Friday, June 22, 2012

Informed consent -- who's it supposed to protect, anyway?

A piece by Erika Check Hayden in this week's Nature on current confusion with respect to informed consent  begins with a discussion of the patent 23andMe filed in late May to protect their findings from their research on Parkinson's disease.  As Hayden points out, many consumers of 23andMe, the direct-to-consumer genotyping company, were surprised to learn that the company was filing to patent a gene -- gene patenting having been one of the earliest and most controversial aspects of the commercialization of genetic research and one that several of the company's founders were known to oppose. We blogged about this when the patent announcement was made. 

Hayden's piece hits close to home because in her second paragraph she quotes MT's own Holly Dunsworth who left a comment on the 23andMe blog post announcing the patent application.  Holly said that she didn't believe she'd agreed to the possibility that one of her genes could be patented when she signed her consent for their genetic services. (She's aghast that genes can be patented, and is against it -- that makes it unanimous here at MT.)  But Hayden points out that "the language is there" in the consent forms.  Well, that may be so if you're a lawyer and it occurs to you that "If 23andMe develops intellectual property and/or commercializes products or services, directly or indirectly, based on the results of this study, you will not receive any compensation" means that if they find something they want to patent in your genome, they will and it's theirs.

The non-legal crowd isn't as likely to have read it that way, and didn't realize they were signing on to the possibility that the company might patent one of their genes, without sharing any of the profit, and without explicitly broaching this sensitive ethical issue with participants.  It's more than a bit disingenuous of 23andMe to claim to be open and free with knowledge on the one hand, engaging customers because of this open access policy and on the other hand committed to constraining that freedom when there's profit to be made -- by them! 

But beyond what this means about 23andMe, this does point out one of the problematic issues having to do with informed consent, and that is that when what can be done with the materials a subject or donor consented to give a researcher or company access to can change as technologies change or as findings accumulate, "informed consent" is in fact not that.  23andMe's consent asks their customers to agree essentially to blanket use of their genetic data.  It's an open-ended consent, as many researchers and institutions prefer these days, seeking permission to do anything with the sample in perpetuity.  Some consent agreements, though, impose specific time or usage limits instead.  Given how quickly technology changes however, these limiting agreements may well be used less and less as genetic research goes forward.  You can be pretty sure that once researchers get their hands on your samples they aren't going to want to give them up.

Another approach is George Church's no-consent-at-all model for the Personal Genome Project.  When people sign on to the project he requests that participants allow all their biomedical data to be freely accessible online, along with their whole genome sequence.  The idea is that because researchers can't predict what they'll find, or what new technologies will come along, science will best progress if participants allow anything at all be done with their data and their biomedical information now and in the future. 

Of course this kind of consent can't be properly 'informed' in any serious sense, relative to being what is fair to call a blank check for the researchers. They know this, of course, and any benefits that do happen to become possible will likely go to them.  Researchers don't get to set all the limits, though.  Any consent for a study using federal funding must allow research participants to be free to remove their samples and data from a study.  And,  Hayden says that several US states, including California where 23andMe is based, are considering laws to constrain what can be done with a person's DNA.

However, genetic data are different from, say, demographic data because even anonymized, no names attached, it's possible to identify individuals if reference genetic data are available, and identifying ethnicity is often trivial.  Not to mention that no genome is an island, so if you are genotyped, that tells you a lot about your parents as well as your siblings.  So, if you consent to genotyping or whole genome sequencing but your parents don't, that can be a problem.  And of course once a sequence is published or summarized in statistical data, it is no longer removable.

Who is informed consent for, though?  Who is it designed to protect?  It stems from Nuremberg Trial protections that were the result of the Nazi experiments in World War II.  They were indeed for protecting human subjects.  Human subjects protections have evolved over the years however, and now while still nominally for protection of, well, human subjects, there's a whole lot of CYA going on, as universities and companies try to avoid the kinds of legal difficulties that researchers such as those working with the Havasupai in Arizona got into not long ago (a case we blogged about here).

Indeed, Hayden quotes Mishra Angrist, genome policy analyst at Duke University, and participant in the Personal Genome Project saying, “Institutions use informed consent to mitigate their own liability and to tell research participants about all the things they cannot have, and all the ways they can't be involved. It borders on farcical.”

The interests of researchers and subjects don't always coincide, of course.  It is only human to expect those with their hands on the data to be tempted, and at least occasionally to yield to the temptation, to seek private gain from the samples, beyond their salaries and job status.  Also, researchers generally and naturally want to be allowed to do whatever they want with their hard-earned samples, while subjects often want constraints -- if they even understand the study.
Many researchers say that the obvious solution is a broad consent document that gives researchers free rein with the data. But many non-scientists think participants should be able to control how their data are used, says lawyer Tim Caulfield of the University of Alberta in Calgary, Canada, who has surveyed patients about this idea. “There's an emerging consensus within the research community about the need to adopt things like broad consent, but that hasn't translated out to the legal community or to the public,” he says.
 And then there's 23andMe, which gives their customers access to all their own data.  Until they don't.


Unknown said...


1) For the record, there's no "r" in my first name.

2) I submit that 23andMe's IC process is no more onerous or disingenuous than virtually every other NIH-funded biobank that collects samples for blanket use in perpetuity. Having a profit motive is not the only way to abuse the rights of research participants. At least 23andMe participants get to learn something about themselves, which publicly funded biobanks that collect information from deidentified and/or anonymized samples cannot do by definition.

3) Your statement that the Personal Genome Project model is "no consent at all" could not be more wrong. Indeed, the PGP is the opposite of that: every conceivable risk *that we know of* is articulated, from disclosure of nonpaternity to having one's DNA planted at a crime scene to being cloned. Moreover, before one gets enrolled in the project one has to complete an exam and score 100% on it. I would encourage you to go to and read a little bit about the project (or read my book) before affixing wildly inaccurate descriptors to it.

4) You note that I am a PGP participant when referring to my quote about institutional liability, but let's be clear: my involvement with the PGP has no bearing on that quote. The PGP is transparent and accessible to its participants. The biobank protocol I reviewed for the Duke IRB was no such thing.

5) I have no relationship with 23andMe and I don't approve of everything that the company does. But 23andMe is an easy punching bag: like shooting retarded fish in a very small barrel. Really, is the fact that the company has > 150,000 people in its database purely a function of its marketing savvy? Is it not possible that some people want access to their own genomic data and are willing to pay a couple hundred bucks to an entity that is more responsive than their neighborhood academic research hospital?


Ken Weiss said...

Sorry about the spelling mistake. And we didn't knowingly mischaracterize your involvement if we did that.

As far as 23's consent, it is lawyeristic, self-serving, evasive small print as far as I'm concerned. Of course people can read it and might understand it, and many would agree to it. Of course it technically covers their butts. The issues about 'informed' consent that we raise have to do with the degree that people are really informed and the degree to which this is rather subliminal exploitation. That the NIH or other entities do it as well is no argument in its favor, but it is a legitimate question to ask whether NIH's ethics policies have been co-opted by research investigators for their own benefit.

We meant to say, but erred in our wording, that George Church has blanket consent (no restrictions on use). We have heard the policy from and discussed it with Dr Church himself. That was our wording mistake, which we regret.

We understand the reason for blanket consent, in this environment when there are so many potential but non-foreseeable issues. And basically everybody knows that after the fact people might feel misused, so the jury is out on whether it would really hold up in court, or be ethical if someone feels harmed. Is it really ethical to simply say I can do anything I want? I don't think so, myself. And it is, after all, self-serving if private profits are to be garnered from the data. But I agree that it's also clearly true that some people do understand the rules and don't care. There's no fault in that, of course.

Finally, that there are large numbers of users means that there are large numbers who like the recreational aspect, want the ancestry or other information, didn't read or don't care or didn't understand about the consent, or believe it will be salubrious for society. But to deny that this is largely marketing savvy seems at least as convenient or naive as arguing that we are misrepresenting what they do. In any case, It provides no support for arguments about propriety informed consent.

Of course, because they're so well funded as to be the big bear on the block and probably immune to failure, they are the punching bag. They are certainly not helpless little fish in a barrel at a county fair.

Clearly this is something a lot of people think is cute and fun, and there are also many who may believe it's biomedically important. Done right, I'd agree. But these ecompanies are playing rather loose with the epistemology, I think, in ways they should know and that I think lead to misperception of what their risk estimates mean. Since I think about this area all the time, and work in aspects of it, I can think of lots of ways such data could be informative and salubrious done right and if the data were reliable.

The profiteering is the major objection I personally have, and that to me is an ethical, not a legal issue. Of course that's just my view, because profiteering is clearly legal!

Anyway, the discussion may be contentious but it's useful to have it and the more out in the open the better.

Clay Shirky said...

"If 23andMe develops intellectual property and/or commercializes products or services, directly or indirectly, based on the results of this study, you will not receive any compensation"

Unless you think that the words "intellectual property" or "compensation" are too high-falutin' for the simple folk agreeing to have their DNA sequenced, then this seems admirably clear.

Falling back on weasel words like 'profiteering' (which seems, in your use, to encompass any commercial activity) doesn't make this look any less like a misdirected rant.

You don't like patenting genes -- nor do I. It's a travesty, and one the courts should reverse. You don't like the fact that it's impossible to square the language needed to reduce legal liability with the effort users are willing to put into reading it, and this is indeed a weakness in all commercial services on the internet.

But you take these attitudes and use them to attack the wrong target. Not only is 23&Me not doing anything particularly wrong, their terms of service are actually clearer on this subject than most. You also confuse access with use. There's no indication that 23&Me has ever or will ever (or, under their terms of service or existing law, could ever) prevent patients from accessing their own data.

So you could target patenting of genes, or you could target the culture of legal liability, or you could target the legal absurdity of fine print everyone knows no one reads, but none of this is particular to the current case. Under the system as it exists today, what 23&Me has an obligation to tell users is that it is a commercial business, one which develops intellectual property from patient data, for which the patients will receive no compensation. This, Dunsworth's uninformed complaints to the contrary, is just what they did.

Unknown said...

"Is it really ethical to simply say I can do anything I want?"

I don't know: ask the Havasupai. Ask John Moore. Ask Bill Catalona's patients who got screwed by WashU. Ask the Greenbergs in Miami. Ask the BIOvu participants in Nashville. Ask the anonymized HapMap participants--oh wait, you can't...

George Church has the integrity and honesty not to leave his participants vulnerable or to go into this with their eyes closed. They must traverse a gauntlet before they can enroll. At present the PGP is pushing 2000 people with thousands more in the queue. There is no profit motive. Who are you to deny people the right to participate?

The larger point is that, based on the initial post, you are either unaware of or are ignoring a change in the culture that is happening from the bottom up. Forget 23andMe and the PGP. Look at PatientsLikeMe, Genomera, DIYBio, Biocurious, DIYGenomics, SNPedia, the Interpretome, the Quantified Self--there are many others. To paint these initiatives as pure profiteering is inaccurate. You can have contempt for Facebook (I do) but to deny that people are motivated and willing to share information is naive. To deny that there are benefits to doing so is paternalistic and misleading. People want this information and they don't need you or me or George Church or Sergei Brin to get it. To cling to genetic determinism and its instantiation in the form of the Common Rule and HIPAA Privacy is to cling to the buggy whip.


Anne Buchanan said...

Wow. All I can say to this is I guess you haven't read anything that Ken or I or both of us together have written. Which is fine, and explains where I assume you're coming from with your comments. We've been called a lot of things in our day but never genetic determinists!

Ken Weiss said...

Obviously people differ on these points which is why ethics and related topics are so difficult. People (including us, of course) don't readily change their views on these sorts of things.

We acknowledged that many people feel fine with sharing information.

I happen to work for a salary, not a commission. What I do professionally is funded by government (and in a way, tuition) sources, and I sell my services, such as they are, for my salary. I develop software that is freely available and open-source for that reason (check my web page!). It's how I think things should be done by university people. If I were in business, I might feel differently.

If 23andMe had said they make their money by selling genotypes, but that any use of their data base for biomedical purposes was pro bono, we would be able to address only the scientific issues, of which there are many, and they're serious. That would be more productive and perhaps less emotional.

Anne Buchanan said...

Yep, and as a business of course it has to make a profit. The list of what Ken and I disagree with though, in addition to what you already list, includes selling disease risk estimates as though they were actually meaningful. Single gene disorders are one thing, but risk of complex diseases another thing entirely.

James Goetz said...

Hmm, if this 23andme patents one or more of Holly's genes, can she pass on that gene(s) to possible children without paying royalties to 23andme?

Ken Weiss said...

That's a very good question! Does she own the allele any longer, once having signed away the rights to 23andMe?

Patents should be for value-added to things occurring in Nature, not for the things themselves. In this case, the allele only occurs in, say, Holly and probably other people (because if it were a single instance, causation is impossible to assess by statistical means alone). So her ownership is being taken away, and if the informed consent is not clear enough, purloined.

If 23andMe said openly on their front page that they make their money by selling genotypes, but that they also are going to do their best to find and patent things they find in your data, and sell the patent for a lot of money, and you'll get none of it, then whether people like me think that's right would be moot. But instead they, like all companies (and research informed consent as a rule) bury these things in the small print. That is why we have the phrase 'small print'!

Of course, others strongly defend privatization of things so long as the legal issues have been at least availably presented and agreed to. They argue that private self-interest is the incentive that makes the world go round.

I disagree, since I know lots of people who don't need that to try to do their best, but it's a standard argument in favor of the business model, competition, and self-interest. And I think my own view is distinctly in the minority.

Holly Dunsworth said...

I posted that Spittoon comment to make a point, not to ignorantly or naively play gotcha or anything of the sort.

Holly Dunsworth said...

I agree that too much hype and fear about DTC perpetuates old dangerous notions of genetic determinism. DTC is out there now and I think that the more people that have access to these data, without fear/hype the better the chances we have of eradicating so much genetic determinism. The genetic purity claims by politicians in Europe, for example would carry less weight if everyone had their own ancestry data and could evaluate those ridiculous claims on a level playing field. Like someone said before on another post: The genie is out of the bottle. And I like that metaphor not just for the pun but because genies can provide a lot of positive outcomes (like DTC) as long as you know how to ask the right questions of the genies/genes. I'm hoping anthropologists and anthropology students, like mine who are genotyped by 23andMe, will be ambassadors of good, fun, knowledge, and anti-determinism in this genomic era. Looking at your own data can be far more powerful for grasping the complexities and subtleties and unknowns and mysteries of genetics and biology than reading about genetics. And 23andMe costs as much as some genetics books and far less than a genetics course. I'm excited and very hopeful about 23andMe and genetics education in spite of my serious ethical issues with gene patenting.