Accountability.

Accountability [A 38–48] according to most of the sources refers to mechanisms through which an organization makes itself answerable for its operations which includes being capable of giving account to stakeholders for the actions it has undertaken [A 46]. Some sources also point out that it also involves answering stakeholders when they ask for explanations about the conduct of the organisation or research and be under the condition of being affected by stakeholders’ judgment of the operations of the organisation. Accountability also demands that an organisation or a research body clearly identifies and discloses who is accountable for the management of data [A 43]. Some of the sources present accountability in terms of data use [A 44–46, 48] while some highlight accountability in terms of organisational accountability [A 43, 46]. Some sources also reference how the principle is reflected in data laws, for example, the GDPR’s principle of accountability of data controllers moves the onus of proof onto data controllers, thereby reducing the need for data subjects to demonstrate causation in many contexts [A 47]. Sources state that robust and transparent accountability mechanisms provide ways to ensure the precise identification of responsibility for data uses and their consequences on research subjects and key actors in research. Furthermore, accountability provides mechanisms for communicating health relevant information to data subjects [A 45]. Sources also agree that accountability can increase public trust in situations such as data reuse [A 48, 49]. One author pointed out that it is necessary as a good governance practice to establish an accountable decision-making body that can provide assurances that data are being used and linked appropriately and responsibly [A 44]. However, some of the sources stated that some biomedical institutions such as biobanks do not offer clear indications as to how the organisation renders account of its operations to interested stakeholders and the public in general as part of their governance practices [A 46].

Anti-discrimination.

References to anti-discrimination [A 42, 47, 50–54] focuses on anti-discrimination along with equitable treatment as central principles of international human rights law. Sources also focus on profiling and racial discrimination which may be caused by data processing. Human rights instruments must allow for meaningful sanctions for persons and organisations who misuse personal data [A 51]. In the European context for example, the GDPR provides protection against the processing of data which may cause discriminatory effects on people on the basis of racial or ethnic origin, political opinion, religion or beliefs, trade union membership or health status [A 47] and categorises health data as special data [A 55]. Some sources suggest that with the advent of machine learning algorithms it is still possible that not all potential discriminatory effects will be reasonably foreseeable to allow pre-emptive action due to the way such algorithm works [A 47]. Sources also state that it is also possible that these non-foreseeable discriminatory effects are based on cultural assumptions and it is known that cultural assumptions are sometimes considered to be statistically invalid and somewhat based on ideology and can therefore be discriminating [A 54]. Furthermore reference to anti-discrimination shows that laws have often been considered to be ineffective due to the fact that it can only be applied when it can be proved that a decision was made on discriminatory presumptions which is usually difficult [A 54].

Autonomy.

While there was no clear definition of autonomy [A 36, 43, 53, 56–62] provided, most of the sources pointed out situations that could undermine autonomy. For example one author pointed out that the use of patient data without transparency or consent may be seen to violate the principle of respect for autonomy [A 60] while the other states that decisions about data that describe who we are and how we live do indeed concern us directly and not being able to make those decisions can thus undermine our autonomy [A 43]. References to autonomy by some of the sources pointed out that there has been a focus on the use of privacy as a principle for promoting autonomy [A 58, 61]. One of the sources pointed out that research on guidelines on data sharing issued over the past two decades identified autonomy and privacy of people, and the quality and management of their data as the three most common themes [A 61]. This is supported by another author who stated that anonymisation often is portrayed as an effective mechanism to guarantee both privacy and autonomy [A 43]. While another argues that they are two core principles in the law and ethics of biomedical research which include informed consent and ethical approval and both are aimed at safeguarding the right to autonomy and privacy [A 53]. Another argues that assessing what is ethical in data access goes beyond a simple opposition between being open and protection of the autonomy and privacy of data subjects [A 57]. Laws that promote autonomy usually reference the principle of justice as pointed out by one of the authors [A 36]. One of the sources argued about the limit of neural processing pointing out that neuroscience is currently only beginning to understand how meaning is represented in the brain and it will be difficult to build machines that act autonomously [A 62].

Beneficence and non-maleficence.

According to the sources the principle of beneficence and non-maleficence [A 36, 41, 56, 59, 60] promotes the welfare of research participants and seeks to protect participants from individual or future harm. Beneficence is usually considered as the primary goal researchers should abide by especially towards research participants who are vulnerable as deduced form the analysis. One source defines beneficence as researchers having the welfare of research participants as a primary goal, particularly those who are vulnerable[A 41]. References to beneficence state that medical ethicists seem to have certain problems with finding a moral basis for beneficence [A 56]. Sources also point out that beneficence promotes public participation and data sharing. One of the sources argues that studies have shown that there is a widespread willingness to share data for secondary purposes based on the fact that it promotes the common good and this willingness and belief are due to the fact they may be a general expectation that members of the public involved in the generation and storage of brain data can contribute to each other’s welfare by data sharing [A 60]. One author argues that the public therefore might feel justified in objecting to irresponsible, insecure or unclear future use of data which puts its members in a vulnerable state and is likely to cause individual or future harm of unknown magnitude which is a direct violation of the principle of non-maleficence [A 60]. One of the sources stated that potential participants in research usually have no say on the good being pursued in a type of research and are usually in a dilemma when considering whether or not to support a particular research based on the mission statement of the research [A 36].

Bias.

From the analysis two major definitions or descriptions of bias [A 4, 56, 63–65] are provided. The first described bias as systematic skews in the way data is collected, annotated and categorised [A 4] while the other defines bias as any systematic error that affects the estimates of the association under study, and can emerge from the identification of subjects [A 63]. From the analysis, references to bias is usually made citing the examples of observation bias and selection bias [A 4, 63, 64]. One of the sources points out that there is sufficient evidence that observational research often leads to bias especially for less privileged groups [A 56]. Some of the sources argue that with the advent of large data repositories and data silos, data bias may be inevitable because bias operates at the level of human cognition [4] which may result to the creation of implicitly biased models and can limit data generalisation and the creation of new data [A 65]. Sources also argue that more often constructs such as race and ethnicity are being used to carry out research about a people and not by the indigenous people themselves [A 66] which results to such constructs being used uncritically when dealing with brain data.

Confidentiality.

Preservation of confidentiality [A 39, 43, 51, 57, 59, 67–69] is viewed by the analysed sources as a cornerstone of good practice in brain banks or brain data repositories [A 68]. In order to maintain a confidential biorepository containing brain data, confidentiality and security are considered as essential [A 69]. Confidentiality, use restrictions and security procedures are applied to mitigate incidents that may undermine trust in repositories [A 70]. Confidentiality generates areas of concern in the context of data sharing which include physical security, handling of identifiers and transfer of both samples and information [A 67] and storage. Confidentiality may also generate arguments when used in conjunction with consent [A 67]. For example, deciding whether donors of data or tissue samples should get feedback where research reveals a serious medical condition is sometimes conflicting with the original intended use and consent of such data and the obligation to confidentiality. References to confidentiality by sources also highlight privacy as an accompanying principle [A 39, 51, 57, 59].Some sources argue that the obligation of confidentiality when not clearly provided by law should rests with the organisation or institution involved in the usage of data either in its policies or guidelines [A 67]. A study which was conducted to determine if Research Ethics Boards (REBs) provided ethical guidance in research involving stored biological specimens revealed that, although most of them mentioned the issue of confidentiality, fewer than 30% suggested steps for protecting confidentiality [A 67].

Consent.

According to most sources Consent [A 4, 14, 15, 36, 39, 41–47, 50–54, 56–60, 64, 65, 67, 71–90] to having a participant’s biomedical data used in research forms a basis for best practices and codes of conduct. Consent serves as the cornerstone of bioethics and is constantly reflected as a core principle in law and ethics of biomedical research promoting autonomy [A 36]. Consent involves obtaining valid, freely given, informed, specific, unambiguous approval from a data subject indicating the data subject’s agreement to the processing of his or her personal data [A 80]. One of the sources argues that when it comes to research involving humans, consent has arguably been the dominant ethical doctrine with concerns being expressed about the consent obsession [A 88]. Our analysis identified the following major consent models which include

1. Specific or Traditional consent [A 36, 65, 80, 84]
2. General or Blanket or Broad [A 36, 43–46, 58, 64, 74, 80, 89],
3. Dynamic consent [A 15, 36, 43, 75, 82], and
4. Altruistic consent [A 76, 90].

Some sources also argue that when it comes to brain data it is possible current consent models may not sufficiently protect privacy [A 71]. It is possible for data subjects to misunderstand the full purpose of a brain scan and may sometimes confuse it for being for therapeutic purposes therefore giving rise to the problem of therapeutic misconception [A 71]. The above consent models also present challenges in various scenarios for example traditional or specific consent is challenged by future oriented research infrastructures because it is not possible to disclose to the data subject the entire range of researchers and research projects that will make use of a participants data [A 15]. General, broad or blanket consent involves consenting to a general governance framework rather than a specific research purpose [A 80]. It is also consent given to an unspecified range of future research subject to minor process restrictions [A 46]. While this promotes data reuse [A 91, 92] for secondary purposes it also leaves room for misuse and has a problematic relationship with the principle of autonomy because it is unclear what is being consented at the initial stage of the consent process. Dynamic consent involves recontacting and maintaining a steady evolving communication with participants preferences which is tailored to promote individual control. Although this is an adaptive process [A 43] it is heavy reliant on resources and may not favour data use for secondary purposes [A 15]. Altruistic consent involves consent by data subjects to process personal data relating to them, or authorisations of other data custodians to allow the use of their non-personal data without seeking a reward, for purposes of general interest, such as scientific research purposes or improving public services [A 90].

An important debate about consent also centres on the opt-in and opt-out models [A 4, 43, 60, 71, 76, 81, 83] being adopted. Extensive opting-out options in research may result in the bias of datasets and may influence the reproducibility and reliability of results [A 43]. An opt-in model is seen as a more ethical approach to promoting autonomy according to one source [A 81] but is not usually considered as a more scientifically valid approach for population based studies. Sources argue that with consent moving from paper-based form to a more electronic ecosystem [A 43, 86] many services have a default opt-in policy with regards to the use of personal data rather than an opt-out policy.

Dignity and respect for persons.

While there was no definition of dignity and respect for persons [A 41, 50, 52, 53, 67] most of the sources mention words like autonomy, wellbeing and safety in association with dignity and respect [A 41, 52, 53]. With some saying that it entails that research participants should be valued and respected and they should be respected both as beings who are capable of exercising decisions, and also as members in communities who make choices in the context of their relationships [A 41]. Some argue that in Europe the GDPR seeks to secure the dignity of people in terms of specific rights [A 61] which will in turn promote autonomy and privacy.

Fairness.

The analysis provided the principle of fairness in two dimensions which include fair access and procedural fairness [A 14, 39, 41, 42, 48, 51, 52, 76, 84, 93–95]. Fairness in terms of fair access has to do with the requirements for users being allowed to look at and use the data [A 14], and should address concerns about fair or equitable access to data, research results, and public health benefits derived from those results [A 51]. Some authors state that fairness may involve using the FAIR principles [A 96] to achieve FAIRification of data [A 95]. This sometimes means that Individuals should be provided with a simple and timely means to access and obtain their individually identifiable health information in a reliable form and format [A 42]. Governance frameworks may allow for information to be exchanged in certain scenarios including data subjects or research participants being able to access their own biomedical data e.g via patient portals to facilitate fair access [A 84]. However, how custodians or data stewards or even clinicians react to such access by patients and other data consumers need to be addressed in governance frameworks to promote fair access. According to one source the use of data access committees may be a good strategy to promote oversight of fairness in data access [A 44]. However one author highlighted that one of the most time-consuming tasks in the access process is obtaining the necessary local scientific and ethical approvals [A 97]. According to the sources Procedural fairness [A 41] involves fairness in processes related to regulatory treatment of research projects [A 51].

Integrity.

The analysis presented integrity [A 38, 41, 42, 52, 53, 62, 67, 75, 94] to be two dimensional with the first being towards protecting the wellbeing of research participants and the second involving maintaining data quality. While there is a need to request for additional samples from the same participants and the storage of these additional samples in certain repositories for an indefinite number of years, there is thus an increasing need to deploy adequate measures of confidentiality and protection of the integrity of the research participants without jeopardizing information that could benefit the entire research process [A 67]. Some of the sources states that to achieve data integrity, data must also be findable, accessible, interoperable and reusable thereby following the FAIR principles of data management [A 95, 98]. If samples are used in a research project, they must be collected, stored, and processed in a way that preserves their long-term stability, searchability, and integrity in order to reduce data waste [A 41]. Some of the sources state that standardisation of high quality data brain data [A 99] and how data should look like should be enforced at a curatorial level which will serve as a measure for building community standards and maintain integrity [A 94]. Persons and entities should take reasonable steps to ensure that research information is complete, accurate, and up-to-date to the extent necessary for the person’s or entity’s intended purposes and has not been altered or destroyed in an unauthorized manner [A 42]. In order to promote integrity, Individuals or entities should be provided with a timely means to dispute the accuracy or integrity of their individually identifiable information, and to have erroneous information corrected or to have a dispute documented if their requests are denied [A 42]. One author points out that appropriate measures need to be taken to maintain the integrity of brain research due to situations like dual-use of neurorobotics for civilian and military applications [A 62].

Justice.

Justice [A 4, 36, 41, 60, 76] according to one of the sources can be defined in terms of the widely held and acceptable legal safeguards which ensure that decision makers conform to a pattern of procedural fairness that ensures that the rights of research participants or stakeholders are respected so that public confidence in the decision making process is maintained [A 36]. This definition is referred as natural justice by the authors. Refences to justice also point out that the principle of justice ensures that the benefits and burdens of a research project should be distributed equitably among all groups in society [A 41]. The use of data for private gains and for commercialisation or private use as pointed out by some sources [A 49] is considered to be in violation of justice because it is unfair to use data for purposes other than the original intended use [A 60]. This concern of misuse and violation of justice continues to resurface especially when it comes to how private organisations use brain data. Sources also point out that the processing and benefits of biomedical big data may be placed on specific social, cultural and economic groups and it may be possible to express such divides as ethically problematic in terms of justice [A 76].

Privacy.

References to privacy described how the anonymity of participants from whom data is collected are protected [A 14]. Privacy is usually used to describe the preservation of a participant’s integrity and the ability of participants to have control over what they reveal about themselves and includes concepts of appropriate protection and use of information [A 100]. Some of the sources emphasize that privacy preservation in data collection and integration is essential when handling big health data [A 98, 101] due to the fact that there is always an ethical tension between the need to share data and maintaining privacy in the process. Although the sharing of data is largely seen as being for the overall common good, it also has the potential to create new risks, and increase existing ones [A 60]. References to privacy also highlight whether existing privacy regulations (ie, the Health Insurance Portability and Accountability Act, or HIPAA) provide sufficient protection to patients while balancing access to data for researchers [A 102]. The various perceived risks involved in sharing brain data which may lead to privacy concerns may include routes to harm like neurohacking [A 4], leakage or loss, unauthorised access, errors in repository records and aggregating data to a group’s disadvantage. One of the authors stated that collection and commodification of neural data that may put vulnerable individuals at risk with respect to the privacy of their brain states can be considered as a threat to neuroprivacy [A 4]. Therefore achieving the highest level of data safety and data privacy is crucial [A 103].

Sources recommend the following approaches to privacy: privacy of personal information, privacy of the person, privacy of personal behaviour and privacy of personal communications [A 100]. This can be extended by adding the following privacy interests and concerns for biobanks and repositories: physical privacy (example may include gathering and storing biospecimens and testing them without consent), informational privacy (such as possible misuse of information), decisional privacy (e.g., control or influence over what is done with data and biospecimens), and proprietary privacy (e.g., ownership of biospecimens and the control of identity) [A 15]. Sources argue that as more data sources become available such as data from consumer neurotechnological devices and advanced analytics being applied for various purposes, protecting privacy is becoming a complicated task. What contributes to this complication and complexity is that standard mechanisms of protection such as anonymisation, de-identification, pseudonymization, notice and consent are excessively stretched in this environment of new capabilities [A 45]. Also a substantial difference in data sharing and data regulations of different countries contributes to the complexity of providing privacy [A 104]. References to privacy also highlights adopting privacy as a feature by design as a good practice [A 84, 87].

Proportionality.

According to some of the sources proportionality [A 39, 41, 53] involves balancing the risks and benefits of research and the entire research process. According to one of the sources proportionality involves ethics review and oversight being commensurate with the risks and benefits for research participants [A 41]. Some of the sources indicate that a governance framework must contain processes that are proportionate, consistent, and targeted only at cases in which action is needed. These include it being clear, coherent, efficient, effective, proportionate, and properly targeted so that the system is neither over-inclusive nor under-inclusive, nor unduly onerous where differing levels of regulation are warranted [A 39].

Protection and security.

From the results of the analysis, references to protection focused more on the protection of research participants than on the protection of data, while references to security focused more on the security of infrastructure and data [A 4, 36, 39, 41, 42, 45, 52, 67, 94, 105, 106]. One of the sources recommended that security should be a guiding principle in ethical frameworks and described security as state-of-the-art measures which must be employed to minimise the risk of research projects’ data becoming lost, misused, or unjustifiably altered or destroyed [A 41]. Some of the sources recommend that data should be protected with reasonable administrative, technical and physical safeguards to ensure its confidentiality, integrity, and availability and to prevent unauthorized or inappropriate access, use, or disclosure [A 42]. Sources also identify that the security and protection of data has always been a challenge, with cyber-attacks, hacking of databases, and data kidnapping being reported frequently [A 4, 45]. Some of the arguments point out that protection and security measures can be put in place to prevent such misguided uses of data, but they are often perceived by researchers as constraining users’ freedom to analyse the data as they see fit [A 105]. References to security, protection and privacy are high priorities for research participants as highlighted by some sources, particularly when it is proposed that data may be shared with commercial companies and governmental organisations [A 106] with research participants pointing out that governance and security is what will build trust and not consent and privacy which is usually talked about [A 94].

Retention and destruction.

References to retention and destruction focused on what manner brain data is stored, how long such brain data is stored and whether such data must be destroyed after use [A 14].

Transparency.

Some of the sources describe transparency as the availability of information about an actor that allows other actors to monitors the working performance of such actor [A 46] while some describe transparency in the context of governance as the accessibility and visibility of the governance structures of consortia [A 107]. Sources also referred to transparency as openness [A 42, 107, 108] References to transparency include using community engagement activities to promote trustworthiness and visibility [79, 106, 108] and using transparency to strengthen public confidence in institutions or research projects which ensures accountability while facilitating public trust [A 41, 46, 48, 54, 79, 108]. This can include sharing information about the proposed use of data, expected societal benefits, harm-minimisation strategies, degree of security and encryption and research results [A 16, 108]. Transparency is almost ubiquitously regarded as a positive feature of itself and is believed to be a mechanism to facilitate accountability and participatory governance [A 38, 46, 48]. Sources also emphasize that greater transparency is needed in safeguarding of data and in data sharing agreements [A 60, 107, 108]. Transparency is considered as benchmark in assessing the adequacy of good regulation for databases housing biomedical data [A 39]. Further recommendations to achieve transparency as suggested by some sources include making all policies, decisions, and practices regarding data used in a particular initiative freely accessible by members of the public in an understandable format [A 38].

Trust.

From the analysis, references to trust focused highly on the call for trustworthiness [A 36, 45, 46, 79, 88, 94, 105] and transparency [A 36, 41, 45, 60, 88, 94]. One of the sources argues that trust underscores data governance policies and involves respect for human autonomy, prevention of harm, fairness and explainability, while using a human-centred approach to building and sustaining trust [A 61], while another points out that mechanisms to increase public trust include transparency of motivation, data handling, and data flow [A 60]. References to trust is also multi-dimensional, complex, and usually varies according to different context. Furthermore, from the analysis it was seen that there are many recommendations on how to achieve trust. Some of the sources state that common qualities of trust and trustworthy institutions include:

• Integrity (which means that the institution is fair and just)
• Dependability (this depicts that the institution will do what it says it will do) and
• Competence (the institution has the ability to do what it says it will do) [A 79]

Existing bioethical literature emphasize the importance of public trust in data production, collection, usage, and sharing [A 36]. References to trust also show that research participants views on storing and using their data is linked to the kind of trust or distrust the public has in an organisation or individual who is using and accessing their data. Participants distrust towards organisations who handle their data generally occurs along two dimensions. The first is distrust of a party’s ability, or competence, to ensure data security, while the second is distrust of a party’s motivations [A 60]. However, there is an agreement on trust with regards to using societal benefits as a justification for sharing data [A 78, 83]. To merit and garner trust, guardians of citizens’ health data ought to ensure that they respect the values of the people who are expected to trust them with their data. Sources also point out that the public or research participants should not have any fear that they are being manipulated into sharing their health data [A 78]. Lack of public trust in the use of data is important and can derail large scale initiatives and a typical example as provided by the analysed sources is the UK care.data initiative which shows how mistrust on the part of the public can derail large-scale data initiatives [A 45].

Neurorights.

Neurorights featured in only one of the articles analysed. References to neurorights provided questions around if brain data should be treated as any other type of biometric data or should be treated as a special type of data with special rights [A 4].

Solidarity.

While there was no definition of solidarity [A 36, 47, 56, 76, 83] provided by the sources, solidarity was mostly referenced together with justice and consent. According to one of the sources, solidarity displays a dominant emphasis on people’s willingness to engage in activities that benefit others [A 36]. One of the sources argue that new approaches to big data governance should be based on the principle of solidarity [A 47] and that they should include three main pillars to reflect solidarity which includes placing greater emphasis on whether or not specific instances of data use are in the public interest, strengthening of harm mitigation instruments, and developing new legal mechanisms to ensure that significant parts of financial profits created on the basis of data use go into the public purse [A 47].

Independence.

While there was no clear definition of independence A [38, 44, 109] by the sources, there were recommendations of what independence should entail. One of the sources highlights independence as a guiding principle to their recommended governance process [A 38]. One of the references pointed out that one way of safeguarding the right to privacy and the right to benefit from science is to ensure a robust and independent data access process for complex and sensitive research resources as this may reduce data hoarding [A 44]. Another source recommended that to promote participatory governance all actors involved in the governance process should be able to able to operate in a zone of bounded independence and a good governance process should be able to operate independently from management to ensure that decisions are free from institutional conflicts of interest [A 38]. Another source points that independence from funders is considered as a crucial element of governance and promotes the trust and participation of the public in research initiatives [A 109]. One source recommended that through the use of Independent committees who make determinations about new uses of data, practices related to hoarding of data or data hugging by researchers may be reduced [A 44].

Responsibility.

The idea of responsibility [A 2, 52, 62, 107] as presented by most of the sources is to provide a principled and responsible approach to research and data governance which is reflective of societal needs. A major approach in achieving responsibility as pointed out from the analysis is the concept of Responsible Research and Innovation (RRI) which is an approach to governance that aims to unite and respond to various stakeholders and their expectations [A 2]. RRI includes components which improve the dynamics of research and innovation such as public engagement, open access, gender equality, ethics, and governance [A 107]. According to one source RRI can hold governance to high ethical standards bridging the communication between researchers and society [A 62]. Sources point out that although RRI is currently gaining momentum, it lacks collective meaning globally [A 107] and is mostly an approach adopted by scientist and initiatives in the European Union on the development of technological innovations [A 62]. Sources also pointed out that with the adoption of RRI, a major challenge which involves the governance of consortia especially after the end of research projects can be overcome [A 107]. Sources agree that integrating responsibility in governance to achieve responsible data governance [A 2, 110] may structure governance in a way that promotes reflexivity, foresight and consideration of future impacts.

Engagement.

The sources indicate that ongoing engagement [A 38, 40, 45, 59, 73, 78, 82, 85, 88, 106, 108, 111] and involvement with stakeholders, communities, researchers, and scientists is integral to the governance of data. Citizens are gradually becoming the driving forces of digital health applications, innovations and data [A 45]. The failure of the care.data initiative is a good illustration of the current boom of appeals for engagement and also shows how lack of engagement can deter large scale data intensive initiatives [A 85]. Engagement is seen as a way to foster trust especially with the public and overcome data use barriers while encouraging accountable and responsible research [A 88]. However, some sources pointed out that ways of enhancing engagement and involvement of the public and stakeholders is usually poorly articulated and defined [A 78, 85, 88]. Significant confusion exists regarding concepts such as engagement, involvement, and participation which generates confusion on the application of these concepts and makes the citizen science rhetoric to pose even a greater risk for confusion [A 78]. Furthermore, although there are some semantic overlaps between terms which involve participant-centric initiatives, the role these concepts assign to participants in research is neither consistent or clear [A 85]. Some sources recommend the inclusion of data subjects as co-decision-makers, co-researchers and as co-principal investigators stating that this can be seen as the most straightforward realisation of engagement [A 85] and may also involve the use of participant association models which may involve participant boards [A 40]. References to engagement also pointed out that in multicultural societies where the views on acceptable data use differ, research initiatives involved in the use of large data repositories may use a social licence with the parameters of the social licence changing over time as citizens became more comfortable with, or more suspicious of various uses of the research and its data [A 108]. The analysis also discovered that public discourse and engagement has been implemented as an ethical requirement in some emerging biotechnologies [A 111].

Ownership.

References to ownership argued that the clarity of the ownership [A 14, 43, 45, 76, 81, 82, 108, 112–116] of data should be considered as an essential governance element as it provides insights to rights regarding the modification and redistribution of data, along with benefiting from intellectual property and innovations developed from its analysis [A 76]. The analysis also shows that there is a tension between ownership and access. Some of the authors stated that they has been an increase in the call for the empowerment of stakeholders (participants and researchers alike) through data ownership because this gives rights to individuals to be the guardians of their own data allowing them to access, modify and set access rules [A 82]. Another author pointed out that although there is a debate around ownership and access, recent empirical research revealed a substantial lack of availability of access policies in practice [A 115]. Moreover, with regard to access requirements, available access policies vary widely and are neither standardized nor harmonised [A 97, 99, 115]. Some of the sources argue that sometimes literature discusses ownership in terms of control [A 43, 76], while another argues that ownership can undoubtedly be viewed in terms of owning products and intellectual property, which raises future debates around the ownership of intellectual property generated form the analysis of aggregated big datasets [A 76]. Some sources also state that while the basic structure of ownership can be strengthened by a calculated emphasis on the ethical value of the protection of personality [A 113], who receives various benefits from the provision or use of data, is relevant in academically-oriented research and various ownership structures of compensation in terms of authorship, compensation, acknowledgements should be reflected in governance structures [A 14, 115]. One of the sources also suggests that policies and governance structures should reflect clear ownership elements and should not be restricted to only copyright notices [A 14].

Legal basis.

Sources pointed out that the collection, curation, processing and deletion of data should be done on the grounds of sufficient legal basis [A 38, 53, 60, 74, 81, 90]. References to legal basis describe legal basis in governance as the foundation that ensures that appropriate legal frameworks, applicable laws, regulations, and standards are behind the reasons for certain data governance actions [A 38]. One author pointed out that some countries have been left with the choice of either requiring specific consent for research or using other legal grounds such as public interest as a lawful basis for processing data due to the tension between legal basis and broad consent [A 90]. Sources also argue that legal basis for the processing of data is important in research which makes use of secondary data because data is used for a different purpose than that originally intended for and this is important even when identifiers in the data are stripped and if individuals are still potentially re-identifiable by a pseudonymisation code [A 60]. One source also highlighted that there are key differences in the legal basis for certain actions across various jurisdictions [A 74].