Strong negotiation underway to prevent new Data Protection Directive to limit research
Some of the largest, most prestigious non-commercial research organisations in Europe are up in arms. They are warning that the EU is set to strangle health-saving research, while threatening the use of routinely collected data to improve patient health. Meanwhile, significant European investments in genetics, cohort studies, biobanks and disease registries, they believe, would also be put at risk. That is, if it adheres to the European Parliament’s text for upcoming data protection legislation. Some critics warn that research is falling victim to a spy scandal: that Parliament embarked on a mistaken course to protect data in the heat of the Edward Snowden revelations on US espionage. This leaves open all sorts of negative consequences, should the legislation not make suitable exceptions to allow research of potential future societal value go ahead, and instead privacy at all costs triumphs everything.
The Parliament, in 2014, adopted amendments to the Data Protection Regulation. The original draft by the European Commission set out a mechanism for protecting privacy, while allowing health and scientific research to continue. The Parliament’s amendments, voted on before the last European elections, would be highly detrimental for medical research and have pernicious consequences for scientific research, critics say.
The League of European Research Universities (LERU) is one such critic. It is calling upon the Council of Ministers to reject the damaging amendments; in particular those to Article 81 and Article 83. Negotiations between the Council and Parliament are expected to begin around June. “As a lawyer myself, I understand the concerns about data privacy protection and that there should be limits to what you can do with people’s data,” says Kurt Deketelaere, secretary general of LERU, based in Brussels, Belgium. “But if each time we have to ask consent for people to use data it would make it impossible to run a lot of the research that university institutes and hospitals are running now. It would even threaten some of the EU’s own research projects.”
Critics of the Parliament’s proposed amendments note that the committee charged with looking over this legislation was LIBE, the Committee on Civil Liberties, Justice and Home Affairs, which has a human rights focus. “I don’t think representatives of countries have set out to oppose research,” says Deketelaere. “This regulation came up during the whole battle between the EU and the United States, espionage and hacking of EU databases. And, as a consequence, it was a difficult position politically and the Parliament reacted in a forceful way. I think a lot of the MEPs really didn’t see the consequences [for medical research].”
Download a free PDF version of the article and spread it!Although the LIBE committee’s area of expertise is not in research, they did receive an insightful opinion from the Committee on Industry, Research and Energy (ITRE). The issue was therefore flagged, according to Beth Thompson, policy advisor at the medical charity Wellcome Trust in London, UK. “We were disappointed they didn’t take the ITRE committee’s recommendations into account,” says Thompson.
Council’s position
In the proposed Directive, Article 81 and 83 have been the object of most debate. On 4th December 2014, the Council announced that it had agreed a “general approach” on Article 83, but not on Article 81. The Council – composed of Member States – has made progress recently but has yet to adopt a position. In the Commission’s original text, Article 81 sets out special rules for processing data concerning health in healthcare and public health, while Article 83 sets out provisions for the use of all types of personal data for statistical, historical and scientific research purposes.
Once the Council has reached an agreement on both articles, it will begin negotiations with the Parliament over the text of the regulation, with the Commission forming the third leg of these trilogue discussions.
Regulations can only be adopted if the Council and Parliament adopt the same text, sentence by sentence, word by word. Some observers believe the process is not likely to be completed until the second half of 2015 at the earliest; this leaves plenty of time for lobbying before negotiations. Medical organisations are confident that the Council’s position will be far closer to the original text proposed by the Commission.
Classic case of over-regulation
The Wellcome Trust had expressed concerns about Articles 81 and 83 back in January, updating a statement twice since. It said that the Parliament’s amendments would make it difficult, if not impossible in practice, to use pseudonymised data concerning health – where an individual’s identity is masked to protect privacy – without specific consent. The Trust also argued that “sometimes researchers need details such as age, postcode and information on a health condition that together could disclose the identity of an individual, but the study would not be possible without it.”
The Trust noted in this position statement that the European Prospective Investigation into Cancer and Nutrition (EPIC)—the largest study of diet and health ever undertaken, involving half a million European citizens— would be put at risk by the Parliament’s amendments. This is because the investigation uses broad consent from participants to allow researchers to access relevant data through proper governance arrangements.
“These proposed amendments could have a devastating impact on health research if adopted, because they fail to recognise the important safeguards that are in place to look after health research data,” says Beth Thompson, policy advisor at the Wellcome Trust. “It would have a damaging impact on life-saving research.” She says EPIC, as an example, will help European citizens make better decisions in future affecting their health. “It looks at impacts of drinking wine or eating red meat on cancer prevalence and other issues which are really important.”
The position statement was signed by dozens of non-profit organisations, such as the Alliance for European Diabetes, Cancer Research UK, the Czech Medical Academy, EUROCAT: European Surveillance of Congenital Anomalies, the Max-Planck-Gesellschaft, the European Heart Network, the Health Law Association, in Spain, and the Italian National Academy of Medicine. The campaign continues through the website Data Saves Lives.
These regulations would affect big datasets across Europe where participants give consent that their data be used in future to ask new research questions, even though these questions are not known at that time, explains Peter Weissberg, medical director of the British Heart Foundation, in London, UK, another signatory of the position statement. “These questions are left open, because we don’t know what the big questions will be in the future, but these datasets are built up over years or decades even.”
Medical research is not all about discovering new drugs, he adds. “The way we found out about some rare side effects of drugs is by collecting large amounts of data and then realising there is a link between people taking a particular drug and a particular condition. The best example is commonly used anti-arthritis drugs which were discovered, through data linkage, to be causing heart attacks.”
[Tweet “Medical research is not all about discovering new drugs”]
The Wellcome Trust position statement urges the Council and the European Commission to oppose the European Parliament’s amendments to Articles 81 and 83. However, some researchers remain unconvinced by the arguments from medical organisations. CEPIS, the representative European body of national informatics associations, has expressed support for the Parliament’s position and backed a statement signed by more than 100 leading academics.
Societal value above privacy?
This brings the question of whether societal value needs to be placed above privacy. “You see in the Wellcome Trust statement that science comes to an end if consent is required, but I wonder if that is true,” says Kai Ranneberg, identity management expert at Goethe University Frankfurt, Germany. “If something is of high societal value, then privileges can still be granted by member states law [according to the Parliament’s text]. And for a law one would have a public discussion about the importance of the research project in relation to the risks caused by data processing without consent by the individual whose data are processed,” he notes, adding: “A critical question is who actually owns personal data. Do the people described by the data own it, or do those who do the measurements own it?”
He also questions the robustness of the sanctions open to ethical boards for research in the face of damaging information leaks. “We need to consider the sensitivity of data now. What if data points to the possibility of you having cancer in five years’ time and that information leaks out to an insurance company? We need harder laws than the soft law of ethical boards.” Ranneberg says the privileges accorded to medical researchers regards patient data came in long before electronic data processing and data protection as a concept were even born, and that the world is a very different place now.
The reality is that data is not as private as before. “There’s been a paradigm shift. Data releases now are much harder to limit or even control and the danger for individuals, that data are being combined to their disadvantage, is much higher today,” Ranneberg adds. There is also the question of what constitutes “research,” if research were to be granted a pass on data protection legislation. “Would this include commercial market research? If the characterisation as research could be used to override the requirement for consent and other protections provided for in the data protection regulation it would become very tempting to declare work as research. The more it is important that any exemption from consent for research purposes is based on law and serving exceptionally high public interest”.
[Tweet “The reality is that data is not as private as before”]
Farming out hot potatoes
A possible compromise outcome, if the Council and Parliament cannot reach agreement, could be the issue of consent being delegated back to Member States, according to Deketelaere. “This is something as researchers we would not like to see. We would like to have a level playing field throughout the 28 member states,” he explains. “My worry is that the EU is pushing a number of hot potatoes back to Member States, which we have seen with GMO legislation a number of weeks ago.”
Others commentators see this as having disadvantages from the point of view of patients and researchers, but believe it could be a pragmatic compromise that would not much upset the status quo. Rather it would be a missed opportunity for European health researchers and patients.
Nonetheless, a remark at a conference in December has been seized upon as offering a way of diverting around a blowback storm. Jan Philipp Albrecht, German MEP and one of the key draftsmen on the data protection legislation in the LIBE committee, told the 5th Annual Data Protection and Privacy conference held in December 2014 in Brussels: “There will be huge exceptions for research in the new regulation.” Impending negotiations should reveal what it all means for European researchers and citizens.
Do you believe the Data Privacy Directive is an over-reaction to the Snowden revelations?
Is the proposed Data Privacy Directive likely to harm research?
Your thoughts and opinions are valuable, feel free to use our simple comment section below.
Featured image credit: CC BY-NC-ND 2.0 by Elif Ayiter
EuroScientist is looking for contributors!
If you would like to write guest posts in EuroScientist magazine, send us your suggestions of articles at office@euroscientist.com.
Go back to the Special Issue: Data privacy
- Citizen journalism: A phenomenon that is here to stay - 13 July, 2017
- Olafur Eliasson: art, science and environmental consciousness - 27 June, 2017
- The logic behind the Stop Vivisection campaign - 13 May, 2015
EuroScientist journal 