Impact of the European General Data Protection Regulation (GDPR) on Health Data Management in a European Union Candidate Country: A Case Study of Serbia (Preprint)

Abstract

UNSTRUCTURED As of May 2018, all relevant institutions in EEA member countries have to comply with the European General Data Protection Regulation (GDPR) or face significant fines. In addition to EEA countries, this regulation has a notable effect on EU candidate countries which are undergoing the process of harmonizing their legislature with EU, as part of their accession process. The Republic of Serbia is an example of a country which is not a member of the EU but is significantly impacted by the GDPR. Serbia’s new Personal Data Protection Act mirrors the majority of provisions given in the GDPR. We outline the context for the implementation of the new Act in Serbia, present the experiences of delivering change in health data management across the health system so far, and outline the impact on the capability of candidate countries to conduct international health data research projects. GDPR has an extraterritorial application for non-EU data controllers who process the data of the EU citizens and residents. This primarily affects Serbian private practices which target EU citizens, although some visitors also end up in the public healthcare institutions. Serbia is a popular destination for medical tourism due to low prices, quality services, and geographical proximity. There are also ex-pat visitors, dual citizens, regular tourists from EU, business visitors, and those in transit to and from member countries. Serbia generally does not have well-established procedures to support international research collaborations around data created in Serbian healthcare institutions. In simpler endeavors, arrangements can be made with institution management and their ethics committees and then secured through contracts. Even then, smaller institutions that have not previously participated in similar ventures may require approval or support from health authorities. Larger studies that involve multi-site data, typically require the support of central health system institutions such as MoH, NHIF or the National Institute of Public Health, as well as any relevant research data aggregators and EHR vendors. Lack of framework for preparation, anonymization, and assurance of privacy preservation requires the researchers to rely heavily on local expertise and support. Given the current limitation of its health and data governance systems and potential issues with the forthcoming legislation, it remains to be seen whether the move toward the GDPR will be beneficial for the Serbian health system and medical research, with respect to the protection of personal data and privacy rights and medical research capacity. Although significant progress has been made so far, direct application of implementation methods designed for more advanced health data environments can be risky but can also stimulate the community to move forward. Serbia needs a strategic approach at the country level, systematic elimination of the problems with insufficient resources in the area of data protection, and further development of a modern personal data protection regulatory and institutional environment. This can only be achieved through a targeted educational effort among health workers and decision makers, aiming to improve awareness and develop the necessary skills and knowledge in the workforce. Privacy Act; Patient Data Privacy; Data Sharing; Information Disclosure; Ethical Issues; Medical Tourists; Healthcare Systems; Privacy policies; Privacy protections; Social aspects of security and privacy