Carletta Tilousi:

I was 19 years old and I was approached on the trail and dr. John Martin said, do you wanna know if you're gonna have diabetes in the future?

 

 

Shalene Gupta:

It was 1989 ... and for Carletta [tih-lou-see] and the Indigenous people of the [have-ah-soo-pie] Tribe, diabetes was becoming a serious threat.

 

 

Carletta Tilousi:

I automatically said yes.

 

 

Speaker:

“Roll up your sleeve please. This won’t hurt.”

 

 

Carletta Tilousi:

And I went in I got my blood taken,

 

 

Carletta Tilousi:

And after they take that blood, they flew it out in the helicopter and brought it four and a half hours down to Arizona State University.

 

 

Shalene Gupta:

It was an offer proposed to all 650 members of the Havasupai Tribe. What they couldn't have known… was that their blood would be used for much more than diabetes research.

 

In fact, researchers used it however they liked... including in ways that went against the Tribe's wishes and beliefs.

 

 

Carletta Tilousi:

And to this day I don't know whether or not I'm prone to diabetes.

 

 

Shalene Gupta:

I'm Shalene Gupta, and this is Trustonomy, an original podcast from One Trust.

 

In each episode, we examine stories from the past… moments when companies and organizations broke that crucial element…trust. These are fascinating, and sometimes tragic stories--but they also show us how businesses and organizations can do better today. We're learning how to build--and repair--the superpower of trust.

 

This time, we're examining how a study at Arizona State University broke an already fragile trust with the Havasupai Tribe.

 

Biological data (day-ta) is the most private and personal information you can collect. And getting proper consent and protecting privacy is especially important when we're talking about marginalized groups with cultural beliefs different than your own.

 

 

Linda Thielova:

I think cultural beliefs are actually super important foundation for how you built your privacy program and how you built consent.

 

 

Shalene Gupta:

That is Linda Thielova [tee-ah-lowva??]. We'll hear more from her later.

 

But first: Who are the Havasupai? (have-ah-soo-pie)

 

 

Carletta Tilousi:

The rocks surround my village.

 

They are over a thousand feet and the upper layer is white mesa. So when the sun comes up, it hits the mesa and it comes down slowly and lights up the village

 

 

Shalene Gupta:

Carletta Tilousi is a member of the Havasupai Tribe.

 

Carletta says in her own language: "My name is Carletta Tilousi. I'm from Havasu Canyon and the story I share with you today hopefully makes an imprint on your memory"

 

 

Shalene Gupta:

She said...

 

 

Carletta Tilousi:

My name is Carletta Tusi. I'm from Havasu Canyon, and the story I share with you today hopefully makes an imprint on your memory.

 

 

Shalene Gupta:

Carletta's village is located on the west side of the Grand Canyon. It is incredibly remote. People can only arrive by helicopter, horseback or a long hike in. But it's worth the trek. In fact, her land is famous for its incredible turquoise waterfalls.​

 

 

Carletta Tilousi:

We are known for our beautiful waterfalls that runs through our canyon our water eventually turns into the color bluegreen. And that is what we are named after Havasu. Baja means people of the bluegreen water.

 

 

Shalene Gupta:

More than three hundred tribal members still live on the reserve in the canyon today.

 

In pre-colonial times, the tribe roamed a vast area of 1.6 million acres--about the size of Delaware. They hunted game and thrived by growing corn, melon, squash and beans. But that prosperity came to a halt when pioneers discovered silver on their land.

 

In the late nineteenth century, President Chester Arthur claimed the vast majority of the Havasupai's land for the American public. Settlers arrived, game was depleted and smallpox and measles ravaged the Havasupai.

 

Then in 1903...

 

 

Carletta Tilousi:

Theodore Roosevelt saw the Grand Canyon for the first time, and, uh, felt that it was important to preserve this area and, made a government action to make it a Grand Canyon National Park, which caused the livelihood and the cycle of my people to change drastically.

 

 

Shalene Gupta:

Within a few years, the tribe was forced off their land and moved to an area in the canyon much smaller than their original territory. And the lack of agricultural and hunting land had a very concrete impact on their health.

 

 

Carletta Tilousi:

People's lifestyle and diet changed drastically and that's how we became prevalent to diabetes.

 

 

Shalene Gupta:

By the late 1980s, more than 50% of Havasupai adults were suffering from Type 2 diabetes. To put that in perspective, the US national average at that time was only 5%. Diabetes was now an epidemic for the Havasupai.

 

And its impact on the community was serious.

 

Kidney failure is a common outcome of diabetes. If that happens, a patient requires dialysis several times a week to remove fluid and waste from their blood.

 

Carletta's village doesn't have the capacity to run a dialysis clinic. So, when people develop diabetes, they're often forced to leave the reserve.

 

When Carletta's stepmom was diagnosed with diabetes… she was forced to leave, too.

 

 

Carletta Tilousi:

Leaving her home, leaving her gardens, leaving uh, all her friends and moving into another community, I believe was the hardest for her. And she passed away in 2001. You know, diabetes has increased over the years, I think 2023, there's a lot of us that are battling with it right now.

 

 

Shalene Gupta:

Diabetes was already an issue among the Havasupai in the 1960s when Dr. John Martin, a professor at Arizona State University, developed a good relationship with the tribe. But it wasn't until 1989 that tribal leaders asked him what could be done about the health crisis.

 

Martin suspected their diabetes was caused by a combination of diet and genetics. So, he asked genetics professor, Therese [tah-rees] Markow [mar-co], to work with him on the study. The first step was to collect blood samples.

 

But Dr. Markow wanted to use the Havasupai's blood samples to conduct other research as well. So she applied for funding.

 

 

Carletta Tilousi:

Marco decided to write her own grants without the knowledge of Dr. John Martin. And that's where the whole process crumbled beneath them

 

 

Shalene Gupta:

From 1990 to 1992, hundreds of Havasupai people gave their blood to researchers at Arizona State University. Soon after, it became clear to Dr. Martin that diabetes was spreading too quickly in the Havasupai population to be caused by genetics.

 

The rationale for all those blood samples was gone.

 

That might have been the end of the story...

 

But then, in 2003, during Carletta’s last semester of college at Northern Arizona University…

 

 

Carletta Tilousi:

I saw Dr. John Martin walking on campus And, uh, he goes, oh, by the way, there's a dissertation that you might be interested in listening to, and it's about Havasupai blood samples being utilized for a study… and I said, okay, well I'll be there.

 

 

Shalene Gupta:

When Carletta arrived, the lecture hall was packed.... and a PhD student was already speaking.

 

 

Carletta Tilousi:

The student was studying the DNA structure of an African community and compared it with the Havasupai DNA structure and then also compared it with a primate

 

 

Shalene Gupta:

Carletta didn't understand the technical aspects of the study, but she quickly figured out that it had nothing to do with diabetes. When the student finished his presentation, there was a question period.

 

 

Carletta Tilousi:

And I asked. if he had received permission from the tribe and also permission from the individuals to do this study. And he said no And they ended the dissertation and asked me to go with them into a separate room.

 

 

Shalene Gupta:

And that's when Carletta met Dr. Markow [mar-co] for the first time.

 

 

Carletta Tilousi:

There was a lot of tension in the air. There was a lot of, um, back and forth about consent forms and Marco and Martin were yelling at each other at some point. And I called the leader of my tribe, and I said, um, I think there's an issue here that you really need to know.

 

 

Shalene Gupta:

A subsequent investigation determined that the Havasupai blood samples had, in fact, been used by Arizona State University and other institutions for two dozen research projects...none of which had anything to do with diabetes.

 

These included studies on schizophrenia and inbreeding-- very taboo subjects for the Havasupai.

 

But perhaps the greatest betrayal here was that research had been conducted into the tribe's origins. Their blood samples were used to argue that their ancestors had migrated from Asia by walking across the Bering Sea land bridge.

 

 

Carletta Tilousi:

We were taught that we were created in Northern Arizona on the rims of the Grand Canyon and so that study in particular,affected our minds really our main existence of who we are, and that goes against our own creation stories. and as the report was being read, you can hear weeping in the room. Weeping from our tribal leaders, weeping from our elders. They felt so violated.

 

 

Shalene Gupta:

What had begun as an earnest examination of the Havasupai's diabetes--which was itself the result of colonial theft and betrayal--had led to yet another betrayal.

 

Carletta Tilousi:

The more I found out, I felt like I was a specimen and I still feel like I'm a specimen.

 

 

Shalene Gupta:

Carletta had given her own blood to the researchers and agreed to participate in the diabetes study... but she never signed a consent form.

 

Some members of the tribe did sign a consent form. But it was incredibly broad.

 

It claimed that the blood could be used to-- quote--"study the causes of behavioral slash medical disorders."

 

This language was vague... a problem that was further compounded because English is a second language for most tribal members, few of whom graduated from highschool.

 

 

Carletta Tilousi:

So how do you interpret behavioral disorders? How do we interpret that? The only thing that was approved by the tribe was to study diabetes. when the blood samples were obtained We weren't explained properly what our blood samples were going to be used for.

 

 

Shalene Gupta:

It was obvious to Carletta that her people's rights had been ignored. After speaking with Havasupai Tribal leaders, they decided to file a lawsuit.

 

It argued that Arizona State University did not receive proper consent from the Havasupai and violated their privacy.

 

The scope of the wrongdoing was broad and included issues that researchers likely never considered. For Carletta and her tribe, the primary goal of the lawsuit was to get their blood samples back.

 

In the Havasupai religion, when a person dies…

 

 

Carletta Tilousi:

Every part of their body will be buried with them, so that their spirit can transition into the spirit world.If part of their body is here in this world in a lab, our belief says that their soul will never rest So our lawsuit was not revolved around money, the people that had gave blood who had deceased. We tried to make them whole again, and it wasn't easy

 

 

Shalene Gupta:

Finally, in 2010–seven years after the investigation, and twenty years after the blood samples were taken–Arizona State University agreed to pay 700,000-dollars to 41 tribe members.

 

More importantly, they returned 151 blood samples.

 

 

Carletta Tilousi:

The elders decided to reburied them at our sacred mountain. And we did it very early in the morning before the sun came up. And so, We believe that once we bury them, then they go with the sunrise. Doing something like that in the side of a mountain with pinon trees and sage brushes all over. And just the smell of the early morning and songs being sung. You'll never forget that.

 

 

Shalene Gupta:

But when trust is broken, there are always scars.... closure is not an easy thing to find.

 

Blood samples were only returned if there was a record that someone had given blood. In the years between the study and the lawsuit, some records were lost.... so many people never got their blood back.

 

 

Carletta Tilousi:

We buried an empty box for the individuals that did not receive their blood samples back. And that was me. I was one of them.

 

 

Linda Thielova:

You can almost hear the trust crumbling can't you?

 

 

Shalene Gupta:

Linda Thielova [tee-low-va] is the Global Data Protection Officer and Head of Privacy Centre of Excellence at One Trust. Linda thinks about privacy and consent issues everyday.

 

And, when she heard Carletta's story, she saw a series of big red flags.

 

 

Linda Thielova:

Somehow nobody questioned the ethics of exposing this very sensitive information about a group of people. The researchers zoned in on what they were pursuing as scientists, and they never looked up to consider the real life impact of what they were doing.

 

 

Shalene Gupta:

Today the number of companies and organizations that rely on data (day-ta) gathered from the public is only expanding. But do we know how to safeguard that data? It's about so much more than the right tech and following the letter of the law.

 

 

Linda Thielova:

The laws that we have to follow when it comes to privacy, they're actually built around a lot of principles. So they're telling us to make sure that we are incorporating transparency into what we're doing and thinking about privacy when we're starting a project or when we're onboarding a new vendor, or when we're collecting data

 

 

Shalene Gupta:

Getting your privacy compliance right is sometimes seen as a hassle or a roadblock. But we forget about the powerful long-term benefits.

 

 

Linda Thielova:

You start building a relationship with the people whose data you have and you can actually gain business value from that because people who trust you are more likely to be your customers and they're more likely to share more information with you

 

 

Shalene Gupta:

Taking data without proper consent, or failing to guard it, is the surest way to turn off the very people whose data you rely on. And that's especially true with biological data-- like the Havasupai’s blood samples.

 

 

Linda Thielova:

That is the type of information which is so unique to you. If somebody steals your password? Well, yeah, you can get a new one, but what are you gonna do if they misused your blood samples.

 

 

Shalene Gupta:

The work Linda's describing really begins and ends with consent. But consent on its own isn't enough. It has to be informed consent. Does the customer or, in this case, a research participant.... understand what they're handing over?

 

The bar for consent is even higher when we're talking about biodata like blood samples.

 

In some cases, the researchers at Arizona State University were relying on oral consent. Many Havasupai, including Carletta, say they weren't given a written consent form at all.

 

And if your business does that, you are tainting your project right out of the gate.

 

 

Linda Thielova:

The fact that the ASU researchers used oral consent that just, uh, gives me privacy, compliance, goosebumps, because like the burden rests on you to prove that you have ticked all the boxes in informing the person…. You are more likely than not not processing the data lawfully. So that is very dangerous because suddenly you have this large poison data set that you might actually rely on, for example, for those research purposes.

 

 

Shalene Gupta:

Those who did receive a written consent form signed something incredibly broad.

 

As we heard earlier, the consent form said the blood samples could be used to "study the causes of behavioral/medical disorders."

 

It gave ASU researchers carte blanche to study almost anything they wanted.

 

But real consent requires transparency. And it requires you to be specific...

 

 

Linda Thielova:

It just blows my mind, frankly, how the transparency gap kept increasing they never said how long or for which specific projects they'll be using the blood samples if the people don't know what they're consenting to, there is no transparency, , only those relationships which have transparency in them can be fully trusting relationships.

 

 

Shalene Gupta:

We're starting to see that consent isn't cut and dry. It's something you have to proactively design and build. And that means meeting subjects where they are.

 

In the case of the Havasupai, written consent forms in English may have been inadequate because English is a second language for many tribal members.

 

 

Linda Thielova:

Which is something I can heavily relate to. scientific language. expects quite a high tier of understanding. And that's something that is not a given for non-English speaker and maybe someone who isn't university educated. , you have to , go the extra mile to bridge that gap and to present it in a very comprehensible manner.

 

 

Shalene Gupta:

This doesn't just apply to extreme cases like gathering blood from a historically disadvantaged tribe. Every business should customize consent communication to all the different groups they interact with.

 

 

Linda Thielova:

I think that's one thing that businesses get wrong. They have this sort of template language and it just can't be copy pasted across all relationships and all use cases.

 

 

Shalene Gupta:

Additionally, consent often requires multiple check-ins... especially if the parameters of your work change over time.

 

 

Linda Thielova:

Companies can't assume one piece of text or communication is enough to create transparency and to inform the typical person of what they need to know to get consent. it's never enough for sensitive type of data to just have one touch point

 

 

Shalene Gupta:

If the researchers at Arizona State had taken consent more seriously, they may have avoided a related problem…  violations to the Havasupai's privacy.

 

Their blood samples were used to produce studies on incest and schizophrenia-- sensative and stigmatizing topics. Researchers likely thought, because no names were attached to these studies, they had taken sufficient measures to protect individual tribal members from negative associations and anonymize the Havasupai's personal data.

 

But it wasn't enough.

 

 

Linda Thielova:

If you don't have a good understanding of which subset of your data actually qualifies as personal data, , you're in trouble. It's not enough to consider individual identifiers. You also need to consider indirect or group identifiers.

 

 

Shalene Gupta:

Remember, every blood sample was drawn from a single indigenous tribe with a population of less than a thousand.

 

 

Linda Thielova:

If a group, is so small, then the data it is according to more and more laws globally, almost being considered personally identifying information and so even though. they never really shared specific identifiers like people's names. The fact that you are a tribe member means that it's very easy to pin all of the research findings onto you,

 

 

Shalene Gupta:

In other words: group data becomes personal data when the sample size is small and lacks diversity. Therefore, privacy is endangered even if names and other traditional personal identifiers are hidden.

 

 

Linda Thielova:

If you are identified as a member of the group, any inferences for that group will automatically be pinned on you. you are no longer just a number.

 

 

Shalene Gupta:

Linda's point is not theoretical. The California Consumer Privacy Act defines information tied to an entire household as personal information.

 

They recognize that cross-referencing sets of seemingly anonymous data can expose details about individuals.

 

In the Havusapai's case, no cross-referencing was required. The set of data was so homogenous and small that every tribal member was now associated with taboo subjects against their will.

 

 

Linda Thielova:

That means that this is not just your regular run of the mill privacy data breach, but you are dealing with a major impact, emotional harm. It's more of a cultural and spiritual violation.

 

You are dealing with a breach of trust on the individual level, individual people who will probably never fully trust researchers again, but you are also dealing with a breach of trust of a whole tribe in the context of the colonialist history.

 

 

Shalene Gupta:

The consequences of betraying trust with the Havasupai were obviously huge. But protecting privacy doesn't have to be complicated.

 

 

Linda Thielova:

If you are following one rule for privacy compliance, you want to make sure that you are not doing something that the individuals, if they found out about it, they would be unpleasantly surprised what you're doing with their data.

 

 

Shalene Gupta:

Linda suggests using a Privacy Impact Assessment, or a PIA, to think through any data collection you do. A PIA defines what kind of data you're gathering, why you are gathering it and how you are using it. It's also a way to discover potential risks in advance.

 

And it's an ongoing commitment.

 

 

Linda Thielova:

You are supposed to revisit your privacy impact assessments regularly just to check if there is potential difference between what you set out to do and what you're actually doing with data.

 

 

Shalene Gupta:

A good PIA can save everyone a lot of grief. But it has to be done proactively. That means gathering input from actual stakeholders.

 

 

Linda Thielova:

In this case, the PIA would require you to have somebody, like a representative of the Havasupai Tribe actually read the project outline, and, uh, confirm throughout the PIA process that they actually understand the consent the same way you understand it. , you need that diversity because otherwise you are blind to those weak spots,

 

 

Shalene Gupta:

What Linda's describing when she talks about the importance of Informed Consent and privacy, is really a kind of caretaking.

 

You do not, as a business, own someone else's data.

 

People own their own data. You've only been entrusted with it.

 

 

Linda Thielova:

Businesses are basically stewards for the data. They have obligations that they need to comply with, and the people as the owners are the ones who should be reaping benefits from their data usage, from them giving away the data, enabling the businesses to use it.

 

 

Shalene Gupta:

Around the world, laws have begun to reflect that attitude. But building consent and privacy into data collection is about much more than legal compliance.

 

 

Linda Thielova:

Having a high bar for privacy and consent in a company means that you are able, as a business to really build trust. So it could be you get more data from them, could be you get longer relationships with them. But the bottom line is you are building meaningful relationships with the people whose data you have.

 

 

Shalene Gupta:

When the Havasupai settled their lawsuit with ASU, the New York Times reported that it was the first time individuals had been paid for the misuse of their DNA.

 

The value of personal data is changing. So being a trustworthy steward of that data is more important than ever.

 

Carletta and her tribe have shown that people are, rightfully, starting to demand it.

 

 

Carletta Tilousi:

We don't want other Indigenous groups to go through what we went through and the distrust that we had to go through, but also it united my family, it united my community too, to be strong together and, and have one voice.

 

 

Shalene Gupta:

Informed consent and privacy are the pillars of data stewardship.

 

The story of the Havasupai teaches us that you need to explicitly state what data you're collecting, how it's being used and confirm that both are understood by everyone involved.

 

You also need to consult with data stakeholders to ensure you don't have any privacy blindspots. As we just heard, what constitutes personal data and a breach of privacy can be more complicated than you think.

 

But when you prioritize consent and privacy, you'll build trust with stakeholders, gather better information, safeguard your company and… most importantly… protect those who gave you their data.

 

I'm Shalene Gupta, and this is Trustonomy, an original podcast from One Trust. Thanks for listening.