13.2.1 Genetic Information Is a Resource Unit in a Resource System

Information refers to raw data, statistics, and factual statements, among other phenomena. Information is necessary for the creation of knowledge. But knowledge goes beyond mere information by incorporating understanding and insight, gained through the processing, organizing, and structuring of information to make sense of it and to divine patterns or implications so that the information now encompasses understanding, awareness, and skills.

Furthermore, information is not inherently meaningful; it becomes meaningful only through its manipulation and integration into a framework of understanding. Thus, a database of human genetic sequences has no inherent meaning as such. It acquires meaning when deployed in research to identify mutations that cause diseases or predispose individuals to certain health conditions; to study genetic variations and their associations with diseases, traits, and drug responses; to select the most effective medications and dosages with minimal side effects; or to trace human ancestry and study evolutionary relationships among populations, toward insights into migration patterns and historical connections among different groups (Gregg Reference Gregg2021b, Reference Gregg2022c).

Knowledge in general is transferable, encoded information involving personal or collective experience and interpretation. As the stuff of knowledge, information is a resource. A person’s genetic data has social value precisely as a knowledge resource, above all for science and medicine. It has value as a resource unit within a resource system that is the aggregate value of many such units. A resource system based on human genetic information comprises the actors and infrastructures (Contreras Reference Contreras, Frischmann, Madison and Strandburg2014; Evans Reference Evans, Frischmann, Strandburg and Madison2017) responsible for producing resource units, such as valid statistical inferences of gene variants for health conditions. Each statistically valid inference that identifies a new association between a specific gene variant and a specific health condition constitutes one resource unit. The validity of the inference is determined scientifically. And – to anticipate my discussion of the social imperatives of individuals sharing their genetic information with researchers and clinicians – the value of the inference increases as the number of users with access to it increases.

Here a resource system extracts information specific to individual cases leading, for example, to knowledge of variants never before observed or variants observed in other individuals but with unknown clinical significance or impact (Evans Reference Evans, Frischmann, Strandburg and Madison2017). Some extracted information establishes the clinical validity of specific gene variants and enables clinically useful, individual diagnoses based on those discoveries. The system also extracts broadly generalizable knowledge, that is, information and understandings with wide applicability. The more generalizable a discovery about the clinical impact of a human gene variant, the more robust or analytically significant the knowledge generated. Because the genome is universally shared within the species, knowledge about it is inherently sharable.

These two types of extraction are linked. The scientist or clinician conducts individual genomic tests to detect an individual’s genetic variants and then links the genomic data to detailed phenotypic information, including the patient’s health records, lifestyle data, and other information about his or her environments. The researcher may identify statistically significant associations between specific gene variants and specific health conditions. And at low additional cost, the researcher may share, copy, reuse, or repurpose the data generated by the genomic testing process. He or she can also pool these linked genomic and health records for large populations. For the information contained in the human genome is harvested not only through its extraction (through genomic testing instruments, laboratories, databases, and computer algorithms) but also through its aggregation, manipulation, and interpretation, to become knowledge.

Forms of information extraction are human artifacts, cultural acts performed on a natural phenomenon, namely, the sequence of DNA that contains the instructions for building and maintaining a human being. Cultural acts include scientific practices, technologies, and methodologies by which we humans interact with the natural world. Cultural acts also reflect cultural values, goals, and priorities, as well as culturally driven objectives such as understanding the natural history of our species and improving human health, as well as medical treatments and biotechnological advancements. Here we observe the inflection of a natural phenomenon – the human genome – with a human artifact: culture. This inflection describes the governance system of the human genome as a knowledge commons. First, a resource unit is an element in a resource system that encompasses communities, their beliefs, and operational rules, as well as property rights, including rights of data access and data contribution. Second, without proper configuration, a resource system cannot generate the desired type or quantity of resource units consistently and in a sustainable manner. Hence the focus of this chapter.

13.2.2 Merits of a Commons

I frame the human genome as a knowledge commons, and genetic information as its resource system, for practical reasons. First, without a commons framework, authority regarding this resource may be divided among multiple stakeholders, including government regulatory bodies, private organizations, research institutions, and possibly independent ethical boards. Each stakeholder may have different criteria and standards, leading to potential conflicts and inconsistencies in defining normative appropriateness. By contrast, a commons allows members to establish a multi-stakeholder governing body, including scientists, medical professionals, ethicists, patient representatives, policymakers, and public advocates; develop a clear code of conduct and ethical guidelines that all members can agree to follow; and create a transparent and fair dispute resolution mechanism, possibly including mediation and arbitration panels.

Second, without a commons, disagreements among stakeholders may need to be handled through established legal and regulatory mechanisms, possibly involving courts, arbitration, or mediation, and possibly leading to prolonged disputes and a lack of coherent policy direction. A commons, by contrast, allows members to utilize deliberative democratic processes to address disagreements, allowing all voices to be heard and considered; aim for consensus but allow for majority voting when consensus is not achievable; and provide an appeals process for decisions that participants believe do not adequately address their concerns.

Third, absent a commons, membership criteria would be set by individual organizations or regulatory bodies, leading to fragmentation, where participants might be recognized through licensing, accreditation, or certification processes specific to each entity, rather than through a unified commons framework. By contrast, a commons allows members to define clear and inclusive criteria for membership, such as contribution to the commons, expertise, or stakeholder representation; maintain transparent records of membership and ensure accountability in the recognition process; and regularly review and update membership criteria to adapt to changing circumstances and to ensure inclusivity.

Fourth, without a commons, monitoring and enforcement likely would fall to individual entities, such as regulatory bodies, private companies, or research institutions, resulting in varied levels of enforcement and compliance, perhaps with some entities prioritizing profit over maintenance of the resource system. But a commons allows members to implement systems to track contributions to the commons, whether through data sharing, research, or other means; create incentives for contributions and penalties for noncompliance, ensuring fair and equitable enforcement; and establish community oversight committees to monitor contributions and address issues of noncompliance.

Fifth, absent a commons, relationships among participants could only be governed by contracts, agreements, and regulations specific to each context, leading to complex and sometimes conflicting relationships, with different rules and expectations depending on the specific context of interaction. By contrast, a commons allows members to develop collaborative frameworks that define roles, responsibilities, and expectations of participants; facilitate regular communication and meetings to foster relationships and address issues collaboratively; and encourage the formation of interdisciplinary teams to tackle complex issues from multiple perspectives.

Sixth, without a commons, preserving personal autonomy would depend on the policies of individual entities, with some organizations prioritizing privacy and autonomy, and with no overarching framework ensuring consistent protection of personal autonomy across different contexts. By contrast, a commons allows members to ensure the informed consent from individuals whose genetic information is included in the commons, implement robust privacy protections to safeguard personal data, and provide mechanisms for individuals to opt out or withdraw their data from the commons.

Seventh, absent a commons, each stakeholder would have different priorities and standards: scientific research might prioritize open access to data while clinical practice might prioritize patient privacy, and private corporations might prioritize proprietary control over information, thus making compatibility and regulation difficult. A commons, by contrast, allows members to develop ethical guidelines that balance the interests of scientific research, clinical practice, and private corporations with community values and democratic principles; it allows members to ensure continuous engagement with all stakeholders to understand their needs and address their concerns; and it allows members to maintain transparent decision-making processes to build trust and accountability.

Finally, without a commons, balancing information production and fair access would depend on the policies of individual entities, with some entities emphasizing open access and equitable distribution and other entities restricting access to maximize profit or to protect proprietary interests, leading to inequities and disparities in access to genetic information and the benefits derived from it.

13.4.1 The Nature of the Resource

The nature of human genetic information lends itself to commons governance in part because the knowledge derived from it constitutes a public good: The health benefits for the donor as well as for many other persons can be shared without diminishing its availability.

Indeed, the knowledge derived from human genetic information is more beneficial precisely when used widely (in scientific research and clinical medicine) and when other donors share their genetic information (for research and clinical purposes). In other words, the resource unit is more valuable, because more beneficial, when more rather than fewer people use, share, and contribute to it. Part of the explanation lies in the fact that the extraction of information from human genetic material requires large datasets; the larger the better. Technological advances make possible the aggregation of scientific and clinical research data in collaborative repositories. Furthermore, “access to data produced through analysis” may encourage collaboration among researchers to their mutual benefit (Sanfilippo et al. Reference Sanfilippo, Frischmann, Strandburg, Sanfilippo, Frischmann and Strandburg2021, 32).

The clinical harvesting of genetic variants includes statistical analysis to identify correlations between health conditions and specific genetic variants. Useful information about the clinical significance of genetic variants derives from pooling genetic data for large samples. Very large samples are needed to ascertain the impact of variants. For a sense of what the word large might mean in this context, consider that, by 2014, “only about 228,000 human genomes had been fully or partially sequenced worldwide” (Evans Reference Evans, Frischmann, Strandburg and Madison2017, 78). Even a test of one million individuals would represent a tiny fraction of the global human population. The state does not offer a work-around. Publicly funded initiatives to develop national genomic data infrastructure are costly and not scalable for the ambitious task of creating several-hundred-million-person genomic data infrastructures. The reality is that genomic data resources assembled using incentivized consent alignment remain relatively small and may include data for only a fraction of the genetic variants possessed by persons within a community and across the globe (Larson and Chon Reference Larson, Chon, Frischmann, Strandburg and Madison2017). Only a data infrastructure much larger and more comprehensive than current ones will enable scientists to identify the clinical significance of gene variants not yet understood.

13.4.2 Community Governance Is Analytically Distinct from Private or Public Governance

To say that not all human genome commons would look like deCODE Genetics is merely to say that there is no single model or paradigm for knowledge commons governance. Models will differ in part because they will involve the state and the market in different ways and to different extents. Ostrom raises this observation to an analytic principle along three dimensions. First, analysis should avoid dichotomies in social scientific analysis because social reality is not dichotomous. That reality is not, for example, entirely public or entirely private, entirely market or completely state; rather, reality is some mixture of market and nonmarket structures. For example, “not all forms of public enterprise are, or need to be, state owned and operated. Various forms of communal or public ownership may exist apart from state ownership” (Ostrom and Ostrom Reference Ostrom, Ostrom, Dragos Aligica and Boettke2009, 142). Second, governance and other ordered social relationships tend to be some combination of command and consensual agreement. Analysis needs to reflect as much. Third, cases of market failure do not necessarily entail that the state should seek to compensate or correct for those failures, on the one hand. On the other hand, if “over-centralized governmental units fail to perform,” privatization is not necessarily the best response (ibid, 150). Analysis should seek to identify possible incentives for improvement within the market and within the state.

Hence, the analytic distinction among commons governance, market governance, and state governance is artificial in the sense that well-functioning markets rely critically on community governance. Furthermore, markets are not independent of, or incompatible with, certain kinds of commons. Correspondingly, the commons can be part of a mixed regime of governance types, where commons-like aspects of resource governance might be combined with state or market forms of governance, if not with both. As a matter of experience, they tend to be combined. Thus, knowledge commons governance is “not necessarily opposed to integration with government-supplied resources of various sorts” (Madison et al. Reference Madison, Frischmann, Sanfilippo and Strandburg2022, 9). Markets are entangled with the communities and cultures in which they are always embedded (Dekker and Kuchař Reference Dekker and Kuchař2022), just as governance types are likely to be combined. When so, then knowledge commons governance is “not necessarily opposed to integration with government-supplied resources of various sorts” (Madison et al. Reference Madison, Frischmann, Sanfilippo and Strandburg2022; Dekker and Kuchař 2024).

13.5.1 The Social Dilemma: Information Flow

Governance is inherently problematic and no form of governance escapes all social dilemmas. Many of the dilemmas that confront the harvesting of human genetic information as a resource involve the sharing of that information.Footnote ⁷ With regard to consent, individuals should have a veto right over how their genetic information is used, yet scientific and medical progress depends on individuals sharing their genetic information. With regard to equity, sharing genetic information advances our understanding of genetic diseases, thereby benefiting development of treatments and of improved healthcare outcomes, yet this goal is undermined by a non-equitable management of genetic information, especially for marginalized communities that might be disproportionately impacted.

I focus on a third social dilemma: one posed by privacy. Note that human genetic information is not inherently sensitive in the sense that it inevitably involves privacy issues. But in the many contexts where it is sensitive, harvesting its benefits involves a trade-off: Sharing the data with researchers might have adverse consequences for the individual sharer’s privacy, yet not sharing it could have adverse social consequences, above all – the information’s potential to contribute to social goods such as science and the clinical treatment of patients. In short, governance that privileges individual privacy over communal welfare (a communal welfare achieved through individuals sharing their data) may have adverse consequences for the common good of public health, while privileging communal welfare over individual welfare may have adverse consequences for the individual’s justified interest in the privacy of her genetic information.

Not sharing would be socially harmful because the scientific and clinical value of any particular genetic information lies in its connection to genetic information from other persons. First, on their own, genomic data have “limited scientific utility” (Evans Reference Evans, Frischmann, Strandburg and Madison2017: 84). Second, extraction of their informational potential requires detailed phenotypic data available for the same individuals to establish verifiable associations between gene variants and health conditions. To establish such associations requires not just sharing the research outcomes. It requires providing the supporting data for closer examination and analysis, that is, it requires detailed phenotypic data, such as the “patient’s longitudinal health record or information about lifestyle and environmental factors” (ibid.) that help contextualize genomic findings. To access their phenotypic data, “patients would need to consent to share their complete health histories” from birth to the present (ibid.). The patient has a privacy interest here precisely because sharing such sensitive information renders her vulnerable in various ways. For example, it renders her vulnerable to potential employers who might decline employment to insurance companies that might use such information to deny the individual the purchase of health insurance.

Thus, the governance challenge posed by the social resource of human genetic information is how information is shared. The challenge concerns the regulation of the flow of information. Regulation of information flow casts the individual’s genome not as something always and only personal and private but as something that, in the context of medical research and clinical practice, contributes to what might be called the public dimension of private health. On the one hand, the personal health interests of the individual are unattainable without the research benefits of large data bases of genetic information. On the other hand, the social goods produced by scientific research and clinical medicine are unattainable without many persons sharing their genetic information.

This notion of a public dimension of private health resonates with the idea of a norm of common purpose. It acknowledges the entwinement of the individual’s health interests with those of her community. The entwinement provides practical and normative motivation for the individual’s sharing of her personal genetic information as well as the community’s motivation to treat that information in ways that secure the health-relevant benefit of the sharers. A norm of common purpose formulates what might be seen – even from a utilitarian perspective of mutual benefit – to be the individual’s moral obligationFootnote ⁸ to participate in the collaborative generation of scientific knowledge through genetic data sharing.

With regard to mutual benefit, mutual benefit is possible in part because information is an inherently sharable resource; benefit from that information follows only from sharing it. Commons governance offers a viable complement to market and state governance in providing for the mutual benefit of participants. If the extraction of human genetic information can yield a flow of valuable resource units only through data sharing, then extraction is sustainable only if configured in ways that are both collaborative and responsible. Collaboration means that users of a genome database are expected to contribute data to it. Responsible means the contributors are not harmed in their privacy interests.Footnote ⁹ With regard to common purpose, a norm is common if it is relevant in readily understandable, practical ways to the health of many other persons, and potentially to all persons in the community but also far beyond any one community. Mutual benefit and common purpose come together in a knowledge commons that collectively governs the human genome, including the participation of persons whose genetic data is circulated within the commons. In the next section, I develop this idea toward knowledge commons governance as participatory democracy.

13.5.2 Sharing as a Dimension of Privacy

Sharing then becomes a type or dimension of privacy rather than the negation of privacy. That is, privacy is not the opposite of information sharing; it is not only a matter of constraint; it is itself a kind or mode of sharing. If privacy is a factor in the generation of knowledge, then it is best governed in terms of the normative appropriateness of the conditions and level of privacy, or the normatively justified disposition over a person’s genetic data. As Nissenbaum (Reference Nissenbaum2009, 127) argues, a “right to privacy is neither a right to secrecy nor a right to control but a right to appropriate flow of personal information,” that is, a “right to contextual integrity” that identifies threats to the individual’s privacy posed by new information technologies and systems. A right to privacy, so understood, “formulates an approach to evaluating these systems and prescribing legitimate responses to them” (ibid, 2), allowing the transmission of the individual’s genetic information in some cases, and to some extent, yet constraining that transmission in others,

Normative appropriateness in privacy regulation has three components: setting boundaries that community members control may motivate individuals to participate in the knowledge commons by sharing their genetic information; “privacy constraints on personal information flow enable knowledge production by encouraging trust” (Sanfilippo et al. Reference Sanfilippo, Frischmann, Strandburg, Sanfilippo, Frischmann and Strandburg2021, 16); and the sensitivity of information depends on the context of sharing. The same information can be sensitive in one context, where freely sharing it would be normatively inappropriate and constriction would be recommended, but not sensitive in another context, where sharing would be appropriate.

The preservation of contextual integrity is a matter of observing principles to govern the flow of the individual’s genetic data.Footnote ¹⁰ Transmission should be tailored to fit the specific context, toward meeting ethical, legal, and security standards. These standards include context-specific principles (e.g., the principles governing the sharing of genetic data for medical research may differ from those for clinical diagnosis or personal ancestry testing); ethical and legal compliance (transmission principles should align with ethical guidelines and legal requirements relevant to the specific context); informed consent (patients should be fully aware of how their data will be used, who will have access to it, and any potential risks); data security (such as encryption and secure communication channels); minimization principle (only the necessary amount of data should be transmitted, and it should be used only for the specified purpose); and transparency and accountability (clear policies and procedures regarding the transmission of genetic data).

Different stakeholders in the knowledge commons may emphasize different privacy concerns or different kinds of privacy concerns about what information is collected, analyzed, or shared, for example: reidentification risks (even if genetic data is anonymized, it can sometimes be reidentified by combining it with other data sources); discrimination (e.g., a person might be denied health insurance or a job based on their predisposition to certain diseases); data security (highly sensitive and valuable data is vulnerable to hacking and unauthorized access); consent and control (donors might consent to one type of research but find their data being used for other purposes they did not agree to); family privacy (data about one person can reveal information about their relatives, who may not have consented to the data being shared); possible psychological impact (such as anxiety or stress about potential health issues, or unexpected information about their ancestry or biological relationships); and commercial exploitation (for instance, companies might use genetic information for developing new products or services and profit from it without sharing any benefits with the donors).

A normatively appropriate information flow involves several requirements. In addition to clear agreement on how data can be accessed and used (ensuring that stakeholders understand their rights and obligations), ethical guidelines must be in place to ensure that data usage respects privacy (with oversight bodies to monitor compliance). Transparent governance structures to oversee the data sharing process are needed. This means that there must be accessible information about data governance policies and practices (including who is responsible for data stewardship and how decisions are made), as well as some way of involving stakeholders in decision-making processes. Informed consent (plus an adequate understanding of how the data will be used) for individuals whose data is being shared is imperative. Individual autonomy (including the patient’s right to access or delete her data as she sees fit, and the right to full information about what data is being collected, how it will be used, and who will have access to it, with revokable consent) must be safeguarded. It is equally important to ensure equitable access to the data and the fair distribution of the benefits and burdens of genetic data use, including by those persons who contribute it, and with no group disproportionately advantaged or disadvantaged by governance practices, and no group allowed to monopolize its benefits. Finally, accountability mechanisms to hold data stewards (designated bodies responsible for managing and protecting genetic data) accountable for their actions are vital. These include regular audits and sanctions for misconduct, but also ethical review by an independent board that would consider the potential benefits and harms of data use and ensure that it aligns with ethical principles and community values. Still, flow control of genetic information is likely always to “involve overlapping ethical contexts or contested values” (Sanfilippo et al. Reference Sanfilippo, Frischmann, Strandburg, Sanfilippo, Frischmann and Strandburg2021, 7).

13.6.1 Privacy

Privacy concerns about the sharing of personal human genetic information involves questions such as: Do the rules governing information flow make sense for how the individual’s genetic information is to be used in a specific context? Are the processes of governance constructed in ways that they endow with legitimacy the rules they generate? Inasmuch as the rules may affect some commons participants more than others, or differently from the way it affects others, how can participants be confident that the rules were designed and established fairly?

To evaluate these concerns, a knowledge commons could employ a standard of procedural legitimacy.Footnote ¹³ A proceduralist determination of personal information flows asks: Do the flows reflect the interest of commons members? A proceduralist determination of the appropriateness of genetic information flows does not itself assume any position on the goals of flow governance, or how they might be ranked. Rather, in each context, it evaluates context-specific governance goals with regard to how well they reflect legitimate interests of different stakeholders within the commons.

Given such concerns, legitimacy might be secured through procedural determination along three dimensions: through governing rules on privacy constructed in ways that give, to different members of the commons, good reasons to regard them as legitimate; through the legitimacy of governance practices concerning privacy that consider the legitimate concerns of all persons affected by the commons; and by means of governing privacy by rules that respect the legitimate interests of commons members.

A proceduralist determination of the legitimacy of personal information flows emphasizes inclusive and participatory rule-making processes, continuous evaluation and revision of rules, and robust mechanisms for accountability and conflict resolution. For example, individuals can report grievances and challenge rules that they find unfair or harmful; regulatory bodies can act as neutral arbitrators to resolve disputes and ensure compliance with established rules; and civil society organizations can monitor and publicize compliance and noncompliance, advocating for individuals’ rights.

Principles of transmission contribute to governance of personal information flows being fair, adaptive, and responsive to the needs of all stakeholders. They do so along two dimensions, among others. First, with regard to the normative validity of rules, any rule governing personal information flows can be questioned or contested, and no rule is absolute or beyond scrutiny. Furthermore, rules are acceptable only if justified in terms of fairness, transparency, and inclusivity. Second, the legitimacy of rules governing personal information flows is derived from the processes through which they are created, evaluated, and revised: inclusive and participatory processes where stakeholders have a voice. The validity of rules is therefore always challengeable and always requires defense, and is subject to continuous evaluation and potential revision. While all stakeholders can regularly review and assess the effectiveness and fairness of existing rules, regulatory bodies can lead the process of revising rules based on stakeholder feedback and emerging issues while researchers can conduct studies to inform evidence-based policy adjustments.

These principles of information transmission draw on Ostrom’s (Reference Ostrom1990) work on commons governance with respect to collective decision-making (similar to how commons are managed through collective action, proceduralist determination involves the collective participation of stakeholders in setting and revising rules); clearly defined boundaries (just as commons require clear boundaries to define who has access, the governance of personal information flows requires clear definitions of what constitutes personal information and under what contexts it can be shared); and mechanisms for conflict resolution (Ostrom’s emphasis on conflict resolution mechanisms aligns with the proceduralist approach’s need for systems to challenge and defend rules).

13.6.2 Democracy and Proceduralism

Governance of such a knowledge commons can be democratic. Knowledge commons governance can be member-driven as an arrangement in which members vote and otherwise participate in commons decision-making, such that decision-making is democratic. Democratic means members of the commons jointly define and address issues of governance in the political sphere. To the extent that a commons displays democratic aspects, democratic self-rule by a commons is nonetheless different from the democratic self-rule of a political community. Above all, governance of a knowledge commons does not undertake tasks of the state, or tasks of the economy, whereas a democratic political community does precisely that. To be sure, a knowledge commons could constitute itself as public-driven if it embraced public participation in some of the affairs of the commons, perhaps in recognition of the likelihood of wide, public consumption of the information generated by the commons.Footnote ¹⁴ It could so constitute itself by soliciting interest in the knowledge commons by diverse members of the public and their involvement in it.

Simultaneously, governance of such a commons can be procedural. A procedural form that copes with abiding normative disagreements within the commons might secure procedural legitimacy through a process of participants deciding together the proper goals of the commons and of its data harvesting, including the normative appropriateness of information flows and of information constraints – and, in that process, by including potentially everyone who might be affected.Footnote ¹⁵

• Individuals Are the Primary Stakeholders: Those individuals whose personal information is being governed. Such governance would provide informed consent and allow participation in decision-making processes, the raising of concerns, and the right to challenge existing rules.

• Healthcare Providers Are Also Stakeholders: Physicians, hospitals, and clinics that collect and use genetic information for medical purposes. The proposed governance would ensure the ethical collection and use of data, adherence to privacy regulations, and engagement in discussions about appropriate information flows. These stakeholders contribute expertise on the implications of data use in medical and scientific contexts.

• Researchers Are Another Group of Stakeholders: Individuals and institutions conducting scientific research using genetic data. The proposed governance would allow for their advocacy for data access for research purposes, ensure their compliance with ethical standards, and allow their participation in setting norms for data use.

• Regulatory Bodies Can Be Stakeholders: Governmental agencies and oversight organizations responsible for privacy and data protection that create and enforce regulations, mediate disputes, and strive to ensure that data governance aligns with public interests and ethical standards. They can facilitate discussions, draft regulations, and influence the formulation of public policy.

• Private Companies Can Be Stakeholders: Some biotech firms and pharmaceutical companies, among other enterprises, utilize genetic information for commercial purposes and develop and implement privacy policies, ensure data security, and engage in transparent practices that build trust with data providers.

• Civil Society Organizations Can Be Stakeholders: Nonprofits and advocacy groups focused on privacy, ethics, and human rights that represent the interests of the public advocate for robust privacy protections, and hold other stakeholders accountable. They can participate in public consultations, provide feedback on proposed rules, and ensure that diverse perspectives are considered.

As an example of a stakeholder role, consider individuals: A patient participating in a genetic study provides consent; she later questions the use of her data for a new research purpose. She has a right to challenge this use and to request a revision of the consent terms. Consider healthcare providers: A hospital implements strict protocols for data sharing based on patient consent and participates in broader policy discussions about data privacy in healthcare. Consider researchers: A university research team proposes new guidelines for genetic data sharing that balances research needs with privacy concerns. The team works with other stakeholders to refine these guidelines. Consider regulatory bodies: A governmental agency develops new regulations for genetic data protection and holds public forums to gather input from all stakeholders before finalizing the rules. Consider private companies: A biotech firm creates transparent data privacy policies and engages with patient advocacy groups to ensure their practices meet ethical standards. Consider civil society organizations: A privacy advocacy group conducts audits of genetic data usage and publishes reports to inform the public and policymakers about potential privacy risks.

These and other stakeholder roles and interactions reflect Ostrom’s (Reference Ostrom1990) principles, such as collective choice arrangements (ensuring that those affected by the rules can participate in modifying the rules); monitoring (of both the resource – genetic data – and the behavior of users – stakeholders – to ensure compliance with established norms); conflict-resolution mechanisms (providing accessible and low-cost methods for resolving disputes among stakeholders); and graduated sanctions (applying sanctions in a way that escalates, based on the severity and context of the violation, toward fairness and proportionality).

13.6.3 Realizing the Commons

For nonspecialist stakeholders, comprehensive understanding of the usage of their human genetic information in research and clinical practice is possible within the knowledge commons. This possibility is a matter of balancing the imperative to share genetic information with the need to protect informational privacy, such that the sharing of one’s genetic information constitutes a dimension of privacy rather than the negation of privacy.

The means to this goal are several. First, clear and transparent communication requires comprehensive educational resources, including brochures, videos, and interactive websites, explaining how genetic data will be used as well as the benefits, risks, and protective measures in place. Clear and transparent communication requires simplified or plain language that avoids technical jargon to ensure that participants of varying educational backgrounds can understand the information. And it requires consent forms that are detailed yet clear, and that outline the specific uses of data, data sharing policies, and the participant’s rights.

Second, an interactive consent process requires informed consent discussions, one-on-one discussions or group discussions with participants, to walk them through the consent process and to answer any questions. An interactive consent process requires interactive tools, including digital tools and apps that can guide participants through the consent process, supplying explanations and visual aids to enhance understanding. And it requires feedback mechanisms that provide options for participants to ask questions and give feedback during the consent process.

Finally, an independent ethical review board might oversee the consent process and ensure transparency and fairness. Or a participant advocacy group could help ensure that participants’ interests are represented and that participants fully understand the consent process.

The validity of the assertion might be determined by various means. Surveys administered before and after the consent process can help assess participants’ understanding of how their data will be used. Comprehension questions in consent forms can gauge participants’ understanding of key points. Focus groups with participants can provide detailed feedback on their understanding and the effectiveness of the consent process. Feedback from focus groups can then iteratively improve educational materials and consent processes, and follow-up assessments over time can help evaluate if participants retain their understanding of data use and if their perception of privacy and trust in the system remains positive. Studying participants’ behavior and willingness to share data over time will shed light on whether a comprehensive understanding influences their continued participation. Regular audits by independent bodies can review the consent process, educational materials, and participants’ understanding, ensuring that the consent process complies with legal and ethical standards, and that participants are truly informed. Publishing regular transparency reports detailing how data is used, who accesses it, and the outcomes of its use, and then sharing these reports with participants, is likewise important, as is collecting feedback on these reports to see if participants feel informed and satisfied with the information provided.

In these ways, the political design principle of procedural legitimacy promotes, within the knowledge commons, normatively appropriate flows of human genetic information. And it helps resolve disputes concerning matters and norms of privacy.Footnote ¹⁶ It would deal with the trade-off between the imperative to encourage the individual to share her genetic information, and the imperative to protect the sharer’s informational privacy, by establishing clear rules for participation in the commons, by controlling access to the human genetic information collected, by removing identifying information before sharing that information, and by making data storage secure. It would not simply obtain the participant’s informed consent when collecting her genetic information. It would also help her fully understand how her data will be used in the commons, in this way to provide her some control over the future use of that data. Finally, the political design principle of procedural legitimacy would link genotypes and phenotypes in normatively appropriate ways, with a view to research using genome-wide association studies, and with a view to state regulation of genome databases, including those in knowledge commons, to prohibit the identification of donors from their data and to enforce strict standards of donor confidentiality.