Reconciling the biomedical data commons and the GDPR: three lessons from the EUCAN ELSI collaboratory

Abstract

The coming-into-force of the EU General Data Protection Regulation (GDPR) is a watershed moment in the legal recognition of enforceable rights to informational self-determination. The rapid evolution of legal requirements applicable to data use, however, has the potential to outstrip the capabilities of networks of biomedical data users to respond to the shifting norms. It can also delegitimate established institutional bodies that are responsible for assessing and authorising the downstream use of data, including research ethics committees and institutional data custodians. These burdens are especially pronounced for clinical and research networks that are of transnational scale, because the legal compliance burden for outbound international data transfers from the EEA is especially high. Legislatures, courts, and regulators in the EU should therefore implement the following three legal changes. First, the responsibilities of particular actors in a data sharing network should be delimited through the contractual allocation of responsibilities between collaborators. Second, the use of data through secure data processing environments should not trigger the international transfer provisions of the GDPR. Third, the use of federated data analysis methodologies that do not provide analysis nodes or downstream users access to identifiable personal data as part of the outputs of those analyses should not be considered circumstances of joint controllership, nor lead to the users of non-identifiable data to be considered controllers or processors. These small clarifications of, or modifications to, the GDPR would facilitate the exchange of biomedical data amongst clinicians and researchers.

New implementation of data standards for AI in oncology. Experience from the EuCanImage project

“…Transfers of personal data to third countries or international organisations (i.e., data sharing with researchers or organisations located outside the EEA) remain a controversial issue 29,30 .…”

Challenges and solutions to system-wide use of precision oncology as the standard of care paradigm

“…Importantly, we cannot overlook the importance of patients’ knowledge and awareness about their own genomic data and the practice of clinical genomics and the necessity of comprehensive policies at both federal and state levels. The real-world adaptation to these barriers led to the re-evaluation of the EU’s General Data Protection Regulation (GDPR) with proposals for international secure data environments, clear responsibility delineations, and specific data analysis requirements (Bernier et al, 2023 ). To fully maximise the use of health data, NHS England recently invested £260 million in developing secure data environments (SDEs) as data storage and access platforms.…”