The European Context

Data protection law has a long history in Europe and the continent's political and cultural contexts, such as secret police surveillance in East Germany, help explain a long tradition of citizens and governments alike seeking to craft a status of noninterference in individuals' private lives; indeed, the first modern data protection laws in the world were passed in the early 1970s in Germany (Hesse Data Protection Act in 1970) and Sweden (Data Act in 1973).

Unlike in countries such as the US or Canada, where the starting presumption in law is that processing personal data is lawful unless it is expressly forbidden, in Europe, processing personal data is prohibited unless there is a lawful basis that permits it. Moreover, data protection law in Europe is “omnibus,” which is to say that, subject to a few exceptions such as personal data processing relating to law enforcement⁷ and “purely personal or household activities,”⁸ it is all-encompassing in its regulatory reach — covering private and public entities, individuals and companies, all types of data, and in all sectors. Essentially, if any data relating to a living person are being collected, used, or shared, they will be regulated. We can compare this sweeping approach to narrow, sector-specific data protection laws in the US, such as California's recently enacted California Consumer Privacy Act of 2018,⁹ which applies to “businesses” (and only those which are large and for-profit), “service providers,” “third parties,” and “consumers,” or the federal Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule,¹⁰ which covers only “individually identifiable health information” (also known as “protected health information”) and applies only to “covered entities and business associates.”

The 1995 Data Protection Directive

European data protection law has built on the work of the OECD's non-binding Guidelines on the Protection of Privacy and Transborder Flows of Personal Data,¹³ first established in 1980, and the Council of Europe's binding 1981 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), the latter of which has been ratified by 53 countries to date.¹⁴ As part of the motivating desire for “ever closer Union,” in the late 1980s the European Commission set out to harmonize data protection laws across the EU's Member States and encourage those Member States lacking comprehensive data protection laws (e.g. Italy, Spain, Greece) to establish them.^{Reference Bygrave15} The resulting Data Protection Directive (95/46/EC), adopted in October 1995, aimed to both harmonize the protection of fundamental rights and freedoms of European citizens in respect of processing activities, and also to ensure the free flow of personal data between Member States.¹⁶

Under EU law, a Directive requires Member States to “transpose” the Directive into their national legislation; in other words, the national legislation must achieve the goals set by the Directive, but how they achieve these is for each national Member State to decide (see also Box 2). This has the benefit of allowing Member States to tailor the Directive to specific national characteristics — but this is also its main drawback. Permitting Member States room to maneuver in this transposition process can undermine the driving regulatory purpose behind any EU legislation: harmonization and/or approximation of laws across the Union. By the end of the first decade of the 2000s, it had become clear to many that not only was the 1995 Directive losing relevance in the age of digital technology-enabled massive, dynamic global data flows, but also that, as the GDPR states itself in the Recitals (i.e. the context-providing paragraphs that appear before the Articles), it had “not prevented fragmentation in the implementation of data protection across the Union, legal uncertainty or a widespread public perception that there are significant risks to the protection of natural persons, in particular with regard to online activity.”¹⁷ There were concerns that differences in the level of protection of the rights and freedoms of Europeans, in particular the right to the protection of personal data,¹⁸ with regard to the processing of personal data in the Member States could prevent the free flow of personal data throughout the EU, constituting an obstacle to the pursuit of economic activities at the EU level, distort competition, and impede authorities in the discharge of their responsibilities under EU law.^{Reference Poullet19}

More specific to the research context, the Data Protection Directive lacked clear provisions on scientific and biomedical research; to the extent that reference to scientific research was made, it was “rather piecemeal and problematic.”^{Reference Townend20} Scientific research — and what it meant (e.g. did it cover biomedical research?) — failed to appear in a stand-alone article. By appearing in a number of places across the Directive, and written in inconsistent language without a consistent theory, scientific research often had to be worked through Member State derogation to determine “appropriate safeguards,” causing regulatory dis-harmony, and helter-skelter implementation of internationally collaborative research.^{Reference Beyleveld21}

The Move from Directive to Regulation

In order to ensure a consistent and high level of protection of European citizens and to remove the obstacles to flows of personal data within the EU, the European Commission, among other regulatory bodies, urged that the level of protection of the rights and freedoms of European citizens with regard to the processing of such data should be equivalent across all Member States, with consistent and homogenous application of the rules for the protection of fundamental rights and freedoms. In principle, a Regulation achieves this better than a Directive. As implied above, under EU law, a Regulation is a binding legislative act with no need for transposition. It is directly effective and must be applied in its entirety across the EU; as such, it does not require a national law to implement its provisions. (This said, as we will see, the GDPR also provides an unusually wide margin of maneuver for Member States to specify its rules, including for the processing of special categories of personal data, known colloquially as “sensitive data.”)

Consequently, beginning in January 2012 with a European Commission draft text and culminating with its adoption in May 2016, the GDPR serves as a modern, fit-for-purpose Regulation that replaces the Data Protective Directive. The GDPR, like the Data Protection Directive, regulates the processing activities of two key actors for the benefit of “data subjects.” These actors are:

• • “Data controllers” — persons or entities that determine the purposes and means of processing personal data, e.g. companies, researchers, universities; and

• • “Data processors” — persons or entities that process personal data on behalf of the data controller, e.g. cloud providers and research collaborators, in many circumstances.

The GDPR's two main objectives are to 1) safeguard the data protection rights of data subjects, who in the health research context are most likely to be research participants, and 2) promote the “free movement” of personal data within the EU.

Pseudonymized Data

Personal data that have been pseudonymized (e.g. key-coded) still fall within the scope of personal data defined in the GDPR, d; it is security measure that replaces or removes information in a dataset that identifies an individual.^{Reference Mourby50} For example, data may be pseudonymized, with identifiers separated, but if the data-set and identifiers are held by the same organization, it will still be considered personal data. This said, the converse — separating a dataset and having the identifiers held across different organizations — in itself and without additional techniques may not constitute anonymized or pseudonymized data, either.

Anonymous and Anonymized Data

The GDPR does not apply to anonymous data or data that have been anonymized. Anonymized data refers to data that were related to an identifiable individual when collected, but through processes of removing identifiers (e.g. through scrambling or blurring), the identity of an individual cannot be determined by a reasonably foreseeable method. Using state-of-the-art techniques, properly anonymized data prevents identification of an individual. It is worth noting that the act of anonymization itself is considered processing personal data. Unlike HIPAA, which specifies methods for de-identifying protected health information (the “safe harbor” method of de-identification and the statistical or “expert determination” method),⁵¹ the GDPR does not specify anonymization methods.⁵² This allows for greater flexibility in the legislation and for enabling data protection authorities to consider whether new methods of both anonymizing and re-identifying data mean the GDPR should apply. At the same time, researchers and organizations should be mindful of the prospect of anonymized data re-becoming identifiable data as more data are generated and linked to them. The key message to impart here is that this is not a one-off process; pseudonymization and anonymization require a watching brief to ensure that the categories are constantly monitored for falling within the law and thereby needing to comply.

Can Research Based on Broad Consent Still Proceed Under the GDPR?

The GDPR rules governing consent are not especially helpful for research, and there is confusion regarding the interplay of specific versus broad consent within the GDPR. This is a weakness in the legislation. The confusion is based on the language of Recital 33 and Article 6(1)(a), the latter of which covers consent to processing non-special categories of personal data, and 9(2)(a), which covers consent to processing special categories of data. Article 6(1)(a) states that personal data may be lawfully processed if “the data subject has given consent to the processing of his or her personal data for one or more specific purposes,” while Article 9(2)(a) states that special categories of personal data may be lawfully processed if “the data subject has given explicit consent to the processing of those personal data for one or more specified purposes.” “Explicit consent” is also required when personal data are used in automated individual decision-making, such as profiling,⁵⁸ and, where other exceptions are not possible,⁵⁹ in data transfers to so-called “third countries” (i.e. countries outside the EU) or international organizations.⁶⁰

The modifier “explicit” is crucial here. As the predecessor data protection opinion body from the Data Protection Directive — the Article 29 Working Party — explained in 2016, “explicit” under the GDPR means that:

However, Recital 33 of the GDPR states that:

Recital 33 therefore suggests that the GDPR is amenable to broad consent in scientific research (“consent to certain areas of scientific research”), which presumably would yield to the judgement of an ethics committee (“when in keeping with recognised ethical standards for scientific research”), yet Articles 6 and 9 themselves, particularly in the latter Article's context of processing health-related and genetic data, would suggest that only specific consent can be lawfully used, unless the GDPR's drafters intended “certain areas [of research]” (Recital 33), “one or more specific purposes” (Article 6), and “one or more specified purposes” (Article 9) to be synonymous. This is debatable. Indeed, the Article 29 Working Party has opined that the GDPR's “Recital 33 does not disapply the obligations with regard to the requirement of specific consent” and that a “well-described purpose” must be included in the consent to comply with the GDPR's requirements.⁶² At the same time, and rather confusingly, it considers: “For the cases where purposes for data processing within a scientific research project cannot be specified at the outset, Recital 33 allows as an exception that the purpose may be described at a more general level.”⁶³ The Article 29 Working Party's successor body, the European Data Protection Board,⁶⁴ should clarify in future guidance that it is legally acceptable under the GDPR for data subjects' consent to be obtained on a “broad basis,” i.e. on a description of the “certain areas of scientific research” for which their personal data will be processed, including special categories of personal data, in the current time.

Moving Beyond Consent

More crucially, though, this unsettled state of affairs regarding broad consent in the GDPR speaks to why researchers should consider a legal basis other than consent for processing personal data for scientific research. As the UK's Information Governance Alliance (IGA) explains, other consent challenges also exist:

Of course, researchers and organizations may continue to rely upon consent, consistent with IGA advice, if they are confident they can meet the GDPR requirements. More beneficially, though, organizations may be inclined to ask participants to consent (perhaps broadly) to participate in a research study as part of their research ethics obligations, but also inform them in the consent process that if they agree to participate, data relating to them will be processed under a different legal basis than consent, such as for a “task in the public interest” (explained below). This is particularly important to recognize, since if consent is used as the legal basis for processing data and a research participant withdraws consent, the controller will no longer have a legal basis to process personal data about them. For organizations that previously relied on consent for the purposes of collecting, using, or sharing data, they should verify whether the consent remains “GDPR compliant.” If the existing consents do not meet the GDPR's requirements, organizations 1) must obtain “fresh” GDPR-compliant consent, or 2) ideally, identify a different lawful basis for data processing, and 3) ensure that the continued data processing is transparent and fair (i.e. that the data subjects rights' and freedoms are not undermined through a change in processing), and if it is not, they should stop the processing.

Other Legal Bases: Public Interest and Legitimate Interests

So what are the relevant legal bases, other than consent, for processing personal data in the scientific research context? For processing non-special categories of personal data, as mentioned above, there are six legal bases, including consent. Under the GDPR, commercial companies and charitable research organizations will likely rely on “legitimate interests” as their legal basis for processing personal data. “Legitimate interests” has broad potential application, but these interests are overridden by the interests or fundamental rights and freedoms of data subjects that require protection of personal data, in particular where the data subject is a child.^{Reference Taylor66} As the UK's Information Commissioner's Office explains,⁶⁷ there are three elements to the legitimate interests basis. One needs to satisfy:

1. A purpose test: identify a legitimate interest (this can include commercial interests, individual interests, or broader societal benefits);

2. A necessity test: show that the processing is necessary to achieve it; and

3. A balancing test: balance it against the individual's interests, rights, and freedoms (i.e. an organization should consider whether it is using people's data in ways they would reasonably expect and which have a minimal privacy impact).

Public authorities cannot rely on the “legitimate interests” basis for any processing they do to perform their tasks as a public authority. Thus, public authorities, such as (non-private) universities and public research institutes such as the US National Institutes of Health (NIH), when carrying out public tasks, are unable to rely on the “legitimate interests” basis. The GDPR explains the reason for this exclusion is because it is for the national legislatures to give public authorities the legal authority to process personal data;⁶⁸ i.e. public authorities should only be able to process personal data in performance of their tasks if the law has given them authorization. However, if the public authority has other legitimate purposes outside the scope of their tasks as a public authority, they can consider legitimate interests where appropriate. This will be particularly relevant for public authorities with commercial interests.

In general, public authorities instead will likely rely on a “task in the public interest or in the exercise of official authority vested in the controller” as their legal basis.⁶⁹ It should be noted that the interpretation of “public task” is narrow and such public tasks must be laid down by law through statutory, common law, or other legal power.⁷⁰ Public authorities should document their justification for reliance on this basis, by reference to their public research purpose as established by statute or charter. This assures participants and the public that the organization is credible and using personal data for the public good. While there is no difference in regulatory standards between organizations that use “legitimate interests” and those that use a “task in the public interest” as legal bases, the GDPR requires organizations to be explicit about which of the legal bases they are using.

The Scientific Research Exception to Process Sensitive Data

As mentioned above, one interpretation of the GDPR is that processing special (i.e. sensitive) categories of data such as health-related data and genetic data is prohibited unless one has both a lawful basis for processing (under Article 6) and a special category condition (i.e. exceptions to the general prohibition) for processing in compliance with Article 9.

In the health context, exceptions exist where processing is necessary for medical diagnosis, the provision of health or social care (note that it does not expressly include medical research), treatment or management of health or social care systems in accordance with EU or Member State law or professional obligations,⁷⁴ and where data processing is necessary for public health and in the public interest on the basis of EU or Member State law.⁷⁵

When processing special categories of data for scientific research purposes, the most likely relevant exception will be Article 9(2)(j): that such processing is necessary for scientific research in accordance with Article 89(1) and that appropriate safeguards are provided for.⁷⁶ The processing must also be consistent with EU or Member State law (such as laws relating to clinical trials). Though “appropriate safeguards” are not spelled out in the GDPR, as an exhaustive list of safeguards would be contrary to the risk-based approach that underpins the Regulation, in the scientific research context they would likely include: 1) ensuring that the research will not cause substantial damage or distress to the data subject; 2) ensuring that the scientific research project has approval from a competent and independent research ethics committee; and 3) ensuring that the data controller has technical and organizational safeguards in place that ensure respect for the principle of data minimization and ensure that exemptions to data subjects' rights are not exercised unless the rights are likely to render impossible or seriously impair the achievement of the purposes of the processing. Examples would include pseudonymizing personal data where compatible with the research purpose, and avoiding processing identifiable data where the research purpose can be fulfilled by further processing with anonymized data. Other examples include having robust IT security and data protection policies in place, as well as risk-assessment exercises of data systems, regular review and audit of privacy impact assessments, and developing efficient IT systems, policies, and procedures to handle data subjects' requests.

Organizations must include the legal basis for processing data in a privacy notice made available to data subjects (sometimes also known as a “fair processing notice”), which includes contact details for the Data Protection Officer, the purposes and legal basis for processing data, and information about with whom data are shared. Best practice suggests that this should be provided at a general level in organizational documents, and project-specific details should be provided to participants in documents such as newsletters or participant information sheets (i.e. consent forms). This information should be given to data subjects prior to processing their personal data, or, where the personal data are obtained from another source (i.e. from another organization), within a reasonable period, depending on the circumstances of the case.⁷⁷ The GDPR helpfully clarifies that where the origin of the personal data cannot be provided to the data subject because various sources have been used, general information should be provided.⁷⁸

Safeguards and Derogations Related to Processing Data for Scientific Research Purposes

Article 89(1) states that processing personal data for scientific research purposes (as well as archiving purposes in the public interest and historical research purposes) must be subject to “appropriate safeguards […] for the rights and freedoms of the data subject.” These safeguards are meant to ensure that technical and organizational measures are in place, in particular, to ensure the principle of data minimization (limiting personal data collection, storage, and usage to data that are relevant, adequate, and absolutely necessary for carrying out the purpose for which the data are processed). This means that anonymization or pseudonymization should be used wherever possible.

Crucially, Article 89(2) allows member countries to create derogations from (i.e. exceptions to) the otherwise core data subject rights of data access, to rectification, to erasure, to restriction of processing, and to object,⁷⁹ whenever these data subject rights “are likely to render impossible or seriously impair the achievement” of scientific research purposes. Such a derogation must be essential for the fulfillment of these purposes. These derogations are subject to the conditions and safeguards laid out in Article 89(1), such as data minimization and pseudonymization (Recital 156).

The “right to object” is curtailed in a slightly different manner than the other data subject rights. Article 21(6) gives data subjects an unconditional right to object in the context of scientific research, as opposed to the conditional right to object in general contexts afforded by Article 21(1). By “unconditional,” I mean that the data controller cannot refuse the request by demonstrating a compelling legitimate ground. Yet, even in the scientific research context, this right is still subject to certain restrictions, namely it can be overridden where “the processing is necessary for the performance of a task carried out for reasons of public interest.”⁸⁰ Article 89(2), on the other hand, serves a slightly different purpose. It allows Member States and the EU to lay down further restrictions on such an “unconditional” right to object, in addition to the “public interest” exception, so long as the Member State (or EU) can show that two conditions are fulfilled: (1) the exercise of this right is “likely to render impossible or seriously impair the achievement of the specific purposes”; and (2) the restrictions are “necessary for the fulfilment of those purposes.” In short, this means that in the absence of national legislation, data controllers may invoke Article 21(6) to refuse the data subject's right to object on the ground that the processing is necessary for the performance of a task carried out for reasons of public interest. Where national laws are in place, and they are in line with the conditions set out in Article 89(2), data controllers may invoke such laws to process personal data for non-public interests. Thus, Article 89(2) allows for expansion of the exception set out by Article 21(6), by means of Member State and EU legislation.

Secondary Data Use

An increasing amount of scientific research relies on access to and use of data collected from previous studies or other contexts. The GDPR has a favorable provision for secondary data use in the research context. Ordinarily, a strict “purpose limitation” principle applies: personal data must not be further processed in a manner that is incompatible with the specific and legitimate purposes for which they were originally collected and processed.⁸¹ However, Article 5(1)(b) states that further processing for scientific research purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial data processing purposes. This means that if the same organization were conducting the further processing (i.e. secondary use) of the data, there is a rebuttable presumption that further processing for the purpose of scientific research is compatible with the original stated purpose of the processing (which might be for e.g. medical diagnosis). The derogations from data subject rights that the scientific research exception permits under Article 89(2) would apply in such a scenario, as permitted by applicable Member State law. It is unclear whether this favorable provision also applies to further processing by another organization (i.e. another data controller), rather than the same one.

International Data Transfers

International scientific research collaboration is affected by the GDPR rules on transferring personal data from the EU to a non-EU country, known as a “third country.” Data controllers that plan to transfer Europeans' personal data to a third country or international organization, be it for cloud computing purposes or otherwise, must be mindful of the GDPR's provisions on international data transfers. There are four avenues for lawful transfer of personal data outside the EU:

1. An adequacy decision (Art. 45);

2. Appropriate safeguards (Arts. 46 and 47);

3. Specific derogations (Art. 49); and

4. Exceptions for one-off (or infrequent) transfers (second subparagraph of Art. 49(1)).

A controller must inform data subjects, at the time that personal data are collected from them, that the controller intends to transfer these personal data to a third country or to an international organization, and that either a) an adequacy decision either exists or is absent, or b) in the case of transfers referred to in Article 46 or 47, or one-off (or infrequent) transfers, reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.

Data can be transferred to a country outside of the EU or to an international organization without specific authorization, provided the country or region's relevant legal framework has been assessed by the European Commission as having an “adequate level of protection” (referred to as an adequacy decision).^{Reference Stoddart, Chan and Joly82} To date, the Commission has recognized as adequate the countries or territories of Andorra, Argentina, Canada (limited only to commercial organizations subject to the federal Personal Information Protection and Electronic Documents Act), Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay, and the US (importantly limited to the Privacy Shield framework⁸³). Adequacy talks are ongoing with Japan and South Korea. Only US legal entities subject to the jurisdiction of the Federal Trade Commission (FTC) or the Department of Transportation (DOT) are eligible to participate in Privacy Shield; thus, it is unlikely that US universities and publicly funded research sponsors, among other entities, can rely on the framework for non-commercial purposes.⁸⁴

In the absence of an adequacy decision, data can still be transferred to a third country or to an international organization if the data controller or processor has appropriate safeguards and enforceable data subject rights, and effective legal remedies are available. Adequate safeguards may be provided for by:⁸⁵

• • A legally binding agreement between public authorities or bodies;

• • Binding corporate rules (agreements governing transfers made between organizations within a corporate group) if approved by the competent supervisory authority;

• • Standard data protection clauses in the form of template transfer clauses adopted by the European Commission;

• • Standard data protection clauses in the form of template transfer clauses adopted by a data protection authority and approved by the European Commission;

• • Compliance with an approved code of conduct pursuant to Article 40 that has binding and enforceable commitments (see discussion in Conclusion below for a code of conduct being drafted in the health research space);

• • Certification under an approved certification mechanism as provided for in the GDPR that has binding and enforceable commitments;

• • Contractual clauses between the controller or processor and the controller, processor or the recipient of the personal data in the third country or international organization, which are authorized by the competent data protection authority; or

• • Provisions inserted into administrative arrangements between public authorities or bodies authorized by the competent data protection authority.

Standard data protection clauses or contractual clauses may not be a viable option for some non-EU public authorities or organizations out of concerns regarding compliance with, among other things, indemnification and jurisdiction clauses.

A third avenue for lawful transfer of personal data outside the EU is derogations for specific situations. Obtaining explicit consent from the data subject “to the proposed [international] transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards”⁸⁶, is one derogation option. However, this rubs against the general desire to avoid relying on (explicit) consent as the legal basis for processing personal data for scientific research purposes, for the reasons explained above. This option is also not available for the activities of public authorities in the exercise of their public powers.⁸⁷ Another potentially relevant derogation option is a transfer, or set of transfers, “necessary for important reasons of public interest.”⁸⁸ Yet again, the GDPR enables Member States to determine individually “where important grounds of public interest laid down” require international transfer.⁸⁹ It is unclear if international scientific research would fall under this derogation option; the GDPR Recitals mention only cases of “public health, for example in the case of contact tracing for contagious diseases.”⁹⁰ For this reason, it is expected that research organizations may have to rely on the fourth avenue for lawful international data transfer.

The fourth avenue for a lawful international data transfer is where a transfer could not be based on a provision in Article 45 (adequacy decision) or Article 46 (appropriate safeguards), and none of the derogations for a specific situation referred to in Article 49 is applicable (e.g. explicit consent or important reasons of public interest). In such a “residual case” scenario,⁹¹ a transfer to a third country or an international organization may take place only if the transfer:

• • Is not being made by a public authority in the exercise of its public powers;

• • Is not repetitive (i.e. similar transfers are not made on a regular basis);

• • Involves data related to only a limited number of individuals;

• • Is necessary for the purposes of the compelling legitimate interests of the organization (provided such interests are not overridden by the interests of the individual); and

• • Is made subject to suitable safeguards put in place by the organization (in light of an assessment of all the circumstances surrounding the transfer) to protect the personal data.

The GDPR specifically mentions that: “For scientific […] research purposes […], the legitimate expectations of society for an increase of knowledge should be taken into consideration”⁹² in permitting transfers in this scenario. Examples might include a rare disease organization based in Heidelberg that wants to share a dataset containing personal and pseudonomyzed data of four patients to an academic medical center in Chicago for genotype-phenotype matching. In cases falling under this “residual cases” avenue, organizations are obliged to inform the relevant data protection authority of the transfer and provide additional information to individuals on the international data transfer.

Given all four of these avenues are not ideal for smooth international data transfers, it is all the more reason, as further discussed below, to have a code of conduct for scientific (health) research in place as soon as possible to enable international data transfers of health-related and genetic data on a legal basis other than explicit consent.

Finally, it should be mentioned that as anonymized data are not subject to GDPR requirements, such data can transferred outside of the EU without being subject to any of the above requirements. Pseudonymized data remain personal data within the scope of the GDPR and thus are subject to these international transfer requirements.