Licensing, ethics and patient privacy

Following one of “those” conversations on twitter, the ones where the 140 character limit just isn’t enough it seemed worth writing up a quick post. It’s that or follow the US election after all…

Richard Sever of Cold Spring Harbour Press posed the following question on:

Regardless of access, should there be a conversation about whether CC BY is the most appropriate license for images of patients? https://t.co/V3XpQ9jZSp

— Richard Sever (@cshperspectives) November 8, 2016

…to which my answer was:

No, if an image shouldn't be distributed we need more granular upstream access controls and ethical frameworks… 1/2

— CⓐmeronNeylon (@CameronNeylon) November 8, 2016

You can follow the conversation via the links above but here I just wanted to flesh out the disagreement and why I think this matters. This is a general class of a problem that we often see, where we reach for licensing as a tool to reassure or solve some sort of complex normative, and often ethical, issue. I’ve always had a problem with this because normative issues are ones of community, and therefore ones that we need to take responsibility for. Licensing (and other legal tools) place responsibility elsewhere, granting control to another community, in this case judges and the courts. Sometimes this is necessary, when there is an expectation that the interests of different communities will need to be arbitrated, but in the case of ethical issues I feel these are internal issues and ones that should be determined (and if necessary sanctioned) internally.

In the specific case here we’re talking about an identifiable image of a child, where the parents had apparently given permission for the image to appear “in a scientific journal” but hadn’t realised that this would be widely available. When they did realise this some years later they withdrew permission and the article was retracted, with the image blacked out in the retracted version. This is unfortunate and there are issues with the specific story but in some ways its a story of things working well. Permission was sought and given, when it was revoked the image was removed and the issue noted.

For me, what is at core here is the issue of informed consent and the degree of assurance that can offered to participants that the commitments made to them, particularly on issues of privacy, can be met. If there is data, including images, that should be restricted from public access then that needs to be made clear, but above and beyond that there needs to be clear communication about the risks of the access control that are put in place breaking down.

Why am I focussed on access control when this was an Open Access article? For me, the issue was a lack of appropriate clarity in the consenting for the use of the image. If the participant’s expectation is that an image or data will only be made available to professional medical staff or to researchers, then it should never go in a journal article of any kind. Journal articles are publicly accessible, in different ways, we cannot guarantee to prevent a journalist who has access to a research library taking a copy of an image from a print subscription journal and using that in an article. If the concern is public view or commercial use then once its in a journal we cannot guarantee that will not happen.

You might argue that the risk is much higher with online CC BY licensed article but ethical judgements err (sometimes radically) on the side of caution for good reason, because they are intended to deal with low probability events that can lead to substantial harm. I would argue that unless a participant explicitly consents to allowing liberal re-use then such data (including images) needs to be properly access controlled.

As John Wilbanks has argued for many years, copyright licenses are a very poor means of protecting participant privacy. There are far too many ways for it to fail, from people ignoring it, to technical systems failing to recognise a separate license for an image in a larger work, to the many conditions under which the license simply doesn’t apply because a use falls under Fair Use or Fair Dealing. Both to establish trust and meet ethical standards it is necessary to link access to contractual requirements that bind the user to limit their downstream uses in ways that licensing can not.

Now Richard was arguing from a different end. Without presuming to put words in his mouth his concern as I understood it was “given that key data needs to go in ‘the paper’ how can we best give participants assurances that make them comfortable with providing consent”. In the end I think we agree that access to sensitive material needs to be limited. My view is that copyright licensing provides little to no assurance of the type needed. Licensing is also implemented by players outside the control of the organisations responsible for consent.

Richard, I think would argue that having open licenses could be discouraging. In both cases I think we end at the point that where material is sensitive and where access controls are deemed necessary, whether by an IRB or by the participants themselves then an ethical approach requires appropriate safeguards. And for me that means robust access controls.

There might be a case in which participants consented to use for publishing, but only under a restricted license. I actually find this a little implausible. The consenting should be based on clear limitations on use, not on copyright licensing, for the reasons noted above about the limitations on enforcing licenses. Nonetheless its at least a theoretical possibility. For me, the importance of having a cleanly and consistently liberally licensed public record is enough to say that under these circumstances such materials should be kept separate to the formal public record, linked from it but not formally part of it.

At scale, re-use requires reasonable certainty and at the moment the wholescale re-use of images, even from Open Access literature runs into problems due to the embedding of differently licensed images and no consistent way of marking this. This is actually an inverse of the problem as above. Just as licensing can’t give sufficient assurances that inappropriate uses will be blocked, poorly expressed licensing doesn’t give clear assurance to users, particularly at scale that use is appropriate.

For me the argument from both ends, that a consistently licensed clean corpus has enormous value, and that licensing is not the right tool for carrying out ethical responsibilities, reaches the same point. If participant consent does not include liberal re-use then material should be maintained separately to the public, published record under appropriate access controls that limit uses to those that have been consented.