Starting from two well know cases of the still surprising “network effect” of biological data, CHIRON scholar Jasmine McNealy examines the concept—and necessity—of community consent. Is community consent a minimum standard (a “floor”) for the ethical conduct for biorepository research or a moral aspiration (a “ceiling”) for community engagement in biorepositories? Or should we be asking another set of questions entirely?

Community Consent: neither a ceiling nor a floor

In June 2024 investigators in both the UK and Canada began investigating the genetic testing firm 23andMe after hackers accessed the site. 23andMe originally denied that there was a “hack”–there was no breach of its security systems–claiming the unauthorized entry resulted from the use of compromised, recycled logins. 

According to reports, the hackers accessed 0.1% of customer data, or around 14,000 users. But this unauthorized access allowed hackers to access the information of others who had opted in to 23andMe’s feature that allows users to connect with genetically related relatives. The hack, then, affects only slightly less than half of the company’s customers.

The scale of the 23andMe breach demonstrates the networked nature of health data, and it is of course not the only instance demonstrating the connectedness of the data in biobanks; the fascinating tale of how police used the genetic data stored on the site GEDMatch to catch the Golden State Killer is a great way to spark conversation about data use, privacy, and consent, especially when the data at issue “belongs” to or implicates more people than those who have directly consented to have their data stored, used, and/or shared.

The 23andMe breach and the Golden State Killer case are two of the more “flashy” cases, but questions of consent, especially the consent of all of those affected by biodata collection and analysis in more mundane or routine health and medical research projects, are just as important. The communities of people affected have expectations about their privacy and the possible impacts of inferences that could be made about them in data processing systems. Researchers must, then, acquire community consent when attempting to work with networked biodata. 

Several benefits of community consent exist, especially for marginalized and vulnerable populations. These benefits include:

• Ensuring that information about the research project spreads throughout the community,

• Removing potential barriers that might be created by resistance from community members,

• Alleviating the possible concerns of individuals about the perspectives of community leaders, and 

• Allowing the recruitment of participants using methods most salient to the community.

But community consent does not replace individual consent and limits exist for both community and individual consent. Therefore, within the context of a biorepository, understanding whether community consent might be a ceiling or a floor requires examining governance and autonomy.

Governance

Governance encompasses the processes and structures by and through which decisions are made and interests are articulated, and requires some form of leadership representing the interests of the community. With any form of governance, however, there is the possibility that those in leadership may not represent all of the interests and values of all of the community. Subgroups, or communities within communities, exist, and may have perspectives that differ from those of the larger community. This can be the catalyst for conflict. 

The existence of community leadership, in the context of a biorepository, may not be possible for communities that do not already have a recognized leadership structure. Some communities have long standing governance. Several Indigenous tribes and communities, for example, have leadership structures that can and have made decisions on researcher access to biodata. Other communities may not have these kinds of mechanisms, especially those where the network of community members is geographically dispersed, where membership is based on self-identification or diagnosis, and other factors. In absence of community governance, researchers must, then, investigate who can best represent a community when conducting biodata related research. In conducting this investigation, researchers should recognize and acknowledge (through publication) the impracticability or impossibility of representing the interests of a general community as a limitation on the research.

Autonomy

Community consent may conflict with individual consent. 

If, for example, an individual self-identifies as a member of a community, and that community (with a governance structure) has declined to participate in a study, that individual’s interest in participating will conflict with the community’s stated interest. In this case, the individual’s autonomy–the ability to govern themself–may reflect their personal values, interests, goals, etc. that are not in alignment with those as identified by the community. But contacting individuals for participation may impair researcher relationships with established community governance structures. In 2018, for example, the NIH and its All of Us research program came under fire for bypassing tribal data sovereignty to collect genetic data by recruiting in urban areas containing large populations of Native Americans, without consulting with tribes or the National Congress of American Indians. Although the focus of interest was the NIH’s end-run around tribal sovereignty, a question remains about the rights of individuals to participate when they 

1. are not formal members of a community, 

2. do not believe in the community governance structure or no formal structure exists, and/or 

3. have interests in conflict with those of the “representative” community.

In the United States and some other jurisdictions, autonomy and personal freedom, many times, takes precedence over recognizing the implications of actions for a community. But researchers should not use this as a way to circumvent ethical and critical considerations with the collection and use of biodata, especially in an era of innovations like artificial intelligence, in which the predictions that can be made from this data can have both short and long term impacts that disperse beyond the individual that has consented. This, coupled with the possibility of researchers fomenting intra-community conflicts, requires that community consent should be considered neither a ceiling nor a floor, but the infrastructure or the foundation for responsible research and biodata management so that communities, and/or representatives of the communities are able to participate in research data governance processes.

Further Reading

Brief, E., Mackie, J., & Illes, J. (2012). Incidental findings in genetic research: a vexing challenge for community consent. Minn. JL Sci. & Tech., 13, 541.

Diallo, D. A., Doumbo, O. K., Plowe, C. V., Wellems, T. E., Emanuel, E. J., & Hurst, S. A. (2005). Community permission for medical research in developing countries. Clinical infectious diseases, 41(2), 255-259.

Al, P. (2021). The value of communities and their consent: A communitarian justification of community consent in medical research. Bioethics, 35(3), 255-261.

Kahn, J. (2005). Informed consent in the context of communities. The Journal of nutrition, 135(4), 918-920.

Foster, M. W., Sharp, R. R., Freeman, W. L., Chino, M., Bernsten, D., & Carter, T. H. (1999). The role of community review in evaluating the risks of human genetic variation research. The American Journal of Human Genetics, 64(6), 1719-1727.