Data Sharing Under the General Data Protection Regulation

Abstract

The General Data Protection Regulation (GDPR) became binding law in the European Union Member States in 2018, as a step toward harmonizing personal data protection legislation in the European Union. The Regulation governs almost all types of personal data processing, hence, also, those pertaining to biomedical research. The purpose of this article is to highlight the main practical issues related to data and biological sample sharing that biomedical researchers face regularly, and to specify how these are addressed in the context of GDPR, after consulting with ethics/legal experts. We identify areas in which clarifications of the GDPR are needed, particularly those related to consent requirements by study participants. Amendments should target the following: (1) restricting exceptions based on national laws and increasing harmonization, (2) confirming the concept of broad consent, and (3) defining a roadmap for secondary use of data. These changes will be achieved by acknowledged learned societies in the field taking the lead in preparing a document giving guidance for the optimal interpretation of the GDPR, which will be finalized following a period of commenting by a broad multistakeholder audience. In parallel, promoting engagement and education of the public in the relevant issues (such as different consent types or residual risk for re-identification), on both local/national and international levels, is considered critical for advancement. We hope that this article will open this broad discussion involving all major stakeholders, toward optimizing the GDPR and allowing a harmonized transnational research approach.

Controversies between regulations of research ethics and protection of personal data: informed consent at a cross-road

“…Finally, in this context of the interplay between the research ethics regulations and regulations on the protection of personal data, it is important not to discount consent as a legal basis when it is methodologically feasible because consent can empower data subjects to control their data and can put the data subject on a “more symmetrical informational and communicative plane with the data controller” (Dove and Chen 2020 ). In addition, it seems that consent is still perceived as a priority basis for processing personal data for research purposes by some researchers and regulators in a few EU member states (Vlahou et al 2021 ; Assessment of the EU Member States’ rules on health data in the light of GDPR 2021). Furthermore, studies on public opinion also show that there is still a prevailing interest of individuals to have control over personal data in regards of what data are collected, who has access to this data, how and with whom data are shared and for what purposes the data are used.…”

Using preregistration as a tool for transparent fNIRS study design

“…Third, when researchers intend to share data with other researchers, they should carefully reflect on the balance between open science practices and privacy protection regulations 151,152 , certainly regarding the General Data Protection Regulation of the European Union. Data anonymization can provide a solution for data sharing as fully anonymous data does not fall under the privacy protection rules 153 .…”

Interview with Harald Mischak

“…In my field of research, biomarkers and biomarker panels generally cannot be patented, limiting open access data sharing to a minimum. An additional issue to be taken into consideration is the GDPR regulation in Europe, which, also due to the unclear text including the threat of enormous fines, further stands in the way of data sharing [11]. However, I personally feel that frequently GDPR is (ab)used to avoid data sharing, in some cases also because the interpretation presented in a paper as a study result is in reality not fully supported by the data.…”