Alexander Bernier
email: alexander.bernier@mcgill.ca

Fruzsina Molnár-Gábor

Bartha M Knoppers

Priscilla M D Pascal Borry

G Cesar

Thijs Devriendt

Melanie Goisauf

Madeleine Murtagh

Pilar Nicolás Jiménez

Mikel Recuero

Priscilla M D G Cesar

Emmanuelle Rial-Sebbag

Mahsa Shabani

Rebecca C Wilson

Davide Zaccagnini

Lauren Maxwell

Reconciling the biomedical data commons and the GDPR: three lessons from the EUCAN ELSI collaboratory

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

INTRODUCTION

The widespread adoption of national data protection laws, including the European Union's flagship General Data Protection Regulation (GDPR), has created debate regarding the ambit of permissible international transfers of personal data, and the appropriate legal and technical mechanisms to safeguard such transfers. These difficulties also arise relative to prior legislation. However, the high costs of non-compliance with the GDPR, and the requirement to ensure compliance with multiple competing national data protection laws have heightened pre-existing challenges [START_REF] Peloquin | Disruptive and avoidable: GDPR challenges to secondary research uses of data[END_REF][START_REF] Svantesson | International data transfers post schrems-moving towards solutions[END_REF][START_REF] Wolfson | Data-SHIELD: resolving a conflict in contemporary bioscience-performing a pooled analysis of individual-level data without sharing the data[END_REF][START_REF] Wouters | Putting the GDPR into practice: difficulties and uncertainties experienced in the conduct of big data health research[END_REF]. The court-initiated adoption of new procedural requirements as preconditions to outbound transfers from the European Economic Area (EEA) to third countries outside the EEA has also exacerbated difficulties in performing outbound transfers of data from the EEA. These are further discussed in the following sections.

GDPR

The enactment of the GDPR prompted the publication of reports from organisations representing researchers, stating that data protection legislation has created legal incertitude and high administrative costs that inhibit or outright preclude data exchange activities that are foundational to biomedical research [START_REF] Vukovic | Enablers and barriers to the secondary use of health data in Europe: general data protection regulation perspective[END_REF][START_REF] Pormeister | The logical fallacies of the legal bases for data processing in and beyond clinical trials[END_REF][7][START_REF] Kutyłowski | Gdpr-challenges for reconciling legal rules with technical reality[END_REF][START_REF] Zarsky | Incompatible: the GDPR in the age of big data[END_REF]. Barriers to inter-institutional cooperation, for partners both within and outside the EEA, arise from the potential for the individuated participating institutions in large networks of collaborators to bear legal liability arising from the acts of the other implicated partner institutions.

SCHREMS I AND SCHREMS II

Other major data protection controversies that have prompted vigorous debate include the Court of Justice of the European Union (CJEU) determinations in Schrems I and Schrems II. These court decisions held that the Safe Harbour Decision and its successor, the EU-United States (US) Privacy Shield, were invalid. These agreements, negotiated between the EC and US regulators, enabled data transfers from the EEA to the US without requiring parties in the EEA to perform additional efforts to ensure legal compliance. The court holding in each case determined that the concerned EU-US agreement breached constitutional fundamental rights guarantees to privacy, data protection, due process, and effective remedies to which EU citizens are entitled [10,[START_REF]Court of Justice of the European Union[END_REF]. In Schrems II, the CJEU further held that parties in the EEA transferring data to most non-EEA countries must perform an assessment of the local legislation to determine whether the law and practice in the destination countries protected the aforementioned fundamental rights [START_REF]Court of Justice of the European Union[END_REF]. Transfers to those countries could not proceed unless appropriate safeguards were implemented to guarantee respect for such rights. This places a high administrative and legal compliance burden on health sector entities in the EEA that perform outbound international data transfers [START_REF]Court of Justice of the European Union[END_REF][12][START_REF] Mclaughlin | Schrems's slippery slope: strengthening governance mechanisms to rehabilitate EU-US cross-border data transfers after schrems II[END_REF][START_REF] Molnár-Gábor | Bridging the European Data Sharing Divide in Genomic Science[END_REF].

The European and Canadian (EUCAN) Ethical, Legal, and Social Issues (ELSI) Collaboratory is an informal collaboration established to foster discussion among the ethical and legal working groups of six distinct Horizon 2020 projects that included scientific partners in both Canada and the European Union (EU; detailed in Table 1). In this article, the EUCAN ELSI Collaboratory advances three proposals for legal reforms to facilitate the reuse of biomedical data and health data, whilst ensuring that GDPR data protection guarantees are upheld. The three models studied are a contractual approach, a data visitation approach, and a federated data analysis approach.

Part 1. Joint controllership contracts EEA and international data sharing efforts often use contracts to define the boundaries of permissible data sharing and data use between project partners and others authorised to use data (e.g., third-party service providers, downstream researchers). These contracts ascribe responsibilities for providing select services to respective partners in the collaboration, and apportion the consequences and costs of non-compliance.

The design of these contracts is case-specific. Specific parties take responsibility for delivering services that fall within their circle of competence and that are associated with their role as defined in the contract. These contracts usually shield select parties from certain forms of liability. Expert advisors or operational staff might be shielded from liability in their personal capacities to encourage their participation in creating and operating international data sharing infrastructure, especially where their participation is performed on a volunteer basis. Entities that operate data hosting platforms are often shielded from liability if users of their platform misuse the platform in a manner that causes harm. Consortium partners who are responsible for developing and implementing a limited portion of a larger infrastructure often use contracts to limit their liability to those elements that fall to their direct control.

The preceding practices might superficially appear to limit the recourse available to data subjects. In practice, however, enabling distinct parties to align the breadth of their potential liability to that of their specified responsibilities incentivises more partners to lend their expertise to data-sharing efforts or to the design of a platform. If collaborating research institutions, individual expert contributors, citizen volunteers, or third-party service providers stand to bear all liability for the data protection non-compliance of a data sharing or platform design effort, regardless of their contribution to such non-compliance, the legal risks will curtail their participation in such efforts. Conversely, enabling parties in such an exchange to apportion respective responsibilities through a legally binding contract, and limiting the liability of such parties to the ambit of their contractual commitments, encourages a larger number of stakeholders to contribute [START_REF] Choat | Fair share, proportionate liability, and net contribution clauses[END_REF][START_REF] Cooter | Decreasing-liability contracts[END_REF][START_REF] Granelli | The attack on joint and several liability[END_REF][START_REF] Hewitt | Who is to blame? Allocating liability in upstream project contracts[END_REF].

The General Data Protection Regulation (GDPR) uses the concepts of 'controller' and 'processor' to determine the respective legal obligations of distinct actors engaged in the processing of personal data. Controllers determine how personal data will be processed. These actors must ensure compliance with the substantive and procedural requirements of the GDPR. Processors are required to implement the instructions of controllers, but are not held responsible for most aspects of GDPR compliance. Therefore, the law directs most legal compliance obligations to the 'controllers' that choose how information is to be used, and only hold the 'processors,' their delegates in implementing such choices, to listen to instruction and to discharge select other minor duties [START_REF]parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing[END_REF].

The law can also hold collaborators that together determine the use of data to be 'joint controllers.' This is a special legal status that arises if multiple legal entities or individuals together share the distinct duties, responsibilities, and behaviors that are incumbent on controllers. Joint controllership would arise if multiple actors together performed common processing activities directed to the same data for shared purposes. This status would not arise if multiple actors transferred data to one another to process for independent purposes.

In sum, therefore, delineating which actors are considered to be controllers, and which are considered to be joint controllers, is central to performing sound GDPR compliance. Difficulties in determining which actors are controllers, or joint controllers, can lead such actors to neglect their responsibilities, or to be held noncompliant for obligations that such actors did not consider themselves bear.

The GDPR builds on the data protection rules enshrined in its precursor statute, the DPD, often mirroring its edicts. One of its notable departures from the DPD is to introduce a definition of joint controllership and to define the liability rules applicable to joint controllers [START_REF]parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing[END_REF][START_REF]Directive 95/46/EC of the European parliament and of the council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and[END_REF].

The text of the DPD did not stipulate whether it was possible for multiple entities to be considered 'joint controllers' and therefore, to share in the responsibilities for data protection compliance as a collective group [START_REF]Directive 95/46/EC of the European parliament and of the council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and[END_REF]. Courts later interpreted the law to allow for joint controllership. Joint controllership in the DPD was interpreted broadly, recognizing a large potential range of legal entities and individuals, including social media platforms and platform users, as joint controllers. However, the courts held that the responsibilities of each joint controllerand their prospective legal liabilitywere asymmetric in scope. Such prospective liability was limited to activities that the concerned actor performed or for which such actor otherwise bore the burden [START_REF]Court of Justice of the European Union[END_REF][22][START_REF]Court of Justice of the European Union. Case C-210/16 Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein[END_REF].

In contrast, the GDPR defines joint controllership, and requires joint controllers to adopt arrangements that apportion their respective responsibilities for each part of the overall data controllership effort [START_REF]parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing[END_REF]. The GDPR further stipulates that each joint controller is subject to joint and several liability for the overall data processing effort [START_REF]parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing[END_REF]. Despite the clear delineation of responsibilities between joint controllers using contracts, each joint controller remains liable for all elements of data protection non-compliance arising from other joint controllers' acts. A joint controller can only unburden itself of such liability by demonstrating "that it is not in any way responsible for the event giving rise to the damage" [START_REF]parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing[END_REF]. The assessment of whether an actor is a joint controllerand can be held liable for the data protection noncompliance of other actorsis left to the determination of supervisory authorities and courts [START_REF]parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing[END_REF].

The DPD performed a nuanced balancing of the respective roles of different collaborators in data processing activities. In a sense, the DPD implied contractual relationships that parties might have negotiated into their respective data protection obligations. In contrast, the GDPR disincentivizes data sharing and platform creation efforts from investing in private law arrangements that apportion relative responsibilities between collaborators. Regardless of the arrangement, each collaborator bears full legal responsibility for all data processing activities that the collective of joint controllers performs [START_REF]parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing[END_REF]. Member projects of the EUCAN ELSI Collaboratory have had considerable success in creating platforms and networks to share data. These efforts were initiated according to the DPD, prior to the enactment of the GDPR and the associated change in joint controllership rules. The transition from the DPD to the application of joint and several liability under the GDPR has slowed or prevented our efforts to enable international data sharing to facilitate the reuse of the data in the health sector.

To achieve heightened success in stimulating inter-institutional and international collaboration that engenders an improved standard of data protection, the following interpretation of the GDPR can be recommended. The law should empower prospective joint controllers to apportion their respective responsibilities according to contractual terms of their own determination. It should not hold such joint controllers to a standard of joint and several liability. If joint controllers do not enter into contracts that define their respective data protection responsibilities, supervisory authorities and courts should interpret their respective responsibilities in concordance with the role of each in the overall arrangement, as arises from the factual situation. This approach reaffirms the rule in the DPD [START_REF]Directive 95/46/EC of the European parliament and of the council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and[END_REF]. It could be incorporated to the GDPR through an amendment, through jurisprudence confirming its continued application, or through EDPB guidance. This position could also be confirmed in a GDPR Code of Conduct directed to healthcare or research data processing [START_REF] Molnár-Gábor | Bridging the European Data Sharing Divide in Genomic Science[END_REF].

Further justification for this proposed reversion is the following. The GDPR made the explicit choice to alter the DPD's liability rule, so as to subject joint controllers to joint and several liability. Recital 146 of the GDPR explains this choice, stipulating that: "Data subjects should receive full and effective compensation for the damage they have suffered. Where controllers or processors are involved in the same processing, each controller or processor should be held liable for the entire damage." [START_REF]parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing[END_REF] This liability rule dissuades organisations from collaborating in performing data processing, and providing ancillary services. Indeed, numerous organisations will choose not to participate in a collective effort if it requires them to bear the compliance risk associated to the non-compliance of the other collaborators. However, interorganisational collaboration is crucial both to performing data sharing, and to guaranteeing an appropriate degree of data protection in performing such sharing. The punitive liability rule articulated in the GDPR might indeed provide tortfeasors with a wider range of defendants to pursue. But it incentivizes organisations to opt out from large-scale efforts to securely share data for fear of liability, reducing collaboration in sharing data and in ensuring that such sharing achieves an appropriate standard of data protection.

This conclusion reflects the experience of the EUCAN ELSI Collaboratory. It is further supported by a broad literature that demonstrates the poor public policy outcomes of joint and several liability rules in numerous contexts. The demonstrated effects of adopting such rules include taxing the purse of large public-sector bodies that contribute in a small manner to the non-compliance of smaller actors, exposing these large public defendants to unsustainable judgment costs, and disincentivizing risk-averse but highly specialised actors, including consultants, SMEs, or academic collaborators, from contributing their expertise to collaborative endeavors, for fear of bearing liability for the acts of others [START_REF] Choat | Fair share, proportionate liability, and net contribution clauses[END_REF][START_REF] Cooter | Decreasing-liability contracts[END_REF][START_REF] Granelli | The attack on joint and several liability[END_REF]. Joint and several liability rules disfavor interorganisational collaborations relative to established monopolists that can internalize the entire data processing value-chain into the boundaries of a single firm. Ironically, monopolies in data processing count among the societal harms that the GDPR was implemented to counteract [START_REF]parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing[END_REF].

Part 2. Secure Data Processing Environments for International Collaboration

The international data transfer rules of the GDPR pose difficulties for international collaborations in health and biomedical research. The structure of these rules, as further detailed below, can outright preclude some organisations from performing, or receiving, international transfers of personal data from the EU/EEA, either because it is not possible for the transfer recipient to meet the requirements of EU law, or because it is too burdensome to perform the required compliance activities. According to the internal logic of data protection law, such transfer requirements are implemented to ensure that the fundamental rights guarantees accorded to EU citizens are not compromised if data is transferred outside of the reach of EU law. Responses to this public policy choice are divided. Some contend that the onus is on third jurisdictions to adopt data protection standards that are aligned to those of the EU, and that data flows from the EU/EEA should rightly be impeded until such alignment is ensured [START_REF] Dove | Raising standards for global data-sharing[END_REF]. Others hold that precluding data flows from the EU/EEA to third countries denies those in Europe the benefits of international health research, and that political matters should not arrest such crucial information flows [START_REF] Peloquin | Disruptive and avoidable: GDPR challenges to secondary research uses of data[END_REF][START_REF] Molnár-Gábor | Bridging the European Data Sharing Divide in Genomic Science[END_REF]. No resolution to this schism is forthcoming. Our proposal, detailed below, advocates in favor of a 'third way': the creation of secure processing environments that enable researchers from third countries to access data according to organisational and technological safeguards that ensure that the fundamental rights recognised in the EU are applied to such processing activities [START_REF] Molnár-Gábor | Bridging the European Data Sharing Divide in Genomic Science[END_REF][START_REF] Phillips | Genomics: data sharing needs an international code of conduct[END_REF].

Instead of having the effects of the law follow the data as it moves to third parties outside the EU/EEA, according to the GDPR transfer rules, this approach would require third parties outside the EU/EEA to restrict their data use to processing environments that incorporate EU fundamental rights guarantees to their intrinsic structure.

To this end, the European Commission (EC) should elaborate the legal treatment of cross-border 'data visitation' arrangements. Data visitation is the provision of access to data through a controlled, secure processing environment that enables data analyses in the cloud, without enabling data download [START_REF] Austin | Safe sharing sites[END_REF]. In this model, the EC, or delegates thereof, would determine the technical and organisational specifications of secure processing environments for international collaboration in health data analysis. These decisions would establish the contractual and administrative prerequisites for obtaining access to a secured 'data visitation' space. Such decisions would also confirm the appropriate technical approach to maintaining platform security, the methods used to ensure the appropriate use of data accessed through secure processing environments, and the rules that must be followed prior to uploading data to a secure processing environment. In contrast to data transfers enabled through the purely contractual approach, the use of a secure processing environment enables actors from jurisdictions that cannot receive transfers of personal data from the EU or the EEA to collaborate in international research [12].

ADEQUACY DECISIONS FOR DATA TRANSFERS OUTSIDE OF EEA Currently, certain jurisdictions cannot receive transfers of personal data from the EU or the EEA because of the legal determinations made in Schrems I and Schrems II [10-12]. One principal holding of these cases is that data exporters in the EU or the EEA that transfer data to jurisdictions that the EC has not deemed to be 'adequate' must perform an assessment of the destination country's legislation and practice. This assessment verifies whether the recipient jurisdiction can ensure compliance with the fundamental rights to privacy, data protection, due process, and effective remedies to which EU citizens are entitled as a matter of constitutional law [START_REF]Court of Justice of the European Union[END_REF]12]. This burden is disproportionate relative to the limited legal compliance resources available to data exporters [START_REF] Svantesson | International data transfers post schrems-moving towards solutions[END_REF][START_REF]Court of Justice of the European Union[END_REF]12].

If the assessment demonstrates that the law and practice of the recipient jurisdiction provides a standard of data protection that is on par with that of the GDPR, data can be transferred to that jurisdiction in reliance on one of the additional transfer mechanisms established in the GDPR [START_REF]Court of Justice of the European Union[END_REF]12].

If the legal assessment demonstrates that the local law and practice of the recipient jurisdiction cannot achieve a standard of data protection compatible with the foregoing fundamental rights, the following consequences ensue. Transfers from the EU or the EEA to the concerned jurisdiction can still be performed if supplementary measures are adopted to remedy the deficiencies in the rights guaranteed to data subjects [START_REF]Court of Justice of the European Union[END_REF]12]. These include "contractual, technical, or organisational" measures [12]. That said, the supplementary measures are generally limited to technical approaches. In most jurisdictions in which law and State practice do not align with the aforementioned fundamental rights of EU citizens, the implementation of contracts or organisational practices are unlikely to succeed in bolstering the protection of EU citizens from incursions on their fundamental rights. In such instances, additional technological safeguards can be implemented to prevent acts that breach the fundamental rights of EU citizens [12].

Sometimes, none of the foregoing approaches are suitable to enable transfers of data from the EU or the EEA to third jurisdictions. Certain institutions would not be able to conform to the requirements of the GDPR's transfer mechanisms because of restrictions in domestic law applicable to them, regardless of whether or not the transfer could be performed in accordance with the requirements of the GDPR [START_REF] Liss | Demystifying Schrems II for the crossborder transfer of clinical research data[END_REF]. Further, numerous intended uses of data are incompatible with the additional technological safeguards required to transfer data to jurisdictions that could not ensure fundamental EU rights guarantees [START_REF] Svantesson | International data transfers post schrems-moving towards solutions[END_REF][START_REF]Court of Justice of the European Union[END_REF][12][START_REF] Mclaughlin | Schrems's slippery slope: strengthening governance mechanisms to rehabilitate EU-US cross-border data transfers after schrems II[END_REF].

To remediate these difficulties, international collaborators barred from receiving data transfers from the EU or the EEA could perform the analysis of such data within a secure data processing environment established using EU technical structure, that itself guarantees respect for the fundamental rights of EU citizens through its platform-integrated technological and organisational safeguards [START_REF] Austin | Safe sharing sites[END_REF][START_REF] Myers | Ethics in public health research: privacy and public health at risk: public health confidentiality in the digital age[END_REF]. Organisational safeguards include access controls, audits of platform use, or data use practices that platform personnel and external users are required to respect.

We have yet to determine whether the GDPR would construe non-EU or non-EEA access to data performed through a web browser or other portal as an international data transfer. Limited jurisprudence has assessed such questions in the past, however, there is no consensus position on this legal issue at present (Lindqvist). 1 The EDPB, for its part, considers access to data in the EU from third countries to constitute an international transfer of data.

Providing data access to users in other jurisdictions through a secure data processing environment should not be construed an international transfer of personal data. The EC could confirm that the processing of personal data on a secure data processing environment that follows approved technical specifications constitutes personal data processing, but is not subject to the additional GDPR international data transfer rules. The secure data processing environment ensures that the concerned data processing presents the same balance of risks as other data processing activities that remain in the territorial and jurisdictional boundaries of the EU and the EEA. There is consequently no need to place additional reliance on the GDPR's transfer safeguards to mitigate additional risks that international collaboration might otherwise create, if the data were to be transferred to third countries, rather than being processed in a secure data processing environment [12,[START_REF] Molnár-Gábor | Bridging the European Data Sharing Divide in Genomic Science[END_REF][START_REF] Austin | Safe sharing sites[END_REF].

This outcome incentivises data custodians to create and to utilise secure data processing environments that are equipped with state-of-the-art audit logs and other technical safeguards, rather than to disclose data to downstream users in other jurisdictions. 2 In lightening the legal compliance burden associated with enabling data visitation, relative to data transfer, legislators and regulators create incentives for data custodians to develop platforms that hard-code local regulatory requirements into their functioning [START_REF] Austin | Safe sharing sites[END_REF]. However, it must be acknowledged that some forms of data processing might not be susceptible to this solution, such as analyses that are reliant on being able to export identifiable outputs of data processing off of the platform, or those that are contingent on the upload and combination of external datasets.

To establish this solution, the EC, the EDPB, or independent experts drafting a Code of Conduct, should stipulate the technical requirements applicable to secure data processing environments. Public bodies or private bodies should be authorised to create secure data processing environments and operate them according to the technical specifications provided. Compliance with these requirements on the part of upstream data contributors, operators, or downstream data users should be assumed to ensure compliance with the GDPR. Such activities should be construed as the GDPRregulated processing of personal data, but not as the international transfer of personal data, even where select contributing nodes, operators, or user nodes are situated outside the EU or EEA. To further stimulate innovation in the functioning of secure data processing environments, there should be a mechanism to enable the technical specifications of alternate designs for secure processing environments to be proposed, formally approved, and published in public repositories, enabling their future use. Certification could also be offered to the operators of secure processing environments, or to in-environment data users that conform to the requirements thereof, to further confirm their compliance with the applicable requirements.

Part 3. Federated data analysis Federated data analysis has been proposed as a panacea for the challenges inherent in performing the centralised storage and analysis of large datasets, and those arising from the centralised storage and analysis of regulated datasets [START_REF] Gaye | DataSHIELD: taking the analysis to the data, not the data to the analysis[END_REF][START_REF] Suver | Bringing code to data: do not forget governance[END_REF]. Ambiguities remain as to the data protection compliance outcomes of federated data analysis [START_REF] Suver | Bringing code to data: do not forget governance[END_REF][START_REF] Murtagh | International data sharing in practice: new technologies meet old governance[END_REF].

Federated data analysis leaves most of the responsibilities for data storage and data analysis under the technical and organisational control of the data's original host institution, whilst enabling all participating institutions to share in the output results of each contributing node's local analysis. This is often achieved through the use of distributed, rather than centralised, computing [START_REF] Gaye | DataSHIELD: taking the analysis to the data, not the data to the analysis[END_REF][START_REF] Suver | Bringing code to data: do not forget governance[END_REF][START_REF] Rieke | The future of digital health with federated learning[END_REF][START_REF] Thorogood | International federation of genomic medicine databases using GA4GH standards[END_REF][START_REF] Warnat-Herresthal | Swarm learning for decentralized and confidential clinical machine learning[END_REF]. There is statutory support for the idea that not all data processing activities with an extraterritorial component can be considered international transfers of data. It is most notable that the legislature has chosen to refer to data transfers as a concept distinct from, e.g. extraterritorial data processing operations. It therefore stands to reason that not all data processing operations with an extraterritorial element need constitute data transfers according to GDPR Chapter V. The GDPR defines data processing. It does not define data transfers, thus explicitly leaving the definition of this concept to courts and to regulators. Data custodians are organisations and persons that assume operational responsibilities for holding data in a secure manner and facilitating its secure provision to downstream users for authorised purposes. This characterisation is agnostic to the GDPR role of the concerned organisations and persons, though these might often be considered controllers in some circumstances, data processors in others, and in certain instances, the non-regulated agents of a controller or a processor. Federated data analysis resolves challenges in bringing together the significant storage and compute resources required to perform the large-scale statistical analysis of data. The individual-level data that each node contributes to a federated data analysis can be stored and analysed using the concerned node's own technical architecture. There is no need for a singular central node to possess the considerable infrastructure required to store large quantities of individual-level data, or to perform largescale data analysis. This burden is shifted, piecemeal, from the central node to each of the smaller nodes that comprise the network of participants in the overall analysis [START_REF] Suver | Bringing code to data: do not forget governance[END_REF][START_REF] Thorogood | International federation of genomic medicine databases using GA4GH standards[END_REF].

From a compliance standpoint, federated data analysis is often lauded as a compromise position between the total nondisclosure of data, and the resource-intensive negotiation of data disclosure for regulated data [START_REF] Scheibner | Revolutionizing medical data sharing using advanced privacy-enhancing technologies: technical, legal, and ethical synthesis[END_REF].

In performing the federated analysis of data, cooperating institutions disclose the non-identifiable outputs of local or distributed data analysis, such as statistical relationships between variables or the local inputs into a larger effort at training a machine-learning algorithm (e.g., model weights). These are then brought together, physically or virtually, from the participating nodes. Each node benefits from the output results of the federated analysis, without disclosing its regulated data to the other nodes [START_REF] Gaye | DataSHIELD: taking the analysis to the data, not the data to the analysis[END_REF][START_REF] Suver | Bringing code to data: do not forget governance[END_REF][START_REF] Murtagh | International data sharing in practice: new technologies meet old governance[END_REF][START_REF] Warnat-Herresthal | Swarm learning for decentralized and confidential clinical machine learning[END_REF].

From the perspective of the GDPR, debate exists as to whether or not federated data analysis methodologies entail the processing, transfer, or joint controllership of identifiable personal data. This determination is dependent on the technical details of the form of federated data analysis adopted. Nonetheless, the experience of the EUCAN ELSI Collaboratory provides select insights in this respect. The following section is intended to provide our interpretation of applicable law, and to articulate select public policy justifications that favor this interpretation. It also argues that the EC, or regulators (e.g. the EDPB or national supervisory authorities) should provide guidance that helps in the ascription of GDPR roles to the actors engaged in a network of federated data analysis, so that common approaches can be adopted on this issue throughout the European Union. This creates heightened clarity for data subjects, GDPR-regulated parties, and for the downstream users of the non-identifiable outputs of federated analysis.

Federated data analysis methods that do not entail the disclosure of identifiable personal data to other participating nodes should not be interpreted as constituting either 'joint controllership,' nor as involving GDPR-regulated transfers of identifiable personal data between participating nodes. Users of a federated data analysis platform enabling requesting parties to obtain the results of queries, which do not constitute identifiable personal data, should not be construed as joint controllers or data transfer recipients, either [START_REF]Court of Justice of the European Union[END_REF][22][START_REF]Court of Justice of the European Union. Case C-210/16 Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein[END_REF]. This is especially true if the participating nodes utilise standard-form contracts to define the privileges and responsibilities of platform users, and if technical safeguards are used to delimit and to audit downstream users' use of the federated data analysis platform.

It is our understanding that this is the correct interpretation of existing EU law. However, ambiguities as to the circumstances in which the utilisation of a federated data discovery or data analysis platform constitutes personal data processing, the international transfer of identifiable personal data, or creates a situation of joint controllership, remain.

EU legislators or regulators, such as the EC or the EDPB, should confirm that reliance on federated data analysis methods do not constitute international data transfers, nor cause joint controllership to arise. These details could also be elaborated through a GDPR Code of Conduct. This should be the case so long as no personal data is transferred amongst participating nodes or to external users, and so long as technical controls and audit measures are implemented to delimit the autonomy of nodes and end users so as to prevent them from "[determining] the purposes and means of the processing of personal data" [START_REF]parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing[END_REF].

The policy justifications for providing such confirmation are the following. The sharing, joint analysis, and transfer of full datasets compiled from identifiable personal data is cost-intensive from the standpoint of regulatory compliance. It has the potential to create risks to the rights and to the freedoms of the affected individuals, both in their capacities as EU citizens bearing fundamental rights, and in their capacities as GDPR data subjects.

Institutions implement federated data analysis platforms for numerous different reasons. Some are for reasons relating to technological or organisational resources. That is, it is often more cost-effective to adopt federated approaches to performing data analysis and data exchange [START_REF] Gaye | DataSHIELD: taking the analysis to the data, not the data to the analysis[END_REF][START_REF] Suver | Bringing code to data: do not forget governance[END_REF][START_REF] Murtagh | International data sharing in practice: new technologies meet old governance[END_REF][START_REF] Warnat-Herresthal | Swarm learning for decentralized and confidential clinical machine learning[END_REF]. Each of the nodes participating in the analysis must possess a measure of technical infrastructure and specialist staff, however, the burden that such analysis might otherwise place on a central coordinating node is much diminished [START_REF] Thorogood | International federation of genomic medicine databases using GA4GH standards[END_REF].

Nonetheless, one of the major benefits of federated data analysis is to create compromises from a regulatory compliance standpoint. Institutions reduce the data protection risks inherent in their data uses, through the transfer of the non-identifiable output results of local data analyses rather than the identifiable input data. In doing so, these institutions reduce the scientific utility of the concerned data, and have a more limited potential to ensure the accuracy of their results, because it is not possible for them to access the raw data that are inputs into the analysis [29-31, 33, 34].

For public policy reasons, this should be deemed the analysis of non-identifiable, non-personal data. This incentivises institutions to implement federated data analysis methods, and therefore to benefit from more cost-effective data analysis (from a compliance standpoint) in exchange for accepting certain trade-offs, such as losing the potential to view and interrogate the underlying data that contributed to analyses. Institutions will adopt methods of data analysis which minimise the residual risks to individual privacy and to individual data protection rights.

Institutions will invest in the exchange of identifiable personal data and bear the associated costs of compliance in those circumstances in which the nature of the intended data uses requires them to use identifiable personal data. Institutions will implement federated methods of data analysis in those circumstances in which the added scientific utility of exchanging identifiable personal data does not justify bearing the added compliance costs of exchanging the full identifiable data [29-31, 33, 34].

For these reasons, it is recommended that legislatures and regulators confirm that the implementation and use of federated data analysis mechanisms does not constitute the processing of identifiable personal data on the part of end-users, so long as these end-users do not obtain access to identifiable personal data through these data processing activities. It is also recommended that legislatures and regulators confirm that end-users and local nodes do not constitute joint controllers, nor recipients of international data transfers. This remains contingent on no identifiable personal data being shared between participating nodes. It also remains contingent on individual nodes, and endusers, not "[determining] the purposes and means of the processing of personal data" [START_REF]parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing[END_REF].

To better substantiate these concepts, regulators should collaborate with technical experts to release empirical methods and metrics for confirming that no identifiable data is shared through a federated data analysis, and for demonstrating that the 'purposes-and-means' test does not create a situation of joint controllership [START_REF] Devriendt | Data sharing platforms: instruments to inform and shape science policy on data sharing?[END_REF]. This could be achieved through the adoption of EDPB guidelines, a sector-specific Code of Conduct, or through a legislative amendment to the GDPR on the part of the EC. Such guidance could outline the circumstances in which participating nodes could be construed as controllers, joint controllers, processors, or as unregulated users or recipients of data that does not constitute identifiable personal data [START_REF] Molnár-Gábor | Bridging the European Data Sharing Divide in Genomic Science[END_REF]. Regulators could perform audits of compliance, require parties to undergo audits of compliance in this respect, or could provide optional verification and certification mechanisms to support efforts to demonstrate compliance in this complex area.

It is recommended that nodes that process personal data as part of a larger federated data analysis network be construed as processing identifiable personal data relative to their own personal data processing activities alone, without being construed as joint controllers of the personal data that the other participating nodes process. It is also recommended that the nodes responsible for bringing together, processing, or otherwise receiving the non-identifiable outputs of a federated data analysis not be construed as the controllers or processors of personal data. This achieves the favorable balance of incentives detailed above. It encourages participants to construct federated data analysis networks that preclude the transfer of personal data between participating nodes, obtaining the results of personal data processing without incurring risks to data protection and privacy.

CONCLUSION

The GDPR has been met with fanfare amongst international scientific research communities. It provides enforceable informational rights to citizens and publics. It also articulates a vision of digital societies that creates obligations to engage in the accountable and equitable use of information, whilst also enabling open and egalitarian downstream access to such data [START_REF]Proposal for a regulation of the European parliament and of the council on European data governance (Data Governance Act)[END_REF].

The adoption of data protection legislation can stimulate heightened public contribution to scientific endeavor, in guaranteeing research participants a common entitlement to the responsible stewardship of their data. Yet, data protection law as now implemented fails to embody these high aspirations. The restriction of international data flows, and the intensive administrative and procedural burdens integrated to data protection legislation strain the resources of clinicians, researchers, and other institutions dedicated to the prosocial use of biomedical data. Clinicians and researchers in the Global South are deprived of cost-effective participation in international efforts to leverage existing data commons for clinical and research purposes. The application of data protection norms to all data processing activities creates potential challenges to the perceived legitimacy of existing institutions dedicated to the practical administration of rights in data, such as Research Ethics Committees (RECs) and health institutions' data custodians.

The salience of these critiques does not detract from the GDPR's importance as a mechanism directed to creating and operationalising both local and international standards regulating acceptable information uses. But, to achieve the ambition of incentivising, enabling, and regulating information use throughout its lifecycle, considerable future expansion on the GDPR will be required.

This requires the creation of new public-sector institutions, markets for public services, sector-specific legislation, and international covenants. More targeted programs of regulatory intervention are also requisite, such as the creation of regulatory agencies, the strategic use of subsidies and taxation schemes to create context-appropriate behavioral incentives, and the promulgation of voluntary and mandatory licensing schemes to promote transparency [START_REF] Gunningham | Smart Regulation[END_REF].

Pending this languorous emergence of appropriate public and private mechanisms to regulate information use in a contextappropriate manner, our three proposed reforms constitute apt mechanisms to enable the full continued application of the GDPR to regulated actors, whilst enabling the cost-effective downstream use of personal data at scale. These amendments provide regulated actors with certitude as to the legal compliance of their data processing activities, and the boundaries of their respective obligations. It is our hope that these should further the goal of rendering data "as open as possible, and as closed as necessary" [START_REF]Horizon 2020 Programme[END_REF].

1

 1

2

 2

Table 1 .

 1 Overview of EUCAN ELSI Collaboratory Consortia.

	Years			2019-23				2019-22							2019-23						2022-24							2018-22	2019-23
	Mission			Develop a federated, cloud-	based infrastructure for	making genomic and	biomolecular data available	Federated Network of	Aligned and Interoperable	Infrastructures for the	Homogeneous Analysis,	Management, and Sharing of	Genomic Oncology Data for	Personalized Medicine	Federated analysis						Enable the reuse of high-	dimensional cancer imaging	data and associated non-	imaging data to enhance the	potential of AI in oncology			Support biomarker	validation, cardiovascular risk	assessment, knowledge	discovery, public health	Create cloud-based	infrastructure and	governance for the reuse and	potentially link clinical of	epidemiological and high-	dimensional laboratory data
	Approach to data	reuse beyond the	consortium	Federated analysis;	Create synthetic data	for download		Federated cloud-	based clinical data	infrastructure					Federated analysis						Hybrid (centralized	and federated)						Centralized, cloud-	based infrastructure	with the ability to	download data or use	data in the cloud	Centralized, cloud-	based infrastructure	with the ability to	download data or use	data in the cloud
	Disease or system focus			Any				Cancer genomics							Cardio-metabolic,	musculoskeletal,	respiratory health and	disease			Cancer							Cardiac imaging	Emerging infectious	diseases (arboviruses,	specifically, Zika,	Chikungunya, and	Dengue) and COVID-19
	Datatypes			Genetic, phenotypic,	and biomolecular	data		Genomic and	phenotypic data						Data from cohort	studies					Imaging data (cancer	imaging) and non-	imaging data	(associated clinical	and other health data)			Imaging, biomarker	Health research data
	Regions			Africa,	Europe,	North	America	Europe,	North	America					Europe,	North	America				Europe							Europe,	North	America	Europe	and the	Americas
	Full name			Common Infrastructure for	National Cohorts in	Europe, Canada, and Africa		European-Canadian	Cancer Network						Federated, FAIR platform	enabling large-scale	analysis of high-value	cohort data connecting	Europe and Canada in	personalized health	A European Cancer Image	Platform Linked to	Biological and Health Data	for Next Generation	Artificial Intelligence and	Precision Medicine in	Oncology	An EU-Canada Joint	Infrastructure for Next	Generation Multi-Study	Heart Research	Reconciliation of Cohort	Data in Infectious Diseases
	Short name			CINECA				EUCANCan							EUCAN-Connect						EuCanImage							euCanSHare	ReCoDID

European Journal of Human Genetics

AUTHOR CONTRIBUTIONS

FUNDING

FMG has received funding by the European Union Horizon 2020 research and innovation program under grant agreement 825835 and the European-Canadian Cancer Network (EUCANCan), a federated network of aligned and interoperable infrastructures for the homogeneous analysis, management, and sharing of genomic oncology data for personalized medicine. FMG is also funded by the Deutsche Forschungsgemeinschaft (German Research Foundation)-NFDI 1/1 "German Human Genome-Phenome Archive.". TD, PB, AB, DZ, and BMK have received funding from the European Commission under the grant agreement No. 825903 (euCanSHare project). LM and PC's contributions were supported by the ReCoDID project, funded by the EU Horizon 2020 Research and Innovation Programme (grant agreement 825746), and the Canadian Institutes of Health Research (CIHR) Institute of Genetics grant to LM (grant agreement 01886-000). MG and ERS have received funding from CINECA, a project that has received funding from the European Union's Horizon 2020 research and innovation programme under grant agreement No 825775. Where authors are identified as personnel of the Biobanking and BioMolecular resources Research Infrastructure (BBMRI-ERIC), the authors alone are responsible for the views expressed in this article and they do not necessarily represent the decisions, policy or views of BBMRI-ERIC.

COMPETING INTERESTS

The authors declare no competing interests.

ADDITIONAL INFORMATION

Correspondence and requests for materials should be addressed to Alexander Bernier.

Reprints and permission information is available at http://www.nature.com/ reprints Publisher's note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.


Aurore Nottez¹

Sami Kolta²

Georges Lion³

Camille Ternynck⁴

Isabelle Legroux-Gérot⁵

Marie-Christine Vantyghem⁶

Bernard Cortet⁵

Julien Paccou⁵

MD Julien Paccou
email: julien.paccou@chru-lille.fr

Prevalence and causes of elevated bone mass

Keywords: sclerotic bone metastases, renal osteodystrophy, myeloproliferative syndromes, mastocytosis, osteopetrosis, hyperostosis, osteosclerosis, skeletal fluorosis, hepatitis Cassociated osteosclerosis Elevated bone mass

ABSTRACT Introduction

Reports of elevated bone mass (EBM) on routine DXA scanning are not infrequent. However, epidemiological studies of EBM are few in number and definition thresholds variable. The purpose of this study was to assess the prevalence and causes of EBM in the general population referred to a single university hospital -catering for a population of 5.9 million inhabitants -for DXA scanning.

Material and methods

DXA databases were initially searched for individuals with a bone mineral density (BMD) Zscore ≥+4 at any site in the lumbar spine or hip from April 1st, 2008 to April 30st, 2018. Two Hologic scanners were available at the Lille University Hospital (France). Prevalence of EBM was evaluated, as were causes associated with EBM.

Results

At the lumbar spine, 18,229 bone density tests were performed in women and 10,209 in men.

At the hip, 17,390 tests were performed in women and 9,857 in men. The total number of patients who had at least one bone density test was 14,745, of which 64.2% were female. Of these 14,745 patients, 211 had a Z-score ≥+4 at any site, i.e. a prevalence of 1.43% [1.25%-1.64%]. The DXA scans and medical records of 92 men and 119 women with elevated BMD were reviewed to assess causes. An artefactual cause was found in 164 patients (75%) with EBM (mostly degenerative disease of the spine), and an acquired cause of focal EBM was found in only 2 patients, both of whom had sclerotic bone metastases from prostate cancer.

An acquired cause of generalized EBM was found in 32 patients (15%), the vast majority of whom had renal osteodystrophy (n=11), followed by hematological disorders (n=9; e.g. myeloproliferative syndromes and mastocytosis) and diffuse bone metastases from solid cancer (n=5). Of the remaining causes, rare hereditary diseases (e.g. osteopetrosis...) and unexplained EBM were found in 10 and 6 cases respectively.

Conclusion

The prevalence of EBM (Z-score ≥+4 at any site) was 1.43% [1.25%-1.64%]. In nearly all instances (97.1%) the explanation for EBM could be found in the medical record and through conventional investigations. This study suggests that the main cause of EBM is degenerative disease of the spine. Further studies are needed to differentiate artefactual EBM from hereditary or acquired EBM, and to investigate unexplained EBM. Genetic testing may prove useful in elucidating rare unknown causes.

INTRODUCTION

Although elevated bone mass (EBM) or dense bone diseases may be suspected when standard radiographs show abnormally dense bone, measuring bone mineral density (BMD, g/cm²) using dual-energy X-ray absorptiometry (DXA) is not only far more accurate, but also quantifies the increase in bone mass (1). Although no consensus exists on the definition of EBM, several BMD Z-/T-score cut-offs values have been suggested. In 2005, Michael Whyte (1) proposed that a Z-score > + 2.5 should be used. Before that, varying cut-offs were used in case reports and case series. A T-and/or Z-score cut-off of ≥ + 4 at the lumbar spine or hip was used in a study of 335,115 DXA scans from 15 centres in the UK (2). Using that cut-off, the prevalence of EBM in that study was 5/1000. Careful review of DXA reports and images often reveals that the increase in BMD can be potentially attributed to artefactual causes, such as degenerative disease of the spine (with or without scoliosis), vascular calcifications (most notably of the abdominal aorta), syndesmophytes, diffuse idiopathic skeletal hyperostosis (DISH), and implanted material (e.g., vascular prosthesis or vertebroplasty) (3,4). In the above-mentioned British multi-centre study, about 50% of cases of EBM were due to degenerative disease (2). Lesions responsible for focal EBM should be considered as dictated by the clinical setting. These lesions include sclerotic bone metastases, Paget's disease, and fibrous dysplasia of bone (5-9).

The causes of acquired generalized EBM are both numerous and varied. Nutritional causes include an excessive intake of fluoride (5). A well-established metabolic cause is renal osteodystrophy, in which the bone sclerosis predominantly affects the axial skeleton (6).

Endocrine causes include chronic hypoparathyroidism and pseudo-hypoparathyroidism (7).

Among hematological disorders, mastocytosis and myeloproliferative syndromes have been reported to cause EBM (8,9). Leukaemia, lymphoma, diffuse bone metastases from solid cancer, and the very rare cases of sclerotic multiple myeloma are the main malignant causes of EBM (10). Hepatitis C can cause diffuse osteosclerosis (11,12). Obesity has been suggested as a possible cause of EBM (13).

Several genetic diseases are associated with a generalized increase in BMD, chief of which are osteopetrosis, mutations in the SOST gene, and mutations in the LRP5 and LRP6 genes.

The quantitative and qualitative bone abnormalities seen in these diseases have variable effects on bone strength and fracture risk, even though BMD values are usually extremely high, with Z-scores that can exceed + 6 at the hip and lumbar spine (14-21).

In clinical practice, reports of EBM on routine DXA scanning are not uncommon, and the causes are both numerous and varied. However, most of the published data are from case series and the prevalence of EBM remains largely unknown.

The purpose of this study was to evaluate the prevalence and causes of EBM in adult patients who underwent DXA scanning at Lille University Hospital, Lille, France over a 10-year period.

PATIENTS AND METHODS

Study design

Our study was conducted on a retrospective cohort of subjects included from April

Definition of elevated bone mass

Elevated bone mass was defined as a Z-score ≥+4 at any site in the lumbar spine or hip in order to compare our findings with those reported by Gregson CL et al. (2).

Data extraction

An anonymised file with data on all DXA scans was extracted from each Hologic© scanner.

Two databases were obtained. Neither of them contained any T or Z-score data. DXA scan results were expressed in g/cm² for all assessed sites (e.g., the value in g/cm² for the 4 lumbar vertebrae was provided).

The data were analysed by age group -18 to 34.9 years, 35 to 39.9 years, 40 to 44.9 years, 45 to 49.9 years, 50 to 54.9 years, 55 to 59.9 years, 60 to 64.9 years, 65 to 69.9 years, 70 to 74.9 years, 75 to 79.9 years and ≥ 80 years -using EBM-value thresholds for each age group, firstly among men and then among women. The following reference curves were used: for women, the IOG curve for the lumbar spine (established from three French populations, Isos, Ofely and Genset) (22) and the NHANES curve for the hip (National Health and Nutrition Examination Survey) (23,24); for men, the BMDCS curve for the lumbar spine (Bone Mineral Density in Childhood Study) (25) and the NHANES curve for the hip (23,24) (e.g., a threshold of 1.401 g/cm² equated to a Z-score ≥+4 for a woman between 45-49.9 years old, according to the IOG reference curve).

EBM-positive DXA scan results (i.e., DXA scan results satisfying the definition of EBM) were selected by gender and age group by the principal investigator (JP) using the reference curves mentioned above.

We determined the total number of DXA scans performed over a 10-year period as well as the corresponding number of patients assessed (since several DXA scans could have been performed for any given patient). We also determined the total number of patients with at least one EBM-positive DXA scan result. If a patient had several EBM-positive DXA scan results, the result of the last scan was selected and used for the analysis.

Data analysis

Review of DXA scan reports and images often provided potential explanations for an artefactual cause of EBM at the lumbar spine. However, medical records and other images of the spine and hip were also examined in order to identify other causes.

An Electronic Case Report Form (eCRF) was completed for each patient with EBM. The following data were collected: gender, age, weight, height, body mass index (BMI) and date of scan. For each site of interest (lumbar spine, femoral neck and total hip), the following data were collected: BMD (g/cm²), T-scores, and Z-scores if available on the DXA scan report. All DXA images with a BMD T-or Z-score ≥+4 at any site were visually inspected by 2 clinicians (JP and AN) trained in the interpretation of DXA scans, and identified causes were recorded. A notation was made if a cause was not identified (unknown causes).

RESULTS

Prevalence of elevated bone mass

Over the 10-year study period, 28,438 DXA scans were performed at the lumbar spine and 27,247 at the hip. Of the 28,438 lumbar spine scans, 18,229 were performed on women and 10,209 on men. Of the 27,247 hip scans, 17,390 were performed on women and 9,857 on men.

The total number of patients who had at least one DXA scan was 14,745, of whom 64.2% were women. Of those patients with at least one DXA scan, 211 had a Z-score ≥+4 at any site, i.e. a prevalence of 1.43% [1.25%-1.64%]. Elevated bone mass was more frequently found in men (1.74% [1.41%-2.13%]) than in women (1.26% [1.04%-1.50%]) (p=0.021). Moreover, our findings indicate that prevalence of EBM is associated with age (p<0.0001). Indeed, when we compared prevalence of EBM across age groups, we found the following: 0.55% [0.31%-0.90%] in patients <40, 1.09% [0.08%-1.40%] in patients 40-59.9, 2.01% [1.66%-2.42%] in patients 60-80 and 2.32% [1.54%-3.33%] in patients >80.

Among those 211 patients, EBM at lumbar spine alone was found in 84% of cases (n=177), at both lumbar spine and femoral neck in 2% of cases (n=5) and at lumbar spine and total hip in only 1% of cases (n=2) (Figure 1). Elevated bone mass at the hip (femoral neck and/or total hip) was found in 8.5% of cases (n=18). "Diffuse" EBM (affecting the 3 sites) was found in 9 patients (4%).

Patient characteristics

Table 1 shows patients' socio-demographic and disease characteristics. The study included a group of 211 patients who were predominantly female (56%) and Caucasian (98%). Age (mean ± SD) was 63.9 ± 15.5 years. Most of the patients were overweight (33%) or obese (BMI ≥ 30kg/m²) (41%). The main reason for performing DXA scans was to screen for and treat postmenopausal, male or glucocorticoid-induced osteoporosis (n=125, 60%). DXA scans was also frequently performed to screen for and treat secondary osteoporosis in patients who had undergone transplantation (mostly kidney and liver) (n=25, 11%). Lastly, the reason for performing bone density tests was unknown in 19 patients (9%), despite a complete review of the medical records.

Causes of elevated bone mass

In a few patients, EBM was attributed to several causes, which explains the difference between the total number of causes (n=215) and the total number of patients (n=211) (Figure 2). Elevated bone mass was potentially attributed to artefactual causes in 75% of the patients (n=164). The cause was mainly degenerative disease of the spine (n=137, 63%) with or without another artefactual cause (scoliosis, DISH, vertebral fracture...) (Supplementary figure 1). Other artefactual causes were ankylosing spondylitis in 4 patients (Supplementary figure 2) and obesity (without osteoarthritis) in 8 patients (Supplementary figure 3). Moreover, "diffuse" EBM was found in 3 patients (patients with both hip and spine osteoarthritis) and associated with obesity in 2 of them.

An acquired cause of focal EBM was found in only 2 patients, both of whom had sclerotic bone metastases from prostate cancer at the lumbar spine.

An acquired cause of generalized EBM was found in 15% of the patients (n=32) identified as having EBM (n=215). The causes were renal osteodystrophy (n=11) (Supplementary figure 4) and hematological disorders (myeloproliferative syndromes (n=7), mastocytosis (n=1), and sclerotic multiple myeloma (n=1) (Supplementary figures 5 and 6)). Diffuse bone metastases from solid cancer were found in 5 patients (Supplementary figure 7). Other causes were hypoparathyroidism (n=2) (Supplementary figure 8), acromegaly (n=1), Erdheim-Chester disease (n=1) and Langerhans cell histiocytosis (n=1) (Supplementary figure 9). In 2 patients, after examination of the DXA scan reports and images and medical records, we concluded that hepatic cirrhosis was the cause of generalized EBM. The first patient was a 62 year-old woman (BMI 29 kg/m 2 ) with hepatocellular carcinoma secondary to alcoholic cirrhosis (Supplementary figure 10). She had already undergone chemoembolization of the liver and Moreover, "diffuse" EBM was found in 5 patients as described above. In those patients, EBM was associated with mastocytosis (n=1), myelofibrosis (n=3), and hepatocellular carcinoma secondary to alcoholic cirrhosis (n=1).

A genetic cause was found in 9 patients (Table 2). Causes were autosomal recessive osteopetrosis (carbonic anhydrase II deficiency syndrome) with "diffuse" EBM (n=1) (Supplementary figure 11), X-linked hypophosphatemia (n=1), GATA-binding protein 3 mutation associated with hypoparathyroidism (n=1) and type 1A pseudohypoparathyroidism (n=1). Moreover, two patients were identified with lipodystrophic syndrome (no mutation identified) (Supplementary figure 12), and three patients with type 1 myotonic dystrophy (Steinert's disease) with no other identifiable cause of EBM (Supplementary figure 13).

In 8 patients, the cause of EBM was unknown, even after a careful review of their medical records, but 4 of them had hepatic abnormalities (hepatitis-C negative patients) (Table 3).

DISCUSSION

In this retrospective study conducted at a single university hospital catering to a population of 5.9 million inhabitants, the prevalence of EBM, determined using a Z-score threshold of ≥ +4 at any one of the measurement sites, was found to be 1.43% [1.25%-1.64%]. The prevalence of EBM was higher in men and in older age groups. The main causes of EBM were degenerative disease of the spine, followed by generalized acquired causes including renal osteodystrophy, haematological disorders (e.g. myeloproliferative syndromes, mastocytosis…) and diffuse bone metastases from solid cancer. Other causes were rare hereditary diseases, some of which were expected (e.g., osteopetrosis, X-linked hypophosphatemia, hypoparathyroidism and pseudohypoparathyroidism) while others were not (Steinerts's disease and Lipodystrophic syndrome). In 8 patients (3.8%), the cause of EBM could not be determined (unknown cause), even after a careful review of their medical records.

To the best of our knowledge, there is only one population-based study on the prevalence of (26) in a study on patients with EBM due to LRP5 mutations. In that study, the authors reported that the hip and lumbar spine Z-scores of patients with LRP5 mutations exceeded +4.

Using this value as a threshold for Z-and T-scores in their study, Gregson C. et al. found that 0.42% of the T-and/or Z-scores in their Hologic® population were ≥ +4. As such, there is a difference between the prevalence of EBM reported in that study and the prevalence of EBM found at Lille University Hospital (0.42% versus 1.43%). One explanation for this difference may be related to the fact that the prevalence in the UK study was calculated based on the number of BMD scans performed and not on the number of patients. The difference may also reflect a centre effect since Lille University Hospital is a tertiary centre that caters for a population of 5.9 million inhabitants and recruits patients with specific characteristics (liver and kidney transplantation, rare metabolic diseases, etc.). Moreover, we decided to define EBM in terms of Z-score alone to avoid the trap of T-scores. Indeed, information can be divergent when using T-as well as Z-scores, especially in elderly individuals. And T-scores are irrelevant and misleading when assessing EBM, while Z-scores tell us how far away the individual is from the mean in an age and gender matched population.

Furthermore, in our study, we found that about 75% of the causes of EBM were artefactual, compared to 54% in the study conducted by Gregson et al., even though we used the same classification for artefactual etiologies (with degenerative disease of the spine accounting for 63% of the artefactual causes of EBM in our study vs. 49% in the UK study). The higher number of artefactual causes could also explain the higher prevalence of EBM in our study, in which more BMD tests were carried out at osteosynthesis sites (approximately 6% in our study vs. 1.7%). Among the artefactual causes, the most common cause was degenerative disease of the spine. It is also important to note that there was a high proportion of overweight (33.2%) and obese (41.2%) patients in our population. The mean BMI of patients with EBM in the study conducted by Gregson et al.

(2) was also high (mean BMI: 31.0 kg/m²). The association between high BMI and EBM has been previously reported (13,27). Indeed, the increase in mechanical stresses related to increased weight could lead to an increase in bone formation. Finally, there are limits to the interpretation of BMD in obese patients due to the measurement technique itself. As DXA is based on the differential attenuation of X-rays by the different tissues in the body, it could indicate an artefactual increase in BMD related to the interposition of fat tissue, particularly at the hip.

Generalized acquired causes were the second most frequent cause of EBM (11%). Among these causes, several have already been reported in the literature in case reports and case series (renal osteodystrophy (6), sclerotic multiple myeloma (10), primary and secondary myelofibrosis (8), mastocytosis (9)...). More than half of the patients with "diffuse" EBM in our cohort were in this group. In our study, we found 2 cases of patients with hepatic cirrhosis associated with EBM without any other identified cause of EBM. It is generally accepted that hepatic cirrhosis is associated with osteoporosis. However, hepatitis C has been reported to be associated with EBM in several case reports, and while the underlying pathophysiological mechanisms remain largely unknown (11,12), insulin-like growth factor system abnormalities have been reported in hepatitis C-associated osteosclerosis (12). We can speculate that these pathophysiological mechanisms are not specific to hepatitis C and that hepatic cirrhosis could also be rarely associated with EBM due to the same mechanisms. Additionally, among those patients in our study with an unknown cause of EBM, 4 had liver disease, including hepatic cirrhosis. Our results need to be confirmed in another cohort of patients.

In our study, genetic causes of EBM were quite rare. Indeed, we found only one case of osteopetrosis associated with a mutation of the carbonic anhydrase II gene (28). We also

Study strengths and weaknesses

We acknowledge that there are several limitations to this study. Since the study was hospitalbased (rather than population-based), our findings cannot be extrapolated to other populations.

Moreover, as the data was from a tertiary centre, they may not be representative of the population as a whole. A major limitation of this type of study, which is inherent to the retrospective and observational character of the cohort, is missing data. For some patients, the cause of EBM was classified as unknown simply because no data (e.g. scans, medical records…) were available. However, as all cases of EBM were reviewed by two rheumatologists with experience in the field of bone disease, and particularly EBM, we were able to determine the cause of EBM in practically all of the patients (96.2%

CONCLUSION

Elevated bone mass is a relatively common feature and can have a considerable number of causes, which can often be determined after careful review of DXA scan reports and images.

In this study, we found that the main cause of EBM was degenerative disease of the spine.

However, our findings suggest that generalized acquired and genetic causes are also possible.

Further studies are required to corroborate these findings. A multi-centre French study is currently under way and it is hoped that it will confirm or refute those causes found in our study that have hitherto not been described (e.g., liver cirrhosis) or poorly described (e.g., Steinert's disease and lipodystrophies). However, studies on selectively targeted patient populations (e.g., liver transplantation patients, or patients with Steinert's disease or lipodystrophy syndromes) are needed to confirm or refute certain causes found to be associated with EBM in our study. Ultimately, high bone mass genetic panels could be undertaken after exclusion of well-known causes by chart and radiographic review, in the few remaining patients.

  1 st , 2008 to April 30th, 2018. All of the patients were adults (age ≥18 years) who had successfully undergone at least one DXA scan to determine BMD. During the study period, two Hologic© scanners were available at Lille University Hospital (HOLOGIC Discovery A S/N 81360 and HOLOGIC Horizon W S/N 300869M). The study protocol was approved by the local Institutional Review Board (n° DEC2018-349), and the study procedures complied with the Helsinki Declaration of 1975, as revised in 2000.

  Identified causes fell into the following 4 categories, as proposed by Gregson et al. (2) and Paccou et al. (3): (i) artefactual causes, comprising degenerative disease of the spine with or without scoliosis, vascular calcifications, syndesmophytes, DISH, and implanted material (e.g., vascular prosthesis or vertebroplasty); (ii) acquired causes of focal EBM, comprising sclerotic bone metastases (e.g., from prostate or breast cancer), Paget's disease, and fibrous dysplasia of bone; (iii) acquired causes of generalized EBM, comprising excessive intake of fluoride, renal osteodystrophy, endocrine causes (e.g., chronic hypoparathyroidism, pseudo-hypoparathyroidism…), diffuse bone metastases from solid cancer, hematological disorders (such as mastocytosis, myeloproliferative syndromes, leukaemia, lymphoma, and the very rare cases of sclerotic multiple myeloma), hepatitis C, and obesity (body mass index ≥ 30); (iv) genetic causes, comprising osteopetrosis, sclerosteosis, Van Buchem's disease and LRP5/LRP6 mutations.Statistical analysisData were analysed using SAS software (version 9.4; SAS Institute Inc., Cary, NC).Categorical variables were expressed as numbers (percentages). EBM rates in the overall population and in the population stratified by gender and age group(< 40; [40, 60[; [60, 80[and ≥ 80 years) were estimated with 95% confidence intervals (exact Clopper-Pearson method). EBM rates were compared between genders using a Chi-square test, and between age groups using the Cochran-Armitage test. Statistical testing was performed at the 2-tailed α level of 0.05.

  was awaiting a liver transplant (Femoral neck T-score= +3.4 and Z-score= +4.8; Total hip T-score= +3.0 and Z-score= +4.0; Lumbar spine T-score= +6.0 and Z-score= +6.2). The second patient was a 51 year-old woman (BMI 29 kg/m 2 ) with alcoholic cirrhosis, who had already had a liver transplant. Elevated bone mass was found at the lumbar spine both before and after the transplant (Femoral neck T-score= 0.0 and Z score= +0.9; Total hip T-score= 0.0 and Z-score= +0.4; Lumbar spine T-score= +3.6 and Z score= +4.0).

  EBM. In that ambispective study, conducted in the UK by Gregson C. et al (2), the authors retrospectively analysed the BMD data (Hologic® and Lunar®) from 13 sites across the UK, and conducted a prospective analysis of data from 2 other sites. Overall, they examined a total of 335,115 DXA scans. The Z-score threshold of ≥ +4 was initially described by Little et al.

Figure 1 :Figure 2 :

 12 Figure 1: Number of patients with a T-and/or Z-score ≥ +4 according to studied site

  found 3 cases of Steinert's disease. To the best of our knowledge, this is the first time that an association has been reported between Steinert's disease and EBM. Steinert's disease, which is also known as type 1 muscular dystrophy, is an autosomal dominant disorder. It is the most common form of muscular dystrophy in adults and is characterized by a variable phenotype and the involvement of several organs (muscle deficit, heart disorders, cataracts, early baldness, endocrine disorders including hypogonadism and glucose tolerance disorders). Bone impairment in this disease has not been extensively studied. In the only study we found in the literature, the authors compared brain CT scans and lumbar-spine and hip BMDs in 16 patients with Steinert's disease versus 20 controls matched for age and sex (29). They reported hyperostosis of the skull and higher lumbar-spine BMD in patients with Steinert's disease compared to controls. Furthermore, a recent study suggests that BMD parameters are different between type 1 and 2 muscular dystrophy (MD). In that study, patients with type 1 MD were found to have higher total body, lumbar-spine, pelvis, arm and leg BMDs than patients with type 2 MD and age-matched healthy controls (30). These findings need to be confirmed in a large cohort of patients with Steinert's disease, in which bone health assessments -including BMD and bone remodelling markers -are systematically performed. In our study we also found 2 cases of EBM associated with lipodystrophic syndrome. This group of diseases is usually associated with a phenotype characterized by an abnormal distribution of body fat and a dysmetabolic profile with insulin resistance. Many mutations associated with these abnormalities have been identified, and some of them have been reported to be associated

with bone impairment. Thus, in a study conducted by Lima et al. (31), the authors investigated biological and BMD parameters in a cohort of 21 patients with Berardinelli-Seip syndrome. Berardinelli-Seip syndrome, which is also known as congenital generalized lipodystrophy (CGL), is an autosomal recessive disorder which is classified into 4 different subtypes based on specific genetic mutations (32,33). The authors reported that 12 patientsmainly with type 2 CGL, i.e. a mutation in the BSCL2 gene -had a Z-score ≥ +2.5 at least at one site.

  ). Moreover, scans and biological assessment were available for most of the patients. Finally, bone assessments were based on DXA alone, without data on bone microarchitecture or fractures history. DXA has its limitations in that it measures only areal BMD. Indeed, DXA scanners generate 2D images of complex 3D structures, and report bone density as the quotient of bone mineral content and bone area. An obvious pitfall of this method is that a larger bone would indicate superior strength, but may in fact have the same bone density as a smaller bone. Other imaging techniques are available such as peripheral quantitative CT (pQCT) or high resolution peripheral quantitative CT (HRpQCT), but are largely research tools. Furthermore, DXA BMD does not differentiate whether the variation in BMD arises from differences in cortical mass, trabecular mass, or external bone size. Finally, DXA is a widely used, useful and robust tool.

Table 1 : Patients' socio-demographic and disease characteristics

 1 Values are expressed as mean (standard deviation) or numbers (percentage).

	Characteristics	N=211
	Women	119 (56)
	Age, years	63.9 (15.5)
	Age groups
	-<40	15 (7)
	-40-59.9	58 (28)
	-60-80	110 (52)
	->80	28 (13)
	Body Mass Index, kg/m²
	-BMI < 20 kg/m²	8 (4)
	-20 ≤ BMI < 25kg/m²	42 (20)
	-25 ≤ BMI < 30 kg/m²	70 (33)
	-BMI ≥ 30 kg/m²	87 (41)
	-NC	4 (2)
	Cause of referral
	-Post-menopausal osteoporosis	59 (28)
	-Male osteoporosis	35 (17)
	-Glucocorticoids-induced osteoporosis	31 (15)
	-Kidney transplantation	14 (6)
	-Liver transplantation	11 (5)
	-Other	42 (20)
	-Unknown	19 (9)

University and/or hospital. These funding organizations did not suggest the subject of this study, and did not have access to the results before publication. This study received funding from the French Rheumatology Society.

Conflict of interest statement: