Data protection and the processing of personal data of very preterm (VPT) and very low birth weight (VLBW) children for scientific health research

The present article emerges from the project ‘RECAP preterm – Research on European Children and Adults Born Preterm’ which has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 733280. Under this project, a report, whose objective was to describe and compare the Challenges and Opportunities of Record-Linkage Processes, was developed by an ISPUP partner and presented in September 2019. Now, we discuss the issue focused on General Data Protection Regulation (GDPR) and national law, with a critical view as to how the legal regime for accessing routinely collected health and educational data and its subsequent processing for research purposes. The main results of this article are the reflection on the difficulties that scientific research faces and the consideration of future legislative changes in a world where data protection is a priority policy concern. Although scientific research in health is recognised by International, European and National law as an asset for the development of society, this article seeks to demonstrate that the possibilities for access and use of personal data, including sensitive data, are not broad.

Download Full-text

Introducing Key Elements Regarding Access to Personal Data for Scientific Research in the Perspective of Developing Innovative Medicines

European Journal of Health Law ◽

10.1163/15718093-bja10011 ◽

2020 ◽

Vol 27 (3) ◽

pp. 195-212

Author(s):

Jean Herveg ◽

Annagrazia Altavilla

Keyword(s):

Data Protection ◽

Open Data ◽

Scientific Research ◽

Personal Data ◽

Private Life ◽

Fundamental Rights ◽

Future Research ◽

General Data Protection Regulation ◽

Public Sector Information ◽

General Data

Abstract This article aims at opening discussions and promoting future research about key elements that should be taken into account when considering new ways to organise access to personal data for scientific research in the perspective of developing innovative medicines. It provides an overview of these key elements: the different ways of accessing data, the theory of the essential facilities, the Regulation on the Free Flow of Non-personal Data, the Directive on Open Data and the re-use of public sector information, and the General Data Protection Regulation (GDPR) rules on accessing personal data for scientific research. In the perspective of fostering research, promoting innovative medicines, and having all the raw data centralised in big databases localised in Europe, we suggest to further investigate the possibility to find acceptable and balanced solutions with complete respect of fundamental rights, as well as for private life and data protection.

Download Full-text

Protection of privacy in the period of Covid-19 pandemic

Law Journal of New Bulgarian University ◽

10.33919/ljnbu.20.2.2 ◽

2021 ◽

Vol 16 (2) ◽

pp. 63-75

Author(s):

Denitza Toptchiyska

Keyword(s):

Communication Networks ◽

Data Protection ◽

Personal Data ◽

Electronic Communications ◽

General Data Protection Regulation ◽

Personal Data Protection ◽

The Right To Privacy ◽

Legislative Amendments ◽

Legislative Changes ◽

The Right

During the pandemic of COVID-19 in April 2020 the Ministry of Health in Bulgaria began the administration of the Virusafe contact tracking application. With the Law on Emergency Measures and Actions, declared by a decision of the National Assembly of 13th March 2020 amendments to the Electronic Communications Act were adopted. The purpose of the legislative amendments was to provide access of the competent authorities to the localization data from the public electronic communication networks of the individuals, who have refused or do not fulfill the obligatory isolation or treatment under art. 61 of the Health Act. This publication aims to analyze the main features of mobile applications for tracking the contacts of infected persons, as well as the adopted legislative changes, comparing them with the standards of personal data protection provided in the EU General Data Protection Regulation 2016/679 and Directive 2002/58/EC on the right to privacy and electronic communications.

Download Full-text

The Impact of the New European Union General Data Protection Regulation (GDPR) on Data Collection at Mass Gatherings

Prehospital and Disaster Medicine ◽

10.1017/s1049023x19003042 ◽

2019 ◽

Vol 34 (s1) ◽

pp. s138-s138

Author(s):

Annelies Scholliers ◽

Dimitri De Fré ◽

Inge D’haese ◽

Stefan Gogaert

Keyword(s):

European Union ◽

Data Collection ◽

Data Protection ◽

Scientific Research ◽

Personal Data ◽

The European Union ◽

General Data Protection Regulation ◽

Mass Gatherings ◽

General Data ◽

The Law

Introduction:As of May 2018, a new European privacy law called the General Data Protection Regulation (GDPR) is in order. With this law, every organization operating in the European Union (EU), needs to adhere to a strict set of rules concerning collection and processing of personal data.Aim:To explore the consequences of the GDPR for data collection at mass gatherings in the European Union.Methods:Since the law was published on April 27, 2016, a thorough reading of the law was conducted by 4 persons with a background in mass gathering health. The GDPR consists of 99 articles organized into 11 chapters. There are also 173 recitals to further explain certain ambiguities. Key articles and recitals relating to healthcare and scientific research were identified. Possible pitfalls and opportunities for data collection and processing at mass gatherings were noted.Discussion:Under article 4, key definitions are noted. There is a clear definition of “data concerning health”. According to the GDPR, health data is a special category of personal data which should not be processed according to article 9(1). However, there is an exception for scientific research (article 9(2)(j)). There are a few safeguards in place, as laid out in article 89. One interesting point is that according to article 89(2), certain derogations can take place if the law interferes with scientific research. The GDPR has major consequences for data collection and processing in the EU. However, with the use of certain safeguards (e.g., pseudonymization) there are still ample opportunities for scientific research. It is important to review one’s method of data collection to make sure it complies with the GDPR.

Download Full-text

Ethics appraisal procedure in 79,670 Marie Skłodowska-Curie proposals from the entire European HORIZON 2020 research and innovation program (2014–2020): A retrospective analysis

PLoS ONE ◽

10.1371/journal.pone.0259582 ◽

2021 ◽

Vol 16 (11) ◽

pp. e0259582

Author(s):

Ilse De Waele ◽

David Wizel ◽

Livia Puljak ◽

Zvonimir Koporc

Keyword(s):

Retrospective Analysis ◽

Data Protection ◽

Ethical Issues ◽

Personal Data ◽

Implementation Phase ◽

Horizon 2020 ◽

Personal Data Protection ◽

Research And Innovation ◽

Ethics Assessment ◽

Anonymized Data

Introduction Horizon 2020 was the most significant EU Research and Innovation programme ever implemented and included the Marie Skłodowska-Curie Actions (MSCA). Proposals submitted to the MSCA actions awere subject to the Ethics Appraisal Procedure. In this work we explored the ethics appraisal procedure in MSCA H2020. Methods Using a retrospective analysis of pooled anonymized data, we explored the ethics appraisal procedure on proposals submitted to Marie Skłodowska-Curie Actions (MSCA) during the entire Horizon 2020 program period (N = 79,670). Results Our results showed that one of the most frequently identified ethics categories was Data protection. We also detected slight differences between applicants’ and the ethics reviewers’ awareness of ethical issues. Trajectory analysis of all ethics screened proposals appearing on main lists showed that a minimal portion of all screened submissions required additional ethics checks in the project implementation phase. Conclusion Personal data protection is one of the most represented ethics categories indicated among MSCA actions which exhaust ethics assessment efforts and may lead to “overkills” in ethics requirements. Excluding the majority of personal data protection assessment from the ethics assessment, except for parts which are directly related to ethics like “Informed consent procedures”, might be necessary in the future. A gap in understanding of ethics issues between applicants and reviewers’ points to the necessity to further educate researchers on research ethics issues.

Download Full-text

Introduction

GDPR and Biobanking - Law, Governance and Technology Series ◽

10.1007/978-3-030-49388-2_1 ◽

2021 ◽

pp. 1-7

Author(s):

Santa Slokenberga ◽

Olga Tzortzatou ◽

Jane Reichel

Keyword(s):

Data Protection ◽

Scientific Research ◽

Personal Data ◽

Practical Experience ◽

General Data Protection Regulation ◽

Eu Member States ◽

General Data ◽

The Uk ◽

Shed Light

AbstractThe General Data Protection Regulation (GDPR) is already four years old legal instrument, with over two years of practical experience, yet, several central questions on its application, its importance in scientific research, rights of the data subjects, and obligations on the controllers and processors remain uncharted. In this edited volume, questions ranging from the meaning of the GDPR provisions for a particular research project to impact of the GDPR on long term collaborations, when the UK is leaving the EU are is discussed. This chapter sets out the aim of this book and provides an overview of how various contributions interplay to shed light on how the GDPR shapes the research regimes on the use of personal data in biobanking by EU Member States.

Download Full-text

Przetwarzanie danych osobowych do celów badań naukowych. Aspekty prawne

Studia Prawa Publicznego ◽

10.14746/spp.2019.4.28.4 ◽

2019 ◽

pp. 79-101 ◽

Cited By ~ 1

Author(s):

Aleksandra Pyka

Keyword(s):

Data Processing ◽

Data Protection ◽

Scientific Research ◽

Personal Data ◽

National Legislation ◽

General Data Protection Regulation ◽

Criminal Convictions ◽

General Data ◽

Technical And Organizational Measures ◽

Volume Range

This article refers to the issue of personal data processing conducted in connection with scientific research and in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). It is not uncommon for the purposes of scientific research to process personal data, which is connected with the obligation to respect the rights of the data of the subjects involved. Entities conducting scientific research that process personal data for this purpose are required to apply the general regulation governing, among others, the obligations imposed on the controllers. The issue of personal data processing for scientific research purposes has also been regulated in national legislation in connection with the need to apply the General Data Protection Regulation. The article discusses the basics of the admissibility of data processing for the needs of scientific research; providing personal data regarding criminal convictions and offences extracted from public registers at the request of the entity conducting scientific research; exercising the rights of the data of the subjects concerned; as well as the implementation of appropriate technical and organizational measures to ensure the security of data processing. In addition, the article discusses the issue of anonymization of personal data carried out after achieving the purpose of personal data processing, as well as the processing of special categories of personal data. The topics discussed in the article were not discussed in detail, as this would require further elaboration in a publication with a much wider volume range.

Download Full-text

Compatibility of a Security Policy for a Cloud-based Healthcare System with the EU General Data Protection Regulation (GDPR)

10.20944/preprints202010.0577.v1 ◽

2020 ◽

Author(s):

Dimitra Georgiou ◽

Costas Lambrinoudakis

Keyword(s):

Data Protection ◽

Security Policy ◽

Health Care Systems ◽

Personal Data ◽

Legal Framework ◽

Security And Privacy ◽

Security Measures ◽

Sensitive Data ◽

General Data Protection Regulation ◽

General Data

Currently, there are several challenges that Cloud-based health-care Systems, around the world, are facing. The most important issue is to ensure security and privacy or in other words to ensure the confidentiality, integrity and availability of the data. Although the main provisions for data security and privacy were present in the former legal framework for the protection of personal data, the General Data Protection Regulation (GDPR) introduces new concepts and new requirements. In this paper, we present the main changes and the key challenges of the General Data Protection Regulation, and also at the same time we present how the Cloud-based Security Policy methodology proposed in [1] could be modified in order to be compliant with the GDPR and how Cloud environments can assist developers to build secure and GDPR compliant Cloud-based health Systems. The major concept of this paper is, primarily, to facilitate Cloud Providers in comprehending the framework of the new General Data Protection Regulation and secondly, to identify security measures and security policy rules for the protection of sensitive data in a Cloud-based Health System, following our risk-based Security Policy Methodology that assesses the associated security risks and takes into account different requirements from patients, hospitals, and various other professional and organizational actors.

Download Full-text

COVID-19 Research: Navigating the European General Data Protection Regulation (Preprint)

10.2196/preprints.19799 ◽

2020 ◽

Author(s):

Regina Becker ◽

Adrian Thorogood ◽

Johan Ordish ◽

Michael J.S. Beauvais

Keyword(s):

Public Interest ◽

Data Protection ◽

Personal Data ◽

Individual Member ◽

Sensitive Data ◽

General Data Protection Regulation ◽

The Public ◽

General Data ◽

High Standards ◽

National Legislatures

UNSTRUCTURED Researchers must collaborate globally to rapidly respond to the COVID-19 pandemic. In Europe, the General Data Protection Regulation (GDPR) regulates the processing of personal data, including health data of value to researchers. Even during a pandemic, research still requires a legal basis for the processing of sensitive data, additional justification for its processing, and a basis for any transfer of data outside Europe. The GDPR does provide legal grounds and derogations that can support research addressing a pandemic, if the data processing activities are proportionate to the aim pursued and accompanied by suitable safeguards. During a pandemic, a public interest basis may be more promising for research than a consent basis, given the high standards set out in the GDPR. However, the GDPR leaves many aspects of the public interest basis to be determined by individual Member States, which have not fully or uniformly made use of all options. The consequence is an inconsistent legal patchwork that displays insufficient clarity and impedes joint approaches. The COVID-19 experience provides lessons for national legislatures. Responsiveness to pandemics requires clear and harmonized laws that consider the related practical challenges and support collaborative global research in the public interest.

Download Full-text

General Data Protection Regulation and Horizon 2020 Ethics Review Process: Ethics Compliance under GDPR

Bioethica ◽

10.12681/bioeth.20832 ◽

2019 ◽

Vol 5 (1) ◽

pp. 6

Author(s):

Albena Kuyumdzhieva

Keyword(s):

Data Processing ◽

Data Protection ◽

Personal Data ◽

Research Field ◽

Research Projects ◽

Horizon 2020 ◽

General Data Protection Regulation ◽

Main Research ◽

General Data ◽

European Programme

The present manuscript examines the new ethics data protection requirements introduced for the research projects funded by the European Programme Horizon 2020.Initially, reference is made to the basic data protection principles introduced by the General Data Protection Regulation (GDPR) and the derogations permitted in the research field in favor of the science advancement. Although these derogations are subject to a number of safeguards to protect personal data, new ethics requirements are introduced for research projects funded by the European Programme Horizon 2020. The aim of these safeguards is the increased transparency and accountability at the data processing and the consequent enhanced protection of the individuals’ rights. These requirements are geared to the main research ethics postulate, which requires free, voluntary and informed participation of the research subject.Under these new requirements, Horizon 2020 beneficiaries/applicants must comply with a set of predefined standards, reflecting their ethical and legal obligations, provide a detailed and precise description of the technical and organisational measures that will be implemented in order to safeguard the rights of the research participants and also demonstrate their observance. In addition, depending on the type of the data being processed and the data processing techniques, the H2020 applicants/beneficiaries may need to provide a number of additional documents/explanations and implement further measures.

Download Full-text

COVID-19 Research: Navigating the European General Data Protection Regulation

Journal of Medical Internet Research ◽

10.2196/19799 ◽

2020 ◽

Vol 22 (8) ◽

pp. e19799 ◽

Cited By ~ 1

Author(s):

Regina Becker ◽

Adrian Thorogood ◽

Johan Ordish ◽

Michael J.S. Beauvais

Keyword(s):

Public Interest ◽

Data Protection ◽

Personal Data ◽

Individual Member ◽

Sensitive Data ◽

General Data Protection Regulation ◽

The Public ◽

General Data ◽

High Standards ◽

National Legislatures

Researchers must collaborate globally to rapidly respond to the COVID-19 pandemic. In Europe, the General Data Protection Regulation (GDPR) regulates the processing of personal data, including health data of value to researchers. Even during a pandemic, research still requires a legal basis for the processing of sensitive data, additional justification for its processing, and a basis for any transfer of data outside Europe. The GDPR does provide legal grounds and derogations that can support research addressing a pandemic, if the data processing activities are proportionate to the aim pursued and accompanied by suitable safeguards. During a pandemic, a public interest basis may be more promising for research than a consent basis, given the high standards set out in the GDPR. However, the GDPR leaves many aspects of the public interest basis to be determined by individual Member States, which have not fully or uniformly made use of all options. The consequence is an inconsistent legal patchwork that displays insufficient clarity and impedes joint approaches. The COVID-19 experience provides lessons for national legislatures. Responsiveness to pandemics requires clear and harmonized laws that consider the related practical challenges and support collaborative global research in the public interest.

Download Full-text