Publications

On 17 December 2012, the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs (LIBE) released its draft report on the European Commission’s proposal for a regulation on the processing and free movement of personal data. The proposal and the amendments offered in the draft report have implications for a number of elements of health, inlcuding health research. This article takes a closer look at the potential effects of the new legislation for research bodies and public health, prior to the drafting of EPHA amendments on this issue.

Background: MEP Jan Albrecht (Greens/EFA, Germany), Rapporteur for the data protection file in the LIBE Committee, released his draft report on the Commission’s proposal in December 2012. A further four committees – Employment and Social Affairs; Industry, Research and Energy; Internal Market and Consumer Protection; and Legal Affairs – are due to give opinions and offer amendments before the report is voted on at the plenary session in April 2013. So far, draft opinions have been released by all four committees but only IMCO has adopted a final text.

Though the main article dealing with health research is Article 83, several of the proposed regulation‘s other provisions have implications. For instance:

• Recital 40 and Article 6(4) allow for processing of research data only where this is compatible with the purpose stated when the data was originally collected.
• Recital 125 states that rules regarding research data must respect other legislation currently in place, for example in clinical trials.
• Article 17 gives data subjects the ‘right to be forgotten’ but also provides two derogations concerning health research. Firstly, data must be erased immediately (upon request by the data subject) unless its retention is necessary for research, according to Article 17(3)(c). Secondly, where data is needed for ‘purposes of proof’, data controllers may ‘restrict processing’, rather than erasing data altogether, according to Article 17(4)(d).

The provisions listed above were not changed by the Albrecht draft report and are broadly supported by the health community.

Meanwhile, Article 83 lays out the conditions for the processing of data for historical, statistical and scientific research purposes. The draft report by the LIBE Committee makes a number of changes to this article, specifically inserting two new paragraphs to govern the processing of sensitive data, including health data, for research purposes. These paragraphs have two key implications:

1. Health data can only be processed for research where consent is given – Article 83(1)(a).
2. The only exception to this rule is where the research is deemed, on a member state by member state basis, to serve an ‘exceptionally high public interest’. In such a case, the data must be at least pseudonymous, preferably anonymous, and this processing is subject to prior authorisation by the competent supervisory authority – Article 83(1)(b).

Further amendments to Article 83 state that:

• Research bodies may only publish data where consent is gained or where the data subject has made the data public his- or herself. This removes the provision in the original draft allowing the publication of data where this is necessary to present research findings – Amendment 339.
• The Delegated Act which allowed the Commission to further specify the criteria and requirements for the processing of research data is removed and the details are instead embedded in the new paragraphs 1(a) and 1(b) – Amendment 341.
• Member states are to notify the Commission about any acts adopted pursuant to new paragraphs 1(a) and 1(b) – Amendment 342.

-* Data enabling identification of the subject (once made anonymous or pseudonymous) must be kept separately – the provision stating that this is case ‘as long as these purposes can be fulfilled in this manner’ is removed by Amendment 335.

The EPHA position and response to the original Commission proposal was broadly supportive of the provisions relating to health research. However, the health community has raised a number of concerns with the amendments offered by the draft report. The amendments made in the report state that processing of personal data for research is ‘not as urgent or compelling as public health or social protection’ (justification for amendment 27) and make the legal situation around use of registry-based data difficult to interpret – this also has an effect upon recruitment of subjects for clinical trials. The clause allowing for use of data without consent only in cases of ‘exceptionally high public interest’ is far too vague and does not clarify who is to classify research as ‘exceptional’ and what impact such an administrative process would have on the volume of research conducted. Finally, the extension of the scope to include pseudonymised data may increase regulatory burden for bodies conducting research.

EPHA is currently drafting a set of amendments to the draft report, in light of the concerns raised . The deadline for tabling amendments is 27 February and it is hoped that the plenary will adopt a final text before the end of the current parliamentary session.

– Further information

• Legislative Observatory file

—-
– EPHA related articles

• [->5211]
• [->5438]
• [->5529]
• [->5422]
• [->5551]