Federated learning models for multi center studies

Introduction

Federated Learning (FL) is an advanced artificial intelligence technique that enables multiple institutions to collaboratively train machine learning models without directly sharing their original datasets. It is particularly important in biotechnology, medical research, pharmaceutical development and genomic studies, where research institutions often possess large amounts of sensitive biological and medical information.

Multi-centre studies involve collaboration between different hospitals, universities, biotechnology laboratories and research organisations. Traditionally, these studies may require researchers to transfer patient records, genomic information and clinical datasets to a central research location. However, transferring such sensitive information creates concerns relating to privacy, confidentiality, cybersecurity and regulatory compliance.

Federated learning provides an alternative approach by allowing participating institutions to train a shared model locally and exchange model updates rather than routinely transferring their original datasets. This approach can support collaborative research while reducing certain data-sharing risks.

In India, federated learning has growing relevance because healthcare institutions and biotechnology research organisations increasingly require secure methods of processing medical, genomic and clinical information.

Meaning and objectives of federated learning

Federated learning is a distributed machine learning approach in which several participating institutions collaboratively develop an artificial intelligence model while retaining their original datasets within their respective systems.

For example, five hospitals conducting a multi-centre cancer research study may collectively train a diagnostic model without transferring all their patient records to one central database.

The major objectives include:

Protecting sensitive medical and genetic information.

Encouraging collaboration between research institutions.

Reducing unnecessary centralised data transfers.

Improving the availability of diverse research datasets.

Supporting large-scale medical and biotechnology research.

Strengthening privacy-conscious artificial intelligence development.

Improving the efficiency of multi-centre clinical studies.

Types of federated learning models

1. Horizontal federated learning

Horizontal federated learning is used when participating institutions possess different individuals' records but share similar data characteristics or features.

For example, several hospitals may possess similar categories of patient information but serve different populations.

This model allows institutions to collaborate without routinely exchanging their original patient records.

2. Vertical federated learning

Vertical federated learning is used when institutions possess different categories of information about overlapping individuals.

For example, a hospital may possess clinical records, while a research institution maintains relevant laboratory information.

The institutions can collaboratively develop a model while limiting direct disclosure of their respective datasets.

3. Federated transfer learning

Federated transfer learning is useful when institutions have different datasets and different feature characteristics.

It can help research organisations collaborate even when their datasets are not directly comparable.

Importance in multi-centre biotechnology studies

1. Genomic research

Federated learning can support research involving genetic variations, inherited diseases and molecular characteristics.

Multiple research institutions can contribute to model development without routinely transferring complete genomic datasets to a central database.

However, model updates may still reveal sensitive information, so additional privacy safeguards are necessary.

2. Clinical research

Hospitals participating in multi-centre clinical studies can use federated models to analyse clinical outcomes and support predictive research.

This can improve the diversity of research populations and reduce certain administrative difficulties associated with centralised data transfers.

3. Drug discovery and pharmaceutical development

Pharmaceutical companies, universities and research laboratories can collaboratively develop predictive models using their respective research datasets.

Federated learning may support drug-response prediction, disease classification and the analysis of research outcomes.

4. Medical imaging research

Different hospitals may use federated learning to develop artificial intelligence models involving MRI, CT scans and other medical images.

This can support collaborative research without requiring all medical images to be transferred to one central repository.

5. Rare disease research

Rare diseases often affect relatively small populations. Individual research institutions may therefore lack sufficient data to develop reliable predictive models.

Federated learning can facilitate collaboration between multiple institutions and support research involving larger combined patient populations.

Legal and regulatory framework in India

1. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023, establishes a framework governing the processing of digital personal data.

Its provisions are relevant to multi-centre studies involving identifiable patient information and medical records.

Important considerations include:

Lawful processing of personal data.

Obligations of data fiduciaries.

Protection against unauthorised processing.

Security safeguards.

Applicable rights of data principals.

Conditions governing consent and other permitted grounds for processing.

Federated learning does not automatically exempt research organisations from data protection obligations. Institutions must examine whether personal data is being processed and whether model updates or derived information can reveal identifiable information.

2. Information Technology Act, 2000

The Information Technology Act, 2000, provides a legal framework for electronic records and certain cybersecurity-related offences.

Section 43 addresses specified unauthorised activities involving computer systems, while Section 66 addresses certain computer-related offences committed dishonestly or fraudulently.

These provisions may become relevant where research databases, model repositories or institutional computing systems are accessed unlawfully.

3. ICMR National Ethical Guidelines for Biomedical and Health Research Involving Human Participants, 2017

These guidelines establish ethical principles for biomedical research involving human participants.

They address informed consent, privacy, confidentiality, scientific validity and independent ethical review.

Multi-centre federated learning studies must consider these principles when processing patient information.

4. Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011

These rules provide requirements concerning the handling of sensitive personal data or information under the applicable provisions of the Information Technology Act.

Medical records and health information may fall within the categories of sensitive personal data covered by the Rules.

Their continuing applicability must be considered alongside the Digital Personal Data Protection Act and relevant commencement notifications.

5. Clinical Trials Rules, 2019

The New Drugs and Clinical Trials Rules, 2019, regulate clinical trials and related research activities involving new drugs and specified clinical investigations.

Where federated learning is used in regulated clinical research, institutions must comply with applicable requirements concerning ethics review, participant protection and research oversight.

Legal and ethical challenges in federated learning

1. Data privacy and confidentiality

Although original datasets remain with participating institutions, federated learning does not guarantee complete privacy.

Model updates may reveal information about individuals, particularly where datasets are small or sensitive.

Therefore, participating institutions must implement appropriate data protection and cybersecurity safeguards.

2. Informed consent

Research participants should receive appropriate information about how their personal and medical information will be used.

Where federated learning involves secondary research or new purposes of data processing, institutions must assess the applicable consent, legal basis and ethics requirements.

3. Data ownership and institutional responsibility

Multi-centre studies may involve different hospitals, universities and biotechnology companies.

Clear agreements should establish responsibilities concerning data access, intellectual property, model ownership, research publications and liability.

4. Algorithmic bias

Participating institutions may possess different patient populations, medical equipment and data collection standards.

Consequently, a federated model may produce unequal or inaccurate results for particular populations.

5. Cybersecurity risks

Federated systems may face unauthorised access, malicious model updates and other cybersecurity threats.

Research institutions must establish appropriate security monitoring and incident-response arrangements.

International legal framework

1. General Data Protection Regulation (GDPR), 2016

The GDPR establishes comprehensive data protection requirements within the European Union.

Articles 5 and 6 address principles of data processing and lawful processing. Article 9 provides additional protection for special categories of personal data, including health and genetic information.

Federated learning can support data minimisation, but it does not automatically establish GDPR compliance.

2. OECD Privacy Guidelines

The OECD Privacy Guidelines establish internationally recognised principles concerning collection limitation, data quality, purpose specification, security safeguards and accountability.

These principles are relevant to collaborative medical and biotechnology research.

3. UNESCO Universal Declaration on Bioethics and Human Rights, 2005

The declaration emphasises human dignity, privacy, informed consent and the protection of individuals participating in scientific research.

4. World Health Organization guidance

WHO guidance on ethics and governance of artificial intelligence for health emphasises transparency, accountability, human oversight and protection of individual rights.

These principles are important when federated learning models are used in healthcare research and clinical decision-making.

Relevant case laws and judicial decisions

There are no widely recognised Indian judicial decisions directly addressing federated learning models in multi-centre biotechnology studies. However, several important judgments provide legal principles relevant to privacy, medical information and digital research systems.

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court of India recognised the right to privacy as a fundamental right under Article 21 of the Constitution.

The judgment recognised informational privacy, personal autonomy and the protection of sensitive personal information.

Relevance: Federated learning involves processing sensitive medical and genetic information across institutions. The judgment provides an important constitutional foundation for protecting patient privacy and ensuring that data processing has a lawful and proportionate basis.

2. District Registrar and Collector v. Canara Bank (2005)

The Supreme Court examined the privacy implications of accessing private documents and records.

The judgment recognised that individuals have legitimate privacy interests in personal information.

Relevance: Multi-centre research institutions must establish appropriate controls over medical records and confidential research information, even when collaborative technologies are used.

3. Selvi v. State of Karnataka (2010)

The Supreme Court considered the constitutional validity of involuntary scientific investigative techniques, including narco-analysis and polygraph examinations.

The Court discussed personal liberty, bodily autonomy and protection against compelled testimonial evidence.

Relevance: The judgment provides broader constitutional guidance concerning the protection of individuals when scientific technologies are used to collect or analyse personal information.

4. S. and Marper v. United Kingdom (2008)

The European Court of Human Rights examined the retention of DNA samples and fingerprints of individuals who had not been convicted of offences.

The Court found that indefinite retention violated Article 8 of the European Convention on Human Rights.

Relevance: The decision highlights the importance of proportionality and appropriate retention policies when research institutions process sensitive genetic information.

5. Google Spain SL v. AEPD and Mario Costeja González (2014)

The Court of Justice of the European Union examined issues concerning personal data, search engines and the right to request removal of certain search results.

Relevance: The judgment illustrates the importance of individual control and privacy protections in digital information systems. Similar principles are relevant when designing federated research systems that process identifiable patient information.

Advantages of federated learning in multi-centre studies

Federated learning offers several potential advantages for biotechnology and healthcare research.

However, federated learning should not be treated as a complete substitute for cybersecurity, privacy protection or ethical supervision.

Challenges in implementing federated learning

Despite its advantages, federated learning faces several technical, legal and institutional challenges.

First, participating institutions may use different data formats, medical terminology and research standards. This can affect model compatibility.

Second, institutions may have different levels of technological infrastructure and cybersecurity capabilities.

Other important challenges include:

High computational and infrastructure costs.

Model update leakage and privacy risks.

Difficulty in verifying data quality.

Unequal representation of patient populations.

Unclear ownership of collaboratively developed models.

Differences in international data protection laws.

Difficulties in establishing responsibility for inaccurate predictions.

Recommendations for strengthening federated learning governance

India should encourage responsible federated learning through a combination of technical safeguards, institutional agreements and regulatory supervision.

Important recommendations include:

Establishing standardised agreements between participating research institutions.

Ensuring appropriate ethical committee approval.

Applying data minimisation and privacy safeguards.

Introducing independent cybersecurity assessments.

Establishing clear intellectual property ownership arrangements.

Maintaining transparent documentation of model development.

Conducting regular assessments for algorithmic bias.

Ensuring compliance with applicable data protection legislation.

Conclusion

Federated learning models provide an important technological framework for collaborative multi-centre biotechnology and healthcare research. They enable hospitals, universities and research institutions to develop shared artificial intelligence models while reducing the need to transfer original patient datasets to a central location. Their applications include genomic research, medical imaging, pharmaceutical development, rare disease studies and clinical research. In India, the Digital Personal Data Protection Act, 2023, Information Technology Act, 2000, and ICMR ethical guidelines provide important legal and regulatory foundations. Judicial decisions such as Justice K.S. Puttaswamy v. Union of India (2017), Selvi v. State of Karnataka (2010) and District Registrar and Collector v. Canara Bank (2005) establish relevant principles concerning privacy, personal liberty and confidential information. Effective governance of federated learning requires strong cybersecurity, informed consent, institutional accountability and transparent research practices. With appropriate safeguards, federated learning can strengthen scientific collaboration while supporting privacy-conscious biotechnology innovation.