Nuala ; Sheehan

M Wolfson

Wallace Se

Sheehan Na

Tobin Md

Knoppers Bm

Burton Pr

Professor Paul Burton

Keywords: Pooling, Meta-analysis, Generalized linear model (GLM), ethicolegal, ELSI, bioinformatics

Background

Contemporary bioscience sometimes demands vast sample sizes and there is often then no choice but to synthesise data across several studies and to undertake an appropriate pooled analysis. This same need is also faced in health-services and socio-economic research. When a pooled analysis is required, analytic efficiency and flexibility are often best served by combining the individual-level data from all sources and analysing them as a single large data set. But ethico-legal constraints, including the wording of consent forms and privacy legislation, often prohibit or discourage the sharing of individual-level data, particularly across national or other jurisdictional boundaries. This leads to a fundamental conflict in competing public goods: individual-level analysis is desirable from a scientific perspective, but is prevented by ethico-legal considerations that are entirely valid.

Methods

DataSHIELD (Data Aggregation Through Anonymous Summary-statistics from Harmonized Individual-levEL Databases), provides a simple approach to analysing pooled data that circumvents this conflict. This is achieved via parallelized analysis and modern distributed computing and, in one key setting, takes advantage of the properties of the updating algorithm for generalized linear models (GLMs).

Results

The conceptual use of DataSHIELD is illustrated in two different settings.

Conclusions

As the study of the aetiological architecture of chronic diseases advances to encompass more complex causal pathwayse.g. to include the joint effects of genes, life-style and environmentsample size requirements will increase further and the analysis of pooled individual-level data will become ever more important. An aim of this conceptual paper is to encourage others to address the challenges and opportunities that DataSHIELD presents, and to explore potential extensions, for example to its use when different data sources hold different data on the same individuals.

INTRODUCTION

Most known associations between genetic variants and chronic diseases reflect weak effects with typical allelic odds ratios in the range 1.1-1.4. [START_REF] Burton | Size matters: just how big is BIG?: Quantifying realistic sample size requirements for human genome epidemiology[END_REF][START_REF] Zondervan | Designing candidate gene and genome-wide case-control association studies[END_REF][START_REF] Spencer | Designing genome-wide association studies: sample size, power, imputation, and the choice of genotyping chip[END_REF] The reliable identification of such effects demands vast data sets. [START_REF] Burton | Size matters: just how big is BIG?: Quantifying realistic sample size requirements for human genome epidemiology[END_REF][START_REF] Zondervan | Designing candidate gene and genome-wide case-control association studies[END_REF][START_REF] Spencer | Designing genome-wide association studies: sample size, power, imputation, and the choice of genotyping chip[END_REF][START_REF] Collins | The case for a US prospective cohort study of genes and environment[END_REF][START_REF] Khoury | The case for a global human genome epidemiology initiative[END_REF] Case-control studies including thousands of cases are required even when interest focuses on the simplest situation: the detection of the direct effects of SNP variants. [START_REF] Burton | Size matters: just how big is BIG?: Quantifying realistic sample size requirements for human genome epidemiology[END_REF][START_REF] Zondervan | Designing candidate gene and genome-wide case-control association studies[END_REF][START_REF] Spencer | Designing genome-wide association studies: sample size, power, imputation, and the choice of genotyping chip[END_REF] Furthermore, when, as is likely, scientific emphasis starts to focus on the study of gene-environment and gene-gene interactions, and the exploration of causal pathways more comprehensively, tens of thousands of cases will often be required [START_REF] Burton | Size matters: just how big is BIG?: Quantifying realistic sample size requirements for human genome epidemiology[END_REF]. Tens of thousands of subjects can also be required to study a quantitative phenotype (e.g. measured blood pressure), because allelic effect sizes may be as small as 1/10 th of a standard deviation, or even less. [START_REF] Newton-Cheh | Common variants at ten loci influence QT interval duration in the QTGEN Study[END_REF][START_REF] Newton-Cheh | Eight blood pressure loci identified by genomewide association study of 34,433 people of European ancestry[END_REF][START_REF] Repapi | Genome-wide association study identifies five loci associated with lung function[END_REF] To achieve sample sizes as large as this, it is often necessary to pool data across multiple studies, and large collaborative consortia have been responsible for much of the recent progress in human population genomics [START_REF] Newton-Cheh | Common variants at ten loci influence QT interval duration in the QTGEN Study[END_REF][START_REF] Hindorff | Potential etiologic and functional implications of genome-wide association loci for human diseases and traits[END_REF][START_REF] Burton | Association scan of 14,500 nonsynonymous SNPs in four diseases identifies autoimmunity variants[END_REF][START_REF] Newton-Cheh | Genome-wide association study identifies eight loci associated with blood pressure[END_REF][START_REF] Zeggini | Replication of Genome-Wide Association Signals in U.K. Samples Reveals Risk Loci for Type 2 Diabetes[END_REF][START_REF] Frayling | A Common Variant in the FTO Gene Is Associated with Body Mass Index and Predisposes to Childhood and Adult Obesity[END_REF][START_REF] Easton | Genome-wide association study identifies novel breast cancer susceptibility loci[END_REF][START_REF] Scott | A genome-wide association study of type 2 diabetes in Finns detects multiple susceptibility variants[END_REF][START_REF] Stacey | Common variants on chromosomes 2q35 and 16q12 confer susceptibility to estrogen receptor-positive breast cancer[END_REF][START_REF] Saxena | Genome-wide association analysis identifies loci for type 2 diabetes and triglyceride levels[END_REF] Large-scale data pooling is equally important in other settings too: in main stream epidemiology [START_REF] Friedenreich | Methods for pooled analyses of epidemiologic studies[END_REF] -particularly in the analysis of formal networks of studies [START_REF] Slimani | Structure of the standardized computerized 24-h diet recall interview used as reference method in the 22 centers participating in the EPIC project[END_REF][START_REF] Harris | Ethical issues and GenomEUtwin[END_REF] -in public health and health-services research, and in comparative international analysis in the social sciences, including coordinated economic surveillance [START_REF] Lynch | Is Income Inequality a Determinant of Population Health? Part 1. A Systematic Review?[END_REF][START_REF] Backlund | Income inequality and mortality: a multi-level prospective study of 521, 248 individuals in 50 US States[END_REF]. Such pooling not only supports the attainment of large sample sizes but can also be used to reduce bias arising from access to a restricted subset of data. But, regardless of its purpose, the sharing of data always raises important ethico-legal issues even when the analysis is mutually agreed. Data privacy, for example, is a hot topic in genomic epidemiology, [START_REF] Sankararaman | Genomic privacy and limits of individual detection in a pool[END_REF][START_REF] Homer | Resolving individuals contributing trace amounts of DNA to highly complex mixtures using high-density SNP genotyping microarrays[END_REF] as well as being a concern for government, industry, [START_REF] Gomatam | Data Dissemination and Disclosure Limitation in World Without Microdata: A Risk-Utility Framework for Remote Access Analysis Servers Statistical[END_REF][START_REF] Karr | Secure, Privacy-Preserving Analysis of Distributed Databases[END_REF] the media, and even the general public. [START_REF] Gcnews | Health beats MoD on equipment losses[END_REF] Biomedical science has responded cautiously to these concerns, ensuring that all ethico-legal stipulations are met and that new issues are dealt with carefully, as and when they arise. [START_REF] Homer | Resolving individuals contributing trace amounts of DNA to highly complex mixtures using high-density SNP genotyping microarrays[END_REF][START_REF] P3g_Consortium | Public Access to Genome-Wide Data: Five Views on Balancing Research with Privacy and Protection[END_REF] Given this caution, it is perhaps surprising that there has been such striking recent progress in detecting genetic associations with complex diseases: [START_REF] Spencer | Designing genome-wide association studies: sample size, power, imputation, and the choice of genotyping chip[END_REF][START_REF] Manolio | A HapMap harvest of insights into the genetics of common disease[END_REF] "in the past three years genome-wide association studies (GWAS) .... have reproducibly identified

F o r R e v i e w O n l y
hundreds of associations of common genetic variants with over 80 diseases and traits (http://www.genome.gov/gwastudies)" [START_REF] Hindorff | Potential etiologic and functional implications of genome-wide association loci for human diseases and traits[END_REF]. But, in one sense, genomic epidemiology has been fortunate. The class of pooled analysis that has underpinned many of the recent successes, [START_REF] Newton-Cheh | Common variants at ten loci influence QT interval duration in the QTGEN Study[END_REF][START_REF] Hindorff | Potential etiologic and functional implications of genome-wide association loci for human diseases and traits[END_REF][START_REF] Burton | Association scan of 14,500 nonsynonymous SNPs in four diseases identifies autoimmunity variants[END_REF][START_REF] Newton-Cheh | Genome-wide association study identifies eight loci associated with blood pressure[END_REF][START_REF] Zeggini | Replication of Genome-Wide Association Signals in U.K. Samples Reveals Risk Loci for Type 2 Diabetes[END_REF][START_REF] Frayling | A Common Variant in the FTO Gene Is Associated with Body Mass Index and Predisposes to Childhood and Adult Obesity[END_REF][START_REF] Easton | Genome-wide association study identifies novel breast cancer susceptibility loci[END_REF][START_REF] Scott | A genome-wide association study of type 2 diabetes in Finns detects multiple susceptibility variants[END_REF][START_REF] Stacey | Common variants on chromosomes 2q35 and 16q12 confer susceptibility to estrogen receptor-positive breast cancer[END_REF][START_REF] Saxena | Genome-wide association analysis identifies loci for type 2 diabetes and triglyceride levels[END_REF] just happens to be consistent with the ethico-legal frameworks that large-scale bioclinical studies have had in place over many years. That is, most such studies are permitted to take part in collaborative GWAS based on study-level meta-analysis. [START_REF] Sutton | Meta-analysis of individual-and aggregate-level data[END_REF][START_REF] Petitti | Meta-analysis, decision analysis, and cost-effectiveness analysis: methods for quantitative synthesis in medicine[END_REF] Here, investigators from each study perform a separate GWAS, and then share the association statistics for each SNP with a designated analysis centre (AC); but the raw data encoding SNP and disease status are not shared. [START_REF] Newton-Cheh | Common variants at ten loci influence QT interval duration in the QTGEN Study[END_REF][START_REF] Newton-Cheh | Eight blood pressure loci identified by genomewide association study of 34,433 people of European ancestry[END_REF][START_REF] Zeggini | Replication of Genome-Wide Association Signals in U.K. Samples Reveals Risk Loci for Type 2 Diabetes[END_REF] The AC then performs a meta-analysis to estimate the genetic associations across the consortium as a whole. But, bioscience will inevitably move on from its current focus on simple associations between genetic variants and disease-related traits, to explore causal pathways more thoroughly: e.g. by incorporating gene-environment interactions. This will increase sample size requirements further,(1) making data pooling yet more essential. In addition, data analysis will become increasingly unpredictable and, therefore, exploratory. For example, in a conventional metaanalysis-based GWAS it is clear a-priori that each study must generate summary statistics to reflect the association of the disease of interest with each of a large number of designated SNPs (e.g. one million). This is onerous but it can be pre-specified ahead of time. The required set of summary statistics is far more difficult to predefine if the analysis is to involve gene-environment interactions; environmental and life-style factors may be parameterized in many different ways, and identification of the appropriate parameterization often demands initial exploratory analysis.

Analytic and ethico-legal considerations

Large scale statistical pooling is typically achieved in one of two ways. [START_REF] Sutton | Meta-analysis of individual-and aggregate-level data[END_REF][START_REF] Petitti | Meta-analysis, decision analysis, and cost-effectiveness analysis: methods for quantitative synthesis in medicine[END_REF] First, the individual level data from each of the original data-sources can be aggregated to produce one combined data set. This is then analysed as if it were generated by a single study, though study-to-study heterogeneity may necessitate the inclusion of study-specific model terms. This approach may be called individual-level meta-analysis (ILMA). Second, appropriate summary statistics can be generated from separate analyses carried out on each independent study, and these then pooled in a study-level meta-analysis (SLMA). SLMA is quick and convenient when based on summary statistics that already exist or can be easily derived de novo. It is therefore the approach to meta-analysis that is often adopted in public health research, the meta-analysis of randomised controlled trials and, recently, in the pooling of GWAS studies. [START_REF] Newton-Cheh | Common variants at ten loci influence QT interval duration in the QTGEN Study[END_REF][START_REF] Newton-Cheh | Eight blood pressure loci identified by genomewide association study of 34,433 people of European ancestry[END_REF][START_REF] Repapi | Genome-wide association study identifies five loci associated with lung function[END_REF][START_REF] Sutton | Meta-analysis of individual-and aggregate-level data[END_REF][START_REF] Petitti | Meta-analysis, decision analysis, and cost-effectiveness analysis: methods for quantitative synthesis in medicine[END_REF][START_REF] Khoury | On the synthesis and interpretation of consistent but weak gene-disease associations in the era of genome-wide association studies[END_REF] But, it has important limitations. First, although it is very convenient to use summary statistics that are already in the public domain, it is important to recognise that they can be biased by selective reporting dependent on findings. In the field of genomic epidemiology this can be particularly problematic. [START_REF] Hattersley | What makes a good genetic association study?[END_REF] Second, even when summary statistics are derived de novo, SLMA can be restrictive. [START_REF] Petitti | Meta-analysis, decision analysis, and cost-effectiveness analysis: methods for quantitative synthesis in medicine[END_REF] The analysis of all but the simplest of biomedical problems demands a significant element of exploration, but analysis in a conventional SLMA is unavoidably restricted to questions that can be addressed using the particular set of summary statistics that was initially requested. [START_REF] Petitti | Meta-analysis, decision analysis, and cost-effectiveness analysis: methods for quantitative synthesis in medicine[END_REF] If an important new question arises, it can only be answered if the investigators are all prepared to produce the new summary statistics that are required. This can cause serious delays.

In consequence, ILMA would often be preferred to SLMA. But, ILMA raises major ethico-legal challenges. Most notably the sharing of individual level data, sometimes termed 'microdata', [START_REF] Gomatam | Data Dissemination and Disclosure Limitation in World Without Microdata: A Risk-Utility Framework for Remote Access Analysis Servers Statistical[END_REF] may be prohibited in law. In many jurisdictions individual level data are treated as being fundamentally different to aggregate data, and some individual-level data cannot cross certain national boundaries. [START_REF] Kaye | Do we need a uniform regulatory system for biobanks across Europe?[END_REF] Even when sharing is legal, it may be proscribed by the consents and ethical approvals under which the data were initially collected. [START_REF] Zink | Ethical and legal constraints on data sharing between countries in multinational epidemiological studies in Europe report from a joint workshop of the European League Against Rheumatism standing committee on epidemiology with the "AutoCure" project[END_REF] And, even whenin principle -microdata can be shared, that sharing can demand protracted applications for access via scientific oversight committees and ethical review boards. [START_REF] Malfroy | Using patient-identifiable data for epidemiological research[END_REF][START_REF]Infectious Diseases Society of America. Grinding to a Halt: The Effects of the Increasing Regulatory Burden on Research and Quality Improvement Efforts[END_REF] But these barriers are there for a good reason; the relevant ethico-legal considerations reflect important values held by many societies. Individual level data can disclose identity,(25) they may be highly sensitive [START_REF] Gomatam | Data Dissemination and Disclosure Limitation in World Without Microdata: A Risk-Utility Framework for Remote Access Analysis Servers Statistical[END_REF] and they may yield unexpected national governments and even study participants might feel wary about passing on to a third party. [START_REF] Homer | Resolving individuals contributing trace amounts of DNA to highly complex mixtures using high-density SNP genotyping microarrays[END_REF] The fundamental importance of these issues is indicated by the fact that they are addressed by the ethico-legal and governance provisions of almost all major bioclinical studies. To illustrate, Box 1 provides exemplar language(38) from the ethico-legal documentation of a number of international biobanks and cohort studies, and from the Model Consent Form prepared by P 3 G (the Public Population Project in Genomics [START_REF] Knoppers | The Public Population Project in Genomics (P3G): a proof of concept?[END_REF]). The quotes are not ascribed to particular studies because anonymity was guaranteed as part of the formal agreement under which this ethico-legal documentation was originally shared with P 3 G.

Resolving a real conflict between 'competing public goods'

Although ILMA offers many advantages in terms of analytic flexibility, [START_REF] Sutton | Meta-analysis of individual-and aggregate-level data[END_REF][START_REF] Petitti | Meta-analysis, decision analysis, and cost-effectiveness analysis: methods for quantitative synthesis in medicine[END_REF] it is therefore clear that ethico-legal restrictions on the transfer of individual level data to third parties mean that a conventional ILMA approach is often impractical. Since this conflict in 'competing public goods' was identified, it has been discussed extensively by the international biobanking community; for example, in forums provided by P 3 G (the Public Population Project in Genomics), PHOEBE (Promoting Harmonization of Epidemiological Biobanks in Europe) and BBMRI (Biobanking and Biomolecular Resources Research Infrastructure). These discussions have led to the rapid evolution of a novel approach to analysis that could, in theory, circumvent the conflict identified. The proposed approach is named DataSHIELD (Data Aggregation Through Anonymous Summary-statistics from Harmonized Individual levEL Databases). This conceptual article describes the approach proposed, demonstrates that it works in theory, explores its potential uses and extensions, and discusses some of the challenges to be faced in implementing it. It is our hope that by sharing the concept with the broader research community, we will encourage others to work with us in undertaking a pilot implementation.

F o r R e v i e w O n l y

METHODS

The conceptual underpinning of DataSHIELD is straightforward. Modern distributed computing is used to realise the full benefits of ILMA without physically sharing any individual-level data. All data remain on the local computers at their studies of origin and the role of the analysis centre is to coordinate a parallelized analysis of the individual-level data on all of those local computers simultaneously. Critically, the parallelized analysis is so framed that the only information passing back and forth between computers consists of short blocks of computer code specifying the next analysis required, and low dimensional summary statistics used in estimating the mathematical parameters of the model (e.g. means or regression coefficients). These items disclose neither the identity, nor the characteristics, of individual study participants.

Figure 1 provides a schematic representation of the class of analytic problems that DataSHIELD is aimed at addressing; here, data are distributed across six sources. The aim is to estimate the statistical parameters that characterise the relationship between an outcome variable Y and one or more explanatory variables X. Here the data are horizontally partitioned(26): i.e. each data set includes all of the variables (X and Y) but on different sets of individuals. A classical ILMA would involve stacking the data matrices from each study to produce one large data matrix (Figure 1a). Under DataSHIELD (Figure 1b), on the other hand, a series of parallel analyses are undertaken simultaneously -using X j and Y j in the j th study -and these analyses are synthesised in an appropriate manner to generate estimates pertaining to all six studies simultaneously.

Figure 2 provides a schematic representation of the type of IT infrastructure that might typically be required to undertake a DataSHIELD analysis. The computers on which the individual-level data reside at each of the six centres are coloured yellow. One centre is designated the analysis centre (AC) and it is a computer (red) at that centre that is used to coordinate and execute the analysis.

Often, the AC will be one of the studies that are contributing data to the analysis. The analysis

F o r R e v i e w O n l y
software/middleware in DataSHIELD will require two primary components: (1) a master process (MP) that resides on the coordinating computer at the AC; and (2) a series of slave processes (SPs) each residing on the local data computers. This structure will enable analytic subroutines to be written by the AC, and then transmitted and activated in a suitable software environment (e.g. in 'R' [START_REF]R: A Language and Environment for Statistical Computing[END_REF]) on each of the data computers. As an analytic session proceeds, the analysis will evolve and the algorithm that is active on each SP will therefore change. It is the MP at the AC that will control which algorithms are running on which computers at which point in time.

EXAMPLE 1

Using DataSHIELD to enhance the flexibility of study level meta-analysis (SLMA)

Perhaps the simplest application of DataSHIELD might entail the replication of a conventional SLMA.

To illustrate this setting, data have been simulated for six hypothetical studies (for details see supplementary materials -S1) that have assessed peripheral systolic blood pressure (SBP in mmHg -1 ) as a quantitative outcome variable and two explanatory covariates: AGE (years, centralized by subtracting the mean of 60 years); and SNP (a single nucleotide polymorphism coded 0,1 or 2, to reflect the number of copies of a minor allele). An illustrative analysis might involve fitting a multiple linear regression model to estimate a regression intercept (b intercept ) and regression coefficients b AGE and b SNP associated with the two covariates. Scientific interest might focus on b SNP to provide an ageadjusted estimate of the increase in SBP associated with each additional copy of the minor allele. If the parallelized analyses are to be undertaken in 'R', [START_REF]R: A Language and Environment for Statistical Computing[END_REF] the statistician at the AC might type the two lines of code at the top of Box 2. Using an appropriate scripting language such as Perl [START_REF] Wall | Programming Perl, Third Edition[END_REF] this code could be packaged and transmitted to each of the SPs where it could be piped to R to fit the required regression model on the local data set. This will generate a results matrix (3 rows, two columns) comprising an estimate and standard error for each regression coefficient (bottom Box 2).

Additional scripting instructions will then command each study to transmit its results matrix back to the AC. There the study-specific results can be pooled using an appropriate form of SLMA, to This DataSHIELD analysis, as outlined, is mathematically equivalent to a conventional SLMA, and all individual-level data remain secure on their computers of origin. But, the first stage (estimation of regression coefficients and standard errors) is controlled remotely by the AC, rather than being carried out by the investigators at each study independently, at the request of the AC. This difference is crucial, because it means that once the initial regression model (Box 2) has been fitted, it is easy to fit a different model that may contain terms for which summary statistics might not, originally, have been requested; for example, one containing an interaction between the AGE and SNP covariates. This would be impossible in a conventional SLMA unless this supplementary analysis had explicitly been pre-specified. This demonstrates that, in principle, DataSHIELD permits SLMA to be undertaken more flexibly. But it offers far more than this. Perhaps most crucially, it allows researchers to make efficient use of an important and versatile class of mathematical models in a manner that is mathematically identical to a full ILMA.

EXAMPLE 2

Using DataSHIELD to undertake individual-level meta-analysis (ILMA) without sharing the data Many important analyses in contemporary bio-population science can be framed as generalized linear models (GLMs). [START_REF] Mccullagh | Generalized linear models[END_REF] This broad class of models incorporates many forms of regressione.g. iteration depends solely on an information matrix and a score vector, both of which can be obtained by fitting a single iteration of the same GLM to the individual level data from each of the collaborating studies one at a time, and summing their overall equivalents. These are then used to update the regression coefficients at that iteration (43) (for details see supplementary materials -S2). The regression coefficients and standard errors that are obtained in this manner are identical to those that would be obtained by fitting the same GLM to the pooled individual data from all studies combined, but the AC never has access to the individual-level data.

RESULTS

The mathematics underpinning the IRLS algorithm guarantee that the DataSHIELD approach, as implemented in example 2, will produce the same results as fitting the equivalent GLM to the individual level data from all studies combined (for details, see supplementary materials -S2 and S4).

Box 3 provides a concrete example to confirm this claim. It outlines the analysis of a second simulated data set consisting of six hypothetical studies set up to investigate the relationship between the risk of acute myocardial infarction, body mass index (BMI) and a single nucleotide polymorphism (SNP). Full details of the simulation, analysis, computer code and results are provided in supplementary materials -S3-S6). In contrast to the simple model used in example 1, this GLM incorporates an interaction term to reflect heterogeneity in the magnitude of the increase in risk of myocardial infarction for a given increase in BMI.

As proof of principle, the estimated regression coefficients and standard errors reported at the bottom of Box 3 are precisely the same, rounding error aside, as those derived from a conventional logistic regression model fitted to a single data set comprising the individual level data from all six studies combined (Box 4). But (see Box 3 and supplementary materials -S3-S5), information flow between the data sources and the AC is restricted to: (1) repeated instructions from the AC to the (one matrix and one vector) passed back from each data computer to the AC at the end of each iteration; (3) the updated vector of regression coefficients -again non-disclosive -passed from the AC to the data computers at the start of each new iteration. None of these items is disclosive of identity or of sensitive information.

DISCUSSION

This paper demonstrates that if all ethico-legal and informatics challenges can be overcome then, in principle, DataSHIELD should enable a full pooled analysis of individual-level data from multiple sources to be undertaken, even when ethico-legal considerations might otherwise obstruct the physical sharing of that individual-level data. At present DataSHIELD is no more than a concept and there is a quantum leap between proving that the mathematics work and actually implementing the approach in practice. The principal challenges are in developing the IT systems required, in determining whether ethical review committees agree that there is a real problem to be solved and that DataSHIELD provides a workable solution to that problem, and in implementing the local infrastructures at individual biobanks and cohort studies (staff and equipment) to enable its use. These challenges are substantive and it might be argued that publication should await successful implementation. The European Union has recently awarded funding under Framework 7 (the BioSHARE-EU project) to enable preliminary work to develop and pilot the required IT systems and to explore the relevant ethico-legal and social issues. Given that the implementation work will now definitely take place, it is critical to enrol studies, as pilot sites, to work with us in implementing and trialling the method. Furthermore, the preliminary work will include exploring the fundamental problem with research ethics committees and determining whether they view DataSHIELD as a viable solution. We hope this paper will assist studies, biobanks and research ethics committees to determine whether they wish to contribute to such a project. Development to date has been undertaken by an international group that includes leading bioinformaticians and ethico-legal experts. On the basis of active discourse between these experts and the broader international biobanking community (via P 3 G and BBMRI), the prevailing viewpoint seems to be that there is a real problem to be overcome and that the fundamental challenges both in the IT and ethico-legal domains can, in principle, be overcome. For example, there is a broad consensus amongst ethico-legal experts that the physical sharing of individual level data between research groups must be subject to appropriate governance and that it is an inescapable fact that the formal documentation and oversight systems in certain studies (see Box 1) proscribes or discourages such sharing. The real challenge, therefore, is to explore whether DataSHIELD provides a workable solution. Bioinformaticians generally seem to believe that the IT interface should be set up in a manner that actively prevents the AC from tunnelling into the local systems to extract data or other information and/or from fitting models that reveal identifying or sensitive data either directly or by logical deduction. It is therefore commonly argued that the DataSHIELD interface should parse all incoming and outgoing messages and then block and record any request, or series of requests,(44) that might, by accident or design, lead to the transmission of inappropriate information. Encouragingly, it seems to be the view of most IT experts that an interface with these characteristics can, in principle, be constructed, and will be feasible to use in practice. This optimistic viewpoint is supported by the fact that secure single-site interfaces already exist allowing external users to specify analyses and then to extract results -but, crucially, no more than results. For example, such an interface is at the heart of the UK's ESRC Secure Data Service [START_REF]ESRC_Secure_Data_Service[END_REF]. Provided this optimism proves to be well founded, the majority view amongst ethico-legal and biobanking experts with whom DataSHIELD has been discussed seems to be that DataSHIELD might then be seen as being equivalent to conventional SLMA. This is because, in both settings, information flow between data providers and the analysis centre is restricted entirely to analytic instructions and nonidentifying summary statistics. If research ethics committees hold the same viewpoint, any study that is currently able to contribute to a conventional SLMA-based meta-analysis (including GWASs)

F o r R e v i e w O n l y
should, in principle, be permitted to make use of DataSHIELD, and the formal ethical and governance requirements should be equivalent. Ultimately, however, the only definitive proof that DataSHIELD will work and will be accepted by ethics review boards is to implement it for real -the publication of this conceptual paper is an important step towards that aim.

The mathematics underpinning DataSHIELD is neither novel, nor difficult to implement. [START_REF] Sutton | Meta-analysis of individual-and aggregate-level data[END_REF][START_REF] Petitti | Meta-analysis, decision analysis, and cost-effectiveness analysis: methods for quantitative synthesis in medicine[END_REF] [START_REF] Mccullagh | Generalized linear models[END_REF][START_REF] Aitkin | Statistical Modelling in GLIM[END_REF] For example, the fitting of a GLM requires no more than a partitioned modification of the conventional IRLS algorithm [START_REF] Mccullagh | Generalized linear models[END_REF][START_REF] Aitkin | Statistical Modelling in GLIM[END_REF] (see supplementary materials -S2-S5). Rather, the originality of the method lies in the basic concept itself. Interestingly, a similar idea has previously been floated in the technometrics literature [START_REF] Karr | Secure, Privacy-Preserving Analysis of Distributed Databases[END_REF], and although this means that we cannot claim precedence, it strengthens the academic foundation of the proposal. Critically, the approach seems not to have been noted by statisticians, bioinformaticians or ethicists working in the field of biomedical research and it has neither been promoted nor applied in this important domain. From a technical perspective, our implementation via GLMs might be viewed as a special case of what the technometrics paper refers to as "secure maximum likelihood estimation".(26) But, the maximum likelihood case is considered only in broad generality in that paper, and there is no specific focus on generalized linear models.(26) Furthermore, our implementation via GLMs circumvents some of the "complications" that the technometrics authors note could arise in the more general case. [START_REF] Karr | Secure, Privacy-Preserving Analysis of Distributed Databases[END_REF] Our article therefore brings an exciting and potentially important new concept to the attention of the biomedical research community, and illustrates the practical implementation of that approach via a broad class of models (GLMs) that already has a wide range of applications in bioscience.

The extensive discussion of DataSHIELD since its initial proposal has resulted in a number of important extensions to the concept. The first is to expand the remit of the approach to work with data sets that are vertically (26) rather than horizontally partitioned. In contrast to horizontal partitioning (Figure 1), under vertical partitioning the different data sources contain different data items on the same primary set of individuals. Such a scenario occurs commonly when a major cohort study, such as ALSPAC, links to secondary (often governmental) data sources to enrich the information that are available for analysis [START_REF] Ford | The SAIL Databank: building a national architecture for e-health research and evaluation[END_REF]. Critically, the data in such secondary sources are often sensitive and can be protected against misuse by prohibiting their physical release. This same problem arises regularly in cross-jurisdictional analyses being undertaken by, or overseen by, national statistics agencies such as Statistics Canada or Statistics UK. The mathematics underpinning the solution to the problem of vertical partitioning is "substantially more complex" [START_REF] Karr | Secure, Privacy-Preserving Analysis of Distributed Databases[END_REF] than that for horizontal partitioning but, in principle, a solution does exist in the form of an approach known as "secure matrix products" [START_REF] Karr | Secure, Privacy-Preserving Analysis of Distributed Databases[END_REF] . If this approach can successfully be implemented, this will markedly enhance the utility of the proposed DataSHIELD approach. The second extension that has been proposed is to take advantage of the approach to help bioscience deal with the pooled individual level analysis of data sets that cannot physically be shared, because of their vast physical size. As illustrative examples, such sources may include full genome sequence data or medical images on large numbers of subjects. Finally, we note that DataSHIELD can prove helpful in any meta-analytic setting where analysis at the level of individual patient records would be scientifically desirable, but ethico-legal considerations discourage ILMA. For example, a reviewer has noted that ILMA permits subgroups of subjects in a given study to be added or removed, which might be valuable when exploring the implications of an intention-to-treat analysis. Although care would have to be taken to ensure that such subgroups were not identified in a potentially disclosive manner, DataSHIELD could address this issue if the subgroups were appropriately flagged.

As an important aside, the genomics world is still grappling with the implications of the work of Homer et al, 2008. (24) A question that is regularly asked of DataSHIELD is whether it would protect against the form of inferential disclosure [START_REF] Gomatam | Data Dissemination and Disclosure Limitation in World Without Microdata: A Risk-Utility Framework for Remote Access Analysis Servers Statistical[END_REF] 24) cannot be invoked as being part of the rationale for controlling third party release of individual level data and, as a corollary, that these problems cannot be prevented by using DataSHIELD. But, this does raise an obvious follow-up question: "are there other circumstances where summary parameters can become identifying?" This is relevant, because DataSHIELD relies on the transmission of summary statistics that are assumed to be non-disclosive. One recognised form of inferential disclosure is termed residual disclosure. (44) Here, the differences between a series of closely related summary statistics -that are themselves non-disclosive -permit precise inferences to be drawn about identity and attribute. It is therefore clear that other scenarios do exist in which summary data can become identifying and some of these may be, as yet, unknown. This emphasises the importance of introducing DataSHIELD cautiously. Because the particular set of summary statistics to be transmitted will vary from one class of problem to another, the potential risk of disclosure will require thorough investigation whenever a new class of models is introduced. Some types of model, such as GLMs,(42) (43) are unlikely to be disclosive, not least because they are of low dimension: they typically have few parameters relative to the number of study participants. But the same may not be true of other models, such as those containing large arrays of random effects. [START_REF] Breslow | Approximate inference in generalized linear mixed models[END_REF] This latter might restrict the fitting of generalized linear mixed models(47) (for example by excluding models where there is a random effect for any single subject). On the other hand, it may prove possible to hold the random effects on the local data computers, while transmitting nondisclosive parameters such as the local variance of the random effects). This requires extensive methodological work, but is an area that we believe would be of considerable theoretical interest to many biostatistics research groups.

Regardless how data pooling is to be approached, two absolute criteria must always be fulfilled.

First, all ethico-legal stipulations must be met. This implies that if it is unclear whether the governance rules of a particular study permit DataSHIELD to be used, that uncertainty must be resolved before DataSHIELD is implemented on that study. Second, the data to be amalgamated across studies must be sufficiently similar to allow them to be pooled. Two data sets may be said to be harmonized for a given set of variables in a particular scientific setting, if it is valid and feasible to pool them in that setting. DataSHIELD should not be used unless the studies to be pooled are harmonized. This requires a formal judgement to be made, and methods and tools exist to help scientists make this judgement in relation to pre-existing studies: these include the DataSHaPER (www.datashaper.org) in population genomics and epidemiology, and the methods advocated by the Luxembourg Income Study (www.lisproject.org) in economics. In addition, it is critical that IT systems are set up so data can be worked on using DataSHIELD.

To finish, we reiterate that our aim in placing DataSHIELD into the public domain at this juncture is to further stimulate active discussion amongst ethico-legal experts, bioscientists, epidemiologists, biostatisticians, health services researchers, social scientists, national statistical offices, and IT professionals. It is our hope that interest generated by this article will encourage others to work alongside us in exploring the opportunities presented by this remarkably simple idea. If the key challenges can be identified and met -and there is no reason to believe that they cannot -DataSHIELD can provide an invaluable addition to the growing toolkit (www.P3G.org) that is facilitating the large-scale pooled analyses that are fundamental to current and future progress in contemporary biomedical and social science. A conventional logistic regression analysis (glm() in 'R') on pooled data from all six studies combined 100x35mm (300 x 300 DPI)

4 KEYWORDS

 4 a conflict in contemporary bioscience -performing a pooled analysis of individual-level data without sharing the data Pooling, analysis, meta-analysis, individual-level, study-level, generalized linear model, GLM, ethicolegal, ELSI, identification, disclosure, distributed computing, bioinformatics, information technology, IT AUTHOR CONTRIBUTIONS Original idea proposed by MW, and worked up as a basic concept in discussion with PB, IF and JL Development of the mathematical methods to underpin the approach: NM, PB, NS, GR Development of thinking in relation to IT implementation: MW, PL, VF, IF, PB Exploration of ethico-legal implications and challenges: BK, SW, MW, PB Exploration of implications for bioscience community including consortia: MT, PB Identification and consideration of extension to vertically partitioned data: JMac, MW, PB Preparation of early drafts: MW, PB Production of supplementary materials: PB, NM Production of final material for submission: PB, MW, NS, GR, BK, SW Reading, commenting upon, modifying and approving evolving manuscript and supplementary materials throughout preparation: ALL

  great practical or theoretical value, which the original investigators, funders,

  and standard errors for all six studies combined. This analysis is detailed in supplementary materials -S1.

  multiple linear regression; logistic regression; Poisson regression; and many types of survival analysis. It also subsumes numerous other analytic procedures including t-tests, analysis of variance and estimation based on contingency tables.[START_REF] Mccullagh | Generalized linear models[END_REF] GLMs are usually fitted iteratively using the Iteratively Reweighted Least Squares (IRLS) algorithm.[START_REF] Aitkin | Statistical Modelling in GLIM[END_REF] An initial guess at the required regression coefficients is progressively refined, over a number of iterations, until maximum likelihood estimates are obtained. Conveniently , in the present context, updating the coefficient estimates at any given

  execute each new iteration of the GLM; (2) non-disclosive summary statistics

  described and explored by Homer et al. The simple answer is 'no', because disclosure under Homer et al, is based on summary statistics reflecting study-wide genotype distributions at each of many SNPs and is therefore totally unrelated to the of individual-level data. This implies that the specific concerns raised by Homer et al(

Box 1 Figure 1 2 4 A

 1124 Figure 1

FUNDING

This work was supported as a core element of the research programs of P 3 G (the Public Population Project in Genomics) funded by Genome Canada and Genome Quebec, and PHOEBE (Promoting Harmonization of Epidemiological Biobanks in Europe) funded under European FP6 (LSHG-CT-2006-518418). The methodological program at the University of Leicester focusing on genetic statistics and large scale data harmonization and pooling is also supported by MRC Project Grant (G0601625), Wellcome Trust Supplementary Grant (086160/Z/08/A), Leverhulme Research Fellowship (RF/9/RFG/2009/0062), and the Leicester Biomedical Research Unit in Cardiovascular Science (NIHR). Nick Masca is funded by a British Heart Foundation Studentship (FS/06/040). Julian Little is a Canada Research Chair in Human Genome Epidemiology.


Carmen Bueno-Ferrer
email: carmen.bueno@ua.es

Alfonso Jiménez

Maria Del Carmen

M C Garrigós

other plasticizers in commercial lids for food packaging by gas chromatography-mass spectrometry

Keywords: Packaging -ESBO, Packaging plasticisers, Food contact materials, Migration Food Types: Baby food, Oils and fats, Vegetables epoxidized soybean oil, plasticizers, migration, validation, gas chromatography/mass spectrometry

Migration analysis of epoxidized soybean oil and other plasticizers in commercial lids for food packaging by gas chromatography-mass spectrometry

Introduction

Epoxidized soybean oil (ESBO) is a vegetable oil widely used as plasticizer and/or stabilizer for poly(vinyl chloride) (PVC) formulations used in food contact materials [START_REF] Lau | Contamination in food from packaging material[END_REF]Fankhauser-Noti et al. 2006;Duffy and Gibney 2007;Biedermann et al. 2008;[START_REF] Pedersen | Migration of epoxidized soybean oil (ESBO) and phthalates from twist closures into food and enforcement of the overall migration limit[END_REF]. These formulations have shown some applications, such as gaskets of lids for glass jars or in domestic films where PVC usually contains 35-45 wt% of plasticizer (Fankhauser-Noti et al. 2005a;Fankhauser-Noti and Grob 2006;Biedermann et al. 2008;[START_REF] Pedersen | Migration of epoxidized soybean oil (ESBO) and phthalates from twist closures into food and enforcement of the overall migration limit[END_REF]. ESBO, as well as some low molar mass plasticizers, such as acetyl tributyl citrate (ATBC), dioctyl adipate (DOA) or dibutyl sebacate (DBS), has grown during the last years as a valid alternative to phthalates, under discussion because of their potential toxicity to humans [START_REF] Rhee | Comparison of embryotoxicity of ESBO and phthalate esters using an in vitro battery system[END_REF]. ESBO shows relatively good compatibility with PVC, low toxicity to humans (BIBRA 1988;ECB 2000;EFSA 2004) and a biodegradable nature [START_REF] Choi | rules necessary for testing migration of the constituents of plastic materials and articles intended to come into contact with foodstuffs[END_REF][START_REF] Liu | Green" composites from renewable resources: Preparation of epoxidized soybean oil and flax fiber composites[END_REF][START_REF] Behera | Synthesis, characterization, and kinetics study of thermal decomposition of epoxidized soybean oil acrylate[END_REF][START_REF] Bouchareb | Effects of epoxidized sunflower oil on the mechanical and dynamical analysis of the plasticized poly(vinyl chloride)[END_REF][START_REF] Liu | Green" composites and nanocomposites from soybean oil[END_REF] However, its migration to foodstuff is still under study, in particular in high-fat foods (Fankhauser-Noti et al. 2005a;Fankhauser-Noti et al. 2006;Biedermann et al. 2008;[START_REF] Grob | Assurance of compliance within the production chain of food contact materials by good manufacturing practice and documentation -Part 3: Lids for glass jars as an example[END_REF].

ESBO is listed as an authorized substance according to food packaging materials legislation [START_REF] Pedersen | Migration of epoxidized soybean oil (ESBO) and phthalates from twist closures into food and enforcement of the overall migration limit[END_REF]European Commission 2002). The specific migration limit for ESBO is 60 mg kg -1 food simulant which corresponds to the overall migration limit (European Commission 2007). In this regulation, the European Commission lowered the ESBO migration limit to 30 mg kg -1 for infant food, since the tolerable daily intake (TDI) for 1 mg kg -1 body weight was often exceeded (EFSA 2004;EFSA 2006). 3 Several analytical methods were reported for the analysis of ESBO in PVC gaskets and food. Castle et al. (1988a;1988b) developed a specific method for analyzing ESBO in food that has been routinely used in further studies (EFSA 2004;Fankhauser-Noti et al. 2005a;Duffy and Gibney 2007). In this method, standards prepared from a commercial ESBO solution and fat extracts obtained from food samples were first transmethylated and then derivatized to form 1,3-dioxolane groups of the ESBO fatty acids. Dioxolanes provide stability to the epoxidized compounds, allowing optimization of the gas chromatographic separation from fatty acid methyl esters and shifting the mass spectra to higher and more selective masses [START_REF] Rothenbacher | Determination of epoxidized soybean oil by gas chromatography/single quadrupole and tandem mass spectrometry stable isotope dilution assay[END_REF]).

An internal standard (IS) was firstly epoxidized and fully derivatized in the same way as ESBO standards and it was used for quantification purposes. However, the synthesis of the IS was a long and complicated process involving a high number of analytical steps where the initial weight, epoxidation yield and purity of the product were not ensured (Fankhauser-Noti et al. 2005b). The same authors proposed a method where after transterification of epoxidized triglycerides, the methyl esters of diepoxy linoleic acid and two internal standards were isolated by HPLC and further transferred to a GC equipped with an FID. [START_REF] Suman | Liquid Chromatography-Electrospray Ionization-Tandem Mass Spectrometry Method for the Determination of Epoxidized Soybean Oil in Food Products[END_REF] developed a method for the analysis of ESBO in foodstuff based on reversed phase liquid chromatography interfaced with electrospray ion-trap tandem mass spectrometry (MS), which included a simple procedure for sample preparation with an extraction step and no further purification prior to the analysis. Biedermann-Brem et al. (2007) developed a method without prior extraction, using a polar GC column and detection by FID or MS for samples with interfering components. The main drawback of this method was the use of MS in chemical ionization mode (positive and negative ion monitoring), that is not commonly available in food control laboratories. [START_REF] Rothenbacher | Determination of epoxidized soybean oil by gas chromatography/single quadrupole and tandem mass spectrometry stable isotope dilution assay[END_REF] developed a method for the analysis of ESBO in food by GC/MS and GC/MS/MS using a stable isotope dilution from synthesized ethyl 9,10,12,13-diepoxyoctadecanoate by following the epoxidation method already described by Castle et al. (1988a). The aim of this work is to simplify these methods permitting easier and faster determinations of ESBO in PVC materials for food packaging. The work presents a modification of the method developed by Castle et al. (1988a;1988b) where the use of IS would be unnecessary. Moreover, some changes in the experimental method (transmethylation and synthesis of 1,3-dioxolane derivatives) and optimization of chromatographic conditions are proposed resulting in a considerable reduction in analysis time. This method was validated including evaluation on detection and quantification limits, linearity, working range, precision, accuracy and selectivity.

Finally, migration studies were carried out by applying this modified method to PVC-ESBO samples in two different food simulants as well as to commercial lids from nine different food jars, including baby food. Migration analysis in real samples was also carried out and other plasticizers such as ATBC, DOA and DBS were determined.

Experimental

Chemicals

Commercial ESBO was supplied by Traquisa S.L. (Barcelona, Spain). ATBC, DOA and DBS were purchased from Sigma-Aldrich (Madrid, Spain). PVC resin Lacovyl PB1172H with k value 67.0 was purchased from Atofina UK Ltd. (Cheshire, United Kingdom).

All chemicals were analytical grade unless specified otherwise. Metallic sodium, methanol (GC grade), sodium chloride and absolute ethanol were purchased from Panreac (Barcelona, Spain).

Cyclopentanone, boron trifluoride etherate and n-hexane (GC grade) were supplied by Merck (Darmstadt, Germany). 2,2,4-Trimethylpentane (iso-octane) and acetic acid were purchased from Fluka (Steinheim, Germany). Commercial virgin olive oil was used in specific migration tests for PVC-ESBO samples in contact with fat food. Water was distilled and passed through a Milli-Q Water System (Millipore, Bedford, MA, USA) prior to use. Sodium methoxide (NaOMe) 0.150 M solution was prepared by dissolving 3.406 g metallic sodium in methanol.

Methods

ESBO standards were obtained by transmethylation and synthesis of 1,3-dioxolane derivatives as shown in Figure 1. This procedure was performed in triplicate and it was based on Castle et al. method (1988b). Since the main goal of these modifications was to avoid the use of an IS, ESBO standards were prepared by weight. The three obtained stock solutions (65000 mg kg -1 ) were stored at -18 ºC. ESBO calibration standards for GC/MS analysis were prepared by appropriately dissolving each stock solution in n-hexane.

Unlike ESBO, other plasticizers such ATBC, DOA and DBS did not need previous derivatization for GC/MS analysis, due to their lower molar mass. A multi-standard plasticizer solution 1000 mg kg -1 in n-hexane was prepared for the migration study in commercial lids.

GC/MS Analysis

GC/MS analysis was carried out by using HP/Agilent Technologies 6890N (Palo Alto, CA, USA) gas chromatograph coupled to Agilent Technologies 5973N mass spectrometer operating in electronic impact (EI) ionization mode (70 eV). A DB-5MS capillary column (30 m x 0.25 mm I.D.

x 0.25 µm film thickness) (Teknokroma, Barcelona, Spain) and a split-splitless injector were used.

Helium was used as the carrier gas with 1 mL min -1 flow rate. Temperatures for injector and detector were 290 ºC and 300 ºC, respectively. For ESBO determination, the column temperature was programmed from 140 ºC (hold 2 min) to 300 ºC at 20 ºC min -1 heating rate (hold 10 min).

Samples (1 µL) were injected in the split mode (split ratio 1:40). Determination of derivatized epoxy fatty acids was performed by using selected ion monitoring (SIM) mode focused on m/z 309, by comparing chromatographic peak areas for migration extracts with those of standards in the same concentration range. Other ions used for identification were those with m/z 277, 367, 396, 465 and 494. For ATBC, DOA and DBS determination, the column temperature was programmed from 80ºC to 160 ºC at 30 ºC min -1 heating rate and from 160 ºC to 320 ºC at 15 ºC min -1 heating rate (hold 7 min). Samples (1 µL) were injected in the split mode (split ratio 1:25) and quantification of plasticizers was performed by using scan mode (50-550 m/z).

Specific migration study

PVC-ESBO samples

For the migration study, PVC samples with known amounts of ESBO were prepared at three different plasticizer concentrations (30, 40 and 50 wt%), since they are common in the preparation of plasticized PVC for food contact materials (Fankhauser-Noti et al. 2006;[START_REF] Ežerkis | Analytical screening of polyadipates and other plasticizers in poly(vinyl chloride) gasket seals and in fatty food by gas chromatographymass spectrometry[END_REF][START_REF] Grob | Verification of results to improve the quality of analytical data: A proposal[END_REF]Biedermann et al. 2008). PVC and ESBO were mixed in a planetary mixer KAPL 5KPM5 (St. Joseph, MI, USA) at 23 ± 2 ºC for 30 min. Plastisols were degassed using a vacuum chamber HEK-GmbH MCP (Lübeck, Germany) to remove air bubbles and further cured in an oven at 170 ºC during 8 min to obtain layers with thickness 0.34 ± 0.04 cm.

A general study for ESBO specific migration in olive oil and distilled water was carried out for all the prepared PVC-ESBO materials by application of the method developed in this work.

Olive oil and distilled water were selected since they cover most of the real applications of commercial lids and tests were performed in triplicate. 10 cm 2 samples were cut and placed in contact with 10.0 mL of olive oil and distilled water by total immersion at 40 ºC for 10 days, since these are the general conditions for food to be stored at room temperature for more than 24 hours contact time (CEN 2002;CEN 2004). ESBO content in each food simulant was then analyzed by direct application of the method developed in this work. Distilled water extracts required prior evaporation to dryness in a rotary evaporator Multivapor BÜCHI P-6, (Flawil, Switzerland) for further testing. A blank test for each simulant was also performed. (CEN 2004). Glass jars were filled with the appropriate food simulant according to their pH value. Distilled water was selected for asparagus since pH was determined to be higher than 4.5 and an aqueous solution (3%w/v) of acetic acid for pickled gherkins, jam and three different fruit-based baby foods since their pH values were lower than 4.5. For jars with fat foods (pate, pesto sauce and mayonnaise), ethanol (95%v/v) and iso-octane were selected as alternative fat simulants, as it is accepted in regulations (EN-13013, CEN 2004) and it has been common in recent research work [START_REF] Tovar | Migration Studies To Assess the Safety in Use of a New Antioxidant Active Packaging[END_REF][START_REF] Kubwabo | Migration of bisphenol A from plastic baby bottles, baby bottle liners and reusable polycarbonate drinking bottles[END_REF]. A blank test for each simulant was also performed. Glass jars were closed with the lid and turned on its head during 10 days at 40 ºC, except in the case of those samples with iso-octane which were exposed to 2 days at 20 ºC according to the EN-13013. All liquids were subsequently evaporated to dryness in a rotary evaporator.

ESBO migration from gaskets was quantified by application of the developed method to dry samples before GC/MS analysis, while ATBC, DOA and DBS were determined by dilution in nhexane prior to the injection in the gas chromatograph.

Results and discussion

ESBO identification and quantification

ESBO mainly consists of some triglycerides, whose average composition in fatty acids is about 11% palmitic (16:0), 4% stearic (18:0), 23% epoxidized oleic (18:1E), 55% diepoxidized linoleic (18:2E), and 8% triepoxidized linolenic (18:3E) (EFSA 2004;Fankhauser-Noti et al. 2006;[START_REF] Yang | Structure and properties of partially epoxidized soybean oil[END_REF][START_REF] Hayati | Physicochemical characteristics of soybean oil, palm kernel olein, and their binary blends[END_REF]. ESBO identification was based in a single fatty acid, i.e. derivatized diepoxidized linoleic acid (C18:2E), due to its high concentration in ESBO and no natural occurrence in food (Castle et al. 1988b;[START_REF] Berdeaux | Characterization, quantitation and evolution of monoepoxy compounds formed in model systems of fatty acid methyl esters and monoacid triglycerides heated at high temperature[END_REF]. The synthesis of 1,3- Castle et al. (1988a) enabled an increase in the molar mass of the epoxidized fatty acids resulting in later elution than for any other fatty acids present in ESBO or in food samples, permitting a clear identification and quantification. The use of the modified method proposed here preserved the same chromatographic behaviour for 1,3-dioxolanes (Figure 2). Derivatized diepoxidized linoleic acid showed two chromatographic peaks (4 and 5 in Fig. 2), corresponding to two stereoisomers with a characteristic mass ratio based on m/z 277 and 309. The most abundant ion (m/z 309) was selected for quantification.

Validation of the developed method

A validation procedure for the method developed in the present work was carried out and the main parameters typically used to ensure reliable results for analytical methods were determined (EMEA 1996).

Linearity, Detection and Quantification Limits (LOD and LOQ)

Three different stock solutions with a concentration near 65000 mg kg -1 were prepared separately. Five calibration standards with concentrations between 1.0 and 9.0 mg kg -1 were prepared from each stock solution to evaluate linearity and they were injected in triplicate. This range was selected because it was necessary to ensure linearity at low concentrations with a working range near LOD and LOQ. Regression parameters for the obtained calibration curves are indicated in Table 1. Results showed a linear behaviour for the three standard series calibration curves over the explored concentration range with acceptable determination coefficient (R 2 ) values, despite all of them were lower than 0.995 due to the low concentrations and close range used in this study. High values were obtained for intercept standard deviations (SD) and relative standard deviations (RSD) from slopes and intercepts. This fact could be attributed to the high number of steps included in the experimental method and the sum of uncertainties from each stage which resulted in relatively high deviations between results. "signal to noise" (S/N) ratio from chromatograms corresponding to the lowest standard of each of the three calibration graphs. LOQ was determined as the S/N of 10:1 and LOD was determined as S/N of 3:1 of average value of ESBO peak obtained during linearity experiments at low concentration. The second method was by using regression parameters of the three calibration graphs. This one is considered more reliable as regression errors are integrated in the obtained values and resulted in lower LOD and LOQ values as indicated in Table 2. The high values obtained for RSD were attributed to the use of three different stock solutions prepared separately. In summary, LOD and LOQ were clearly lower than the ESBO migration limits and sensitive enough to assess the possibility of this method to be applied for ESBO specific migration tests even at low concentration levels.

Precision

In this validation study, precision was calculated in terms of intraday repeatability as RSD (%) of peak areas obtained from the three different standard series at three concentration levels (5.0, 7.0 and 9.0 mg kg -1 solution of ESBO) in triplicate. The same equipment was used and procedure over the whole analysis was followed by the same analyst to reduce human errors. Obtained results were lower than 5% in all cases, confirming an acceptable repeatability of this method when compared with 7% obtained by Castle et al (1988b).

Accuracy

This parameter was evaluated by calculating the percent recovery of known spiked amounts of ESBO in olive oil near the legal migration limits. Four concentration levels (30, 60, 100 and 200 mg ESBO kg -1 olive oil) were used for such tests performed in triplicate. It should be mentioned that olive oil is a complex matrix because of its high content in unsaturated fatty acids. In order to quantify the ESBO concentration in the spiked samples, it was necessary to draw another Castle et al. (1988b). Good recovery percentages and RSD values were obtained for all concentration levels, as shown in Table 3. These results could be considered acceptable for the analysis of real samples and also similar to those obtained by Castle et al (1988b), which ranged from 97% to 109% by spiking food samples with ESBO at the same concentration level (from 110 to 170 mg kg -1 ).

Working range

The method working range was evaluated from the two calibration curves prepared for validation at different concentration levels, as previously indicated. LOQ was taken as the lower limit for such range (3.6 mg kg -1 ESBO) while the highest concentration standard used in the accuracy evaluation was selected for the upper limit (126.0 mg kg -1 ESBO). It must be noticed that different values of the working range were obtained if expressed as mg kg -1 ESBO or mg kg -1 food.

Considering the second case as the most representative for comparison with legal limits, the working range for this method was 16-438 mg kg -1 food, including the ESBO migration legal limits indicated in the Introduction section. Therefore, this method could be considered completely valid to be used in ESBO migration studies.

Selectivity

Selectivity of this method was calculated by considering the synthesis reaction to form 1,3dioxolane derivatives from epoxidized fatty acids. Results were essentially the same as those obtained by Castle et al (1988b). Derivatized monoepoxidized oleic acid could not be used for such purpose since the specific ion m/z 367 is also observed by natural occurrence in food, making it

Specific migration study

PVC-ESBO samples

Once the analytical method developed and validated in this work showed its reliability for ESBO determinations, it was used to evaluate the specific migration of ESBO in real conditions. In both cases a calibration curve was prepared with 14 standards ranging from 3.0 to 600 mg ESBO kg -1 solution in order to obtain a wide concentration range for quantification.

As shown in Figure 4, intense chromatographic peaks corresponding to high migration values were obtained for PVC-ESBO samples in contact with olive oil (around 2100 mg ESBO kg -1 olive oil in the case of the 30% ESBO sample and even more intense peaks for higher concentrations).

These high migration results were attributed to the massive exchange of fatty acids from the plastic sample with ESBO and the food matrix (olive oil), due to their high similarity in molecular composition. Moreover, an inadequate short curing time or a high ESBO concentration in the PVC-ESBO materials could involve a lower interaction between both components. The olive oil blank sample yielded no detectable peaks for derivatized diepoxidized linoleic acid as it can be observed in Figure 4. Therefore, it could be concluded that the studied PVC-ESBO formulations would not be suitable for packaging use in food with very high fat content.

A similar migration study performed in distilled water yielded no detectable values for ESBO.

Therefore, all the studied formulations could be suitable for aqueous food packaging, making ESBO a promising alternative for PVC formulations since their low toxicity compared to phthalates [START_REF] Rhee | Comparison of embryotoxicity of ESBO and phthalate esters using an in vitro battery system[END_REF] as well as their biodegradable nature [START_REF] Choi | rules necessary for testing migration of the constituents of plastic materials and articles intended to come into contact with foodstuffs[END_REF][START_REF] Liu | Green" composites from renewable resources: Preparation of epoxidized soybean oil and flax fiber composites[END_REF][START_REF] Behera | Synthesis, characterization, and kinetics study of thermal decomposition of epoxidized soybean oil acrylate[END_REF][START_REF] Bouchareb | Effects of epoxidized sunflower oil on the mechanical and dynamical analysis of the plasticized poly(vinyl chloride)[END_REF][START_REF] Liu | Green" composites and nanocomposites from soybean oil[END_REF]. The evaluation of the suitability of the developed method for ESBO determination in real samples was carried out by selecting target food products packaged in glass jars. Nine different commercial lids were selected for the specific migration testing and an additional screening analysis of other plasticizers commonly used in gaskets was carried out in order to study the current compliance level of migration in food contact materials in the Spanish market. All tests were performed in triplicate. The obtained results (Table 4) revealed that the highest amounts of migrated plasticizers were found in alternative fat simulants, particularly in ethanol 95% (v/v). Some plasticizers were found in the three analyzed lids from fat food, and all of them migrated in amounts higher than the current legal migration limits. Two of them showed high levels of ESBO and, in the case of pate lid, even above the current transitional limit of 300 mg kg -1 (European Commission 2007;European Commission 2008). The third sample (pesto sauce) showed high levels of ATBC. Some of the standard deviations obtained from triplicates were high although they could be considered acceptable for commercial samples. In the case of aqueous simulants, migration from lids was barely detected. In the case of baby fruit lids no detectable values were obtained for any sample, as it could be expected, because of the high hydrophobic character of common plasticizers.

Conclusions

A simpler, faster and more economical method for ESBO determination was developed and it was compared to the well-known one reported by Castle et al. (1988a.) The main difference between both methods consists of the elimination in the use of a costly internal standard giving added value to this development since it permits the determination of ESBO in plasticized PVC materials avoiding the use of tedious and expensive methods. The analytical validation of this method was carried out and gave indication on its reliability for application to food and materials in direct contact. Satisfactory results were obtained for precision and accuracy, with comparable or 13 even better values than the reference method. The working range for this method was 16-438 mg ESBO kg -1 food including all the ESBO migration legal limits. As the result of the specific migration analysis, PVC-ESBO formulations prepared in the laboratory were not suitable for packaging of highly fat food, where massive exchange of fatty acids between the plastic material and simulant could occur due to their high similarity in molecular composition; but they could be used without restrictions for aqueous food packaging. Migration analysis from commercial lids confirmed that the amounts obtained for ESBO exceeded legal migration limits in two of the three analyzed lids from fat foods, with the third one exceeding the ATBC legal migration limit. No other remarkable migration in other simulants was observed.

  Specific migration tests from commercial lids were performed in triplicate following EN 13130-1 Standard

  as shown in Figure3. In consequence, the derivatized diepoxidized linoleic acid with specific m/z ratio 277/309 was used for this study.

Figure 1 .

 1 FIGURE CAPTIONS

Figure 2 .

 2 Figure 2. Chromatogram of commercial ESBO obtained by application of the developed method.

Figure 3 .

 3 Figure 3. Chromatograms of an olive oil sample and an olive oil sample after contact with ESBO

Figure 4 .

 4 Figure 4. Chromatograms from olive oil samples after contact with PVC-ESBO samples. Peaks:

  a higher concentration range. Satisfactory values (R 2 > 0.998) were obtained in this case, better than those shown in Table 1 at low ESBO concentrations and comparable to those obtained by

	calibration curve with
	F o r
	P
	e
	e r
	R
	e
	v i e
	w
	O n l
	y
	10

Table 1

 1

Table 3

 3

		Mean value (mg kg -1 solution)	RSD (%)
	LOD (S/N = 3) a	1.3	8.6
	LOD (3 Sb /a) b	1.1	13.9
	LOQ (S/N = 10) a	4.5	14.7
	LOQ (10 Sb /a) b	3.6	15.2
	Note: a nine replicates.
	b three replicates.

Table 5 Mean value (mg Kg -1 food simulant) a

 5

	Plasticizer	Pickled Gherkins	Asparagus	Jam	Pate	Pesto sauce	Mayonnaise
	ESBO LOQ: 15.9 (mg/kg)	<LOQ	ND	<LOQ 676±282	94±49	18±18	<LOQ	71±24	<LOQ
	DBS LOQ: 0.006 (mg/kg)	ND	ND	ND	ND	ND	ND	ND	2±2	0.4±0.2
	ATBC LOQ: 0.01(mg/kg)	ND	1.2±0.1	ND	22±19	8±2	285±12	19±3	ND	ND
	DOA LOQ: 0.01 (mg/kg)	ND	ND	ND	ND	0.23±0.05	ND	0.23±0.01 0.23±0.01 0.53±0.04
	ND: non detectable	Alternative fat simulant: ethanol 95%v/v	Alternative fat simulant: iso-octane
	Note: a three replicates.

http://mc.manuscriptcentral.com/tfac Email: fac@tandf.co.ukFood Additives and Contaminants

Acknowledgements

The authors would like to thank Traquisa S.A. (Barcelona, Spain) for kindly supplying ESBO; and also Institute Juan Gil Albert (Diputación de Alicante, Spain) and University of Alicante (SICyT UAUSTI09-05) for their financial support.

European Committee for Standardization (CEN). 2004. EN 13130-1, May 2004, Materials and articles in contact with foodstuffs. Plastics substances subject to limitation. Guide to test methods for the specific migration of substances from plastics to foods and food simulants and the determination of substances in plastics and the selection of conditions of exposure to food simulants.