Data protection and research in the European Union: a major step forward, with a step back

After a lengthy process that began in 2012, the General Data Protection Regulation 2016/679 (GDPR) of European Union (EU) finally came into force on 25 May 2018.1Regulation Parliament and Council 27 April 2016 protection natural persons with regard to processing personal data free movement such data, repealing Directive 95/46/EC (General Regulation). https://eur-lex.europa.eu/eli/reg/2016/679/oj.Google Scholar The past 8 years have seen numerous discussions surrounding GDPR. Although health research is not one its major focus areas, GDPR has become matter great concern for community. intense advocacy, supported by entire oncology community, Society Medical Oncology (ESMO) other co-signing parties found final text be positive improvement over originally approved version 2014 Parliament.2European ParliamentEuropean website.http://www.europarl.europa.euDate: 2020Date accessed: February 24, 2020Google ESMO welcomed text’s recognition principle ‘one-time consent’ retrospective biobanking ‘no population-based registries, two concepts which were heavily advocated community years. However, challenge interpreting implementing across all EU countries persists. In pursuing this goal, an body, Board (EDPB) (which replaced so called Article 29 Working Party) adopted guidelines, some interpretations relating scientific research, are community.3European Board, Guidelines 05/2020 consent under 2016/679. Version 1.1. Adopted 4, 2020. https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf.Google Certainly, many barriers remain securing future consistent well-regulated framework. immediately recognised potential impact could led 6-year-long advocacy action plan protect from unintended consequences Regulation. This towards policymakers, idea while fully protecting privacy patient should jeopardise clinical, translational epidemiological EU. case was summarised position paper published Annals 2014.4Casali P.G. SwitzerlandRisks new Regulation: endorsed community.Ann Oncol. 2014; 25: 1458-1461Abstract Full Text PDF PubMed Scopus (24) Google Undoubtedly, crucial piece legislation will greatly including research. First, being regulation, it directly became part Member States’ laws, no transposition. Second, breadth GDPR’s ranges usage clinical starting cancer registries. Observational simplest form medicine. It allows clinicians look back at their previous cases learn them. may translate series analyses or reports, turn constitute knowledge generate hypotheses tested through prospective trials. Retrospective can also serve as external controls uncontrolled studies. addition observational done biological samples, is, tumours tissues, viewed packages data. combination samples gives rise ‘biobanking’, becoming essential component ‘precision medicine’. fact, having ability clinically annotated Two issues regarding ethics legality storing using purposes need addressed. tissues stored safest conditions, patient’s protected highest standards possible. strict apply stored, records kept hospital surgically excised tumour hosted archives pathology department. Strict place, independent planned use whether not. Evidently, any undergo scrutiny institutional review boards, committees, etc., patients’ rights what specifically takes place purposes. right, principle, informed about his/her tissue purposes, nonclinical reasons. Informed element medical ethics. Thus, retain right not, concerning If been given, withdrawable time (of course, before project). context GDPR, discussion around one-time focused ‘specific’, extent specificity carried out given detailed. most cases, when difficult foresee specific aim For example, nature agents discovered cannot foreseen collected, say, (and department, or, deliberately biorepository). Likewise, why automatically hospital’s (e.g. electronic record), interest if, few (that collected safeguards) used researcher, after several years, retrospectively see they responded medicine, would patients ‘reconsented’? Or if sample assessed expression molecular target hit anticancer agent, mean researcher seek ‘reconsent’ patient? reasons obvious clinician, reconsenting often impossible, very least highly burdensome, unreasonably intrusive life, contacted long intervals disease. practice, prevent physicians information otherwise easy collect prove extremely useful reality, giving initial ‘donate’ and/or words, dissent, but paradoxically first place. While goes without saying (i.e. tissues), lack option donate further illiberal violate certain human rights, improving benefit health. Ultimately, Population-based disease registries provide incredible array how diseases behave, quality care affects outcomes correlates risk factors, among others. oncology, understand trends occurrence, correlate survival changes systems, assess outcome newly implemented treatments, actions policy establish plans measure effectiveness. Specifically, incidence, prevalence cancer, improve understanding evolving scenarios worldwide. These currently try widen scope beyond basic pathologic diagnosis date death. trivial note public researchers predict disease, estimation needs population, population. Even single dissenting flawed represent population anymore. vital work ‘no-consent’ policies, high subject operational rules. possible define setting running procedures responsibilities means law, kind no-consent them survive. negotiations, amendments compromises resulted considered alleviated our concerns. reflects main points (i) retrospective, (ii) explained via recitals, those statements recalling assumptions upon articles based. interpreted accompanying relevant research.•GDPR Recital 33 acknowledges ‘it identify purpose collection’.1Regulation recognises unknown states ‘(…) allowed give areas keeping ethical research’. Depending wishes, ‘only parts projects’, withdrawn. Importantly, another recently Regulation, Clinical Trials No 536/2014 (CTR), come operation ‘full functionality’ Information System achieved. incorporates notion consent’.5Regulation 16 trials medicinal products use, 2001/20/EC. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32014R0536.Google CTR that: appropriate universities institutions, circumstances accordance applicable law protection, able example medical, social sciences order necessary his her outside protocol trial withdraw time’. Furthermore, CTR, 28 reinforces aforementioned (as read conjunction each other) ‘give (…) participate exclusively purposes’.3European acknowledged trials, case, end trial. All must take ‘without prejudice’ provisions, comply framework GDPR.•With respect 157 ‘by coupling obtain value widespread conditions cardiovascular depression’.1Regulation reiterates ‘research results obtained solid, high-quality basis formulation implementation knowledge-based policy, life number people efficiency services’. Therefore, ‘in facilitate processed safeguards set State law’. Simply put, even consent, provided privacy-protecting complied with. Lastly, 52 stating ‘derogating prohibition special categories suitable safeguards, fundamental where do so, particular field employment pensions security, monitoring alert prevention control communicable serious threats Such derogation made management health-care services’.1Regulation 2018. Significantly, ‘regulation’ ‘directive’, compared predecessor (the 1995 Directive, 1995/46/EC). A regulation differs directive because binding countries, national provisions ruling bodies parliaments governments). important because, ensure agreed between institutions States consistently aim: creating instead directive. that, wording still lines directive, State-by-Member basis. ‘authorities’. Throughout last 6 behalf continuously stressed harmonious 1995/46/EC fragmented approach EU, allowing foster others create unattractive environments. An uneven rule obstacle collaborative face additional difficulties due discrepancies regulations. As 2018, body ‘Article Party’ (EDPB). EDPB oversees application rules, ensuring safeguarding cooperation EU’s authorities. Their role includes delivering guidelines core equally interpreted, oversee disputes States. theory, guarantee dealt uniform manner, thus effectively upheld case. delivered Party revised 10 4 intend clarify ambiguous definitions within articles. concept specifying mentioned earlier 33. acknowledge there flexibility degree specification advise ‘applying flexible stricter interpretation requires scrutiny’ data.3European Despite intent deal uncertainty Recital, therefore leave room constitutes ‘a scrutiny’, meaning guidance discrepant text. corresponding witnessed concrete examples inconsistencies ‘interpretations’ applied ground varying ways country country. result levels, either differing, instances, exist all. indeed asserts provided, aspects related resulting same Directive. together EDPB, supervisory authorities harmonise especially comes sharing (including Economic Area United Kingdom). More best share secure instance, promoting technologies. cause urges following consideration, GDPR:•GDPR guarantee, States, provide, willing, reviewing (institutional boards committees);•GDPR operate supervision bodies;•Recital (2) enrolled significant safeguard realm Parliament, Commission worked tirelessly framework, aims environment user. principles Recitals 157, CTR. We now opportunity these fact harmonised allow continue rely uphold outlined other. Patients health-research Denying denying civil right. authors wish support contributions Executive well societies endorsing manuscript, listed below.