Amendments by the European Parliament pose a very serious threat to statistical and research work, particularly for health data. Fortunately, there is still time to ensure these amendments are not included in the final text and the research and statistics community must come together to oppose these amendments.
Nearly three years ago, the European Commission published a proposal for a new Data Protection Regulation. This would replace the EU Data Protection Directive from 1995 and associated member state law, such as the UK's Data Protection Act. The regulation is designed to bring the law on the use of personal data up to date, taking into account the growth of the internet since the 1995 directive. The regulation is also intended to ensure greater harmonisation across the EU since - unlike a directive - it will apply directly in all EU member states and does not need to be written into national law.
The regulation will apply to the processing of personal data - data that can directly or indirectly identify an individual - across nearly all sectors, such as marketing and social media. In their draft of the regulation, the European Commission struck a good balance in enabling the use of personal data for statistics and scientific research purposes, while protecting privacy. The Commission’s text included special provisions for statistics and scientific research purposes such that consent was not required for these purposes, under certain conditions. Exemptions from some of the regulation’s requirements were also included for statistics and research, for example allowing data to be stored indefinitely.
Since early 2012, the Commission’s text has been making its way through the European legislative process. In this process, the Council of Ministers - representing member states - and the European Parliament must independently form a position on the text, before coming together with the Commission to agree a compromise.
The European Parliament agreed its position in March 2014. The parliament’s amendments were developed over the summer of 2013 when Edward Snowden’s leaks about the use of personal data by the US and UK security agencies raised concerns about how technology companies and governments use data. In response, the parliament developed a package of amendments to the regulation intended to strengthen protections for data across all sectors. Research and statistics have become unfortunate victims of this reaction, since the package included amendments that would tightly restrict the way personal health data could be used for these purposes.
The parliament’s amendments to Articles 81 of the draft regulation have introduced a requirement for consent on the use of personal data concerning health for statistical and scientific research purposes. The regulation requires consent to be 'specific, explicit and informed' so this means that opt outs and broad consent would not be sufficient. The parliament’s amendments would allow member states to legislate for a very narrow exemption from consent. However, such an exemption could only apply to the use of pseudonymous data - where data are coded to mask the identity of the individual, but can still be traced back to them - not fully identifiable data. Further, the exemption could only be used where the research 'serves a high public interest' and 'cannot possibly be carried out otherwise'.
Of course, it is vital that personal health data are only used in an appropriate way and with safeguards that protect individuals. However, the parliament’s amendments fail to recognise important mechanisms that are already in place to protect individuals, such as independent ethics committee approval for research studies.
If these amendments were implemented, the narrow scope of the exemption from ‘specific’ consent and the disproportionately high bar to qualify for the exemption would have a devastating impact on the use of personal health data in research and statistics. Requiring specific consent in almost all cases would undermine studies based on broad consent and those where seeking consent would introduce unacceptable bias. Much research involving personal health data would become at worst illegal, and at best unworkable. As a result society would miss out on the benefits this research would have to offer.
The parliament adopted these amendments by an overwhelming majority. However, they only had a single vote on the full package of amendments. In the plenary debate, we were pleased to hear a number of MEPs raise concerns about these amendments and the impact on health research. Viviane Reding, then Commissioner for Justice, said that she wanted to see the Commission’s proposals on research maintained since they strike a balance between protecting individuals while facilitating 'indispensable research'.
The regulation continues to make its way through the legislative process and there is still time to make sure that these amendments are not passed into law. In December, the Council of Ministers agreed its position on statistical and scientific research purposes, which is much more positive than the parliament’s text. Once the Council has agreed its position on the rest of the legislation, they will enter negotiations with parliament to agree a compromise.