Destination uncertain – but Council points in the right direction
04.12.14
Today, the Council announced agreement on a partial general approach on some of the key elements of the proposed Data Protection Regulation dealing with health research. Publication of a Council partial general approach provides a chance to take stock of the evolution in the debate since the European Commission introduced its proposal in 2012, since we already have an idea what Parliament and the Commission think.
All three institutions understand that scientific research requires special treatment, both in relation to health research and healthcare service delivery but also other areas of research using personal data. The whole health and research community has welcomed this.
The EU sees innovation and the digital economy as being at the heart of its economic recovery. It’s clear that the Regulation will play a key role in setting the regulatory framework for the digital economy. If anything, the EU understates the importance of getting this right in its emphasis on new products and services. As well as supporting new forms of support for patients, the use of “big data” will also transform efficiency of delivery and assessment of healthcare outcomes. It is a crucial part of the solution to the challenge of making European healthcare systems sustainable.
With that said, the state of play is at best a mixed picture. On a positive note, the Council has established that the processing of personal data for scientific purposes is deemed lawful. It has also started to clarify the issues around consent, a complex area where the domain of data privacy overlaps with the ethical oversight of research, which is governed by other legislation. Another step in the right direction is the reference to “pseudonymisation” in the text. Although it doesn’t lend itself to sound-bites and can mean different things in different contexts, pseudonymisation is a critical concept since it opens up a space where we can consider how to protect data which is restricted to research purposes but could contribute to re-identification. This is important for many in the research community, both because it provides some recognition of the safeguards and protection that already exist (and work well) in protecting individuals, but also because it will encourage their further development.
Where the Council text is less encouraging is in the reliance that it places on future derogations being enacted to enable health research to take place. This is particularly problematic if it leads to a reliance on member states introducing national derogations. Here you can see some familiar European tensions around harmonisation as well as some tensions that are specific to this issue, such as the question of getting the interplay right between the exercise of individual rights and the broader collective interest in scientific progress. The Parliament had to consider the same issues but adopted a more problematic approach. As things stand, we run the risk of a level of disharmony in national provisions, which could inhibit research where data-sharing across borders is necessary. It will be important to find solutions to this. The Regulation extensively addresses the need for self-regulation and there may be solutions here if the legislators can be encouraged to provide the right framework for the research community.
