Introduction

Precision medicine is defined as a newly arising approach for disease prevention and treatment that is adapted to the individual variability in genes, environment, and lifestyle of each person (National Institutes of Health (US) 2017). “All of Us,” the Precision Medicine Initiative (PMI) launched in 2015 by then US President Obama, aims to advance medical science and clinical care through engaging individuals as a resource through “classify[ing] individuals into subpopulations that differ in their susceptibility to a particular disease, in the biology and/or prognosis of those diseases they may develop, or in their response to a specific treatment” (National Research Council 2011, 12).

The former government of the Republic of Korea (hereinafter referred to as “Korea”) also recognized the paradigm of precision medicine as a next-generation growth engine and proposed the “Precision Medicine Cohort Program” as a national strategy in 2016. However, this initiative was delayed (Korea Institute of S & T Evaluation and Planning 2017). One of the major reasons was opposition from scientific and academic communities, as there was insufficient consideration of the ethical, legal, or social issues.

Meanwhile, the Korea Center for Disease Control (KCDC) is finalizing the plan for the Precision Medicine Cohort Program, which it hopes to initiate as a demonstration project in 2018. Under this plan, the fundamental role of biobanks to promote health and technology has not changed, but the concept and practice of precision medicine are now rapidly being infused into the operation of Korean biobanks under the Bioethics and Safety Act (BSA). Therefore, this article aims to identify current bioethical and regulatory issues relating to oversight, privacy, informed consent, and data sharing, and will propose an approach to address them.

Biobanking and Precision Medicine

For almost a decade, the Korean government has continuously developed and expanded biobanking. In 2008, the Korea Biobank Project (KBP) was launched to collect and manage human biomaterials (or biospecimens), through a top-down approach. The KBP has developed 17 regional biobanks through a collaboration with tertiary hospitals and established a national biobank at the KCDC. Each regional biobank mainly collects human material relating to various diseases using electronic medical records (EMRs), while the national biobank stores and manages human materials, and links them with information obtained from various national cohort studies and national survey results. The various biobanks are connected by the Korea Biobank Network (KBN), which enables them to share information of human bioresources via the Biospecimen Information Management System (BIMS). The KBN also provides biospecimens—alone or in combination with genetic or epidemiological data—for research purposes.

Recently, however, there have been two major changes with a significant impact on the practice of biobanking. First, the Korean government has developed a big data utilization system in healthcare. The healthcare sector has generated and is managing a large amount of data but has not released it in the public domain in order to safekeep sensitive information. However, since a large amount of healthcare information is already digitalized in the current information technology environment, the government now intends to develop for the capability of integrating information from various sources through a new policy of open public data (see Tables 1 and 2). As a consequence, the traditional focus of biobanks on human biospecimens is now turning into an open cloud platform aiming to provide valuable health data in combination with genome data, information in EMRs, and other public data.

Table 1 Public and private data to be considered to integrate to biobank in Korea (revised from Kang 2016)
Full size table
Table 2 Comparison of collecting data in each national biobank program
Full size table

Secondly, recent information technology enables rapid distribution of various types of data generated by various mobile and wearable devices. This makes it possible to collect and use personal life log data via social networking services (SNS) and health data through mobiles and wearable devices in real time. Table 2 shows how the Korean government plans to collect information for precision medicine through personal devices, in comparison to how it is done in the USA.

Biobank Oversight

As a human biomaterial biobank is required to establish an institutional bioethics committee under §9 of the BSA (BSA 2008), the National Biobank has constituted the Distributive Review Committee (DRC, similar to an IRB). In the data collection stage, the DRC reviews the design of national cohort studies or surveys which collect human materials as part of their research. Where access to and distribution of biospecimens are concerned, the DRC reviews the ethical and scientific validity of the research proposal, the legitimacy of consent procedures, measures for protecting personal information, and other matters regarding bioethics and biosafety. At the utilization stage, the DRC supervises and inspects the progress and outcomes of research projects that use human materials from the biobank. However, review may be waived if the research only uses human material or genetic information stored by the biobank but does not otherwise involve any direct contact with human subjects, as the research would be classified as “research that does not collect or record personal information” (Enforcement Regulation of the BSA 2016). Among its various functions, the main role of the DRC relates to preliminary investigation of the research proposal at the access and distribution stage.

However, as human biospecimens could be stored in the form of digitalized data, the role of the DRC could become less important, as the focus is shifted to the database rather than the biological materials that are the source of the data. Practically, it means that the role of the Data Access Committee (DAC) may be emphasized more than the role of the DRC. The DAC is responsible for verifying whether national research ethics requirements such as those on consent are respected when a biobank provides data to external requesters and researchers (European Bioinformatics Institute n.d.). In addition, a national biomedical research data repository for advancing science and health known as CODA (Clinical & Omics Data Archive) was established in 2016 under the National Biomedical Research Resource Management Act. The main goal of CODA is to collect, organize, and preserve clinical research and human-derived omics data from publicly funded studies. CODA started a data provision service on 20 June 2017, which allows researchers to access and download data after submitting a data usage application and after approval from CODA. Under a Data Usage Agreement, research data provided by CODA can only be used for research during the specific period that was approved. Furthermore, access and use of data are limited to the participating researchers identified in the CODA-approved data usage application and are not available to third parties. If data access is required for collaborative research, a separate application must be made by the third party. Any attempt to identify an individual based on research data is strictly prohibited (Korea Centers for Disease Control and Prevention n.d.).

Consent in Biobanking

There are two types of consent in genome research and biobanking in Korea. Under §37 of the BSA (BSA 2012), consent for research on human materials is a mix of specific and broad consent, because participants can determine the scope of secondary research use (either specific or broad) and can also decide on the preservation period (either specific or permanent). On the other hand, researchers are required to define the research purpose for consent-taking purposes in either a specific or broad manner, with emphasis on respect for the autonomy of participants. Consent for biobanking of biological materials is closer to broad consent under §42 of the BSA, because the specific research purpose does not need to be written into the consent document unless the biobank conducts the research itself. Such an arrangement could promote digitization of physical biospecimens. As observed by McGuire and McGuire (2008), once information is digitized, it could be continuously stored, used and completely shared by data providers due to the nature of genomic studies. Therefore, broad consent has almost completely replaced specific consent after the revision of the BSA in 2013.

However, there have been limitations on broad consent. The informed consent requirement has changed several times through different rounds of revision of the BSA. Practically, it was burdensome for researchers or even biobanks to re-contact individuals and obtain consent, because there was no interactive system between participants, biobankers, and data users originally. Therefore, researchers who need to conduct scientifically important and urgent research may be confronted by an ethical obstacle when re-consent is necessary (Kim 2014). Meanwhile, information and communications technology (ICT) has become more pervasive in society, with mobile and wearable devices emerging as an interface between participants and the promises of precision medicine research and tailored medical services. And at the same time, there is growing public concern over data leakage and privacy infringement. Considering these trends, are the current consent models for genome research and biobank appropriate to reflect the participants’ autonomy?

Responding effectively to this question will require us to think of informed consent as being concurrently concerned with sustaining trust, transparency, and public education. There is also an emerging discussion about adapting ICT as a tool to express individual autonomy through for example dynamic consent. Dynamic consent is not only a procedure but also a mechanism to engage participants on making real-time choices on the use of their personal information (Kaye et al. 2015). More specifically, dynamic consent has the advantage of reflecting a participant’s changing preferences on data provision, as it allows for the participant to be re-contacted, to receive research results and to withdraw from the research, continuously over time. However, there is a concern that data quality or completeness of the database can be impaired. Therefore, an approach to strike the right balance between a data donor’s autonomy and meeting the needs of scientific research needs to be considered.

Privacy Protection

Under the BSA, there are two tracks to protect individual privacy in biobanking. The first track concerns the situation where a biobank collects human materials directly from a donor. In this case, the donated human material can immediately be anonymized by the biobank as part of the collection process, except when the donor of the biospecimens consents to leave his or her personally identifiable information attached (BSA §43.2). The second is when a biobank collects human materials from a researcher (BSA §38.1) or a genetic testing institution (BSA §53.1). The biospecimens must be anonymized in those cases. In addition, the biobank is required to formulate guidelines for the protection of personal information, which include schemes such as the following: anonymizing and protecting personal information; method and procedure for providing personal information; provision of personal information due to transfer of human biospecimens; provision of personal information when discarding biospecimens when the biobank is unable to preserve them for testing due to temporary or permanent closure of business or other inevitable circumstances; and education program about personal information protection for employees of the biobank (BSA §42.1).

However, the risk of identifiability in a “big-data” environment is increasing. It basically means that the burden and risk of privacy loss is becoming heavier for individuals who donate human materials and genetic information for research (Presidential Commission for the Study of Bioethical Issues 2012). With increasing integration of information sources and growing accessibility of information, the possibility of an individual donor and his or her relatives being identifiable without them realizing it presents new risks. A decade ago, Lowrance and Collins (2007) already raised concerns on personal identifiability in genomic research. More recently, Gymrek et al. (2013) have demonstrated the feasibility of breaching anonymity in public sequencing datasets using a tracking back technique.

The impact on personal identifiability and/or re-identifiability would vary by region, country, disease (such as cancer or hypertension), governance (strict rules or not), and purpose (research or commercial). However, in some countries which have national health insurance systems, the impact on private information retrieval (PIR) would be higher than other countries. Taiwan, Japan, and Korea in particular have diverse but well-organized national health agencies which produce and control nationwide public health databases that can be integrated to produce a larger scale “big-data” repository. Furthermore, the Korean population, for example, is relatively small and homogenous in ethnicity. Governmental control over a well-organized and comprehensive population database may expose Korean citizens to a greater risk of personal identifiability and/or re-identifiability than those of other counties.

Genomic Data Sharing

With advancement in genomic research and research collaborations, there is an increasing demand for human biospecimens in biobanks. As a consequence, CODA, for example, has recently started to offer a sequencing service to obtain human genomic data. Although a DRC can impose conditions for sharing data or biospecimens abroad, the Standard Operating Procedures of KBN are based on the principle that domestic distribution of human biospecimens is to be promoted (Korea Centers for Disease Control & Prevention 2015). What then is the main challenge to data sharing in Korea?

So far, the BSA only covers data sharing for research purposes. Providing human biospecimens stored in a biobank to others is free of charge (BSA §43.3). The financial sustainability of biobanks is not a concern as the state or a local government subsidizes the biobank out of their budget. In other words, the cost of biobanking is a tax on the people (BSA §45). Even though data sharing for research is still expected to be done on an altruistic basis, so that banked human biospecimens and genome data cannot be sold as they are treated as public goods, data sharing is itself becoming complicated, varied, and closer to commercialization. For example, Korea has entered a new phase with the recent appearance of private companies providing direct-to-consumer genetic testing (DTC-GT) services in December 2015. Unlike the USA where the scope of DTC-GT is not explicitly limited by federal law, a private genetic testing institution which is not considered a medical institution in Korea can only offer 12 categories of genetic testing related to aesthetics and disease prevention, such as tests relating to skin pigmentation, hair loss, hair thickness, skin aging, neutral fat concentration, cholesterol, blood sugar, and vitamin C concentration. In other words, Korea’s DTC-GT regulation limits testing to disease prevention or conditions that are not likely to cause genetic discrimination, rather than genetic disorder, and non-communicable diseases such as cancer. The problem, at an individual level, is whole genome sequencing, since it is broader in scope that what is currently permissible under the DTC-GT regulation. Furthermore, there is a concern that the private sector would exploit sequencing data in ways that are detrimental to the individuals concerned and their communities. Private corporations do not need to be localized in a specific country, but often also extend their business through establishing affiliated companies in various countries or make business alliances with an existing local enterprise. In this way, private corporations, as data producers and users and data platforms, may be incentivized to accelerate the collection of genetic information so that it can be transferred and used abroad. For instance, 23andMe sold the genetic information of 3000 Parkinson patients to Genetech for US$ 60 million (Herper 2015; Reuters 2015).

Whereas the value of genetic information is clearly significant, the ownership issue is still unclear and contested. Discussion of when for-profit sharing of personal health and genomic data may be allowed and how benefits (monetary or otherwise) could be shared with donors is hence urgently needed.

Discussion

In establishing biobanking governance, societal trust is essential for the success of the biobanking project. Arguably, a key to promote public trust are biobanking policies that reflect interest of donors. However, considering how rapidly biotechnology is progressing, how effective is the BSA and the legal system in general in securing public trust? Also, can the BSA effectively govern a broad range of interests, from human biospecimens and related data research, to industry and public health?

The BSA (BSA 2004), passed on 29 December 2003 in a plenary session of the assembly, enacted on 29 January 2004 and implemented on 1 January 2005, initially had a strict focus on genetic research and gene therapy with the specific purpose of prohibiting human cloning. Three incidents aroused social sensation in Korea. First, in 1997, the world’s first cloned sheep “Dolly” was born. Second, in July 2002, the media reported that a domestic biotechnology company cooperated with a foreign religious organization to conduct human cloning experiments. Third, in December 2002, there was a foreign media report that the world’s first clone, “Eve,” was born. At that time, when Korea already has a strong reputation in biotechnology, there was a social movement to develop strict ethical review procedures and guidelines based on law (Park 2000). This prompted the administration to pass and enact the BSA and to designate the Ministry of Health and Welfare as the implementing authority (Kwak 2003). Between the date of its original enactment and 20 December 2016, the BSA has been revised 14 times and, through a total of 70 articles, a regulatory framework was developed for the National Bioethics Review Board, the Institutional Bioethics Review Board, human subject research, human embryo research, human material research, biobanking, genetic testing, and gene therapy.

As different biotechnologies have developed at different pace and laws have been revised several times, the issues that were dealt with in the original legislation have also changed significantly. First, the scope of bioethics policy as legislated in the BSA, originally limited to existing embryo and genetic research, has expanded to include human subject research and human material research (Reasons for amendment of the BSA 2012). Also, at the time of enactment, the permissibility of human cloning by somatic cell nuclear transfer and research involving inter-species nuclear transfer was important, but more recently, gene therapy and related research have become more significant (Reasons for amendment of the BSA 2015). Additionally, industrial and medical applications of the BSA are changing. As discussed above, legal notification for DTC-GT is required for specific categories of testing. However, considering future industrial evolution and the social ripple effect, DTC-GT may need to be subject to more stringent regulation.

The problem is that the legal framework appears at this point to be based solely on the BSA, as amended over the years. The BSA is unlikely to meet challenges that are expected to arise from more recent technological developments for a number of reasons, including the limited scope of its original design. There are no other laws in the Korean legal system that can deal with human biomedical research. Even if it did exist, it would be difficult to ensure that bioethical concerns are properly addressed, particularly where multifaceted concerns like commercialization are involved. Although there are laws such as PIPA and medical law, more targeted regulatory guidance is needed for newer applications of personal genetic information due partly to the broader societal and public trust implications.

After so many revisions, the BSA’s regulatory framework has become skewed toward issues related to human biospecimens, genes, and reproductive and regenerative medicine. Most of all, are the regulatory subject matters in the BSA appropriately and accurately harmonized in order to meet bioethical goals? Do we need to keep the BSA as a broad and comprehensive framework and amend it further to respond to emerging technologies and newly adopted therapies? How could more specific legal provisions, such as those needed to prevent discrimination, be included in the BSA? Or do we change the whole regulatory governance system established under the BSA in order to include bioethical principles that would apply not only to research, but also to therapies and broader concerns that relate to data non-discrimination? Or should new and separate laws be enacted for each major development in biotechnology and biomedicine?

In fact, similar questions were already raised at the time when the BSA was first enacted. However, the importance and future prospect of biotechnology today is likely to be incommensurable with expectations 13 years ago when the BSA was enacted. It is necessary to ask the questions again and more earnestly so that proper governance can be established from a longer term viewpoint, taking in account that the healthcare paradigm is in rapid transition.

One alternative approach is to incorporate bioethical principles in the BSA in the Basic Law; conceptually, incorporating bioethical principles into a higher law would also mean incorporating bioethical deliberation and engagement into the governance of human subjects research and the responsible (and non-discriminatory) use of genetic and health data. Individual laws should also be enacted within the Basic Law framework to address specific concerns. For example, a Precision Medicine Act can be legislated to govern research and broader utilization of human biospecimens, genetic data, and related “big data” concerns, and a Regenerative Medicine Act can be established for research and other utilization of stem cells and embryos.

Conclusion

Korean biobanks are now changing to adapt to the new paradigm of precision medicine. However, since Korea has been regulating the field through the BSA which was first enacted in 2004, there are limitations to this approach, since the field of biotechnology is rapidly developing and fragmenting. First of all, IRB review and informed consent are important rules for respecting the moral authority of patients and subjects (including tissue donors), yet these rules have limited capacity to build trust. Under the BSA, it is difficult to properly incorporate the role of the DAC, which is becoming more important in comparison to that of the DRC. In order to use human biodata including genomic information through information and communications technology, more appropriate consent model needs to be considered. In the meantime, even though data sharing for research is still altruistic so the data and human biospecimens cannot be sold for-profit, current data sharing practices have become more complicated, and are closer to commercial use and commercialization. Public concerns on data monetization derived from personal health and genome data will grow in the near future, so the establishment of a policy on data and biospecimen ownership and appropriate benefit sharing with donors based on sound ethical and legal principles is urgently needed. In the light of all these challenges, continuing and deeper deliberation must be carried out in order to develop a more comprehensive and responsive governance framework.