The Sequence in the Safe: What Happens to Your Data After a CRISPR Trial

By the time a CRISPR trial volunteer signs a consent form, they may have read the risks, the visit schedule and the possible side effects. Few read the data clauses. Yet a gene-editing trial is a data-generating exercise as much as a clinical one. In the UK, that data is governed by UK GDPR, the Data Protection Act 2018, research ethics committees, NHS rules and the Human Research Authority. Here is a practical map.

What data is created

Clinical data includes eligibility checks, dosing, adverse events, blood counts and follow-up. Genomic data may include target sequencing, whole-exome or whole-genome analysis, off-target checks and sometimes RNA. Samples such as blood, bone marrow or tissue may be stored in a biobank. Administrative records include consent forms, correspondence and the trial master file.

Some of this goes into the NHS record. Some is held by the sponsor. Some sits in a biobank. Each may have a different data controller, and each may have different rules.

Consent is tiered, not one switch

Consent forms often separate several choices: taking part in the trial; optional genomic sequencing; storage of samples; future research; commercial research; recontact; and return of incidental findings. You can often agree to the trial and decline optional biobanking, but some data is core to safety and cannot be optional.

Under UK GDPR, consent must be specific, informed and unambiguous. For research, broad consent can be acceptable with safeguards, and ethics committees review the wording. Where consent is impractical, the Confidentiality Advisory Group can approve use of confidential patient information without consent under Section 251. The national data opt-out also applies to some NHS data uses. Ask which basis applies to your trial.

Pseudonyms are not anonymity

Genomic data is distinctive. Even without a name, a sequence plus metadata can re-identify a person. Pseudonymised data remains personal data under UK GDPR. Anonymised data falls outside the regime, but true anonymisation of genomes is hard. Be sceptical of the word 'anonymous' in a clause if samples are retained.

Who is the controller?

Look for the controller, joint controllers and processors. In NHS trials, the sponsor and the NHS trust may be joint controllers; a biobank may be a separate controller. A commercial partner may be a processor or a controller. If a company can decide how data is used, it is likely a controller. Ask for the privacy notice and the data management plan. Check overseas transfers: a US cloud provider or an EU partner will need an adequacy route or an international data transfer agreement.

Commercial reuse

Many trials include an optional clause saying data and samples may be used by commercial partners for research and development. This does not usually mean payment to you. Intellectual property in discoveries may belong to the sponsor, a university or a funder. You may not receive royalties. You can often refuse the commercial tier without losing your trial place, unless commercial use is core to the study. Ask whether refusal affects access to the therapy.

Withdrawal

You can withdraw consent for future processing, but you cannot always erase data already used. The GDPR right to erasure has research exemptions, and safety data may be kept. Ask what withdrawal means in practice: stop future research, destroy samples, no further contact. Get it in writing.

Incidental findings

Sequencing may reveal a risk of inherited cancer or another condition. The trial policy may say that serious, actionable findings will be offered. You may be able to decline. If you decline, consider the implications for insurance and family members. Ask who returns results, and to whom.

Checklist for the clauses

• Who is the data controller?
• What is core to the trial and what is optional?
• Will commercial partners reuse data or samples?
• Will data leave the UK?
• How long will data and samples be kept?
• How do I withdraw, and what does withdrawal mean?
• Will incidental findings be returned?
• Can I be recontacted?
• Can I see my results?
• Who is the data protection officer?
• How do I complain to the Information Commissioner's Office?

Ask for the separate consent forms and the privacy notice before signing. If a clause says 'unspecified future research' and 'commercial partners' without detail, ask for limits. A good trial team will answer.

The bottom line

Data is part of the therapy. Consent is not a single signature but a set of choices. Read the tiers, ask who holds the sequence, and keep a copy of what you agreed to.