robust. However, people change names, misspellings occur, residence may change and small errors in the name, date and year of birth used by the encryption software may result in missed linkage and duplicate entries may be introduced into the cancer registry. A missed link to a death certificate, one pillar in proper cancer registration, and/or to an already reported case may influence not only the incidence but also the estimation of survival. In the study of occupational risk factors for cancer, which often is determined on few cases, a missed link between a worker and a rare cancer like leukaemia may completely change conclusions and refute a true risk or implicate a false risk. The argument that other methods than register-based research are used when studying occupational cancer is often raised. These methods however, may be subject to ascertainment and recall biases which rarely influence routine monitoring (Table 1). A simulation of the consequences of missed linkages to mortality data was carried out by Eero Pukkala from the Finish Cancer registry [32] (Fig. 1). As can be seen the deviation from the true standardised incidence ratio (SIR) is quite large even with a small error about 2% in mortality linkage. The error increases in importance by increasing the age of the study subjects.
In order to assess the span in overall cancer incidence and mortality (Fig. 2), we studied cancer incidence trends from 1987 to 2007 in four countries with long standing cancer registration (Denmark, Finland, Iceland and the Netherlands) using the ECO website (http:// eco.iarc.fr//Default.aspx 16-10-2012) developed under the EUROCOURSE project. The differences in incidence (age adjusted European standard) between the countries are about 50 cases per 100.000, the trends are increasing both due the ageing of the population and impact of risk factors for cancer, whereas the mortality is decreasing as a sign of better treatment and earlier diagnosis. Comparing this to Germany (Fig. 3.) where we have selected six La¨nder, those with highest, lowest and intermediate incidence, we see a span of 100 cases per 100.000 from a low incidence in Berlin to a very high in Saarland – i.e. twice the span seen between the Nordic countries and the Netherlands. The trends in incidence recorded in Germany behave rather unexpectedly with a decline in Schleswig– Holstein and Munich, stability at a high level in Saar-
1000
Error 0%
100
Error 2%
SIR
a
Error 5% Error 10%
10
Error 20%
1 40-49
50-59
60-69
70-79
80+
Age
Fig. 1. Change in standard incidence ratio (SIR) by error in linking mortality data to a cancer registry. Source: http://eco.iarc.fr/.
M.R. Andersen, H.H. Storm / European Journal of Cancer 51 (2015) 1028–1038
1033
Fig. 2. Cancer incidence and mortality at all sites of Finland, Denmark, Iceland and the Netherlands, in men. Age-standardised rate – EU Standard (ASR(E)). Source: http://eco.iarc.fr/.
land, a clear artefact between year 2000 and 2001 in Hamburg, and a low incidence in Berlin. The declines may be a result of picking up prevalent cases or duplicate cases which could be related to the registration procedure with encryption and poorer control over the data in the earlier years of cancer registration. The Hamburg graph can only be explained by a registration change with inclusion of either a new data source or a new entity. The stability of the rates in Saarland is contrary to the expected, if life expectancy is increasing as in the Nordic countries. One may argue that trends in all cancer (excl. skin) are a poor comparison, hence we studied lung cancer incidence and mortality, where due the poor prognosis incidence and mortality should follow each other closely (Fig. 4). The span between incidence and mortality is higher in Germany than in the Netherlands, Denmark and Finland and indeed the trends in some of the German La¨nder are of concern. It is not possible from these observations to other than speculate on the reason behind the differences. It may be artefactual linked to the registration procedures.
Be it in reporting and/or inability to do routine quality control of the reports on an individual level without a cumbersome procedure through a trusted third party (TTP), such as the Notification office, which is necessary if one needs to asses if all linkages pertain to the same individual. It is obvious that observed differences if true are really important, as this may point to exposures and behaviours of population that may impact the cancer pattern and care. Likewise it is obvious that if differences are based on registration differences and even artefacts, false conclusion may be drawn that can potentially harm large populations or at least in vane change the life of thousands of people. A requirement of monitoring is that the data must be correct [19]. If confidentiality regulation and security procedures lead to less correct data and in turn to erroneous conclusions on analysed data, more harm than benefit for the societies and for the individual will be the result. Another tool to safeguard autonomy over personal data is consent, e.g. giving the data subject control over the processing of his/her data. As discussed below, consent plays an important role in clinical research. Yet depending on the context, this does not exclude the
1034
M.R. Andersen, H.H. Storm / European Journal of Cancer 51 (2015) 1028–1038
Fig. 3. Cancer incidence and mortality at all sites in six German La¨nder, Finland, Denmark and the Netherlands, men. Age-standardised rate – EU Standard (ASR(E)). Source: http://eco.iarc.fr/.
possibility that consent is an unfortunate basis for processing of data for register-based research purposes. 5. Principles of research ethics Some of the basic principles in all research ethics are the individuals’ right to integrity, autonomy, and to refrain from participation in research. In the medical research practice this implies that research subjects should never be exposed to a risk in association with a research project without their explicit consent.11 This practice was advocated following World War II [36], in part to protect subjects from harm in experimentation and in part from personal data protection regimens based on human rights. It concurs with the duty of medical confidentiality and the need to protect patients, research subjects and 11 Explicit consent can be defined as any freely given specific and informed decision of the data subject with which the data subject signifies his or her agreement to personal data relating to him or her being processed [27].
personal data remains unquestioned. It is, however, increasingly acknowledged that the thinking behind explicit consent is premised on the clinical encounter between doctor and patient. In modern health care systems with highly complex data flows, such a form of consent is unlikely to be adequate for all purposes [18]. The obligation for clinical researchers to acquire explicit consent from their research subjects is a means to ensure that the decision to participate in any medical research is in fact the research subject’s [37–39]. In register-based research, however, there is no risk to the health of the data subjects as there in general is no direct contact to the data subjects. Likewise the potential risk of breach of confidentiality or unauthorised use of collected data is effectively kept low, and results presented in tabular or graphical format from where no individuals can be identified. On these grounds there is a growing recognition that the codes of conduct in medical and in epidemiological research should be considered separately.
M.R. Andersen, H.H. Storm / European Journal of Cancer 51 (2015) 1028–1038
1035
Fig. 4. Lung cancer incidence and mortality in six German La¨nder, Denmark, Finland and the Netherlands, men. Age-standardised rate – EU Standard (ASR(E)). Source: http://eco.iarc.fr/.
5.1. The consent tradition and epidemiological research ethics The consent tradition arguably has a liberal ideological background with a strong emphasis on an individual’s right to self-determination [40]. Fierce proponents of this tradition argue that the costs to an individual cannot be balanced with the benefits to society. Serving as research ethics any use of an individual’s data require explicit consent, strongly favouring individuals’ rights, mainly as to limitation of purpose and onward disclosure of data [18]. In the EU access to medical care has become a right to all citizens. Whether universal or insurance-based, European healthcare systems are based on solidarity and sharing of risk. From a communitarian perspective the right to health care includes the responsibility to allow information gained in the course of treatment to be used for the benefit of others who develop a similar disease, or are at risk of developing it [41]. The ethical framework for research is focussed on collective values, such as reciprocity, citizenry and universality [36,42]. A lot can be lost if these complex and abstract issues of inherently conflicting ethical notions of personal right to self-determination and collective responsibility are
viewed too rigidly. European citizens and hence also policy-makers face concrete requirements for more accountability and performance assessment in health care, requirements for effective health protection, and efficient administration of the healthcare systems. In sum there is an increasing need for more and better information on public health and quality of the health care provided. The objective of epidemiological research ethics is to protect vital data subject interests, e.g. the interest of profiting from new research findings and the right to protection of personal data. 5.2. Derogation to the requirement for explicit consent Today ethics in medical research are enshrined in different ethical guidelines such as the Helsinki Declaration and CIOMS ethical guidelines.12 According to both the Helsinki Declaration [43], Article B 26 and the CIOMS ethical guidelines [44] individual consent should not be 12
Although the ethical principles are often shared, such guidelines and recommendations have no legal standing. International ethical guidelines do, however, provide an important benchmark for researchers and policy makers to accommodate fundamental ethical principles into research practice and policies.
1036
M.R. Andersen, H.H. Storm / European Journal of Cancer 51 (2015) 1028–1038
Table 5 Consequences of explicit consent to register-based research [45]. – Studies involve analysis of tens or hundreds of thousands of cases in order to gain coverage and statistical power. The practical burden of seeking consent would be disproportionate, lead to inefficient use of public funds for research and in long-term be deleterious to the public’s health. – Exclusion of deceased data subjects introduces a significant selection bias, while inclusion cannot harm the data subject. – Repeated burden for patients/ relatives being asked to consent is of concern. – Low response rates leads to biased research results. – Seeking general consent imposes unacceptable work load on medical personnel and low completeness of cancer registration. – From a strict legal point of view, consent only remains valid for a limited period of time. Not possible to foresee future research questions. – Incompleteness of registration as a result of differences in the manner in which consent is sought or given invalidates international comparisons. – Documented differences between individuals who consent to participation in research and those who do not, entailing disastrous selection bias [40].
required in cases where conduct of the research would be impossible or impracticable, for example in secondary use of subjects’ records from large databases [26]. The legitimacy of weighting practicability, or feasibility, in deciding whether it is necessary to seek consent for retrospective studies is also endorsed with the Directive [31]. The Directive holds basic principles regarding the processing of patient data and exemptions to some of those principles as well. One of the basic principles of the Directive is that of ‘explicit consent’ for the use of sensitive data, such as data about health (article 8.1 of the Directive). However, sections 8.3 and 8.4 of the Directive provides for exemptions on this principle. A provision is incorporated to allow processing of sensitive personal data without the consent of the data subject, as long as the processing is carried out ‘for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of healthcare services’. This derogation includes all the components required for disease registration and most uses of registry data for research purposes. National legislation may add further exemptions or restrictions by law or legal order. These do not override the requirement for data processing to be ‘fair and lawful’ under the Directive. According to the article 29 Data Protection Working Party13 research cannot be based on article 8.3 of the Directive and should be based on article 8.4, which allows Member States to lay down further exemptions for reasons of substantial public interest, subject to suitable safeguards [31]. Many member states consider cancer research such a public interest and the conditions by which cancer registries operate as suitable safeguards.
13 The Article 29 Data Protection Working Party is made up of a representative from the data protection authority of each EU Member State, the European Data Protection Supervisor and the European Commission. The Article 29 Data Protection Working Party was set up under the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. http://ec.europa.eu/justice/data-protection/article-29/.
If there were no exemptions to the principle of explicit consent (see Table 5), cancer registration and most epidemiological activity would terminate at once [40,45]. In the Nordic countries using personal data for research purposes and the processing of pre-existing data for research purposes so far has not be considered incompatible with the purpose for which they were collected. Public health and research in public health has been acknowledged to be of specific importance to the society, thus overriding individual consent by data subject – often counted in millions – but subject to acceptance by Data Protection Agencies and in some countries also ethical vetting. This has not for decades given rise to any published problems nor breaches of the confidentiality of the individuals included in the research done on the collected data. The existence of carefully written guidelines evidently has been a reason for this [28]. 6. Addressing health care challenges of tomorrow Policy-makers across Europe face challenges of designing effective and sustainable healthcare systems, and protecting the ageing population from preventable health threats. Population-level analyses are essential in this respect. In the absence of sound population based epidemiological research, actions would be founded on anecdotes, small trials and stakeholder interests. Oncologists, health professionals and researchers must join forces and support action to explain and raise awareness of the need for cancer and other disease registries and analysis of data, for disease control, prevention, screening, outcome research and the production of sound evidence in measuring quality of care or other health interventions. This is in line with the Directive on cross boarder health care article 14 on use of data for research purposes.14 Register-based research is a rational and cost-effective means to gain new knowledge and scientific results 14
Directive 2011/24/EU OF THE European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in crossborder healthcare.
M.R. Andersen, H.H. Storm / European Journal of Cancer 51 (2015) 1028–1038
that can be translated into action. Population and disease registers are of incontestable value, and the benefits from epidemiological research will increase even further with personalised medicine, the development of clinical databases and large scale bio-banking facilities provided they can be combined and used for large populations. Research can lead to findings into new therapies, diagnostics and methods of prevention. Any new EU directive or regulation, whatever instrument is chosen, that hamper the possibility for public health research should be severely contested. Losing access to register data, compromising data quality and the analysis hereof at the expense of confidentiality and data protection regulations will neither serve the individual nor the society. Conflict of interest statement None declared. References [1] Dalton SO, Schu¨z J, Johansen C, et al. CANULI – social inequality in cancer incidence and survival in DK. Eur J Cancer 2008;44(14):1933–2086. [2] Pokrel A et al. Education, survival and avoidable deaths in cancer patients in Finland. Br J Cancer 2010;103:1109–14. [3] Auvinen A, Karlajalainen S. Possible explanations for social class differences in cancer patient survival. In: Kogevinas et al., editors. Social inequalities and cancer. Lyon: IARC Scientific Publications; 1997. p. 377–97. [4] Pukkala E, Martinsen JI, Lynge E, et al. Occupation and cancer – follow-up of 15 million people in five Nordic countries. Acta Oncol 2009;48:646–790. [5] Shkolnikov VM et al. Linked versus unlinked estimates of mortality and length of life by education and marital status: evidence from the first record linkage study in Lithuania. Soc Sci Med 2007;64:1392–406. [6] Andrae B, Kemetli L, Silfverdal L, et al. Screening-preventable cervical cancer risks: evidence from the Swedish nationwide audit of cervical cancer screening histories. J Natl Canc Inst 2008;100:1–8. [7] Barlow L, Westergren K, Holmberg L, Talback M. The completeness of the Swedish Cancer Register: a sample survey for year 1998. Acta Oncol 2009;48(1):27–33. [8] EUROCOURSE, ENCR Working Party. Position paper on the Commission’s proposal for a General Data Protection Regulation; 2012. www.eurocourse.org. [9] Jensen OM, Parkin DM, Maclennan R, Muir CS, Skeet RG. Cancer registration: principles and methods. Lyon: IARC Scientific Publications; 1991. [10] Sant M, Alleman C, Santaquilani M, Knijn A, Marchesi F, Capocaccia R. EUROCARE-4. Survival of cancer patients diagnosed in 1995–1999. Results and commentary. Eur J Cancer 2009;46(6):931–91. [11] Verdecchia A, Francisci S, Brenner H, Gatta G, Mangone L, Kunkler I. Recent cancer survival in Europe: a 2000–02 period analysis of EUROCARE-4 data. Lancet Oncol 2007;8(9):784–96. [12] Coleman MP et al. Cancer survival in Australia, Canada, Denmark, Norway, Sweden, and the UK, 1995–2007 (the International Cancer Benchmarking Partnership): an analysis of population-based cancer registry data. Lancet 2011;377(9760): 127–38.
1037
[13] Coleman MP et al. Cancer survival in five continents: a worldwide population-based study (CONCORD). Lancet Oncol 2008;9(8):730–56. [14] Janssen-Heijnen MLG et al. Prevalence of co-morbidity in lung cancer patients and its relationship with treatment: a populationbased study. Lung Cancer 1998;21(2):105–13. [15] Stenbeck M, Andersson G, Berglund A, et al. Swedish registries – a unique resource for health and welfare; 2013. Available from: www.simsam.nu. [16] Hagel E, Garmo H, Bill-Axelson A, et al. PCBaSe Sweden: a register-based resource for prostate cancer research. Scand J Urol Nephrol 2009;43:432–9. [17] Van Hemelrijck M, Wigertz A, Sandin F, et al. Cohort profile: the National Prostate Cancer Register (NPCR) of Sweden and Prostate Cancer data Base Sweden (PCBaSe) 2.0. Int J Epidemiol 2012:1–12. [18] Lowrance WW. Learning from experience: privacy and the secondary use of data in health research. London; 2002. [19] Council of Europe. Convention no 108, convention for the protection of individuals with regard to automatic processing of personal data; 1981. [20] Directive 95/46/EC of the European Parliament and of the Council of October 24 1995 on the protection of individuals with regard to the processing of personal data and the free movement of such data; 2012. Available from: http://ec.europa.eu/justice/ policies/privacy/docs/95-46-ce/dir1995-46_part1_en.pdf [accessed Feb 1 2012]. [21] van Veen EB. Obstacles to European research projects with data and tissue: solutions and further challenges. Eur J Cancer 2008;44(10):1438–50. [22] Rahu M, McKee M. Epidemiological research labelled as a violation of privacy: the case of Estonia. Int J Epidemiol 2008;37:678–82. [23] Stiller CA. Cancer registration: its uses in research, and confidentiality in the EC. J Epidemiol Community Health 1993;47:342–4. [24] Gouveia J, Coleman MP, Haward R, et al. Improving cancer control in the European Union: conclusions from the Lisbon round-table under the Portuguese EU Presidency, 2007. Eur J Cancer 2008 Jul;44(10):1457–62. [25] Hakulinen T et al. Harmonization may be counterproductive – at least for parts of Europe where public health research operates effectively. Eur J Public Health 2011;21(6):686–7. [26] Stenbeck M, Allebeck P. Do the planned changes to European data protection threaten or facilitate important health research? Eur J Public Health 2011;21(6):682–3. [27] ENCR. Guidelines on confidentiality and ethics for populationbased cancer registration and linked activities in Europe; 2012. Available from: www.encr.org. [28] IEA. Guidelines for proper conduct in epidemiologic research; 2007. Available from: http://ieaweb.org/2010/04/good-epidemiological-practice-gep/. [29] International Association of Cancer Registries. Guidelines on confidentiality in the cancer registry. IARC: Lyon; 1992. [30] International Association of Cancer Registries. Guidelines on confidentiality for population-based cancer registration. International Association of Cancer Registries; 2004. [31] van Veen EB. Patient data for health research. The Hauge: MedLawconsult; 2011. p. 57–62. Available from: http:// www.medlaw.nl/?=435. [32] Pukkala E. Nordic biological specimen bank cohorts as basis for studies of cancer causes and control: quality control tools for study cohorts with more than two million sample donors and 130,000 prospective cancers. In: Dillner J, editor. Methods in biobanking, methods in molecular biology; 2011. p. 61–112. [33] Bellach B, Scho¨n D. Legislation to protect individual confidentiality: the case of cancer registration in Germany. Sci Total Environ 1996;184(33):36.
1038
M.R. Andersen, H.H. Storm / European Journal of Cancer 51 (2015) 1028–1038
[34] Katalinic A. Epidemiologische Krebsregistrierung in Deutschland. Bundesgesundheitsblatt Gesundheitsforschung Gesundheitsschutz 2013;47(5):422–8. [35] Katalinic A. Personal communicaton; 2012. [36] Sutrop M. Viewpoint: how to avoid a dichotomy between autonomy and beneficence: from liberalism to communitarianism and beyond. J Intern Med 2011;269(4):375–9. [37] Hansson MG. The need to downregulate: a minimal ethical framework for biobank research. Methods Mol Biol 2011;675:39–59. [38] Agulanna C. The requirement of informed consent in research ethics: procedure for implementing a crucial ethical norm in African communal culture. Eur J Sci Res 2010;44(2):204–19. [39] Moreno JD et al. Informed consent. Encyclopedia of applied ethics. San Diego: Academic Press; 1998.
[40] Hansson MG, Chadwick R. Is medical ethics doing its job? J Intern Med 2011;269(4):366–9. [41] Doll R, Peto R. Rights involve responsibilities for patients. BMJ 2001;322(7288):730. [42] Callahan D. Individual good and common good: a communitarian approach to bioethics. Perspect Biol Med 2003; 46(4):496–507. [43] World Medical Association Declaration of Helsinki, 2008 revision; 2008. [44] CIOMS. International etical guidelines for biomedical research involving human subjects. Geneva: CIOMS/WHO; 2002. [45] An Informative Report on This Topic is Canadian Institutes of Health Research. Secondary use of personal information in health research: case studies. November 2002. Available from: http:// www.cihr-irsc.gc.ca/e/1475.html [accessed 20th May 2012].