Data protection reforms could damage medical research, say science groups

Out-Law News | 03 Feb 2014 | 3:10 pm | 4 min. read

A coalition of health and scientific research bodies have begun lobbying MEPs and EU Ministers in an effort to ensure new EU data protection laws do not stifle medical research.

The group, which includes the Medical Research Council, the Nuffield Foundation and Universities UK and is led by health charity the Wellcome Trust, said that current proposals, if introduced, "severely threaten" health and scientific research.

"Concerns about patient confidentiality are legitimate and it is essential that people’s privacy is protected," Dr Jeremy Farrar, director of the Wellcome Trust, said. "But when the safeguards become disproportionate, they benefit no one."

Farrar said that proposals to update EU data protection laws that were originally tabled by the European Commission were "measured and sensible" and added that they "struck the right balance between protecting the individual and making possible huge benefits for all of our health".

However, he said that changes to the Commission's draft which were backed by a committee of MEPs in October last year, and which are set to be voted on by the whole European Parliament this spring, "are disproportionate and put at risk future medical research and improvements in health".

The coalition said that researchers need to be able to make use of personal data within projects and that it is not practical sometimes to ensure data is anonymised. It said that research that uses personal data is subject to "a robust ethical and governance framework" which ensures the proportionality of that use and that "strict confidentiality controls" help prevent "misuse and harm" to individuals whose data is used.

The group said, however, that draft rules backed by the LIBE Committee at the European Parliament would "make it very difficult, if not impossible in practice, to use pseudonymised data concerning health ... without specific consent". The Committee's proposals would "also prohibit the use of identifiable personal data in scientific research without specific consent", it added.

"Researchers only use identifiable data without consent where other approaches are not practicable, and this is currently only allowed subject to ethical approval and strict confidentiality safeguards," the coalition's statement said. "Sometimes researchers need details such as age, postcode and information on a health condition that together could disclose the identity of an individual, but the study would not be possible without it."

"In many studies that would be affected, individuals have voluntarily given broad consent for their data to be used in research to further our understanding of society, health and disease. Their contributions could be wasted if the amendments become law," it added.

Under the plans backed by LIBE, the processing of personal data would be governed by a complicated legal framework. Strict rules around the processing of health data, as well as other 'special categories' of data, would be created. Separate rules would also apply if the personal data involved belonged to a child.

The LIBE proposals require that personal data is "processed lawfully, fairly and in a transparent and verifiable manner in relation to the data subject" and "collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes".

One instance in which adults' health data could be lawfully processed, under the proposals, would be where individuals have given their consent to that activity. Organisations would have to show they have consent to the processing of the data for one or more "specified purposes". Organisations would not be able to rely on consent given previously when the purpose of the processing for which they were granted permission to proceed with changes.

The LIBE proposals, like the Commission's draft Regulation, provide scope for the processing of health data without the need for individuals' consent in certain circumstances.

Rules specific to the processing of health data for health purposes or for scientific research purposes have been approved by the Committee. Separate rules would again apply where the processing of health data was taking place in the context of "scientific research activities in clinical trials".

The LIBE proposals, if introduced, would generally require organisations to obtain individuals' consent to process their personal health data even where it is deemed "necessary for historical, statistical or scientific research purposes".

However, in such occasions, the LIBE draft provides individual EU member states with the right to draw up their own rules to permit health data processing without consent where it is "necessary for historical, statistical or scientific research purposes", subject to a number of other conditions being met.

The carve out would only be able to be relied on where the research being undertaken "serves a high public interests" and "if that research cannot possibly be carried out otherwise". Even then the data to be processed would have to be anonymised, or at worst "pseudonymised under the highest technical standards".

Organisations would also have to take "all necessary measures" to "prevent unwarranted re-identification of the data subjects" and individuals would retain a right to opt out from having their data used at any time during the research programme. Personal data processed under such arrangements could not, generally, be processed for other purposes without individuals' consent.

A new scheme designed to faciliate medical research through the making available of patient data to researchers is set to be implemented in England. The Health and Social Care Information Centre (HSCIC) is to start accumulating patient records from GPs and other public health bodies in March and form a new database, known as 'care.data'. The HSCIC will have the power to either publish or grant access to the data in certain circumstances, subject to privacy safeguards.

Individuals have the right to prevent their data being collected and used in the care.data programme. According to a recent poll by health sector publication Pulse, 41% of the 391 GPs surveyed intend to opt themselves out from the scheme.