Governance & Ethics | Bigpicture

Making pathology data available for research across organizations requires more than secure technology. It requires clear governance, legal and ethical frameworks, and transparency about how Bigpicture itself is managed. Bigpicture connects these elements to support responsible research while protecting data subjects, data contributors and users.

How Bigpicture is governed

Bigpicture is currently governed as a European public-private research initiative, with structures that support strategic decision-making, project oversight and independent advice. The project is jointly led by Jeroen van der Laak and Katrien Grünberg of Radboud University Medical Center, together with Julie Boisclair of Novartis and Anna-Lena Frisk of Johnson & Johnson Innovative Medicine.

Its governance structure enables consortium-level decision-making with specialist advisory and coordination bodies:

General Assembly

The main decision-making body of the consortium, bringing together representatives of the Bigpicture partners.

Managing Board

Responsible for overseeing the management, coordination and progress of the project.

Multi-stakeholder Advisory Board

Provides external perspectives and expertise from relevant stakeholder groups, including regulation, clinical practice, industry, academia and patient representation.

Ethics Advisory Board

Provides independent expertise and oversight on ethical and legal aspects of Bigpicture, including data sharing and data protection.

Node Coordination Board

Coordinates the network involved in pathology data contributions and supports the quality and diversity of data entering Bigpicture.

Governance is part of the infrastructure

Bigpicture has developed its legal, ethical and data governance frameworks alongside the technical infrastructure. This brings together expertise in pathology, technology, data protection, ethics and law to address the requirements involved in contributing and using pathology data across organizations and countries.

The framework covers areas including data protection, ethical requirements, data access, security, confidentiality and the responsibilities of both data contributors and users. Bigpicture's GDPR Task Force supports the consistent implementation of data protection requirements across the project.

Clear rules for sharing and using data

A central part of this framework is the Bigpicture Data Sharing Agreement (DSA). Signed by the consortium partners, the DSA establishes the legal framework for contributing and using data through Bigpicture and defines the roles and responsibilities of data contributors, data users and the organizations hosting the Repository.

Individual datasets can also have their own Terms of Use, defined by the Data Contributor. These specify the conditions under which a dataset can be accessed and used.

Together, these agreements provide a framework for data sharing while allowing requirements to reflect the legal, ethical and research conditions attached to individual collections.

Protecting data and privacy

Bigpicture handles both clinical and non-clinical pathology data. For clinical data in particular, privacy and data protection requirements are an essential part of determining whether and how data can be contributed and reused. The safeguards required depend on the data and its intended use. Bigpicture's framework addresses areas including anonymization and pseudonymization, informed consent and other legal bases for data use, Data Protection Impact Assessments (DPIAs), confidentiality and international data transfers.

Technical and organizational safeguards complement these legal and ethical requirements. Access to Bigpicture services and datasets is managed through authentication, authorization and permission mechanisms rather than providing unrestricted access to the underlying data.

Controlled access to pathology data

Bigpicture is not an open-data repository. Researchers can discover available datasets, but access to the data itself is controlled. Access conditions are determined for individual datasets. A researcher requesting access must provide information about the dataset requested, the intended research purpose and the people who will use the data. Requests are submitted through Bigpicture's REMS access-management service and assessed against the applicable Terms of Use and data protection requirements.

Depending on the dataset, a Data Access Committee may oversee this process on behalf of the Data Contributor. The Data Contributor or its Data Access Committee may also require additional documentation, such as a completed DPIA, before access is granted.

Responsibilities continue after access is granted

Responsible data use does not end when a researcher receives access. Data Users must use data only for the approved purpose and comply with the conditions set by the Data Contributor. Requirements can include confidentiality, appropriate security measures, restrictions on transferring data to others, reporting security breaches and deleting data when required. These responsibilities are set out in the Bigpicture Data Sharing Agreement and summarized in the Bigpicture Policy for Data Users.

Read the Policy for Data Users

Independent ethical oversight

Bigpicture's governance also includes independent advice and oversight. The Ethics Advisory Board monitors and assesses the ethical and legal approaches taken by Bigpicture. Its members include international experts in ethical, legal and societal issues as well as patient representation, bringing perspectives on areas such as data sharing and data protection into the development of Bigpicture. This complements the legal, data protection and governance expertise within the consortium itself.

A framework for responsible data use

Bigpicture’s governance framework brings together legal agreements, data protection requirements, access controls and ethical oversight to support responsible use of pathology data across organizations. The Data Sharing Agreement, dataset-specific Terms of Use, controlled access processes and data protection measures provide a clear foundation for how data can be contributed, accessed and used within Bigpicture. These safeguards are an integral part of the Platform and help ensure that research can take place within clearly defined legal, ethical and security conditions.