[Special Summary] EU General Data Protection Regulation and Health Research

Background: MEP Jan Albrecht (Greens/EFA, Germany), Rapporteur for the data protection file in the LIBE Committee, released his draft report on the Commission’s proposal in December 2012. A further four committees - Employment and Social Affairs; Industry, Research and Energy; Internal Market and Consumer Protection; and Legal Affairs - are due to give opinions and offer amendments before the report is voted on at the plenary session in April 2013. So far, draft opinions have been released by all four committees but only IMCO has adopted a final text.

Though the main article dealing with health research is Article 83, several of the proposed regulation’s other provisions have implications. For instance:

• Recital 40 and Article 6(4) allow for processing of research data only where this is compatible with the purpose stated when the data was originally collected.
• Recital 125 states that rules regarding research data must respect other legislation currently in place, for example in clinical trials.
• Article 17 gives data subjects the ’right to be forgotten’ but also provides two derogations concerning health research. Firstly, data must be erased immediately (upon request by the data subject) unless its retention is necessary for research, according to Article 17(3)(c). Secondly, where data is needed for ’purposes of proof’, data controllers may ’restrict processing’, rather than erasing data altogether, according to Article 17(4)(d).

The provisions listed above were not changed by the Albrecht draft report and are broadly supported by the health community.

Meanwhile, Article 83 lays out the conditions for the processing of data for historical, statistical and scientific research purposes. The draft report by the LIBE Committee makes a number of changes to this article, specifically inserting two new paragraphs to govern the processing of sensitive data, including health data, for research purposes. These paragraphs have two key implications:

1. Health data can only be processed for research where consent is given - Article 83(1)(a).
2. The only exception to this rule is where the research is deemed, on a member state by member state basis, to serve an ’exceptionally high public interest’. In such a case, the data must be at least pseudonymous, preferably anonymous, and this processing is subject to prior authorisation by the competent supervisory authority - Article 83(1)(b).

Further amendments to Article 83 state that:

• Research bodies may only publish data where consent is gained or where the data subject has made the data public his- or herself. This removes the provision in the original draft allowing the publication of data where this is necessary to present research findings - Amendment 339.
• The Delegated Act which allowed the Commission to further specify the criteria and requirements for the processing of research data is removed and the details are instead embedded in the new paragraphs 1(a) and 1(b) - Amendment 341.
• Member states are to notify the Commission about any acts adopted pursuant to new paragraphs 1(a) and 1(b) - Amendment 342.
• Data enabling identification of the subject (once made anonymous or pseudonymous) must be kept separately - the provision stating that this is case ’as long as these purposes can be fulfilled in this manner’ is removed by Amendment 335.

The EPHA position and response to the original Commission proposal was broadly supportive of the provisions relating to health research. However, the health community has raised a number of concerns with the amendments offered by the draft report. The amendments made in the report state that processing of personal data for research is ’not as urgent or compelling as public health or social protection’ (justification for amendment 27) and make the legal situation around use of registry-based data difficult to interpret - this also has an effect upon recruitment of subjects for clinical trials. The clause allowing for use of data without consent only in cases of ’exceptionally high public interest’ is far too vague and does not clarify who is to classify research as ’exceptional’ and what impact such an administrative process would have on the volume of research conducted. Finally, the extension of the scope to include pseudonymised data may increase regulatory burden for bodies conducting research.

EPHA is currently drafting a set of amendments to the draft report, in light of the concerns raised. The deadline for tabling amendments is 27 February and it is hoped that the plenary will adopt a final text before the end of the current parliamentary session.

 Further information

• Legislative Observatory file

 EPHA related articles

• [EPHA Briefing] General Data Protection Regulation
• EPHA position on General Data Protection Regulation
• European Parliament releases draft report on General Data Protection Regulation
• European Parliament’s LIBE Committee debates General Data Protection Regulation
• Internal Market and Consumer Protection Committee releases opinion on proposed Data Protection Regulation