I actually think that the data is the major issue here. As @chriskanan mentioned, this is pretty standard for a company that was spun-out of a lab. The individuals involved are given equity in the company as is the institution. The conflict of interest is then recorded and these individuals won't be involved in vendor-related decisions for these companies. But, given that they were a lab-spin out, this start up probably provides some worthwhile information back to the lab. The individuals' conflicts of interest is pretty cut and dry (even given the recent MSK COI issues).
But, from the NYT piece, there are three issues related to the data that are at issue: 1) the dataset was generated over many decades by many pathologists who were not similarly compensated; 2) the company has an exclusive license to the data; 3) it is unclear if the patients were properly consented to allow their data to be used for commercial purposes.
The first issue is a question of money. MSK owns the data, but what about the people that generated the data? When an lab spins out a company, it's quite common for the creators of the IP get a chunk of equity (or proceeds or licensing depending on the institutional IP policy). In this case, there were dozens of pathologists that were key to building up that dataset and they were left out of the company. But this is just a money question... and could probably be solved by throwing more money at the problem. But it is important. Because, you want to encourage other doctors to contribute their findings to these types of databases to allow for future studies. Without their buy-in, these data would be lost. If you forget to include these people when that data is commercialized, you start to lose that buy-in.
The other two questions are more interesting in my opinion... Of course the company would want an exclusive license to any MSK dataset that was vital to the survival of the company. And I'm sure that MSK gets a royalty each time their data is used. But that doesn't limit the company from getting their data from another institution as well and not using the MSK data. In this case, what would MSK's recourse be? It's hard to say because MSK also owns a piece of the company... which is where the conflicts really start to raise questions. The MSK data should probably be available to anyone who wants access and has the ability to pay the licensing fee. This seems like the course most non-profits would take. But because they also own part of the company, they also want the company to have exclusive access to it. What's the proper course for a non-profit to take? What if this company could provide a truly valuable service to patients? What if the company was economically non-viable without the exclusive license? These are legitimately tough questions. I think the better solution would have a F/RAND license on the data, which may have lessened some of the above equity issues as well. However, I'm not sure the course MSK took is particularly bad. The article states that they had difficulties in getting the company funded, which underscores how difficult of a project this is.
The other side of this coin is that in most spin-out situations where the IP was created by the lab, granting the company an exclusive license to that IP (patent, etc) is extremely common. That's not entirely what happened in this case. (I don't know anything about the specifics of this case, just speculating here...) If the lab generated IP (software) that generated a model based on historical MSK data, then it's not just the lab's IP that was used, but institutional IP (generated by many other people). This makes the exclusivity a bit tougher to explain. (And is the cause of the first issue).
The biggest question to me is if the patients were properly consented for this type of data sharing. Given that the data was collected over decades, it's really difficult to know what the consent process was across the board. What they really want to avoid is the connotation that patient data is being used to fuel for-profit companies. Once that starts, you could see a slow erosion of trust of the patients... patients that have multiple choices for physicians in the NY area. Even if the patients in question were properly consented, MSK will want to avoid this type of PR to make current and future patients more comfortable.
So, in this case... the data is really the issue. Of the three issues I mentioned, I think the biggest question is that of the data access. If the license to the data wasn't exclusive, I don't know if this would have been as large of an issue.