In November of 2019, NIH asked the public for comment on a proposed set of rules that would eventually govern the sharing of data generated from research it funds. PRIM&R’s comments to the agency, submitted on January 10 of this year, generally commended the proposed rule’s mandates to create a data sharing plan but took issue with some of the specifics. In a blog post summarizing our response to the proposal, we identify the timing of the submission requirements, overdependence on deidentification of data, and lack of ethics guidance as areas that could be improved in the rule’s final version. 

On October 29, that final rule was published: Final NIH Policy for Data Management and Sharing. The rule, which effectively replaces a 2003 policy, will require “researchers to prospectively plan for how scientific data will be preserved and shared through submission of a Data Management and Sharing (DMS) Plan” and will apply to any NIH-funded or –conducted research that generates scientific data. It will be effective as of January 25, 2023, giving impacted researchers and institutions more than two years of lead time to ensure that they’re compliant with the new rules.  

The final rule, like the proposed rule before it, scores some key victories in the establishment of widespread and responsible data sharing practices while leaving some gaps that PRIM&R would like to have seen filled. Most notable is the lack of a mandate to share data. As we said in our January blog post, data sharing is popular among study subjects:  

PRIM&R [supports mandated data sharing] in light of recent evidence suggesting that research subjects are eager to see their data shared and their contributions put to the best use…. One of the largest motivators for subjects to participate in research is the belief their contributions will advance science, a possibility that is more likely when their data can be analyzed by a larger group of researchers. 

Of course, there are exceptions to our belief that data is best shared—such as when doing so would violate the privacy of a person or population—and any sharing of participant data must be clearly and effectively communicated in the process of obtaining informed consent. 

But a mandate to share scientific data isn’t the only way to increase data sharing in practice, so we commend the final rule for a critical detail that’s changed since the proposed version: DMS plans will now have to be submitted at the time of application, rather than “Just-in-Time.” This means that data management and sharing will have to be considered earlier in the planning of research, and as such will more likely be seen as an essential, rather than incidental, component of scientific exploration. NIH sees this shift in timing as a way to push the cultural expectations of the scientific community, stating in the preamble to the rule that “this approach is more conducive to achieving NIH’s goal of promoting a culture in which data management and sharing are recognized to be an integral component of a biomedical research project;” we agree with this assessment. 

The published rule comes with three supplemental sections, which expand on the primary document’s key points regarding elements of the mandated plan, allowable costs for data management and sharing, and the selection of repositories for generated data. Regarding the selection of repositories, we have previously submitted concerns to the White House Office of Science and Technology Policy (OSTP) (which coordinates with NIH on these issues) that are unaddressed in this latest rule. In our March comments, we asked that the list of desirable characteristics for a data repository include a) credit for data generators, b) reconsideration of the penalties for terms-of-use violations, and c) a stronger mechanism to ensure fidelity to original consent. For more details on these requests to OSTP, read our blog post on those submitted comments from this spring. Relevant in the context of the NIH data sharing plan is that the list of desirable characteristics for data depositories has not been updated to address these points. 

In our submitted comments to the proposed rule last year, we asked NIH for “clarification…about the relationship between this NIH-wide policy for Data Management and Sharing Policy and the policies that may be promulgated by specific NIH institutes, centers, and offices.” The final rule doesn’t address this specifically or in detail. NIH has promised to address these types of concerns in the form of additional guidance before the rule’s effective date; we look forward to those resources adding the needed information to help the grantee community comply as effectively as possible. 

So, too, will we look forward to further guidance on how to communicate data sharing issues within the process of informed consent—something the final rule promises to do. For example, one issue that will surely be a challenge to communicate to research participants is the limitations to deidentification, which PRIM&R has repeatedly cautioned is “not a viable privacy risk mitigation strategy given that it is no longer possible to guarantee that data will remain permanently deidentified.” Making sure subjects understand the nuances involved in responsible data sharing will be no small task, and we are confident that NIH is prepared to provide thorough, meaningful guidance to make sure it’s done in a way that centers human subjects’ needs.  

In sum, the final rule isn’t perfect: there is no mandate to share data, and grantees will need guidance on crucial questions of communicating these complex issues to participants. Nevertheless, the rule represents a positive step toward expanded, responsible sharing of data, which is critical to both good science and just treatment of research subjects.