London School of Hygiene & Tropical Medicine

Mark Twain said that history does not repeat itself, but it rhymes. I’m not so sure. 

In 2014, the government paused (and then ultimately abandoned) a plan known as 'care.data', which would have brought together the primary care medical records of the entire English population into a central database. The collapse of the plan followed an increasing chorus of concerns over transparency, data security, commercial exploitation, and who would have access to the most sensitive details of our lives. Promises about safeguards were vague and did not inspire confidence. Some of the concerns raised were valid; others were misplaced. But ultimately public confidence was lost because the benefits and risks of the scheme were not explained in an open and mature way. 

Recent weeks have felt like a straight repeat of this painful episode.  

Like care.data, the latest plan, billed 'General Practice Data for Planning and Research' (GPDPR) would produce a national database of detailed de-identified medical records, a resource of incalculable potential value for public health. 

It is hard to overstate the benefits of making large-scale health data available for research. Our Electronic Health Records research group at the London School of Hygiene & Tropical Medicine (LSHTM) have used de-identified electronic medical records data over many years to make crucial progress in our understanding of disease. We rapidly established the safety of MMR vaccination following autism concerns, allowing public confidence in the MMR vaccination campaign to recover, and ultimately saving children’s lives. We uncovered links between obesity and cancer, leading to influential public information campaigns. During the COVID-19 pandemic we were able to carry out critical research at speed to establish who is most at risk of severe COVID-19 outcomes, helping the government to decide who should shield, and who should be prioritised for vaccination. Our health records leave behind clues that can help the patients that follow us. A small number of people, mostly young women, experienced a rare blood clotting disorder after receiving a particular type of COVID-19 vaccine. This could only have been detected by analysing large-scale health data; young people are now offered an alternative vaccine, avoiding the risk of a rare but dangerous side effect.

So GPDPR has immense potential for good, and would create one of the richest resources in the world for learning about disease. But the plans are now in trouble. Once again, there has been a reluctance to engage the public in an open and mature conversation explaining the benefits, as well as the small but genuine risks of sharing our data. Perceptions of a malicious “data grab” have gained traction. A campaign to persuade people to opt out of data sharing entirely has enjoyed considerable success. This is a disaster for future research. Opting out not only removes your data from GPDPR, but from virtually all health research. Opportunities to gain insights into disease are lost. Rare side effects of drugs are allowed to rumble on, hidden from researchers. The data we are left with are unreliable, no longer properly representing the full population. 

Under increasing pressure, the government has now agreed to delay the GPDPR rollout by several months. This time must be used to learn from the repeated mistakes of the past. I believe that we should more loudly articulate the benefits of a scheme like GPDPR, and the strong moral case for sharing our data to help future patients. But the public also deserves honest information about the risks, and the use of every possible safeguard to minimise these risks. That means being crystal clear about who can and can’t access the data, with transparent and rigorous procedures for granting access only on the condition of demonstrable public benefit. It means using the best available tools to protect data security, such as trusted research environments which avoid the risks of moving data around. And it means imposing harsh penalties for any malpractice. We cannot reduce the risks to zero but the last 30 years of health research should be a source of reassurance: increasing availability of electronic health data for research has overwhelmingly provided benefits to society, and cases of data misuse have been remarkably rare in practice.

The pause to the GPDPR rollout provides an opportunity to do things better. Explain the benefits. Listen to the concerns. Take practical steps to reduce the risks and build confidence. Then we just might avoid history rhyming, or repeating, for a third time.