Embedding ethics in infrastructures for data-intensive health research

What is an infrastructure?

While the term infrastructure is often mentioned in, for instance, European policy documents, its precise meaning often remains unclear (Aarden, 2023). To better grasp the phenomenon of health data infrastructure, it is useful to look at existing work on infrastructures more generally. Here, we especially build upon the work of Star and Ruhleder (1996), Star (1999), Bowker et al. (2009), and Star and Bowker (2009). They distinguish several characteristics of infrastructures (Box 1), which we will discuss further below.

Intuitively, the concept of infrastructure is generally associated with the material objects and equipment that support certain activities or provide the foundation on which other systems run or operate, such as roads, bridges, and channels (Bowker et al., 2009; Star, 1999; Star and Ruhleder, 1996). However, it is important to note that infrastructures are especially shaped by the social practices that it involves. For example, infrastructure such as a road network is determined also by its users and by a wide range of social and organizational aspects, such as traffic laws, driving tests, and licenses.

Infrastructures are argued to be better understood as (social and material) relations instead of objects (Aarden, 2023; Grisot and Vassilakopoulou, 2017; Star and Bowker, 2009). In other words, something becomes infrastructure only in relation to the practices and activities it supports. For example, a railroad is not infrastructure for a railroad engineer, because for them it is the object of their work (Bowker et al., 2009; Star and Ruhleder, 1996). It becomes infrastructure only in relation to the activity it enables. Infrastructure should therefore not only be seen as a physical object, and cannot be separated from its use (Star, 1999; Star and Ruhleder, 1996).

Thus, what infrastructures are depends not only on the material elements but also—or mainly—on what people do with it in social practices (Star and Ruhleder, 1996). Infrastructures can thus be seen as socio-technical systems, encompassing both material and social structures, practices, routines, norms, and organizational arrangements involved in an activity such as data-driven research. This implies that actors involved with data-intensive health research, as well as guidelines, protocols, standards, and organizational procedures, are all part of a data infrastructure.

Infrastructures tend to be difficult to observe empirically because they are embedded within organizations, social arrangements, and material and digital technologies. When functioning appropriately, they become a taken-for-granted, naturalized, and transparent part of everyday life (Hogle, 2016; Star and Bowker, 2009; Star and Ruhleder, 1996). A successful health data infrastructure would thus, for instance, let researchers across different organizations collaborate, share, and reuse data without any friction (Hogle, 2016). This also implies that an infrastructure becomes especially—or solely—visible upon breakdown (Hogle, 2016; Star and Bowker, 2009; Star and Ruhleder, 1996). In other words, attention is only drawn to infrastructure when it stops functioning properly.

Moreover, infrastructures shape and are shaped by and often embody conventions, practices, and existing standards. Standardization and categorization are required for an infrastructure to function appropriately (Star and Bowker, 2009; Star and Ruhleder, 1996). In an infrastructure for data-intensive health research, this would, for instance, imply fixed metadata categories to ensure the reusability and interoperability of datasets.

The development of infrastructures tends to be highly path dependent (or, as Star and Ruhleder, 1996 describe it, “built on an installed base”). This means that they usually evolve from or are built upon existing structures (Tworek, 2021), and that developing a new infrastructure usually means that existing infrastructures are revised or enhanced (Aula, 2019; Grisot and Vassilakopoulou, 2017). As a result, new infrastructures inherit existing standards, characteristics, strengths, and limitations of previous or existing infrastructures, and it is difficult (or even impossible) to design a new infrastructure from scratch (Star and Bowker, 2009; Star and Ruhleder, 1996). In current efforts to build infrastructures for data-intensive health research, this is, for instance, done on the basis of already existing digital systems within healthcare and health research institutions, such as electronic health records and data repositories.

The path dependency of infrastructures also relates to the way in which infrastructures are usually built: in an evolutionary, distributed process, instead of at once based on a complete preexisting plan (Star and Bowker, 2009). Infrastructures are therefore also characterized as “experimental.” Developing new infrastructures can have far-reaching consequences that are difficult to predict (Aarden, 2023), which is often the case with innovations and emerging technologies (Rotolo et al., 2015).

Infrastructure for data-intensive health research

In practical terms, a data infrastructure refers to the (institutional and physical) means that support storing, sharing, and consuming data (Kitchin, 2014). For data-intensive health research, building on the conceptualizations of infrastructure outlined above, this can be understood as referring to what is required to make such research possible in practice. This includes not only physical and digital systems or databases, but also—crucially—elements such as metadata standards that enable interoperability of datasets, the people who are conducting research, and the regulatory frameworks that determine what uses of data are permitted. As such, the elements of an infrastructure for data-intensive health research can be categorized as follows (see also: Dixon et al., 2016):

Individual actors such as researchers.

As mentioned before, an infrastructure is an embodiment of standards, for instance, not only through predefined metadata categories and informed consent standards but also through rules on whether a study proposal warrants ethics review. These standards shape which practices become possible, and which are regarded as “good practice.” They also steer what people can and cannot do, determine which tasks they are assigned, and thereby influence how responsibilities are distributed.

Different choices can be made about how to support an activity or address a given problem within an infrastructure—for instance, through social, technical, or institutional solutions. Decisions here ultimately shape the resulting infrastructure (Bowker et al., 2009). As a practical example, in infrastructure for data-intensive health research, ethical concerns about privacy can be addressed through technological solutions (e.g., by embedding encryption or certain privacy-by-design in digital systems (Jacobs and Popma, 2019)), but also through social or institutional measures (e.g., by educating researchers on data protection guidelines) (Bowker et al., 2009). Decisions here define different tasks, roles, and competences from the various actors working with an infrastructure, affecting the leeway each actor has in performing a role and the allocation of responsibilities among actors. It is therefore important to make well-considered choices about how infrastructures are developed. The following section examines how ethical norms can become embedded in data-intensive health-research infrastructures and how these embeddings shape the distribution of responsibilities. While we will mainly focus on what this means for the responsibility of researchers, other actors in data-intensive health research (e.g., data stewards) can also be affected.

Embedding ethics in infrastructures for data-intensive health research

The already complex legal landscape in the EU, which includes medical device laws, data laws (e.g., GDPR), and cybersecurity laws, is currently being reshaped by novel developments such as the AI Act and the proposals for an EHDS (Biasin et al., 2023). This legal framework covers the rules and regulations that researchers and institutions have to comply with, thus establishing a minimum standard for acceptable behavior when (re)using large amounts of health data. This minimum standard is, however, accompanied by “softer” ethical norms, which are, for example, delineated in standards, codes, and guidelines (also referred to as “soft law”). Guidelines such as the WMA Declaration of Taipei or the European Code of Conduct for Research Integrity provide norms for researchers to adhere to (ALLEA, 2023; World Medical Association, 2016). In practice, a researcher's latitude in deciding whether and how to comply with both legal regulation and ethical norms is shaped by various elements of the research infrastructure in which they are working. Referring back to the elements of infrastructure for data-intensive health research described above, moral and legal norms for research are often further specified in guidelines and local or institutional policies aimed at (i) individual actors like researchers. Compliance with these norms can be further facilitated through (ii) social and organizational arrangements, such as review committees and data stewardship, but also through (iii) material elements and technological measures.

First, collective self-regulation, e.g., through professional guidelines, is common in data-intensive health research (Muller et al., 2022). This can put a considerable amount of responsibility on individual researchers. For instance, researchers themselves have to apply general rules, principles, or open norms to their specific research context. Translating abstract rules or open norms into concrete decisions can be difficult and burdensome for individual researchers (Mittelstadt, 2019; Smit et al., 2023). Therefore, these norms, as well as legal requirements, are often also implemented or accompanied by local and institutional policies, in order to give clearer interpretations and operationalization of norms (e.g., give specific guidelines for which type of consent is needed in which situations).

It is debatable how much latitude for researchers’ local or institutional policies and norms entails. In theory, researchers’ freedom is quite limited, as policies are formulated to enforce the researcher's actions and ensure compliance with established guidelines. However, in practice, oversight may not always be thorough or consistent. Moreover, legislation and regulations on data use also contain open norms. This gap can provide the researcher with some degree of latitude in how they conduct their work. The presence of more specific organizational norms and “standard operating procedures” takes away some responsibility of individual researchers and makes compliance easier by providing stricter rules to adhere to. However, it has been argued that more concrete and strict rules can be rigid, whereas more general principles to guide action enable context-sensitive judgements about the value and risks of specific actions in specific contexts (Laurie and Sethi, 2013). The latter would imply that researchers must take responsibility for, and have the competence to make, such judgments. This requires more specific competences and knowledge from researchers, and may create a sense of (undue) pressure around making, or being able to account for, their decisions.

Apart from having (local, institutional) guidelines and policies that researchers must adhere to, compliance with norms can be supported or implemented in infrastructure in various ways, which can be either more or less obligatory in nature. For certain types of health research, compliance with laws and regulations is enforced or supported by social and organizational bodies such as RECs, DACs, and data stewards. Both the EHDS and Data Governance Act (DGA) mention ethics bodies and committees as important safeguards for a responsible research practice (Smit et al., 2024).

Yet, RECs have been established within a practice that is focused on protecting the rights and interests of individuals participating in clinical trials. These involve other types of (e.g., more physical, individual, and direct) risks, burdens, and benefits than data-intensive health research (Ferretti et al., 2021a, 2021b), and the relation between researcher and data contributor or participant is different in data-intensive health research practices (Metcalf and Crawford, 2016). Moreover, RECs are usually involved in the preparative phase of research only, which may be insufficient in case of data-intensive health research (Ienca et al., 2018). Researchers cannot foresee all future data use or access requests, so RECs cannot prospectively review this. Additionally, secondary use of health data sometimes falls outside the scope of existing ethics review, for instance, because it is assumed that this research poses minimal risks for participants or data contributors (Ferretti et al., 2021a; Metcalf and Crawford, 2016; Scott et al., 2020).

This has led to the establishment of DACs as a new tier of oversight (Shabani et al., 2017). DACs emerged as a way of regulating data sharing, as opposed to making data openly available without restrictions or leaving decisions on data sharing to individual researchers. At the same time, there is no widely accepted framework under which DACs operate (Cheah and Piasecki, 2020). It is, for instance, unclear what the conditions or criteria are for allowing or refusing access to data (Bernier et al., 2023; Shabani et al., 2017). There is thus no general consensus on the role of DACs, nor on their composition in terms of which expertise is required (Bernier et al., 2023).

When data collection, sharing, or linkage requires approval by a review committee such as a REC or DAC, this strictly enforces norms, which makes it difficult for researchers to deviate from these norms. This distributes the responsibility among multiple actors, making adherence to ethical norms a shared responsibility rather than an individual one, while also providing a sense of reassurance that their research adheres to ethical and legal norms. Moreover, the procedures of committee review itself may prompt researchers to consider ethical aspects of their research and make ethical deliberations themselves, for instance, when drafting a research protocol or proposal to submit to a committee. At the same time, prospective committee review can also cause researchers to “outsource” the responsibility for ethical implications of research to designated committees, instead of making ethical judgments themselves. For instance, researchers may see ethics review as merely a bureaucratic hurdle or assume that a committee will address all potential ethical concerns. This may diminish researchers’ perceived urgency to reflect on the ethical implications of research.

In addition to review committees, forms of training and education for researchers and data stewardship can support compliance with norms in data-intensive health research. Education on research integrity is seen as an important approach for fostering responsible research practices, by, for instance, promoting awareness and reflection, as well as educating on existing rules and norms (Pizzolato and Dierickx, 2021). Although there is no specific consensus on the role of data stewardship, it primarily encompasses activities related to supporting researchers with data management within an organization, and ensuring that data is findable, accessible, interoperable, and reusable (FAIR) (Jansen et al., 2019). In addition to supporting adequate FAIR data management, it has also been argued that data stewardship includes supporting researchers with the ethical and legal aspects of data-intensive health research (Wendelborn et al., 2023). Data stewardship can thus encompass advising, supporting, training, and educating researchers on all these aspects within research institutions. Whether data stewards are also responsible for ensuring compliance with ethical and legal norms in data-intensive health research is unclear. While some authors argue that researchers (and research institutions) retain final responsibility, and data stewardship solely offers advice and support in fulfilling these responsibilities (Jansen et al., 2019), others argue that data stewards also carry some form of responsibility for considering the rights and interests of stakeholders and data contributors (Wendelborn et al., 2023). In general, the tasks of data stewards are thus described as quite broad in scope, but there is no consensus on their responsibility in ensuring that data-intensive health research practices adhere to ethical and legal norms.

Data stewards or training for researchers generally have a supporting function within research institutions, which means that they do not strictly enforce norms in the way that, for example, review committees do. However, they can play a role in implementing norms by supporting and educating researchers. Even if we assume that most researchers aim to adhere to established norms, they may unintentionally deviate due to insufficient awareness. This makes accessible support essential in promoting responsible research practices. Data stewardship is especially helpful in assisting researchers in following established guidelines and policies. However, data stewardship is not necessarily suited to support researchers in making moral judgements when established guidelines or policies are lacking, as data stewards are generally not educated for this purpose.

Finally, the material elements of an infrastructure can also promote responsible research practices. Certain actions can be enabled, promoted, or restricted through the way in which supporting tools and (digital) technologies are designed. First, it is common to use standardized templates, for example, for informed consent forms or contracts. These templates define and steer certain procedures, such as how informed consent should be obtained (Jackson and Larson, 2016). This relieves researchers of the responsibility for determining these procedures themselves. Another example of technological measures is privacy by design, privacy by default approaches, and privacy-enhancing technologies (PETs) (Hoepman, 2014; Jacobs and Popma, 2019). Ethical implications related to aspects such as privacy and security are closely linked to how technologies are designed (Hoepman, 2014; Jacobs and Popma, 2019). Therefore, the way material aspects of data infrastructures are designed also plays an important role in promoting responsible research practices. This is specifically the case for aspects such as privacy and security, but arguably less for other ethical implications, such as bias. Privacy by design and related approaches make it easier for individual researchers to comply with specific norms, as it provides limited latitude. This could, however, also lead to rigidity and less flexibility to enable balancing certain norms and values in a specific context, in order to determine the appropriate approach in individual cases.

An overview of different approaches of embedding ethics in infrastructures for data-intensive health research can be found in Table 1.

OPEN IN VIEWER

Table 1.

Ways to embed ethics in data-intensive health-research infrastructures and their implications for actors’ latitude, responsibilities, and required competences.

		Implications for latitude	Implications for moral responsibility and competences
(i) Individual actors	Guidelines and policies for individual researchers	Wide latitude for individual researchers (dependent on monitoring practice)	Assigns responsibility for compliance with guidelines to researchers Allows for flexibility in individual cases Places high demands on researchers’ moral competences
(ii) Social and organizational arrangements	Committee review (REC, DAC)	Limited latitude for individual researchers	Distributes responsibility for compliance among multiple actors, instead of reliance on an individual researcher Easy compliance for researchers ‘Outsourcing’ of responsibilities for ethical consideration to a designated committee Requires ethical reflection of researchers, e.g., in drafting research protocols Increased regulatory burden and bureaucracy
	Training or education for researchers	Wide latitude for individual researchers	Offers support for researchers in following established ethical and legal norms Less suitable to support researchers in making moral judgements when guidelines or policies fall short
	Data stewardship	Wide latitude for individual researchers	Offers support for researchers in following established ethical and legal norms Less suitable to support researchers in making moral judgements when guidelines or policies fall short
(iii) Material elements	Technological measures through digital systems (e.g., privacy by design)	Limited latitude for individual researchers	Distributes responsibility for compliance among multiple actors and technologies, instead of reliance on an individual researcher Easy compliance for researchers Rigidness and less flexibility in individual cases Places limited demands on researchers’ moral competence
	Templates (e.g., informed consent forms, contracts)	Limited latitude for individual researchers	Distributes responsibility for compliance among multiple actors and materials, instead of reliance on an individual researcher Easy compliance for researchers Rigidness and less flexibility in individual cases Places limited demands on researchers’ moral competence

Considerations for allocating responsibilities

When considering how to design infrastructure for data-intensive health research in such a way that it promotes responsible research practices, it is again important to distinguish between backward-looking and forward-looking responsibilities. Backward-looking responsibility in data-intensive health research will ultimately and formally lie with research institutions or sponsors, which are accountable and liable when ethical or legal norms are breached. However, as mentioned before, we are interested in how to distribute forward-looking responsibilities through infrastructure. These are difficult to assign to collectives (Rovane, 2014; Thompson, 2017) and tend to be diffused among a wide variety of actors in research practices (Muller et al., 2025).

Laws and regulations relevant to data-intensive research can be highly complex, particularly because they also contain open norms that must be interpreted and applied in specific contexts. Embedding support into infrastructures makes compliance for individual actors easier. For example, committee review or privacy by design approaches provide assurance to researchers who want to conduct their work responsibly, while alleviating some of the burden of individual responsibility. In these cases, responsibility is (partly) moved to or shared with other actors, such as committee members or technology developers. Committee review may, at the same time, prompt researchers to reflect and deliberate on ethical implications themselves, such as when drafting a protocol to be submitted to a REC. This could strengthen their knowledge and awareness and sharpen their sensitivity to the ethical dimensions of their research.

However, embedding ethics in infrastructures also has potential downsides, relating to the tasks, responsibilities, and competences demanded of researchers. External review procedures or material formats guiding researchers may also diminish researchers’ ethical reflection on the implications of their own research. If researchers can rely on established routines, they no longer need to think critically or engage in substantive ethical reflection (Bak et al., 2023). This can be legitimate in some instances, such as in low-risk research involving anonymized data or data use with clear informed consent. However, relying on established routines may also decrease researchers’ sensitivity to ethical issues and decrease their moral competences (Johnsson et al., 2014), which could be problematic in their future research work. On a more practical note, if formalized procedures result in lots of paperwork, ethics can be increasingly seen as just a bureaucratic hurdle (Grady, 2015). Disproportionate bureaucratic control—especially in research with perceived low risks—is a frequent cause of frustration for researchers (Dixon-Woods and Ashcroft, 2008), and it can unreasonably stagnate the process of doing research. The perceived need to continuously justify one's actions and have them scrutinized by external control mechanisms could also result in stress and feelings of mistrust in researchers.

As these reflections suggest, there is no universally correct approach for distributing moral responsibilities in data-intensive research, and multiple approaches may be valid. At the same time, neither placing everything entirely in the hands of the individual researcher, nor relying too heavily on social control mechanisms and/or embedding norms in the affordances of material design appears to offer the best path forward. In practice, this will presumably result in a complex system of checks and balances. Given the advantages and disadvantages mentioned above, trade-offs will inevitably have to be made, which requires careful and deliberate decision-making by relevant stakeholders. Moreover, in these decisions, ethical considerations (i.e., the extent to which compliance with established norms can be ensured) will have to be balanced with practical ones, for example, to avoid administrative overload. Being aware of potential (undesirable) implications and (dis)advantages of specific ways to organize responsibilities does allow for monitoring and/or mitigating these where possible. For instance, potential unwarranted effects, such as loss of moral sensitivity by embedding ethical norms in standard operating procedures or digital systems, can be better anticipated and acted upon.

Implications of the infrastructure itself

Even when the ethical implications of data-intensive health research are addressed through careful design of infrastructure, data infrastructures themselves also bring ethical issues that require attention (Contaxis, 2024). This is already visible in the characteristics of infrastructures as highlighted by Star and Ruhleder (1996), Star (1999), Bowker et al. (2009), and Star and Bowker (2009). First, path dependency can make it difficult to address ethical challenges in a fitting way, as a lot of infrastructure is already in place. Infrastructure typically evolves incrementally over long periods, making it difficult to anticipate or steer its long-term effects on research practices. For instance, review by RECs may seem a logical way to tackle some of the ethical challenges of data-intensive research. However, the existing scope of and normative framework used by RECs may not be suitable for dealing with the specific ethical challenges of data-intensive health research (Ferretti et al., 2021a, 2021b; Ienca et al., 2018). Ironically, such path dependency in developing infrastructures is itself an example of the “problem of many hands,” as many different actors are involved over the course of the development of a data infrastructure.

Moreover, data infrastructures generally require straightforward classifications and standardizations (Star and Bowker, 2009; Star and Ruhleder, 1996), such as a standardized metadata system, in order to promote reusability and interoperability of data. This raises ethical, philosophical, and political questions. Such classifications may implicitly have strong theoretical and normative commitments and form a theoretical framework that becomes taken for granted (Leonelli, 2019). Additionally, decisions about which categories are included or excluded, and who gets to define these categories, are inherently political.

As infrastructure substantially shapes research practices, it is also relevant to consider who decides how data infrastructures are designed. Based on our analysis, it would make sense not to leave decisions here solely to those involved in developing technical and digital infrastructures. First, it is important to involve researchers who work with infrastructure in these decisions, as it will impact their responsibilities and which competences are required. However, these are not the only relevant stakeholders to include. As others have pointed out, involving patients or citizens in the decision-making process is important as well, not only from a democratic point of view, but also to improve decision-making and prevent overlooking important implications of the research conducted (Frith, 2023). Involving and informing patients and citizens is often argued to be a way of increasing public support and trust (Teodorowski et al., 2021). The failed UK care.data program illustrates that public support and trust are essential for a successful use of health data (Sterckx et al., 2016). This initiative, which aimed to collect and link health data for various purposes (including research), was ultimately canceled due to persistent criticism about inadequate patient information and the lack of an accessible opt-out option. Finally, ethicists could also play a valuable role by identifying ethical implications of data-intensive health research (infrastructures) together with patients and citizens, and assessing which moral competences and training for researchers may be required. These stakeholders should not be involved only once, as the development of infrastructure is typically a prolonged and incremental process.