Who Owns the Data in a Medical Information Commons?

Abstract

In this paper, we explore the perspectives of expert stakeholders about who owns data in a medical information commons (MIC) and what rights and interests ought to be recognized when developing a governance structure for an MIC. We then examine the legitimacy of these claims based on legal and ethical analysis and explore an alternative framework for thinking about participants' rights and interests in an MIC.

Former President Barack Obama said, when talking about precision medicine and genetic data, “I would like to think that if somebody does a test on me or my genes, that that's mine, but that's not always how we define these issues.”¹ This comment resonated with how many DNA testing companies talk about data ownership.² It reflects an intuitive feeling that many share that I should own information about myself, but as President Obama suggested, this intuition is not necessarily congruent with our legal understanding of data ownership.

Tony M. Honoré wrote that “[o]wnership is one of the characteristic institutions of human society.”³ Yet despite its ubiquity, ownership proves surprisingly hard to define. There is no single, widely accepted legal definition of ownership. “To own” is a transitive verb: It requires an object.⁴ Not surprisingly then, most non-lawyers think of ownership in physical terms, where physical property is the thing that is owned. However, in the law, property is not the object itself but rather the ability to assert control through aggregated legal interests. Understanding property as a set of legal relations or a collection of rights has become popularly known as the “bundle of rights” approach to property law.⁵ This construction allows ownership over things that lack a physical form, such as a song, an episode of a television show, a brilliant design innovation, or — for the purposes of this article — health data. In other words, the bundle of rights approach provides the basis for intellectual property.⁶

Much of the appeal of understanding property in this way stems from the ability to “unbundle” and tailor the component rights. Different objects under different conditions invoke different ownership interests.⁷ For example, the owner of a single piece of land has rights to exclude people from entering, to charge them for entering, and to sell the land, as well as rights associated with a mining concession but cannot freely abandon their property, ignore zoning laws, or decline the government acquisition for public use.⁸ Patents are a distinct form of property that confers the right to exclude others from making, using, selling, and importing but does not convey positive rights to make, use, sell, or import.⁹ These examples demonstrate that ownership rights are rarely universal or absolute.¹⁰

This article considers data ownership in the context of a medical information commons (MIC). The paradigmatic example of a commons in legal scholarship is the medieval village green used for grazing cattle. While no single villager has exclusive ownership, all inhabitants have limited access rights over their shared resource. However, the commons lacks a precise definition. Some scholars define the commons as the collectively owned resource itself. Others refer to the commons as the governance structure for allocating the collective ownership rights over the shared resource. Weston and Bollier explain that in “its broadest sense, a commons is a governance system for using and protecting all the creations of nature and society that we inherit jointly and freely, and hold in trust for future generations.”

This article considers data ownership in the context of a medical information commons (MIC). The paradigmatic example of a commons in legal scholarship is the medieval village green used for grazing cattle.¹¹ While no single villager has exclusive ownership, all inhabitants have limited access rights over their shared resource. However, the commons lacks a precise definition.¹² Some scholars define the commons as the collectively owned resource itself.¹³ Others refer to the commons as the governance structure for allocating the collective ownership rights over the shared resource.¹⁴ Weston and Bollier explain that in “its broadest sense, a commons is a governance system for using and protecting all the creations of nature and society that we inherit jointly and freely, and hold in trust for future generations.”¹⁵

Of course, an MIC deals not with land but with information and data. For our purposes, we use the definition of an MIC provided by Deverka et al.: “a networked environment in which diverse health, medical, and genomic data on large populations become broadly available for research use and clinical applications.”¹⁶ Importantly, an MIC describes the network and its governance structures, which are made up of smaller collections of networked data. Thus, there is no one single MIC. Rather, the term describes a larger ecosystem of shared data.¹⁷

In this paper, we explore the perspectives of expert stakeholders about who owns data in an MIC and what rights and interests ought to be recognized when developing a governance structure for an MIC. We then examine the legitimacy of these claims based on legal and ethical analysis and explore an alternative framework for thinking about participants' rights and interests in an MIC.

Experts' Perspectives on Data Ownership

We present a sub-analysis of semi-structured interviews with expert stakeholders from our larger project, Building the Medical Information Commons, which solicited input on topics related to data sharing in the context of an MIC. A description of the sampling approach and data collection methods are described elsewhere.¹⁸ Interviews were conducted with 41 expert stakeholders (10 of whom have a law background) from several employment sectors that may be involved with the development of an MIC or work on matters related to health data sharing: academia (n=14), government (n=4) and non-governmental organizations (n=9), healthcare systems (n=3), laboratories (n=3), and technology companies (n=8). This paper reports findings from a thematic content analysis of three questions from the interview guide: How do you define ‘data ownership’? In your opinion, who owns the data in an MIC? What rights and interests do individuals whose data populate the MIC have? Additional commentary during the interview on data ownership provided outside the context of these questions was also included in the analysis. Coding was managed using NVivo 11 Pro software program, a qualitative software management and analysis tool.

Who owns data in an MIC?

Some experts thought that the person whom the data describes should own the data that is shared in an MIC, while others felt that investigators who generate the data are the rightful owners of those data. A few suggested that perhaps there should be co-ownership between the data sources and the data generators. However, the vast majority agreed that nobody owns the data shared in an MIC, or at least nobody should own it. Some legal experts felt strongly that data simply cannot be legally owned by anybody:

[D]ata is not ownable, at least under US law and under the laws of many common law jurisdictions. You can't own data. You can't own the news of the day. We've known that since the early 20th century…as long as I consent to the extraction of my cells or my blood or my saliva, whatever it is, then I think that whatever information you can conclude about it is not owned by anybody.

Others recognized that there might exist some legal claim of ownership over data but felt that thinking of data as being owned by somebody does more harm than good:

Interviewee: I would be perfectly happy to avoid the O word entirely, and just not talk about ownership at all, but talk about rights and responsibilities.

Interviewer: Why is that?

Interviewee: Because when I say ownership to somebody who either didn't take or has long forgotten first-year property, they think, “Oh, if you own something you have complete and utter dominion over it,” which is never true. This very broad, but deep and powerful lay understanding of the term ownership gets in the way of reality. It does in every context, but we have enough experience that we know that if [you] say [you] own your car, that doesn't mean you have the right to drive at 120 miles per hour. We don't think about that as a limitation on your ownership, but it is…If you tell people you own your data, or your doctor owns your data, or your health insurer owns your data, I worry that that will be taken to mean too much.

For some, the very concept of ownership was thought to be “inimical and antithetical to the commons,” which is intended to be a community good. As one expert explained:

[I]f the goal is to create a commons, a shared resource to facilitate its use, ownership is the wrong thing because ownership implies that somebody can control and can have control over [it]…Can block uses, right? You don't want to block uses. You want a governance system that makes decisions about what kind of uses are appropriate and then to maximize those types of uses. That's very different from an ownership model where someone can just say, “Nope, you're trespassing on my property. Get out.”

What Rights and Interests Should Stakeholders Have in an MIC?

Jacqueline Lipton points out that “[o]ne of the more obvious reasons we talk about ‘property’ in information is the lack of a better word.”¹⁹ Ownership then functions as a metaphor for the bundles of rights discussed above. However, using the language of ownership without further clarification fails to specify which rights and interests are at stake when individuals contribute their data to an MIC.

In terms of what those rights and interests are, at a minimum, experts felt that there should be transparency about the ways in which data will be used within the commons and that individuals should be able to access information about themselves.

[T]he rights that [participants] have are to understand, [have an] informed understanding, of what's going to happen with their data and well, I would say they should have a right to full access to all of their data and data derived from them and a full understanding of what the governance is that decides who else will have access to that data.

Experts did not agree, however, about whether individuals should be able to control who else can access and use their data. Some felt that the commons is a public good and so there is some sort of social obligation to contribute data and to let it be used for research without retaining any control over those uses.

[T]here are lots of things that we don't like that are imposed on us by the government. I don't like to pay taxes…But we pay taxes. We have to pay taxes, because we live in a society in which, as a collective, we've decided that it is in the greater social good to pay taxes so that we have roads and police and all of the other things that taxes buy for us as a society. I view biomedical research as the same thing. It would be better for us to cure cancer than to allow the types of access and control that are being requested.

Other felt that individuals should have control over the initial decision to share data, but that once it is shared, they give up any control over its future use.

I think once you give it away, you give it away… when you are a data donor, you're going to have to become savvy and make sure that the people you've given your data to are people who are going to use it wisely, the way you define wise.

Some respondents felt strongly that individuals should be able to control how their data are used and should be able to exercise “veto power” over objectionable uses:

[T]he people who contribute the data should continue to have a say in how the data are used and their say should be taken very, very seriously.

Finally, a few experts felt that whatever rights individuals have to control the use of data in the commons has to be negotiated contractually. According to this view, an MIC is a free market and individuals can decide to share their data in exchange for whatever they think is a fair exchange:

They can condition their giving of physical samples to researchers. They can condition it on whatever contractual provisions they want, and the researchers can accept or reject those.

It was acknowledged that giving individuals control over the use of their data, whether contractually or as an extension of their legal and ethical rights, has some transactional costs associated with it. It can be burdensome and may impede use of this shared resource. Novel technologies may be able to mitigate some of these costs by automating the decision-making process and implementing data use limitations, but even if the costs remain high, they were generally thought to be justified by the importance of respecting the rights and interests of individuals whom the data describe.

Legal Perspectives on Data Ownership

Research institutions, biotech companies and health care providers all have legally recognized ownership rights in health data in the form of intellectual property (with all of intellectual property's concomitant limitations).²⁰ However, it is less clear what legal rights — if any — the people who are the sources of data enjoy with respect to that information.

MICs are made up of various kinds of health data, including medical records and genetic information. Here, we explore the current state of the law with respect to these two categories.

Medical Records

Although they may assume otherwise, people generally do not own their medical records.²¹ All fifty states agree that medical providers — not patients — own the tangible, physical record.²² Moreover, twenty-one states have statutes or regulations stating that providers own medical records.²³ Yet, like all ownership rights, the rights in medical records are limited. Health care providers must still comply with the legal and ethical standards governing patient privacy and disclosure.²⁴

While they may not own their medical records, patients generally have rights to access their records and to prevent others from gaining access, entitlements traditionally recognized in the property bundle.²⁵ Only one state, New Hampshire, gives patients explicit statutory rights. It provides that “[m]edical information contained in the medical records at any facility licensed under this chapter shall be deemed to be the property of the patient.”²⁶ Additionally, two cases from the 1960s grant patients clear ownership rights in their medical records. One federal district court found that “each patient has a property right in his hospital records” and another asserted that, although the hospital owns the physical record, “[t]he patient has a property right in the information appearing or portrayed on the records.”²⁷ Thus, in some jurisdictions, patients may own their data albeit not their physical records.

Genetic and Genomic Data

Of course, medical records may include genetic or genomic data. However, DNA has generated its own body of distinctive law that is worth exploring. At least five states have passed statutes related to genetic ownership. In Alaska, “a DNA sample” and “the results of DNA analysis” are “the exclusive property of the person sampled or analyzed.”²⁸ Colorado provides that “[g] enetic information is the unique property of the individual to whom the information pertains.”²⁹ A Florida statute has proclaimed that the results of DNA analysis are “the exclusive property of the person tested.”³⁰ According to Georgia law, “[g]enetic information is the unique property of the individual tested.”³¹ And in Louisiana, “[a]n insured or enrollee's genetic information is the property of the insured or enrollee.”³²

In jurisdictions where explicit ownership rights have not been statutorily defined, judges have been reluctant to recognize explicit genetic ownership interests. In the (in)famous case, Moore v. Regents of the University of California, the California Supreme Court held that people lack ongoing property interests in their excised cells.³³ In another case, a federal district court in Florida affirmed that legal conclusion and even went a step further, finding that in the research — opposed to the clinical — context, people have even fewer rights in their tissue once it is outside the body.³⁴ Interestingly, the court chose not to apply the Florida genetic property statute, finding that the law covers only cases of unlawful disclosure or lack of informed consent. In Missouri, when patients who donated bio-specimens asked for the samples to be transferred to their doctor's new research facility, a federal appellate court held that, while the donors could request that their tissue be destroyed, they could not request that it be moved.³⁵ These cases stand for the proposition that people lack meaningful ownership rights in their biospecimens. By contrast, in a criminal case, another federal appellate court acknowledged that a defendant had an ownership right in his blood sample, although not the genetic information it contained, because the blood was a “tangible object.”³⁶

More recently, courts — at least in states with genetic property statutes — have demonstrated a greater willingness to recognize ownership interests in the genetic information that the tissue contains. In one particularly colorful case, a Florida couple sued a man for conspiring to take and test their genetic material for use in an earlier lawsuit. They alleged “an exclusive right of possession and ownership of the genetic information encoded in their genetic material” and that “[b]y collecting, analyzing, and testing their genetic material to obtain…confidential genetic information, Conspirators exercised an act of dominion and authority that deprived [them] of their rights of ownership, possession, control, and privacy.”³⁷ The trial court found the couple had a sufficient property interest in their genetic data to sustain a common law action for conversion. Another recent case targeted a direct-to-consumer genetic testing company for sharing a customer's data with third parties.³⁸ In rejecting the company's motion to dismiss, the district court noted that Alaska law includes a property interest in genetic data for purposes of tort law.

Finally, it is worth noting that while individuals may currently lack broadly construed ownership rights in their health data, they still enjoy protection for limited entitlements traditionally found in the property bundle, such as a right to exclude via informed consent, a right to access data through the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and other federal laws such as the Privacy Act of 1974, and a right to commercialize using contract law.³⁹ These rights are — we argue — not generally considered fundamental rights derived from natural law based on universally accepted moral principles; instead, they are created and protected by positive laws, which are statutory man-made laws.⁴⁰ Rather than focus on who has a natural ownership right to the data in an MIC, then, it may be more important to specify which positive laws ought to be created to protect the ethically justified interests of individuals whose data are shared in an MIC.

Ethical Perspective on Data Ownership

This holistic approach would be problematic if we had natural rights to our medical data. But that is far from clear. Such rights, one would think, would have to flow somehow from our natural rights to bodily integrity. However, the right to decide what happens to our body does little to fix the content of rights in information derived from our bodies. So long as patients are aware of what will happen to their data when they enter the clinic, it seems clear that they can validly consent to the procedures that generate health and genetic data.⁴¹ Their right to consent to bodily incursions, therefore, does not determine what it is permissible to do with the data these incursions generate. At most, the right to bodily integrity confers a right to consent to the acquisition of information taken from our bodies or derived from us.

The justification for further informational rights is thus more plausibly a matter of deciding which set of privacy-protecting practices are best justified overall, in light of all relevant values, than a matter of directly interpreting some sort of natural rights in our bodies. To be sure: arguments might still be made, in this more holistic vein, in favor of a more broadly construed notion of ownership. Perhaps, for instance, ownership interests derive from a moral right to fair compensation for contributing data to an MIC.⁴² However, it is far from clear that this fair return on contribution requires granting an ownership right in any full-blooded sense of “ownership.” For, again, the question is: how best to specify rights, this time, rights to share in profits from data, in light of all relevant values. And it seems that there is good reason not to implement compensation in a way that involves treating data as a paradigm case of property, like a re-saleable commodity. Practically speaking, an excessively commodified approach to medical data threatens a tragedy of the anti-commons, where it becomes prohibitively expensive to investigate and conduct all of the individual transactions needed to construct useful aggregated data sets for individual studies.⁴³ Moreover, we may simply be uncomfortable holding patients to a principle of caveat venditor, denying them any ongoing rights in their information (e.g., the right to access it or to withdraw it if they change their minds) after they have sold it to an MIC.⁴⁴

Perhaps most importantly, informational ownership in the data within an MIC could substantially set back medical progress. As our expert stakeholders noted above, establishing a right of ownership runs afoul of the very purpose and spirit of an MIC. Focusing instead on the bundle of rights and interests that are thought to be important to build a trustworthy and sustainable MIC is thus a much more productive way forward.

Perhaps most importantly, informational ownership in the data within an MIC could substantially set back medical progress. As our expert stakeholders noted above, establishing a right of ownership runs afoul of the very purpose and spirit of an MIC. Focusing instead on the bundle of rights and interests that are thought to be important to build a trustworthy and sustainable MIC is thus a much more productive way forward. Granted, this reasoning might seem circular to those who would oppose an MIC on ownership grounds — they claim that ownership rights, as rights, might sometimes require us to forego beneficial projects, just as rights to bodily integrity foreclose potentially valuable clinical research from being conducted if consenting subjects cannot be found to participate in it. But if informational rights — by contrast to body rights — are to be justified holistically, in terms of the effects of granting them, then there is in fact nothing wrong with evaluating proposed rights-regimes in terms of their consequences, including their consequences for an MIC. An ethically sophisticated understanding of informational rights, then, shows that our experts are after all on solid ground in using the benefits of an MIC itself as an argument against rights claims that would prevent its emergence.

Conclusion

In conclusion, we have shown that many of the experts we interviewed did not think that individuals should be able to assert broad ownership claims over the health, medical, and genomic data shared with an MIC. However, experts did agree that individuals retain some rights and interests with respect to the data and that this should include, at a minimum, transparent communication, individual access to that information, and perhaps even some degree of control over its use. These findings are based on qualitative interviews with diverse expert stakeholders; thus, they are not generalizable to all stakeholders involved in building and maintaining MICs. Ten of our respondents have a law background so their perspectives on ownership may have been informed by legal definitions of property and relevant case law. Two of these respondents are from Canada, so their perspectives may have also been influenced by Canadian law and social norms. Nevertheless, these findings are generally consistent with current interpretations of U.S. law. They are also consistent with plausible philosophical approaches to moral rights in bodies and bodily information.

As Prof. Jacqueline Lipton noted back in 2004, data ownership is a useful metaphor that helps clarify an important truth: Whether people frame their aspirations in terms of data ownership, or in ethical principles, or in the language of other legal theories, we all ultimately seem to want approximately the same things.⁴⁵ People want respect for the rights and interests of individuals whose data are stored in databases and MICs, including access to information about themselves and a meaningful voice in how their data are used and disclosed; they want data security and other basics protections; and they want the societal benefits that will flow from having our data accessible for research, public health, and other important uses.