Comments – University of Manitoba, Human Ethics Resource Committee

While we can appreciate the potential need for a broad consent option, more information and guidance are needed for its use. More information and definitions are needed for repository and data repository. It is also unclear how researchers and institutions will operationalize these repositories. How will we ensure the data is accurate and only contain data by those who have provided consent? How are consent forms managed to ensure participant’s rights are respected? How should consent forms in these cases be managed from a data management perspective? Who is checking for compliance? Who’s responsible for the upkeep of these repositories and ensuring they are taken down/destroyed when stated? How are withdraw requests operationalized? If these individuals have not yet been consulted, it is imperative that data management specialists are involved in these conversations as they are the data experts. It would also be helpful to involve privacy specialists and people who work with personal health information. Standard repository language for consent forms would be helpful.

Line 47– ‘repository assumes those responsibilities’ – Does this mean that when something is deposited, the onus of the researcher is transferred to the repository? What ongoing obligations are there to the 'owner' of the dataset?

Line 71/72 – participants ‘must be able to request withdrawal of their stored data...’ While this seems self-evident from an ethics perspective, practically this raises several questions: if a participant wishes to have their data removed from a repository, who is responsible? What is the responsibility of the REB to ensure this is done? What is the responsibility of the repository? Does takedown process/policy need to adhere to REB policy? How does privacy factor into any declarations of takedown?

Line 76/77– ‘Researchers must justify any limitations ....’ This will likely require considerably more forethought and understanding of terms of use and nature of deposit by researchers. Training will be essential.

Line 130– Precision here is likely needed. If something is deposited into a collection whose definition/name infers a specific purpose or group, then by extension that data is associated with said community.

Line 132– This will seem burdensome to researchers and may discourage deposit. The nature of data reuse includes the possibility that you may not be able to predict how people may use it (i.e. hence the use of open platforms etc.).

Line 137– Does this include minimal length of time? The intention of data deposit is also preservation over a considerable length of time. Will the researcher need to provide for the entire life cycle? More clarity would be appreciated here.

Line 142– This will require a specific element in the signatory section. What does this mean in relation to bullet 3 (line 146) (i.e. limitations of withdrawing)? What does this mean in terms of aggregating/group anonymization of data?

Line 153– This potentially opens up the repository to legal liability. Since the researcher signs a waiver from the repository on deposit, the onus is put back on researcher. Therefore, what is the responsibility of the institution?

Line 167– This will require ongoing relationship/communication between the REB and repository to ensure repository policy can meet these requirements.

Line 202– This would be the case for the vast majority of data deposits. Also, what is the obligations of the repository to ensure appropriate consent was obtained? Does the repository need to retain copies of consent? Will the researcher need to prove consent upon request?