Regardless of if the data is identifiable, the patient would need to be consented for their data to be used for research purposes. This is a pretty standard clause, and I’d be shocked if MSK didn’t have this as part of their standard consent, but it may not have been done for all patients over the years. The patients would not have a right to reclaim the reminant tissue, but they may still have a say in how the data derived from their treatment is used, deidentified or not. Normally this is an IRB issue. I have no idea how you’d go though licensing these data commercially. It’s an ethical minefield.

For example, if patients knew their data would be licensed commercially, they may not have agreed to their treatment.

And even if it was legal do do this without consent, you’d still want to make sure you had patient consent just to avoid these issues at all. If they didn’t have consent, it’s a huge PR issue, even if not a legal one.