General Data Protection Regulation (GDPR) and implications for research

Abstract

There has been a lot of discussion and debate in various forums regarding how the European Union (EU) General Data Protection Regulation (GDPR), 2016/679/EU [1], which comes into force on the 25th May 2018, will affect research. Anecdotally, a lot of this discussion has been negative and angst ridden; focusing on what will not be allowed after GDPR comes into force. European Union Regulations are directly enforceable within the EU member states, without the need for domestic legislation, and, regardless of what happens in the United Kingdom (UK) as a result of Brexit, the UK will be part of the European Union on that date and have to comply with the law at that time. The GDPR has effective since 24th May 2016 [2], having a two year transitional period from the Data Protection Directive (Directive 95/46/EC) [3] that it is replacing. The Data Protection Directive was concerned with 'the processing of personal data and on the free movement of such data' (preamble Directive 95/46/EC) [3]. In the UK this was enacted through the Data Protection Act 1998 (DPA 1998) [4]. The DPA 1998 was based around eight data protection principles (Schedule 1 Data Protection Act 1998) and these principles remain in the GDPR. Indeed the reason for the new legislation is that it is almost 20 years since DPA 1998 became law, and the changes in the way society communicates and the amount of information available about individuals, the way that data can be collected, stored, and the use that information is put to means that the existing legislation is no longer fit for purpose. Although the GDPR encompasses the original eight principles in the DPA 1998, it applies these objectives to the modern world. The GDPR is quite a large piece of legislation having 99 Articles, although it can be said to have three main objectives. These objectives are: to provide rules for the protection of the personal data of natural persons and the processing of their personal data; to protect the fundamental rights and freedoms of natural persons, particularly with regard to their personal data; and, to ensure that personal data can move freely within the European Union (Article 1 GDPR). In short the GDPR is concerned with working practices in the way that personal data is handled and used, including how it is shared. Most of the Articles within the GDPR concern corporations and organisations and the way in which they handle personal data. Much of this will have little effect on individual researchers. However, there are some provisions within the GDPR that will affect researchers directly. Obviously it is not possible to go through all the Articles in this editorial; however there are common areas that appear to be of concern to many of the researchers I have spoken with. These areas being:

Impact of the General Data Protection Regulation on Clinical Proteomics Research

“…In particular, based on Article 1 of the GDPR, the overarching objectives of the legislative measures taken are: a) to provide rules for the protection and processing of personal data; b) to protect the fundamental rights and freedoms of individuals, particularly in relation to their personal data, and c) to ensure that personal data can move freely within the EU . The GDPR has several inherent attributes, as it seeks to modernize the previously implemented Data Protection Directive (Directive 95/46/EC) with the current realities regarding the obtaining and further use of personal information collected from European citizens, explicitly placing foremost priority on individuals’ related rights and needs.…”

“…The main issues of concern regard GDPR legislative requirements for informed consent for study subjects’ data collection and processing, data anonymization, and data storage and/or sharing . Specific research areas anticipated to be most affected include those encompassing the use of research databanks and biobanks, such as those often used within the context of clinical proteomics investigations.…”

“…Finally, the right of participants to withdraw at any time from the study, and by extent the right to complete erasure of their data, is a particular cause of concern . The right to erasure entails that data already coded according to GDPR provisions below will have to be removed, along with their omission from any already delivered reports and/or publications.…”

“…Particularly for longitudinal cohort investigations and interventional trials, the right to erasure may compromise the stability of study design and populations, and most importantly adversely impact both the internal and external validity of research studies conducted. However, according to Article 17, data may not be necessarily required to be removed on the premise of the right to erasure if it was lawfully collected and is still necessary for the purpose of research for which it was obtained …”

“…According to Chapter V of the EU regarding the transfer of data outside of the EU, data may be shared outside of the EU. However, individual's rights to data protection and sharing may not be compromised by laws in force in third party countries to which data is transferred and/or shared . One of the limiting factors, though, based on Article 20 of the GDPR, is that data ought to be portable and hence readily received and reviewed by study participants.…”