Intended for healthcare professionals

Editorials

Proposed EU data protection regulation is a threat to medical research

BMJ 2013; 346 doi: https://doi.org/10.1136/bmj.f3534 (Published 31 May 2013) Cite this as: BMJ 2013;346:f3534
  1. M C Ploem, associate professor of health law ,
  2. M L Essink-Bot, professor of social medicine,
  3. K Stronks, professor of social medicine
  1. 1Department of Public Health, Academic Medical Centre, University of Amsterdam, PO Box 22660, Amsterdam, Netherlands
  1. m.c.ploem{at}amc.uva.nl

A suggested amendment would make most epidemiological and health research impossible

Legislation going through the European Parliament this summer could prohibit most epidemiological and other medical research if amendments proposed by one committee are accepted. The main goals of the legislation will be to strengthen the digital privacy rights of European citizens, improve Europe’s online economy, strengthen the free market, and end the divergence between national data protection laws of the 27 member states of the European Union. This is all well and good, as long as data protection is balanced fairly against adequate provision for legitimate data processing.

The European Commission proposed last year that the EU’s 1995 Data Protection Directive 95/46/EC should be replaced by the General Data Protection Regulation.1 In line with the current directive, the draft regulation prohibits the processing of sensitive personal data, including “data concerning health.” However, the draft allows exceptions, including data processing for research and statistics. Research deserves a special position within the normative framework, not only because its focus is not on the individual, but also because it serves an important public interest—the generation of valuable knowledge for society.

So far, so good. But, in December 2012, the European parliament’s Committee on Civil Liberties, Justice and Home Affairs (LIBE committee) called for amendments that would put insurmountable obstacles in the way of research that uses sensitive data, such as health data, especially retrospective studies.2

The committee argues that “[p]rocessing of sensitive data for historical, statistical and scientific research purposes is not as urgent or compelling as public health or social protection. Consequently, there is no need to introduce an exception which would put them on the same level as the other listed justifications.”

Moreover, the committee proposes that “Processing of personal data concerning health which is necessary for historical, statistical or scientific research purposes, shall be permitted only with the consent of the data subject.” And it leaves limited room for exceptions: “Member states may provide for exceptions to the requirement of consent for research . . . with regard to research that serves an ‘exceptionally high public interest,’ if that research cannot possibly be carried out otherwise. The data in question shall be anonymised, or if that is not possible for the research purposes, pseudonymised under the highest technical standards, and all necessary measures shall be taken to prevent re-identification of the data subjects. Such processing shall be subject to prior authorisation of the competent supervisory authority.”

We have serious concerns about these proposed amendments. Firstly, we see no reason to remove the research exception from the draft regulation. Data processing activities for research and statistics, certainly within the field of medicine and health, have always been regarded as matters of public interest. For example, the preamble of the additional protocol to the Council of Europe’s Convention on Human Rights and Biomedicine states that “progress in medical and biological science, in particular advances obtained through biomedical research, contributes to saving lives and improving quality of life” and that “the advancement of biomedical science and practice is dependent on knowledge and discovery which necessitates research on human beings.”3 Sustainable public health requires sound scientific and statistical evidence.

Furthermore, which research might serve an “exceptionally high public interest” and who would decide that? The potential of a research project to yield exceptionally important findings is hard to predict because scientific progress is incremental. This amendment would prohibit most epidemiological and health research, including research that used data from dead or untraceable patients, retrospective studies, and large scale cohort studies where obtaining informed consent might not be completely impossible but would require disproportionate effort by researchers. Thirdly, the committee proposed to take away the European Commission’s competence to adopt “delegated acts” to further specify criteria and requirements on research using personal data. We think that the commission should remain in the position to make use of its powers and should remove, as urgently as possible, existing obstacles for research across borders.

Lastly, we agree that review by an independent body should be part of the legal framework when non-pseudonymised (or directly identifying) data are collected and used without explicit consent of the patients involved. This should also be the case when the research gives rise to specific privacy concerns, such as the collection of genetic data, or when the research has stigmatising consequences for the participants. However, because of their expertise in reviewing research protocols, ethical review committees are, in our view, much better suited for this role than the competent supervisory authority proposed by the LIBE Committee.

The desire of the EU legislator to harmonise national data protection by drafting directly binding rules is reasonable, given its mission to realise a free market within the EU. This goal coincides fully with the medical research community’s attempts to facilitate research at a European level. A good example is the Biobanking and Biomolecular Research Infrastructure (www.bbmri.eu/), one of the first European projects, designed to promote and support a European research infrastructure. However, in our view the EU will succeed in its mission only if the future regulation provides a fair balance between data protection and the possibilities for data processing for legitimate purposes. We fully acknowledge that privacy is a fundamental right of all citizens, and that it is of great importance—now and in the future—that people’s private lives are respected. However, it is equally important that research can proceed so that the same citizens may expect the best possible care.

Notes

Cite this as: BMJ 2013;346:f3534

Footnotes

  • Competing interests: We have read and understood the BMJ Group policy on declaration of interests and declare the following interests: MCP is a member of the Dutch Health Council, two ethical review committees, and the privacy board of the Academic Medical Centre. MLE-B is a board member of the Dutch Society of Physicians in Policy, Management and Research; board member of the Foundation Child Oncological Center Amsterdam; member of the board of examiners of the Dutch School of Public and Occupational Health; and member of the Committee Regulation and Research of the Dutch Federation of Scientific Societies. KS is a member of the Dutch Health Council, the HIV Monitoring Foundation, and the supervisory board of STIVORO (expertise centre for anti-smoking policies).

  • Provenance and peer review: Not commissioned; externally peer reviewed.

References

View Abstract