Sudden cardiac arrest (SCA) is a major health problem that accounts for 20% of all natural deaths in Europe. People with SCA die within minutes if not treated immediately, and global average survival rates are only 7%. In order to improve these numbers, we need insight into the complex sets of factors causing SCA and determining survival. This requires data, and a lot of it.

Large patient cohorts have been set up around the world, including in Europe where the ESCAPE-NET consortium will combine existing SCA datasets from various countries. The data collected ranges from information about treatment, medical history and prescriptions, to socio-economic measures such as income. Moreover, patients’ genetic material is increasingly stored in biobanks.

By linking together this information into big datasets for research, a complete picture of the SCA patient can be drawn. This will help inform personalized medicine and lead to better outcomes. Although randomized clinical trials (RCTs) are often seen as the holy grail of medical research, observational studies making use of routinely collected data offer important advantages in terms of external validity, cost and burden on research participants.

What’s the harm?

Nonetheless, the collection and use of large-scale patient data bring about various ethical questions, as well as legal uncertainties given the implementation of the EU General Data Protection Regulation (GDPR). Medical emergency settings like SCA are particularly delicate, since patients cannot give consent beforehand, and because the majority do not survive the event.

In our study, we looked at the literature on SCA and other critical and acute conditions in order to identify potential harms to patients whose data is used in research, as well as measures that researchers can take to mitigate those harms.

Compared to RCTs, the risks of participation in non-interventional studies are less obvious, but they are still there. Thinking about these ethical aspects should start early because for any study, it is unethical to use resources and involve participants when there is no sound methodology. This is very important in the acute setting, where data is often of lower quality.

When risk profiles are created on the basis of incorrect study findings, the resulting bias may create potential for health disparities between (ethnic) groups. Thus, fairness considerations should be taken into account when selecting SCA study populations. More generally, we should be careful that the use of big data does not reinforce societal injustices.

In studies that collect genetic information, an additional ethical concern relates to the disclosure of clinically actionable findings.

At the individual level, the collection of detailed information about patients increases the risk of re-identification, even more so when DNA is collected. Living persons have a right to privacy grounded in fundamental values such as autonomy, individuality, human dignity and respect – although it is not clear if and when this applies to deceased patients as well. Direct harms from privacy breaches in medical research have been scarcely documented, but data breaches are at a minimum harmful in the sense that they affect trust in research institutions and may thereby hamper progress.

In studies that collect genetic information, an additional ethical concern relates to the disclosure of clinically actionable findings, i.e. genes or genetic variants that give a higher risk of certain treatable diseases. For instance, participants have a right not to know these results, but this may create a moral dilemma for researchers who are burdened with this knowledge.

Informed consent and patients’ rights

In light of the potentially harmful effects, research participants are usually asked for informed consent. In an earlier draft of the GDPR, which was amended after criticism, informed consent would have been required for all research, causing worries about “data overprotection”. Requiring consent from patients in acute settings such as SCA leads to biased research – as the large majority that cannot give consent are excluded – and may violate the wishes of patients wanting to donate their data to science.

Alternatively, research is sometimes performed without consent or permission is asked at a later time point. But it is not always clear what the best moment is to ask for this deferred consent. There are also uncertainties in ethical and legal guidance about whether the relatives of deceased patients should be asked for consent, and the GDPR does not apply to data from people who have died.

Other ways to ensure responsible processing of patient data include security measures like encryption or the use of data enclaves, as well as oversight by ethics committees and data protection authorities. The new GDPR requires institutions that process large-scale health and genetic data to install a Data Protection Officer (DPO), conduct Data Protection Impact Assessments (DPIAs), to have certain security safeguards in place, and to set up contracts with parties processing data.

In addition to harmonization and strengthening of data subjects’ rights, the GDPR may also have negative effects. Publicity around the law combined with heavy fines for non-compliance seem to lead to a kind of GDPR-induced anxiety. For a new study, we are conducting interviews with SCA researchers and notice that many spend their time on figuring out the details of the GDPR, and negotiating with parties afraid to keep sharing data, rather than doing science.

Ethical aspects of big data research in health should continue to receive attention, and context-specific guidance is warranted. At the same time, we need to ensure that bureaucratic hurdles do not stop these important studies.