Sharing confidential health data for research purposes in the UK

In this article I respond to the tendency of the law to approach ‘the public interest’ as a legal test, thereby drawing the criticism that this narrow notion of what purports to be in the public interest is wholly disconnected from the views of actual publics, and
 lacks social legitimacy. On the other hand, to simply extrapolate outputs from public engagement work into policy (or indeed law) is equally problematic, and risks being at best ineffective and at worst reinforcing existing inequalities. Given this apparent disconnect between these conceptions
 of the public interest, and the shortfalls inherent in each, this article scrutinises this disjuncture. I argue that the application of a processual lens to the construction of the legal and regulatory role of the public interest sheds light on how legal notions of the public interest,
 and attitudes of actual publics towards data sharing, might be reconciled. I characterise this processual approach as being iterative and flexible, specifically drawing attention to the way that multiple actors, processes and interests interact, change and evolve over time in the health research
 endeavour. This approach is elaborated through two case studies that illustrate how the public interest appears in law (broadly conceived). Its application provides novel insights into the ways in which the public interest can be crafted within and beyond the law to better inform the development
 of health research regulation.


Introduction
A recent joint Royal Society and British Academy report on data use and governance in the 21 st century points to the advances that effective data sharing and linkage may spur in healthcare and treatment discovery, and the significant choices and dilemmas this raises. A central tension is the need to promote data innovation while meeting the needs of society and reflecting public interests (British Academy and Royal Society, 2017). For example, health data, such as that held by the NHS, may be of 'immense value' to researchers developing artificial intelligence for use in healthcare settings. However, the question of how this value is realised remains 'a crucial one to get right because of the implications for public confidence' (House of Lords, 2018).
This snapshot from an ongoing debate in the UK about how health data is used for purposes beyond direct care captures a persistent anxiety about the interplay between 'public interests' and the views of actual publics. This is exacerbated because, for reasons I will come to, it is often a legal requirement that health data may only be made available to researchers when this is 'in the public interest'. More specifically, in this article I respond to the tendency of the law to approach 'the public interest' as a legal test, thereby drawing the criticism that this narrow notion of what purports to be in the public interest is wholly disconnected from the views of actual publics, and lacks social legitimacy. On the other hand, to simply extrapolate outputs from public engagement work into policy (or indeed law) is equally problematic. As I outline below, to do so risks being at best ineffective and at worst reinforcing existing inequalities. Given this apparent disconnect between these conceptions of the public interest, and the shortfalls inherent in each, this article scrutinises this disjuncture. I argue that the application of a processual lens -explained below -to the construction of the legal and regulatory role of the public interest sheds light on how legal notions of the public interest, and attitudes of actual publics towards data sharing, might be reconciled. I characterise this processual approach as being iterative and flexible, specifically drawing attention to the way that multiple actors, processes and interests interact, change and evolve over time in the health research endeavour (see Taylor-Alexander et al, 2016;Laurie, 2017). This approach is elaborated through two case studies that illustrate how the public interest appears in law (broadly conceived). Its application provides novel insights into the ways in which the public interest can be crafted within and beyond the law to better inform the development of health research regulation.

Background
The public interest as a concept is by no means particular to the law, nor to health research regulation. Political and social scientists, philosophers and lawyers, among other disciplines, have tussled over whether this might be considered 'a central concept of a civilised polity' (Bailey, 1962) or indeed so vague and ambiguous that it is no more than a rhetorical device (Sorauf, 1957;. Whether the public interest is best understood modestly as a procedural mechanism (Sorauf, 1957), as key to the protection of fundamental values in society (Bell, 1993;Feintuck, 2004), or in utilitarian terms as the views of the majority, there is little doubt that this is a contested concept that is 'much used but ill defined' (Bell, 1993). In the context of health research regulation the challenges and opportunities of the public interest have also been subject to scrutiny (Townend, 2004;Taylor, 2011;Sorbie, 2016).
Nonetheless, the public interest remains central to health research regulation, and is often deployed as a 'gateway' to access information, be it data or tissue (see Capps and Van der Eijk, 2014). For example, the Health Research Authority has a legal mandate to protect and promote the interests of patients and the public in health and social care research in England and Wales (Care Act 2014). More specifically, the common law duty of confidentiality brings the public interest into play as data sharing that would otherwise be a breach of this duty will be lawful if justified in the public interest. Two further legislative regimes also typify examples that invoke the public interest and shape the health data sharing endeavour. These are the regime which established the Confidentiality Advisory Group and the recently enacted Data Protection Act 2018. I address this legal landscape further below.
The potential benefits of responsible access to health data by researchers, as well as the perils of getting this wrong, have led to a renewed focus on the public acceptability of these initiatives and a growing body of literature that explores public attitudes towards sharing health data for research purposes (Aitken et al, 2016b;. This commitment to using patient data responsibly is shared by funders, as exemplified by Wellcome's 'Understanding Patient Data' initiative. The need for law to take heed of publics' views is underlined by the case of care.data which brings home the message that 'legal authority does not necessarily command social legitimacy' (Carter et al, 2015), as described in Box 1.

Box 1
Care.data was an NHS England initiative whereby information would be extracted routinely from GP practices by the Health and Social Care Information Centre and then linked. This would be made available for specified purposes, including audit and research, in a format that was stripped of identifiable information. Following widespread concerns about the scheme -including around its transparency and oversight -the programme closed in 2016. (NHS England, 2013;Taylor, 2014) Here a legal framework was in place to facilitate data sharing but, as argued by Carter et al, the social licence to do so was not (2015). This outcome is consistent with the claim that empirical data has the potential to provide a 'more realistic view of what the law is, what it does and how it can be improved' (van Boom et al, 2018). However, the point of crossover -from empirical research to legal implementationremains vexed and 'the relationship between law and extra-legal insights is not an easy one' (Crijns et al, 2018).
Meanwhile, empirical work on publics' views is also not exempt from critique. In particular, public engagement activities can risk criticisms of exclusivity and tokenism (Ocloo and Matthews, 2016), raising 'questions of representativeness, articulation, impacts and outcomes' (Stilgoe and Lock, 2014). Echoing the difficult relationship between law and 'extra-legal insights', public involvement in health services is recognised as '… an area of policy where ostensibly good intentions appear to repeatedly fail in implementation' (Stuart, 2012).
In the context of evidence-based policy questions around the type of evidence that 'counts', and the extent to which evidence is applied in subsequent initiatives, points to a 'growing sense of disappointment in the relationship between research and policy' (Smith, 2013). Here too academics have closely scrutinised the persistent disjuncture between research and policy and the flaws inherent in a 'largely linear conception' of this relationship (Smith, 2013). This concern, that a narrow account of how evidence is used may result in an oversimplification of the multiple interests in play (Saltelli and Giampietro, 2017), is a pressing consideration for law as well as for policy. Further, even if evidence is used to inform policy Courtenay Botterill notes that this still cannot be decisive as 'trade-offs' are required between what is evidentially 'optimal' and 'other societal priorities' (Courtenay Botterill, 2017).
To improve evidence-based policy, proposals include the use of participative and deliberative analysis (Saltelli and Giampietro, 2017) and a dialogical approach that is able to embrace a range of publics' views (Aitken, 2018). Returning to health research regulation, the literature addressing public attitudes towards data sharing calls for initiatives to improve public awareness of data uses, and for 'opportunities for public engagement and deliberation' (Aitken et al, 2016b). However, applying the lessons learned from the preceding critiques of evidence-based policy suggests that, prior to taking these steps, it is important to first explore if and how publics feature in legal constructions of the public interest in health research.

Methods
This desk-based research was prompted by my experience as a legal scholar working in multidisciplinary teams and observing different approaches to shared concepts such as the public interest. It commenced with a literature review, as summarised above, to situate the role of the public interest, both in health research regulation and in relation to the growing body of literature on actual publics' views towards data use. This highlighted the persistent tension at the point of crossover from evidence to implementation, whether by way of policy or law.
To delineate this apparent disconnect I used doctrinal legal research methods (Hutchinson and Duncan, 2012) to ascertain and describe the current state of the law. As such, my key sources were case law (that is, judicial decisions in court cases, also known as the 'common law') and legislation (that is, law passed by Parliament) and my focus was on the public interest in law 'on the page'. My analysis was 'inward looking' and focused on the wording of and relationship between these legal instruments (Hutchinson and Duncan, 2012). I characterise this as a linear approach and explain below how this can overlook the temporal and interactive elements of health research regulation.
In order to further examine this relationship between a legal conception of the public interest and empirical evidence on publics' views using a processual approach (as introduced above, and unpacked below) I selected two case studies, each relating to a scheme of legislation that regulates health data sharing. These examine the promulgation of legislation that underpins the operation of the Confidentiality Advisory Group (established over 15 years ago) and the Data Protection Act 2018 respectively. I chose these as they both, in different ways, turn on appeals to the public interest and allow for comparisons to be drawn over time. The use of case studies complemented the processual approach -which emphasises how multiple interests are engaged over time -in that it allowed me to develop the contours of this novel approach, to demonstrate the value of this lens in context, and also to draw out insights which speak to the role of the public interest in health research regulation more broadly.
In order to go beyond the 'letter of the law' I used a wider range of sources that speak to how the public interest is formulated and operationalised. More specifically, I collected data from before legislation was enacted (from parliamentary debates as captured in Hansard, using the search term 'public interest') and from after it came into effect (using Health Research Authority documents) on how each scheme should operate when interpreting the law in action. In relation to the Confidentiality Advisory Group I relied on publicly available documents about how this body makes decisions on the public interest. This time my analysis of the law was 'outward looking' and set in context, thereby providing a wider perspective.

Legal notions of the public interest and evidence of actual publics: the apparent impasse
In this section I outline the legal landscape, and then delineate the apparent impasse between the ways that the public interest is constructed in law and through the views of actual publics on health data sharing.
There are three key features of the law that bring the public interest into play in different ways. The first is the common law duty of confidentiality. This is so because where confidential information is imparted to another person, in circumstances giving rise to an obligation of confidentiality, this must not be disclosed without consent or justification. One such justification is where disclosure is 'in the public interest'. This duty is not set out in legislation, but has emerged as a precedent as a result of judicial decisions over time. For example, it is now well established that patients can expect that their personal information will be held in confidence by medical practitioners, and that this will not be used or disclosed further except in certain limited circumstances. When considering secondary uses of data -such as in health research -the same principles apply, in that health data must not be used or disclosed further unless there is a legal basis for doing so (SHIP, 2008;General Medical Council, 2018). An example of how identifiable patient data might be shared for secondary purposes without obtaining individual consent is where this is provided by doctors to registries that collect and analyse data on specific diseases (Coleman, 2003). Concerns about the legality of this practice, among other matters, led to the enactment of legislation in England and Wales in 2001 that forms another key feature of the data-sharing landscape (Box 2). In summary, this legislation allows the Secretary of State to make regulations to 'set aside' the common law duty of confidentiality for defined medical purposes, including medical research, where this is 'in the interests of improving patient care, or in the public interest'.

Control of patient information
(1) The Secretary of State may by regulations make such provision for and in connection with requiring or regulating the processing of prescribed patient information for medical purposes as he considers necessary or expedient-(a) in the interests of improving patient care, or (b) in the public interest.
These powers are now found in Section 251 of the NHS Act 2006 (as enabled by the Health Service (Control of Patient Information) Regulations 2002)and referred to colloquially as 's251 support'. What this means is that in circumstances where seeking consent is neither possible nor practical, researchers can obtain s251 support to use confidential patient information for medical research. To do so they must make an application to the Confidentiality Advisory Group of the Health Research Authority, which then provides advice on whether the request should be granted. Finally, the health data sharing landscape is also shaped by data protection laws, including the recent implementation of the General Data Protection Regulation (Regulation (EU) 2016/679, the GDPR), as supplemented in the UK by the Data Protection Act 2018 (Box 3).

Box 3: Data Protection Act 2018 8. Lawfulness of processing: public interest etc
In Article 6(1) of the GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of the controller's official authority includes processing of personal data that is necessary for-(a) the administration of justice, (b) the exercise of a function of either House of Parliament, (c) the exercise of a function conferred on a person by an enactment or rule of law, (d) the exercise of a function of the Crown, a Minister of the Crown or a government department, or (e) an activity that supports or promotes democratic engagement These are not health data specific pieces of legislation, but instead are directed to the processing of personal data more generally. The detail of this extensive legislation falls outside of the scope of this article, but it is of note that the public interest features here too in the context of using (or, in data-protection parlance, 'processing') personal data for health research. More specifically, Health Research Authority guidance provides that where the organisation processing personal data is a public authoritywhich includes universities, NHS organisations and Research Council institutesthe lawful basis for processing personal data for research under the GDPR should be that this is a 'task in the public interest' (Health Research Authority, 2018). This article pays particular attention to Section 8 of the Data Protection Act 2018, which supplements this provision in the GDPR (and, as will be seen, its Explanatory Note).
To this point I have sketched in three key legal features of the data-sharing landscape (one common law duty, and two legislative regimes) and outlined how the public interest features in each. I now turn to how these notions of the public interest are constructed and, in legal terms, derive their legitimacy. The starting point is a common criticism of the law as a 'closed area of enquiry' (van Boom et al, 2018) that looks inwards to derive its legitimacy -for example to precedents set in previous cases, or to the passage of legislation through Parliament. The legislative regimes described above each derive their (legal) legitimacy from their passage through Parliament and enactment into domestic law. That is, the legitimacy of these laws comes from the fact that they are produced through formal mechanisms for proposing, scrutinising and passing laws, namely, the Parliamentary process in a democratic society. An examination of their text -and more particularly Section 251 of the the NHS Act 2006 at Box 2 and Section 8 of the Data Protection Act 2018 at Box 3 -takes us little further. Both refer boldly to 'the public interest', offering little insight as to how this can or should be operationalised.
Next I turn to the common law duty of confidentiality, which predates both of these legislative regimes, and which 's251 approval' was specifically designed to 'set aside' in the public interest. This duty is derived from judge-made case law rather than statute. As such legitimacy in legal terms is derived here from judicial precedent and opinion. The law's legitimacy comes, once again, from its formal legalistic institutional origins -in this case, the courts. By way of example, case law in relation to the disclosure of identifiable health information (in the context of the doctor/patient relationship) provides that there is not only a personal interest in an individual's confidentiality being maintained, but also a wider public interest in doing so in order that patients (in general) are not discouraged from consulting with healthcare practitioners (W v Egdell [1989] EWCA Civ 13). This is not a proposition that is supported by empirical evidence of patients' actual views on visiting their general practitioners. Instead it is a matter of judicial opinion on how the relevant legal test (that is, whether conduct is 'in the public interest') should be applied. This is not to say that such a proposition is incorrect -it may well be that patients would be less likely to consult their GP if they were concerned that the information they provide might not be treated in confidence. However, in law it is not necessary to present evidence from actual patients to prove that this is the case (Healthcare at Home Limited (Appellant) v The Common Services Agency (Respondent) (Scotland) [2014] UKSC 49, paragraph 3). Rather this is a legal principle that judges will apply on the facts of each case at their discretion.
As discussed at the outset, the public interest is not solely the preserve of the law, and so this approach may feel unsatisfactory from various other disciplinary perspectives. Nonetheless, this is consistent with the long-established 'intellectual tradition' within the law of inventing fictional persons to provide a barometer of what 'reasonable' members of the public might think, feel or expect in a given situation (Healthcare at Home Limited (Appellant) v The Common Services Agency (Respondent) (Scotland) [2014], paragraph 2). Here the public interest is a heuristic that is conceptualised by the courts on the facts of each case as a counterpoint to individualistic claims.
Left here, this suggests an impasse between legal notions of the public interest and the views of actual publics, neither of which alone is sufficient to give full, lasting and legitimate effect to the notion of the public interest. However, my analysis thus far neglects three key aspects of the preceding picture. First, in characterising (or indeed caricaturing) the law as a 'closed area of discourse' (van Boom et al, 2018) this fails to appreciate the interactions that occur beyond the stark letter of the law. Second, this presents a static account of both law and views of actual publics at a fixed point in time; it does not take account of how these might each change over time within and across diverse contexts. Third, this overlooks the various actors and subjectivities that are in play, irrespective of whether these are recognised by the law on the page. It is here that I argue that a processual approach adds value.

8
The public interest: a processual approach As previously established, as well as dispute over what the public interest 'is', there are also persistent tensions in the literature as to how this concept should be understood, with appeals made variously to the values it invokes, the process it requires, or the views of (some or all) of 'society' at large that it reflects. While some scholars invoke a value-based concept of the public interest (Feintuck, 2004), others retreat to a more modest procedural account (Sorauf, 1957). Indeed Sorauf went on to argue that there is no sustainable account of this nebulous concept that stands up to scrutiny (Sorauf, 1962). In health research regulation, Taylor's corpus of work, most particularly in the context of health research using confidential data, finds a way through this thicket by appealing to a 'thin' version of the public interest which is 'tied to the idea of legitimacy' (Taylor, 2011). Taylor highlights the need for transparency, and for decisions around data sharing to be made in such a way that those affected would have reason to 'expect, respect and accept' (Taylor, 2014;Taylor in Sorbie, 2016).
My first key argument in this article offers a further novel conceptualisation of public interest that stands in contradistinction to those found in the literature thus far: namely a processual approach to the construction of the legal and regulatory role of the public interest. This approach is iterative and flexible, specifically drawing attention to the way that multiple actors, processes and interests interact, change and evolve over time in the health research endeavour (see Taylor-Alexander et al, 2016;Laurie, 2017). An example is the dynamic process of ethics review. While this is mandated by law as a linear enterprise of application-review-decisions, the actual processual nature of the endeavour is a complex to-and-fro between researchers and ethics committees, sometimes negotiated, and centred on whether there is sufficient benefit (including social value) in the proposed research that merits tolerance of any associated risks.
A processual approach to the public interest can be distinguished from one based on process per se which is common in the law and emphasises the 'steps taken to achieve a particular end' (Laurie, 2017). In his earlier work Sorauf reluctantly recommends a 'modest conception' of the public interest, based on the 'settlement of conflict by orderly rules and procedures' as at least avoiding the 'uncertainty and ephemera' that would otherwise ensue (Sorauf, 1957). In contrast, a processual lens draws the focus away from the 'end product' and has the potential to engage with the messy realities and subjectivities, both of the law, as broadly conceived, and of evidence of actual publics in a pluralistic society. Such an approach mirrors the move within the evidence-use literature away from a linear approach to the relationship between research and policy (or, in this case, research and law) and towards recognition of the multiple interests that are engaged.
There are two other respects in which the processual can be distinguished from the preceding accounts of the public interest as provided within and outside of health research regulation. First, a processual approach is not dependent on a particular value, or set of values. By way of example, Feintuck's normative model of the public interest is grounded in '… the fundamental, value laden, democratic imperatives that underlie society: human dignity, parity of esteem, and the ability to participate actively in society' (Feintuck, 2004). In contrast, the contribution of a processual approach lies in its ability to expose the subjectivities and values in play in a given context, rather than to determine what these should be or indeed how they should be resolved. In this way, a processual account accords more with Taylor's 'triple test' which, in emphasising the need for transparency in health data sharing, suggests that persons are provided with '(1) reasons to expect the use of data; (2) reasons to accept that use; and (3) that the data uses respect patient preferences' (Taylor, 2014;Taylor in Sorbie, 2016). A processual approach not only complements this test, but also goes beyond this in its holistic perspective on the legal and regulatory endeavour, focusing not only on the reasons for decisions, but also on the dynamics of the legal and social frameworks within which these decisions are iteratively constructed. Thus, in the ethics review example given above, there is no single answer to what social value in research looks like. The researcher seeking approval must offer a reasonable claim that the protocol will deliver some kind of public benefit by conducting the research. Equally, ethics committee members might reasonably disagree on whether the endeavour is worth the risks, unless these are minimised and/or the proposed public benefit is optimised as far as possible.
Accordingly, the processual directs our attention to the dynamics of giving effect and legitimacy to law -not just on the page, but also in bringing context and meaning to its application both up and downstream. The following section provides a processual analysis of the promulgation of each of the legislative regimes that I introduced at the start of this article that appeal, in different ways, to the public interest.

Confidentiality Advisory Group (CAG)
The CAG, and its predecessor bodies, were established in 2001 by the legislative regime at Box 2 and described above. At this time there was a turn towards closer scrutiny of how the NHS used health data and sought patient consent (Higgins, 2003), and confusion around when it was acceptable for researchers to share confidential information in the public interest (Coleman et al, 2003).
The political view, as relayed by the Chair of the CAG's predecessor body, was that the NHS should move and was moving towards the 'elimination' of the use of patient-identifiable data for secondary usages (Higgins, 2003); however, it was not yet at a point where this was feasible. While health researchers may have been sceptical about whether this was a realistic goal, it was accepted that this legislation provided only a temporary solution (Coleman et al, 2003) until the CAG's predecessor could 'work its way out of a job' (Higgins, 2003). Reflecting the uncertainties of the time around what publics might think about responsible data usage, there were widespread calls for public discussion, 'properly informed' debate and a survey of attitudes, with the aim of 'reaching a settled public consensus' (Coleman et al, 2003).
As this legislation was debated in Parliament a number of anxieties about the role of the public interest made themselves plain. These included ( On a narrow analysis, this account appears to re-emphasise the gap between the public interest in law and views of actual publics on health data sharing for secondary purposes, which at the time were 'underrepresented or underreported' (Aitken et al, 2016b). However a processual analysis reveals other insights. This approach requires us to take a longer-term view of the multiple dynamics in play; not just when and how law gave expression to the public interest as a matter of legal text, but also how life was later breathed into this by considering what the public interest means in a given context. For example, we now know, with the benefit of hindsight, that far from being temporary the CAG regime has operated in various iterations, under broadly the same legislative framework, for over 15 years. It has become an established feature of the health research regulatory landscape and has been described as an example of good governance that effectively addresses the limitations of the 'consent or anonymise' paradigm . While 'eliminating' the use of patient-identifiable data may once have been regarded as a desirable goal, we now see a more nuanced approach to data linkage and a growing role for appeals to the public interest. This need for a range of approaches is acknowledged both in literature addressing good governance  and in the literature on public attitudes to access to health data that suggests that 'public's relationships of trust in science are not straightforward' (Aitken, 2016a).
While the role of the public interest is not elaborated upon in legislation as text, its operationalisation in context can also be seen in the function of the CAG. Looking at the 'processes within processes' we see that applications are prepared by researchers, and scrutinised by the CAG to establish, among other matters, whether every application 'clearly demonstrate[s] how there will be a clear public or clinical benefit arising from the use of information' (CAG pre-application checklist, Question 8). Turning to the actors these processes engage, the CAG comprises around 23 members who include stakeholders from lay, regulatory, health, social care, patient and research spheres, among others (Health Research Authority, CAG members, 2019). These decision makers come with their own diverse experiences of health, data, research and the regulatory endeavour, and experiences of deciding previous s251 applications. It is not, of course, suggested that the CAG members can or do represent or reflect the full range of actual publics' views, but neither are they 'faceless bureaucrats' without perspectives that might inform their own views (though some would disagree -see the Public Accounts Committee, November 2015, Question 13). Further, decisions made by the CAG emphasise 'meaningful engagement with patients, service users and the public is considered to be an important factor for the CAG in terms of contributing to public interest considerations as to whether an unconsented activity should go ahead' (Minutes of CAG meeting 15 November 2018). It is of note that work has been done by the CAG to seek to understand stakeholder views (CAG: Understanding public views on using personal data 16 March 2017).
In the preceding analysis, a processual lens has revealed a more nuanced picture of the construction of the public interest within the CAG regime. This resists the characterisation of a divide between the law, as clear and objective, and the views of actual publics, as messy and subjective. It also draws our attention to ways in which public views and acceptability do bear on the statutory framework while leaving it far from clear as to the exact nature of this relationship. For example, while the CAG clearly exercises judgments on the basis of the public interest in its decisions (and guidance on this dated 2012 was previously available on its website) this has since been removed.
Given that the CAG regime developed at a time when there was limited understanding and representation of publics' views on data sharing, the recent enactment of the Data Protection Act 2018 provides a counterpoint. Now public acceptance is recognised as playing an increasingly important role in the success of any such scheme, and a body of evidence has emerged in relation to the factors that can influence public responses to sharing health data (Aitken et al, 2016a(Aitken et al, , 2016b.

Data Protection Act 2018 -'tasks in the public interest'
As set out above, European legislation (the GDPR) provides that where a public authority is processing personal data for research a lawful basis for doing so is that this is a 'task in the public interest' (Health Research Authority, 2018). How this phrase should be interpreted is then elaborated upon in domestic law in Section 8 of the Data Protection Act 2018 (Box 3) and, rather crucially as we will see, in its Explanatory Note (Box 4).
When this Bill was first proposed by the Government a key concern from the heath research community was that the narrow drafting of the public interest clause, which omitted any explicit reference to research functions, was insufficient to provide a clear statutory pathway for lawful research using health data (Wellcome, 2017). Echoing the literature on good governance above, it was argued in Parliament that there needed to be a lawful basis to process health data for research other than requiring explicit consent on every occasion, for example in relation to rare diseases (HL Deb 10 October 2017 Volume 785 Column 141 Lady Neville-Jones). Notably, many of the same challenges and opportunities of the public interest which arose in this Parliamentary debate -including its definitional uncertainty and wide scope -were reminiscent of concerns raised over 15 years previously in debates on the promulgation of the CAG regime (for example see HL Deb 10 October 2017 Volume 785 Column 146; and 30 October 2017 Volume 785 Column 1236). In the Public Bill Committee debate an attempt to introduce an amendment to Section 8 of the Data Protection Bill to explicitly include '(e) the exercise of research functions by public bodies' in the statutory list of 'tasks in the public interest' was narrowly defeated, by ten votes to eight (Data Protection Bill Deb 13 March 2018 Column 18).
However, looking beyond the strict letter of the law, a subsequent change can be seen in the Explanatory Note to the Bill (Box 4). Explanatory Notes are prepared by the Government (in this case the Department for Digital, Culture, Media and Sport and the Home Office) but do not form part of the Bill, nor are they endorsed by Parliament. Having originally made no reference to health research, these were then amended in January 2018 to refer specifically to health research by universities (see text in bold in Box 4). In terms of a processual approach, these are key to how 'tasks in the public interest' will be interpreted in practice by a range of stakeholders. In addition, a processual approach legitimates -and indeed might require -a longer term and wider range of considerations to be taken into account, such as the lobbying that directly influenced the Explanatory Note. More particularly, when we consider the downstream dynamics of future actors who will be called upon to consider the contextual meaning of the public interest, such amplification of possible meaning becomes invaluable.

Box 4: Explanatory Note
Section 8: Lawfulness of processing: public interest etc This section provides a non-exhaustive list of examples of processing under Article 6(1)(e). This includes processing of personal data that is necessary for the administration of justice, the exercise of a function of a Government department, either House of Parliament, the Crown, a Minister of the Crown, a function conferred on a person by enactment or rule of law or an activity that supports or promotes democratic engagement. The list is similar to that contained in paragraph 5 of Schedule 2 to the 1998 Act. As the list is non-exhaustive, organisations whose processing activities are not listed in this section will still be able to rely on Article 6(1)(e) where those activities are carried out in the public interest or in the exercise of the controller's official authority. So, for example, a university undertaking processing of personal data necessary for medical research purposes in the public interest should be able to rely on Article 6(1)(e).

[emphasis added]
Unlike the CAG, the Data Protection Act only came into force on 25 May 2018 and so, at the time of writing, it is early days in terms of how this will work in practice. However, already this amplification of the message in the Explanatory Note can be seen in key documents, such as the Health Research Authority's operational guidance on the GDPR.
Returning to the attributes of a processual approach, the two brief case studies above demonstrate how this is enriching of our understanding of public interest over time. While the approach itself is not predicated upon a necessary link with actual publics' views, the processual analysis draws attention to the ways that, in these contexts, publics' views (and indeed those of other stakeholders -most particularly in the health research community) on the acceptability of data sharing and linkage do bear on the law as the public interest is operationalised and disseminated in particular contexts. This can be contrasted with a linear, process-driven account of the public interest which, in seeking to minimise uncertainty and the effect of the passage of time, can overlook these interactions.

The public interest: a normative claim?
The arguments I have advanced so far in this article speak to my first key claim: that a processual lens delivers a more nuanced analysis of the construction of the legal and regulatory role of the public interest, thus providing novel insights into the ways that the public interest appears in, and is crafted beyond, the law. However, this as yet leaves unanswered the normative question of whether there ought to be a link between legal notions of the public interest and empirical data on the views of actual publics and, if so, whether this should be more overt. This argument requires reflection on the preceding analysis to identify the grounds for and content of such a claim.
The roots of the claim stem from the contention developed in the first part of this article that both legal and empirical conceptions of the public interest are, in themselves, inadequate to give full, lasting and legitimate effect to the public interest. More specifically, the failure of care.data indicates that even when data sharing is provided for in law, without an understanding of context, and the extent to which this accords with views of actual publics, it may lack the social licence required to succeed (Carter et al, 2015). Similarly, to overlook social signalling of areas where the law has not kept pace, or perhaps is overly restrictive, might lead to a culture of caution and other harms in terms of the non-use of health data in research (Jones et al, 2017). On the other hand, a simplistic and additive approach to publics' views will not deliver the 'clearly defined and transparent governance processes' that are required to effectively manage access by researchers to patient data (Wellcome, 2015, Action 1). Here the evidence use literature indicates that to simply extrapolate outputs from public engagement work into policy (or indeed law) is both unlikely to succeed and risks perpetuating an oversimplified account of the multiple interests in play. As argued above, a processual approach reveals that legal notions of the public interest in health research regulation and evidence of views of 'actual publics' on health data sharing do interrelate, although this relationship is tentative and far from clear. Therefore, in order to deliver 'absolute clarity about the purposes for which data can -and cannot-be accessed, with transparent guidance about acceptable and unacceptable uses' (Wellcome, 2015, Action 3), I further argue that this relationship ought to be both acknowledged and made more overt, in order that it may be exposed to debate in health research regulation.
The content or nature of the relationship that ought to exist is elucidated but not resolved within the scope of this article. Again, parallels can be drawn from the evidence-use literature which acknowledges that there may be 'trade-offs' between what is evidentially 'optimal' and 'other societal priorities' (Courtenay Botterill, 2017). To further explore the contours of this relationship a deliberative (Aitken et al, 2016b;Saltelli and Giampietro, 2017) or dialogical (Aitken, 2018) approach may be best suited to accommodating the 'conflicts, negotiations and adaptations inherent in the public interest' (Johnston and Pieczka, 2018).

Concluding remarks
In this article I have examined the relationship, if any, between legal notions of the public interest in health research regulation and evidence of views of 'actual publics' on health data sharing. From a narrow perspective an answer derived from an 'inward looking' analysis of the law -that the public interest is a legal device which appeals to fictional 'reasonable persons' and thus is not centrally concerned by views of 'actual publics' -has the benefit at least of clarity. However, what this delivers in ease of application is significantly outweighed by that which it obscures about the messy realities of the data sharing endeavour. I argue that a fuller account of the public interest is provided through the application of a processual approach that pays attention to (1) a holistic view of the operation of law, beyond the statute book; (2) the dynamic nature both of law (broadly conceived) and publics' views over time; and (3) the actors, activities and subjectivities that are in play.
Through this lens an analysis of two legislative regimes that shape the data sharing landscape illuminate the multiple and dynamic interests that are engaged by the public interest. For example, this indicates that the moment in time at which 'hard law' comes onto the statute books should not be treated as an 'end point', and directs our attention both up and downstream.
Taken together, this illustrates how a processual lens adds value both to our understanding of law and of the use of empirical data on the views of actual publics. As to law, it requires lawyers and legal institutions to acknowledge where and how a range of wider views have influenced legal development, even when this is not finally and formally part of the law itself. As to the use of evidence, these legal examples show myriad and subtle ways in which stakeholder views can and do influence law, but that, as in the case of evidence use in policy, the processes by which this happen are rarely linear.
In this article I also call for a more overt link in law-making and legal implementation as between legal notions of the public interest in health research regulation and evidence of views of 'actual publics' on health data sharing, while acknowledging that further work is required to identify the contours of this relationship. This is timely and urgent in light of the current and sustained focus by Government, regulator, researcher and policy-making actors on the need to realise the potential public benefits of effective data sharing and linkage in health. If we are to adequately address the lessons learned from the care.data programme it is necessary to 'open up' debate around how the public interest is deployed in health research regulation, and the appeals this makes to (among other matters) values, processes and the views of actual publics.

Funding details
This article is based on doctoral research conducted with support from a Wellcome Senior Investigator Award entitled 'Confronting the Liminal Spaces of Health Research Regulation' (WT103360MA): www.liminalspaces.ed.ac.uk/)