Medical research, data sharing, and properly informed consent.

When Sheila M. Bird agreed to participate in a Covid surveillance study, she did not realise her negative test result and personal details would be passed to NHS Test and Trace. Here, she calls for closer scrutiny of privacy policies by research ethics committees, and clearer communication with study participants.

REACT‐1 (Real‐time Assessment of Community Transmission) is a series of SARS‐CoV‐2 antigen surveillance studies in England that inform our understanding of how the Covid‐19 pandemic is progressing (bit.ly/3EYZt98). Each study in the series recruits 100,000 or more randomly invited citizens to answer questions about risk behaviours and take a PCR test.

Swabs are sent to people's homes and then couriered to a diagnostic laboratory. An important element of the study design is that neither the swabs nor the boxes used to return them reveal any details about the person taking the test: the only identifier is an alphanumeric code.

As a biostatistician who has designed and conducted willing anonymous salivary HIV (WASH) surveillance studies linked to self‐completion risk questionnaires in nine Scottish prisons, , , , I saluted REACT‐1's design care and was happy to take part when invited to do so for round 10 of the series.

But then, having taken part, I was astonished to be told that my personal identifying information had been disclosed to NHS Test and Trace when my swab test came back negative. I felt I had been duped by the very design niceties which I had so admired. I set out to understand how and why this had happened, concerned not only for my own personal information but also about the trustworthiness of medical research.

Privacy and consent

REACT‐1 is conducted by Imperial College London and Ipsos MORI with funding from, and in partnership with, the UK Department of Health and Social Care (DHSC) as joint data controller. When I was invited to take part in March 2021, I received a two‐page letter. Page 1 made no mention that my test result and personal identifying information would be sent to NHS Test and Trace. On the reverse, page 2, in a section headlined “Your Privacy”, I was told:

The swab test results will be passed to Ipsos MORI and Imperial College London to link to the information in the questionnaire. All questionnaire information will be kept confidential by Ipsos MORI, and approved Imperial College London staff and researchers…

The next paragraph stated:

Ipsos MORI will pass on test results to NHS Test and Trace. If your result is positive (suggesting that you currently have COVID‐19) NHS Test and Trace may contact you…

Importantly, this second paragraph did not state explicitly that my personal identifying information would be passed to NHS Test and Trace. Indeed, the second sentence could be read as implying that NHS Test and Trace may have been given access to personal identifying information for only those participants whose test result was positive.

Foolishly, I did not check the 10‐page privacy policy that was linked to in the letter: ipsos.uk/covid-swab-privacy. It was only after being told on 20 March 2021 that my personal identifying information had been passed to Test and Trace that I reviewed the policy.

Page 1 of the policy indeed included the alert that: “If you complete the swab test and survey, some of the data you provide will be shared with NHS Test and Trace.” The reader is then directed to page 5, where there is a key alert:

If you take part, Ipsos MORI has a legal obligation to pass on your test result (whether positive, negative or inconclusive) and some additional data about you to NHS Test and Trace. A full list of the data that will be provided can be found at https://www.gov.uk/guidance/covid-19-and-influenza-point-of-care-testing-results-how-to-report.

Clearly, I should have read the privacy policy before consenting to participate in the study. But can we really expect potential research participants to follow a weblink from page 5 of a 10‐page web document to be properly informed?

I considered it neither adequate nor reasonable that participants had to consult three separate documents to be fully informed that their swab test result would be sent to NHS Test and Trace along with their name, gender, date of birth, NHS number, ethnicity, and address (at minimum). Therefore, on 22 April 2021, I asked the Health Research Authority (HRA) to review REACT‐1's consent forms (paper‐based and online) to ensure that critical information about the disclosure of personal identifying information (and any other data) in respect of swab‐test negative participants is detailed explicitly.

Upon review, my complaint was upheld on 21 July 2021. Accordingly, the research ethics committee (REC) which oversees REACT‐1 had now “specified that the informed consent documentation and invitation letter should be updated to more explicitly state that all test results will be shared with Test and Trace and to make clear what personal data will be provided to Test and Trace alongside the test results”.

Legal obligations

I also had a question about the “legal obligation” that supposedly requires the REACT‐1 research team to disclose personal identifying information about research subjects to NHS Test and Trace. Legislation (referred to below as the “Notification Regulations”; bit.ly/32JLJlG) does require the reporting of any SARS‐CoV‐2 test processed by diagnostic laboratories, together with such personal identifying information as known by the diagnostic laboratory. But the reporting requirements are placed on diagnostic labs only. Crucially, the REACT‐1 study has been designed so that the personal identifying information of research participants is not known to its diagnostic laboratory.

I considered it neither adequat enor reasonable that participants had to consult three documents to be fully informed

I pointed out that it was Ipsos MORI, not the diagnostic lab, that had passed my test results and personal information to NHS Test and Trace. In response, a DHSC representative told me, via email, that:

Whilst the Notification Regulations place a statutory requirement on the laboratories for the reporting, the method used by REACT … minimises the amount of personal identifiable data shared with laboratories who do not need to know certain details. This approach is compliant both with [the General Data Protection Regulation] and the Caldicott principles of minimising the amount of data shared whilst also meeting the aims of the Notification Regulations in allowing better insight into the nature of infections given the threat posed by Covid‐19…

I posed my question about legal obligations to the HRA, who stated: “It is not the responsibility of the REC to consider legal obligations, their remit is limited to the ethical implications of a proposed study … It is the responsibility of the sponsor to ensure that their study complies with all relevant legal obligations.” Of course, in this case, the DHSC is not only the funder and study sponsor but also a partner in the research team – and legislator too.

When force of law is asserted as grounds for disclosing information about research participants, I believe it is vital to test the basis for that assertion. For example, many years back, an Edinburgh research team was asked by police to disclose personal identifying information about a research participant, an ex‐prisoner, who had been HIV‐infected in 1993 during an outbreak of HIV infections at Glenochil Prison. The research team sought review by a judge: no information was disclosed until the judge had affirmed that the police request was lawful.

In my experience of HIV surveillance studies, especially when linked to risk behaviours, maintaining the anonymity of participants was crucial for ensuring high rates of participation and meriting prisoners' trust. Our WASH studies in Scottish prisons had a high volunteer rate, averaging over 80%. By contrast, during the Covid‐19 pandemic, volunteer rates for national surveillance studies in the UK have been between 10% and 40%.

Implications beyond REACT‐1

Study designs which safeguard the confidentiality of research participants have characterised my work as a Medical Research Council biostatistician, and my complaint to the HRA about improperly informed consent for data sharing was motivated by concern that trust in medical research could be undermined.

The decision arising from this complaint – that informed consent documentation and invitation letters should be more explicit about what is being shared – has implications beyond the REACT‐1 series of studies. The length and content of privacy policies, and version control of weblinks, should be thoroughly appraised by research ethics committees that make judgements on properly informed consent. Equally thorough appraisal is needed by regulatory authorities such as the UK Medicines and Healthcare products Regulatory Agency, the US Food and Drug Administration and the European Medicines Agency before signing off on “information for users” of medicines and devices, including diagnostic tests (for more on this, see bit.ly/3mXDCIS).

Finally, when force of law applies, or is invoked, research participants must be warned upfront about which data are being shared externally (and with whom), especially if biological samples are provided or if research participants' consent for data‐sharing has been effectively abrogated.

For later rounds of REACT‐1, the privacy statement in the two‐page invitation letter has been revised to be clearer about the data to be disclosed. For me, resolution came by perseverance. After much back and forth with the DHSC, my request to remove my data from NHS Test and Trace was finally granted on 28 July, a week after the HRA's review.

Disclosure statement

The author is a member of the Royal Statistical Society (RSS) Working Party on Diagnostic Tests and chairs the RSS/DHSC Panel on Test and Trace, and was a participant in REACT‐1 round 10.