The Ethics Blog

A research blog from the Centre for Resarch Ethics & Bioethics (CRB)

Tag: governance of health data

Health data infrastructures require more continuous governance

29 September, 2026 / / 1 Comment

Health data holds great value for research and development, even long after it was originally collected. It can shed light on questions beyond those that initially motivated the collection. Therefore, data infrastructures are being established to store health data for long periods of time. Biobanks and registries keep samples and data available for researchers who apply to use them to investigate new questions. This long-term sharing of research participants’ health data places high demands on data security and oversight. Researchers applying for data access undergo rigorous review and must sign detailed agreements.

But what can happen to participants’ health data after a biobank or registry approves the researchers’ application and transfers the data to them? In the spring of 2026, it was discovered that health data from UK Biobank was being offered for sale on overseas commercial online platforms. The participants’ data had already been de-identified, and the sales offer was immediately removed from the platforms once discovered. While it is unlikely that anyone was harmed by the incident, it highlights a vulnerability in the system.

In an article, Yusuke Inoue (formerly a visiting researcher at CRB) and Jennifer Viberg Johansson discuss this incident as an illustration of the need for more long-term responsibility regarding participants’ health data. Carefully reviewing the researchers’ application prior to granting data access is not enough. The authors argue that responsibility for participants’ health data should encompass the data’s entire lifecycle: before, during, and after access.

Yusuke Inoue and Jennifer Viberg Johansson call this continuous governance of health data infrastructures – but what does that entail? It implies, among other things, that the committees deciding on data access have a responsibility that extends beyond the initial decision. There must be mechanisms to continuously ensure that data accessed by researchers is handled correctly throughout the period of use, and to intervene if problematic handling of the data is detected. The authors argue that these mechanisms should be proportionate to the risks involved, to ensure that continuous governance does not unnecessarily impede responsible research or routine, low-risk data usage.

Shared health-related data may cross numerous boundaries during its lifecycle and may also be utilized by commercial entities. Continuous governance therefore entails responsibility for how data is shared following the decision on access, and how it is handled by parties other than the institution originally granted access. The authors emphasize that commercial use of health data is not inherently problematic; on the contrary, it is a prerequisite for translating medical research into innovations that benefit patients. Yet, continuous governance involves a responsibility to ensure that unauthorized onward transfer of data does not occur and that data is used in accordance with the conditions and purposes expected by both participants and society at large.

Health data infrastructures are not merely technical systems, the authors write. They are public institutions that cease to function if people lose trust in them and are no longer willing to contribute their data. A crucial aspect of continuous governance is, therefore, ongoing public communication regarding how participants’ health data is transferred and used after access has been granted, as well as the risks that may arise at later stages of the health data lifecycle. It is also important to act quickly and openly when problematic data usage is discovered – which is precisely what was done when it was discovered that health data from UK Biobank was being offered for sale.

The aim of Yusuke Inoue and Jennifer Viberg Johansson’s proposal for continuous governance is not to make sharing health data more difficult, but to make it easier to do the right thing, ensuring that incidents like the one involving UK Biobank do not happen again.

Read their arguments for continuous governance here: Ethics of Health Data Infrastructures: Toward Continuous Governance and Public Trust.

Pär Segerdahl

Written by…

Pär Segerdahl, Associate Professor at the Centre for Research Ethics & Bioethics and editor of the Ethics Blog.

Inoue Y, Viberg Johansson J. Ethics of Health Data Infrastructures: Toward Continuous Governance and Public Trust. Journal of Medical Internet Research, 2026, doi: 10.2196/104402

This post in Swedish

Approaching future issues

Safeguards when biobank research complies with the General Data Protection Regulation

17 May, 2022 / / 1 Comment

The General Data Protection Regulation (GDPR) entails a tightening of EU data protection rules. These rules do not only apply to the processing of personal data by companies. They apply in general, also to scientific research, which in many cases could entail serious restrictions on research. However, the GDPR allows for several derogations and exemptions when it comes to research that would otherwise probably be made impossible or considerably more difficult.

Such derogations are allowed only if appropriate safeguards, which are in accordance with the regulation, are in place. But what safeguards may be required? Article 89 of the regulation mentions technical and organizational measures to ensure compliance with the principle of data minimization: personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. Otherwise, Article 89 does not specify what safeguards are required, or what it means that the safeguards must be in accordance with the GDPR.

Biobank and genetic research require large amounts of biological samples and health-related data. Personal data may need to be stored for a long time and reused by new research groups for new research purposes. This would not be possible if the regulation did not grant an exemption from the rule that personal data may not be stored longer than necessary and for purposes not specified at data collection. But the question remains, what safeguards may be required to grant exemption?

The issue is raised by Ciara Staunton and three co-authors in an article in Frontiers in Genetics. The article begins by discussing the regulation and how to interpret the requirement that the safeguards should be “in accordance with the GDPR.” Then six possible safeguards are proposed for biobank and genetic research. The proposal is based on a thorough review of a number of documents that regulate health research.

Here, I merely want to recommend reading to anyone working on the issue of appropriate safeguards in biobank and genetic research. Therefore, I mention only briefly that the proposed safeguards concern (1) consent, (2) independent review and oversight, (3) accountable processes, (4) clear and transparent policies and processes, (5) security, and (6) training and education.

If you want to know more about the proposed safeguards, you will find the article here: Appropriate Safeguards and Article 89 of the GDPR: Considerations for Biobank, Databank and Genetic Research.

Pär Segerdahl

Written by…

Pär Segerdahl, Associate Professor at the Centre for Research Ethics & Bioethics and editor of the Ethics Blog.

Ciara Staunton, Santa Slokenberga, Andrea Parziale and Deborah Mascalzoni. Appropriate Safeguards and Article 89 of the GDPR: Considerations for Biobank, Databank and Genetic Research. Frontiers in Genetics. 18 February 2022 doi: 10.3389/fgene.2022.719317

This post in Swedish

We recommend readings

Research for responsible governance of our health data

wrist wearing smart watch with hand holding dumbbell
15 December, 2020 / / 1 Comment

Do you use your smartphone to collect and analyse your performance at the gym? This is one example of how new health-related technologies are being integrated into our lives. This development leads to a growing need to collect, use and share health data electronically. Healthcare, medical research, as well as technological and pharmaceutical companies are increasingly dependent on collecting and sharing electronic health data, to develop healthcare and new medical and technical products.

This trend towards more and more sharing of personal health information raises several privacy issues. Previous studies suggest that people are willing to share their health information if the overall purpose is improved health. However, they are less willing to share their information with commercial enterprises and insurance companies, whose purposes may be unclear or do not meet people’s expectations. It is therefore important to investigate how individuals’ perceptions and attitudes change depending on the context in which their health data is used, what type of information is collected and which control mechanisms are in place to govern data sharing. In addition, there is a difference between what people say is important and what is revealed in their actual behaviour. In surveys, individuals often indicate that they value their personal information. At the same time, individuals share their personal information online despite little or no benefit to them or society.

Do you recognise yourself, do you just click on the “I agree” button when installing a health app that you want to use? This behaviour may at first glance suggest that people do not value their personal information very much. Is that a correct conclusion? Previous studies may not have taken into account the complexity of decisions about integrity where context-specific factors play a major role. For example, people may value sharing health data via a physical activity app on the phone differently. We have therefore chosen to conduct a study that uses a sophisticated multi-method approach that takes context-specific factors into account. It is an advantage in cybersecurity and privacy research, we believe, to combine qualitative methods with a quantitative stated preference method, such a discrete choice experiment (DCE). Such a mixed method approach can contribute to ethically improved practices and governance mechanisms in the digital world, where people’s health data are shared for multiple purposes.

You can read more about our research if you visit the website of our research team. Currently, we are analysing survey data from 2,000 participants from Sweden, Norway, Iceland, and the UK. The research group has expertise in law, philosophy, ethics and social sciences. On this broad basis, we  explore people’s expectations and preferences, while identifying possible gaps within the ethical and legal frameworks. In this way, we want to contribute to making the growing use and sharing of electronic health data ethically informed, socially acceptable and in line with people’s expectations.  

Written by…

Jennifer Viberg Johansson, Postdoc researcher at the Centre for Research Ethics & Bioethics, working in the projects Governance of health data in cyberspace and PREFER.

This post in Swedish

Part of international collaborations